Meet NanoCo, maintainers of NanoClaw: we raised $12M to give every member of your team a professional assistant →
Skills
Email & Tools Official

Gmail

Add Gmail as an MCP tool. Read, search, send, label, and draft emails from your agent.

What it does

  • Read, search, send, draft, label, and filter emails when triggered from messaging
  • OAuth managed by OneCLI — no raw credentials reach the container
  • Per-agent-group enablement via the central DB (ncl groups config)
  • MCP server integration for container-safe email access
  • Pairs cleanly with /add-gcal-tool (sibling skill, same pattern)

What you'll need

  • NanoClaw installed and running
  • OneCLI Agent Vault initialized (run /init-onecli first)
  • Gmail connected in OneCLI
  • gmail.readonly + gmail.modify + gmail.send scopes

Install

/add-gmail-tool

How it works

The /add-gmail-tool skill wires the @gongrzhe/server-gmail-autoauth-mcp stdio MCP server into selected agent groups. The agent gets Gmail capabilities — reading, searching, sending, drafting, and managing labels and filters — when asked. The agent doesn’t monitor your inbox automatically. Instead, you trigger email actions from a messaging channel: “Check my inbox,” “Send an email to Sarah about the meeting,” or “Search for invoices from last month.”

The MCP server reads stub credentials at ~/.gmail-mcp/ containing the onecli-managed placeholder. OneCLI’s gateway intercepts outbound calls to gmail.googleapis.com and swaps the placeholder for the real OAuth token from its vault. Containers never receive raw API keys — that’s the v2 invariant.

Setup

Three steps, mostly automated:

  1. Connect Gmail in OneCLI. The skill checks onecli apps get --provider gmail and tells you to open the OneCLI web UI (http://127.0.0.1:10254) to authorize if it isn’t already connected. Scopes should include gmail.readonly, gmail.modify, and gmail.send.
  2. Write stub credentials at ~/.gmail-mcp/gcp-oauth.keys.json and ~/.gmail-mcp/credentials.json — both contain the onecli-managed placeholder. No GCP project setup or browser OAuth flow is needed; token refresh is OneCLI’s job.
  3. Wire per agent group. The skill registers the gmail MCP server and the ~/.gmail-mcp mount in the central DB (ncl groups config add-mcp-server plus a container_configs update) for each group that should have email access. groups/<folder>/container.json is materialized from the DB on every spawn, so hand-edits there don’t stick.

Then it pins GMAIL_MCP_VERSION in the Dockerfile and rebuilds. There’s no allowlist to edit — the allow-pattern (mcp__gmail__*) is derived automatically from the group’s mcpServers registration.

What the agent can do

Once Gmail is set up, the agent has access to these capabilities (tool names surface as mcp__gmail__<name>):

  • Read emails — read_email, download_attachment.
  • Send emails — send_email for new messages or replies.
  • Search — search_emails with Gmail’s search syntax.
  • Draft — draft_email creates drafts without sending, for your review.
  • Organize — label tools (list_email_labels, create_label, …), filter tools (create_filter, …), and batch modify/delete.

Tips

  • This skill is tool-only. Inbound email as a channel (emails triggering the agent directly) hasn’t been ported to v2’s channel architecture yet.
  • This skill mirrors /add-gcal-tool. If both are installed, they share the OneCLI-managed pattern and the same Dockerfile pnpm install block.
  • First call is a second or two while the MCP server boots and OneCLI does the token exchange. Subsequent calls are fast.
  • If the agent says “I don’t have Gmail tools,” the most common cause is the gmail MCP server not being registered in that group’s mcpServers — re-run the ncl groups config add-mcp-server step and restart, or rebuild a stale image.
  • If you see 401 Unauthorized from gmail.googleapis.com, OneCLI isn’t injecting the token — check the agent’s secret mode (onecli agents secrets) and that Gmail is connected (onecli apps get --provider gmail).