← Back to directory
C

Clasp

Official
Command-line tool for developing Google Apps Script projects locally
Category
Dev Tools #74 of 438
Stars
★ 5.9k Very popular
Transport
stdio (local process)
Runtime
Node.js 22+
Credentials
API key / credential required
License
Apache-2.0
Last commit
63FMRS · C

clasp is a command-line tool maintained in Google's own GitHub org for local Apps Script development, with an experimental clasp mcp subcommand exposing it over STDIO to coding agents using the CLI's existing credentials. It covers project push/pull, deployments, versions, logs, and API management, but the MCP tool surface is limited and still evolving, OAuth scopes are broad, and push performs a full overwrite of the remote project — credentials and push operations should be handled carefully.

Strongest · Documentation 15/20 Weakest · Reliability 8/20

Reliability
8/20
Security and permissions
13/20
Maintenance
15/20
Documentation
15/20
Setup experience
12/20
Why each score
Reliability 8/20
The README only shows a CI status badge and a coveralls badge as images/links, with no actual workflow file content or committed test evidence supplied, and no manifest was cached to confirm declared MCP tools match real behavior. The MCP mode is explicitly labeled 'EXPERIMENTAL' and described as offering 'a limited subset of tools for agents. Feedback is welcome,' signaling known incompleteness. Per the static calibration rule, without verifiable CI workflow content plus committed tests covering the server's key paths, the score cannot exceed 12, so 8 is assigned.
Security and permissions 13/20
Authentication uses standard OAuth, with credentials stored in `.clasprc.json` under the user's home directory; multi-user support (--user) and bring-your-own-OAuth-client guidance for better compliance are positive signals. However, the documented full scope list includes the very broad `https://www.googleapis.com/auth/cloud-platform`, which violates least privilege. Destructive operations like delete-script and delete-deployment prompt for confirmation by default (bypassable via --force, with the risk called out). The push command overwrites the entire remote script by default without an additional confirmation step, though this is prominently disclosed via a 'Warning' callout — still a real data-overwrite risk. The service account/ADC path is honestly labeled 'EXPERIMENTAL/NOT WORKING,' which is transparent but also confirms that pathway is unreliable. Overall, main risks are visible with partial confirmation and disclosure, but scope minimization and confirmation coverage are incomplete; this does not rise to red-line severity, hence 13.
Maintenance 15/20
The repository belongs to the google org, uses Apache-2.0, has 5778 stars and 53 open issues, and is not archived. A clear 2.x→3.x migration guide and recently added Gemini/Claude Code MCP extension support indicate active evolution. However, the supplied material shows no explicit security-response channel (e.g., SECURITY.md), release cadence, or ownership/CODEOWNERS evidence, so governance signals are incomplete, preventing a top score.
Documentation 15/20
The README is thorough: installation, authentication (including bring-your-own-credentials, allow-listing, service accounts), a full command reference with options and examples, `.clasp.json`/`.claspignore` configuration, troubleshooting (Node version, DEBUG logging, proxy usage), and a migration guide — well-layered with ample examples. However, documentation specific to the MCP mode being reviewed is very thin: a single descriptive sentence plus 'Options: N/A', with no listed tool names, parameters, return formats, or limits, and the manifest was not cached to verify actual tool behavior. This is a clear gap for the object under review, capping the score.
Setup experience 12/20
Clear npm global install steps are given, along with the need to manually enable the Apps Script API via an external GUI step, followed by `clasp login` for OAuth. For MCP specifically, three paths are documented: Claude Code plugin install, a `claude mcp add` CLI command, and referencing a `claude-mcp.json` config file — reasonable coverage of mainstream client configuration examples. However, the overall flow still depends on several manual/external steps (enabling the API, interactive OAuth login), and there is no execution evidence confirming reliability of this flow. Per the static calibration rule, the score cannot exceed 15, so 12 is assigned.

Static review · not runListed 2026-08-06

Read the FMRS scoring method →

Fit and risk

What it can accessReads local filesWrites / deletes local filesRuns commands or codeUses the networkChanges third-party account data

Best for

  • Developers who want to develop Google Apps Script locally with their own editor and Git workflow
  • Teams that need version control and collaboration for Apps Script projects
  • Users who want an AI coding agent (Claude Code, Gemini CLI) to manage Apps Script projects directly

Not for

  • General cloud storage or database integrations unrelated to Apps Script
  • Scenarios requiring vendor-backed official support SLAs (the README explicitly states it is not an officially supported Google product)
  • Projects relying on clasp 2.x's built-in TypeScript transpilation (removed in 3.x — use a bundler like Rollup instead)
  • Non-interactive service-account authentication (README marks this as experimental/not currently working)

Required permissions

  • Google OAuth access to read/write the user's Apps Script projects (script.projects, script.deployments, script.webapp.deploy, etc.)
  • Google Drive read-only metadata and file access (drive.metadata.readonly, drive.file) to list and create bound scripts
  • Google Cloud Service Usage API access to list/enable/disable advanced services
  • Cloud Logging read access to fetch script execution logs
  • Local credential storage in `.clasprc.json` (containing OAuth tokens) in the home or working directory

Risks and side effects

  • `clasp push` always replaces the entire remote project content (the Apps Script API has no atomic or per-file operations), so mistakes can overwrite remote code
  • OAuth scopes are broad — covering scripts, Drive files, logging, and API management — so leaked credentials (especially custom ones saved via `--creds`) carry meaningful exposure
  • MCP mode is explicitly experimental; the README states it currently offers only a limited tool subset and behavior may change
  • Service-account / application-default-credentials support is explicitly marked experimental and 'NOT WORKING,' and should not be relied on for production automation

Setup

Before you start

Runtime:Node.js 22+

Other optional settings (3)
DEBUG optional Set to clasp:* to enable verbose debug logging when troubleshooting.
HTTP_PROXY optional HTTP proxy URL, supported via the Google APIs Node module for restricted networks.
HTTPS_PROXY optional HTTPS proxy URL, supported via the Google APIs Node module for restricted networks.

1) Install globally: npm install -g @google/clasp; 2) Enable the Google Apps Script API at https://script.google.com/home/usersettings; 3) Run clasp login to authorize (the MCP server reuses these saved credentials); 4) Wire it into a coding agent — in Claude Code either run /plugin install @google/clasp, or manually run claude mcp add clasp -- npx -y @google/clasp mcp (or claude mcp add-json clasp "$(cat claude-mcp.json)" using the repo's config file); in Gemini CLI run gemini extensions install https://github.com/google/clasp.

.mcp.json
{"mcpServers":{"clasp":{"command":"npx","args":["-y","@google/clasp","mcp"]}}}

Shown for Claude Code. Other clients may use a different file or key (VS Code uses "servers") — the configurator below converts it.

.vscode/mcp.json
{
  "servers": {
    "clasp": {
      "command": "npx",
      "args": [
        "-y",
        "@google/clasp",
        "mcp"
      ]
    }
  }
}

Goes in your project's .vscode/mcp.json (VS Code uses a "servers" key).

Terminal
claude mcp add clasp -- npx -y @google/clasp mcp

Run it in a terminal; replace any <…> placeholders with your own values first.

Check that it works

Run clasp login beforehand to authorize, then confirm the clasp server's tools appear in your MCP client's tool list; asking it to list your scripts proves the connection works.

Troubleshooting

  1. Verify Node.js >= 22.0.0 with `node -v`; upgrade via `npx n latest` if needed
  2. Confirm the Apps Script API is enabled and `clasp login` has completed successfully
  3. If the MCP server fails to authenticate, check that the relevant `.clasprc.json` credentials are valid, and re-run `clasp login --user <name>` for the specific account if needed
  4. Set the environment variable `DEBUG=clasp:*` for verbose debug logs when troubleshooting
  5. For push/pull issues, check `scriptId` and `rootDir` in `.clasp.json` and confirm `.claspignore` isn't excluding needed files

Things to try

Once connected, you can ask your AI assistant things like:

  • List my Apps Script projects
  • Push the local files in this directory to my Apps Script project
  • Create a new deployment for my script
  • Run the sendEmail function in my script

Use cases

Check Apps Script project code into version control and collaborate with a team
Push/pull script files and manage deployments and versions from the command line
Remotely execute Apps Script functions and view logs
Let an AI coding agent read, push, and deploy Apps Script projects directly via MCP

Supported clients

Claude Code
Gemini CLI

Listed from the project's documentation, not tested by this site.

Overview

clasp (Command Line Apps Script Projects) is a command-line tool maintained in Google's own GitHub org for developing Google Apps Script projects locally: pushing/pulling code, managing deployments and versions, running script functions remotely, tailing Stackdriver logs, and enabling/disabling Google APIs. Version 3.x adds an experimental clasp mcp mode that runs clasp as a local MCP server over STDIO transport for use by coding agents such as Claude Code and Gemini CLI, reusing the same credentials as the CLI (requires a prior clasp login). The README explicitly states this is 'not an officially supported Google product,' and the MCP mode currently offers only a limited subset of tools.

Similar servers

Context7 80 · B

Upstash's official server providing up-to-date third-party library docs for AI coding assistants

★ 64.1k · Tools 2 Compare with this →

Source revision e9441e57b0ae Data synced 2026-11-04 Read the FMRS scoring method