> [!WARNING] > **Developer Preview:** Available as part of the [Google Workspace Developer Preview Program](https://developers.google.com/workspace/preview), which grants early access to certain features. Google Classroom offers a remote [Model Context Protocol (MCP)](https://modelcontextprotocol.io/introduction) server that allows AI agents to securely interact with Google Classroom data. By configuring the Google Classroom MCP server, you enable AI applications like Google Antigravity and Claude to perform actions in Google Classroom. The Google Classroom MCP server provides a standardized way for AI agents to: - **Read data**: List courses, retrieve course content and metadata, and view submissions and grades. - **Take action**: Create and update coursework and announcements. - **Respect security**: Inherit the same permissions and data governance controls as the user. To learn about the key concepts and benefits of Google remote MCP servers, see [Google Cloud MCP servers overview](https://docs.cloud.google.com/mcp/overview). > [!NOTE] > **Note:** This document describes how to configure the Google Classroom remote MCP server and explore capabilities with an existing AI application. To learn about building your own agents, see [Build a Google Workspace AI Agent with ADK and MCP](https://codelabs.developers.google.com/google-workspace-mcp-adk). ## Tool reference The following [tools](https://developers.google.com/workspace/classroom/reference/mcp) are available for the Google Classroom MCP server: - `list_courses` - `list_course_work_submissions` - `get_course_work` - `create_course_work` - `update_course_work` - `list_course_work_submissions` - `list_topics` - `create_topic` - `list_announcement_summaries` - `get_announcements` - `create_announcement` - `get_course_work_rubric` - `create_course_work_rubric` - `get_course_roster` - `get_guardian_info` - `search_course_standards` ## Prerequisites - Membership in the [Google Workspace Developer Preview Program](https://developers.google.com/workspace/preview). - A Google Cloud project. To create a project, see [Create a project](https://developers.google.com/workspace/guides/create-project). - An MCP host, like [Google Antigravity](https://antigravity.google/). - A test Google Classroom class with at least one test student account. If you don't have a Google Classroom class that you can use for testing, [create one in the UI](https://support.google.com/edu/classroom/answer/6020273?co=GENIE.Platform%3DDesktop) and [add a test student](https://support.google.com/edu/classroom/answer/6020282?co=GENIE.Platform%3DDesktop). > [!NOTE] > **Note:** While Google Classroom can be used with consumer accounts (like gmail.com), to best simulate real-world use cases, we recommend using a Google Workspace for Education account. See [prerequisites](https://developers.google.com/workspace/classroom/guides/onboarding/prerequisites) to become familiar with, and request, a demo account. ## Configure the Google Classroom MCP server To use the Google Classroom MCP server, you must enable both the API and MCP services in your Google Cloud project, then configure your MCP client connection. ### Enable the Google Classroom MCP and API services 1. Enable the Google Classroom API in your Google Cloud project: [Enable the APIs](https://console.cloud.google.com/flows/enableapi?apiid=classroom.googleapis.com) 2. Enable the Google Classroom MCP service in your Google Cloud project: [Enable the MCP service](https://console.cloud.google.com/flows/enableapi?apiid=classroommcp.googleapis.com) ### Set up the OAuth consent screen The Google Classroom MCP server uses OAuth 2.0 for authentication and authorization. You must configure the OAuth consent screen before you can create an OAuth client ID. 1. In the Google Cloud console, go to **Google Auth Platform** \> **Branding**. [Go to Branding](https://console.cloud.google.com/auth/branding) 2. If you have already configured the **Google Auth Platform** , you can configure the following OAuth Consent Screen settings in [Branding](https://console.cloud.google.com/auth/branding), [Audience](https://console.cloud.google.com/auth/audience), and [Data Access](https://console.cloud.google.com/auth/scopes). If you see a message that says **Google Auth Platform not configured yet** , click **Get Started**: 1. Under **App Information** , in **App name** , type `Classroom MCP Server`. 2. In **User support email**, select your email address or an appropriate Google group. 3. Click **Next**. 4. Under **Audience** , select **Internal** . If you can't select **Internal** , select **External**. 5. Click **Next**. 6. Under **Contact Information** , enter an **Email address** where you can be notified about any changes to your project. 7. Click **Next**. 8. Under **Finish** , review the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy) and if you agree, select **I agree to the Google API Services: User Data Policy**. 9. Click **Continue**. 10. Click **Create**. 11. If you selected **External** for user type, add test users: 1. Click **Audience**. 2. Under **Test users** , click **Add users**. 3. Enter your email address and any other authorized test users, then click **Save**. 3. Click **Data Access** \> **Add or Remove Scopes**. A panel appears with a list of scopes for each API that you've enabled in your Google Cloud project. 1. Under **Manually add scopes** , paste the scopes for the Google Classroom MCP server. The scopes needed for the [sample prompts](https://developers.google.com/workspace/classroom/guides/mcp/configure-mcp-server#test-mcp-server) are: - `https://www.googleapis.com/auth/classroom.announcements` - `https://www.googleapis.com/auth/classroom.courses.readonly` 2. Click **Add to Table**. 3. Click **Update**. 4. After selecting the scopes required by your app, on the **Data Access** page, click **Save**. ### Configure your MCP client To add the Google Classroom remote MCP server to your MCP client, follow the instructions for your client. Instructions for two common clients are provided here. See [Configure MCP in an AI application](https://docs.cloud.google.com/mcp/configure-mcp-ai-application) for details on connecting different types of clients. User-delegated OAuth 2.0 client IDs that call the Classroom MCP server must have **Use this client for an AI-powered agent** selected in **Google Auth Platform** \> **Clients** . To update an existing OAuth 2.0 client ID, select this setting in **Google Auth Platform** \> **Clients** , as described in [Manage OAuth Clients](https://support.google.com/cloud/answer/15549257). If you can't change this setting on an existing client, or if the client also supports non-agent features, create a new OAuth 2.0 client ID for your AI agent. For rejected requests, service accounts with domain-wide delegation, or Google Apps Script, see [Troubleshooting](https://developers.google.com/workspace/classroom/guides/mcp/configure-mcp-server#troubleshooting). ### Antigravity To add the Google Classroom remote MCP server to Antigravity, add the server configuration to your `mcp_config.json` file. These instructions support Antigravity 2.0, Antigravity IDE, and Antigravity CLI. 1. Create an OAuth 2.0 client ID and secret: 1. In the Google Cloud console, go to **Google Auth Platform** \> **Clients** \> **Create Client**. [Go to Create Client](https://console.cloud.google.com/auth/clients/create) 2. Select **Web application** as the application type. 3. Enter a **Name**. 4. In the **Authorized redirect URIs** section, click **+ Add URI** , and then add `https://antigravity.google/oauth-callback` in the **URIs** field. 5. Select **Use this client for an AI-powered agent**. 6. Click **Create** and copy your **Client ID** and **Client Secret**. 2. Open or create the configuration file `~/.gemini/config/mcp_config.json`. 3. Add the `mcpServers` configuration to `mcp_config.json`: { "mcpServers": { "classroom": { "serverUrl": "https://classroommcp.googleapis.com/mcp/v1", "oauth": { "clientId": "OAUTH_CLIENT_ID", "clientSecret": "OAUTH_CLIENT_SECRET" } } } } Replace the following: - `OAUTH_CLIENT_ID`: The client ID you created. - `OAUTH_CLIENT_SECRET`: The client secret you created. 4. Save `mcp_config.json`. 5. Authenticate the MCP server. You can authenticate using either the GUI settings or the CLI: - **For Antigravity IDE or GUI (Antigravity 2.0):** 1. Open your settings screen (e.g., click **Settings** at the bottom-left or open **Antigravity User Settings**). 2. Navigate to **Customizations**. 3. Under **Installed MCP Servers** , click **Refresh**. 4. Find `classroom` in the list, click **Authenticate** , sign in to your Google Account, copy the authorization code, paste it into the input dialog, and click **Submit**. - **For Antigravity CLI:** 1. Start Antigravity CLI: agy 2. Open the interactive MCP management panel by running: /mcp 3. Use the arrow keys to select `classroom`, move to the **Authenticate** action, and press **Enter** . Complete the sign-in flow in your browser, copy the authorization code, paste it into the terminal prompt, and press **Enter**. 6. Verify that the server is correctly configured and running: - **For Antigravity IDE or GUI:** A **Sign out** button is displayed next to the server under **Customizations** \> **Installed MCP Servers**. - **For Antigravity CLI:** Open the `/mcp` panel to view your configured MCP servers. Verified and authenticated servers display **Authed** next to their names inside the interactive TUI panel. You can select the server under the dashboard view to inspect its status and list all of its available tools. The remote MCP server is ready to use in Antigravity. ### Claude To use the Google Classroom remote MCP server with Claude.ai or Claude Desktop, you must have the Claude Enterprise, Pro, Max, or Team plan. To add the Google Classroom remote MCP server to Claude, configure a custom connector with an OAuth client ID and secret. 1. Create an OAuth 2.0 client ID and secret: 1. In the Google Cloud console, go to **Google Auth Platform** \> **Clients** \> **Create Client**. [Go to Create Client](https://console.cloud.google.com/apis/credentials/oauthclient) 2. Select **Web application** as the application type. 3. Enter a **Name**. 4. In the **Authorized redirect URIs** section, click **+ Add URI** , and then add `https://claude.ai/api/mcp/auth_callback` in the **URIs** field. 5. Select **Use this client for an AI-powered agent**. 6. Click **Create** and copy your **Client ID** and **Client Secret**. 2. Configure the MCP server in Claude: 1. In Claude.ai or Claude Desktop, go to **Settings** \> **Connectors** or **Admin settings** \> **Connectors**. 2. Click **Add custom connector**. 3. Enter the connection details for the Google Classroom product: - **Server name** : `Google Classroom`. - **Remote MCP server URL** : `https://classroommcp.googleapis.com/mcp/v1` 4. In **Authentication** , select **Sign in now** . In **OAuth client** , select **Use your own OAuth client** and enter your **OAuth client ID** and **OAuth client secret**. 5. Click **Add** and then **Connect**. ### Others Many AI applications have ways to connect to a remote MCP server. You typically need to enter details about the server, like its name, endpoints, transport protocol, and authentication method. For the Google Classroom remote MCP server, enter the following: - **Server name** : `classroom` - **Server URL** : `https://classroommcp.googleapis.com/mcp/v1` - **Transport** : [Streamable HTTP](https://modelcontextprotocol.io/specification/latest/basic/transports/streamable-http) - **Authentication** : The Google Classroom remote MCP server uses OAuth 2.0. When creating your OAuth 2.0 client, select **Use this client for an AI-powered agent** . For details, see [Learn about authentication and authorization](https://developers.google.com/workspace/guides/auth-overview). ## Test the Google Classroom MCP server After you configure the MCP client, you can verify the connection by running some test prompts. Try asking your MCP client the following questions: - **"What classes am I currently teaching?"** The client checks your schedule using `classroom.list_courses` and summarizes you the active courses where you have the teacher role. - **"For my geology class, draft an announcement about the upcoming field trip."** The client uses `classroom.create_announcement` to draft the announcement, which you can review and post in the Google Classroom app. If the tools execute successfully and you receive relevant responses, your Google Classroom MCP server is correctly configured. ## Extend functionality with additional servers Other Google Workspace services offer remote MCP servers. To extend the capabilities of your MCP client, consider enabling and [configuring additional remote MCP servers](https://developers.google.com/workspace/guides/configure-mcp-servers). For Google Classroom in particular, configuring the [Google Drive MCP server](https://developers.google.com/workspace/drive/api/guides/configure-mcp-server) can be particularly useful for working with attachments. ## Troubleshooting Use the following sections to resolve common authentication and connection issues with the Classroom MCP server. ### Check OAuth log events If you encounter issues connecting to the MCP server, check for errors in the OAuth logs. Ask your Google Workspace administrator to review the **OAuth log events** in the [security investigation tool](https://knowledge.workspace.google.com/admin/security/about-the-security-investigation-tool). ### Rejected requests from user-delegated OAuth clients If your requests to the MCP server are rejected, verify that the user-delegated OAuth 2.0 client ID for your 3-legged OAuth flow has **Use this client for an AI-powered agent** selected in **Google Auth Platform** \> **Clients**: - **Existing client supports the setting** : Select **Use this client for an AI-powered agent** on your existing OAuth client. - **Existing client can't be updated** : Create a new OAuth client with **Use this client for an AI-powered agent** selected and update your app to use it. - **Existing client also supports non-agent features**: Create a separate OAuth client for the AI agent and keep the existing client for your non-agent features. For instructions, see [Configure your MCP client](https://developers.google.com/workspace/classroom/guides/mcp/configure-mcp-server#configure-mcp-client) and [Manage OAuth Clients](https://support.google.com/cloud/answer/15549257). ### Service accounts with domain-wide delegation If your app uses a service account with domain-wide delegation for 2-legged OAuth, you can't select **Use this client for an AI-powered agent** because service accounts aren't managed in **Google Auth Platform** \> **Clients**: - **Access control** : Requests to the MCP server from these service accounts aren't rejected for missing the agent setting. Instead, access is governed by the domain-wide delegation settings that your Google Workspace administrator manages. For details on administrator settings, see [Control API access with domain-wide delegation](https://knowledge.workspace.google.com/admin/apps/control-api-access-with-domain-wide-delegation). - **Sensitive actions**: Google Workspace MCP servers still return form elicitation prompts for human-in-the-loop confirmation on sensitive tool calls made through domain-wide delegation user impersonation. ### Requests from Apps Script If you call the MCP server from Apps Script, you can't select **Use this client for an AI-powered agent** on the default OAuth client that Apps Script creates and manages for your script. This applies even if your script uses a [standard Google Cloud project](https://developers.google.com/apps-script/guides/cloud-platform-projects#standard_cloud_platform_projects). To call the MCP server from Apps Script, do the following: 1. In the Google Cloud console, go to **Google Auth Platform** \> **Clients** , create an OAuth client, and select **Use this client for an AI-powered agent**. 2. In your script, use the [OAuth2 for Apps Script library](https://github.com/googleworkspace/apps-script-oauth2) to authorize users with that OAuth client. 3. When you call the MCP server, send the access token that the library returns instead of the token from `ScriptApp.getOAuthToken`. Apps Script projects that don't call Google Workspace MCP servers aren't affected. ### Repeated hourly sign-in prompts If you're prompted to sign in again about every hour, your MCP client isn't receiving a refresh token. Google's OAuth 2.0 server issues a refresh token only when the authorization request includes `access_type=offline`. Requesting only the OpenID Connect (OIDC) `offline_access` scope doesn't return one. Check whether your MCP client supports custom authorization parameters: - **Client supports custom authorization parameters** : Add `access_type=offline` to the authorization request. To get a new refresh token for a user who already granted access, also add `prompt=consent`. - **Client doesn't support custom authorization parameters**: Sign in again each time the access token expires. For details, see [Refresh an access token](https://developers.google.com/identity/protocols/oauth2/web-server#offline). ## Important security consideration: Indirect prompt injection When you expose a language model to untrusted data, there is a risk of an [indirect prompt injection attack](https://en.wikipedia.org/wiki/Prompt_injection). Because MCP hosts like Google Antigravity have access to powerful tools and APIs through the Google Classroom MCP server, they can read, modify, and delete data in your Google Account. To mitigate these risks, you must screen prompts and responses for malicious content or prompt injection attacks. You can use the Google-provided [Model Armor](https://docs.cloud.google.com/model-armor/overview) or you can use your own solution if you document it in order for users to accept that risk. For more information, see [Configure security for Google Workspace MCP servers](https://developers.google.com/workspace/guides/configure-mcp-security). Follow these best practices: - **Only use trusted tools.** Never connect Google Classroom MCP server to untrusted or unverified applications. - **Be cautious with untrusted inputs.** Avoid asking your MCP client to process events or other resources from unverified sources. These inputs may contain hidden instructions that can hijack your session, allowing an attacker to modify, steal, or delete your data. - **Review all actions.** Always carefully review the actions taken by your AI client on your behalf to ensure they are correct and align with your intentions. - **Use Model Armor** . [Enable Model Armor](https://developers.google.com/workspace/guides/configure-mcp-security#model-armor) to protect against prompt injection attacks. ## Feedback Share feedback on the Google Classroom MCP server in our [public issue tracker](https://issuetracker.google.com/issues/new?component=191645&template=2404851). ## Related topics - [Configure security for Google Workspace MCP servers](https://developers.google.com/workspace/guides/configure-mcp-security) - [Google Workspace MCP servers in Antigravity (codelab)](https://codelabs.developers.google.com/google-workspace-mcp-antigravity#0) - [List of Google Workspace MCP servers](https://developers.google.com/workspace/guides/configure-mcp-servers#support-products)