Feature Request: Add Support for Customizable OAuth Scopes to Prevent Unintended Email Operations

[Do-yoon]

The official Gmail MCP currently does not support customizable OAuth scopes. This limitation prevents users from fine-tuning the permission levels granted to the Gmail integration based on their security and privacy requirements.

With hardcoded OAuth permissions, there is a risk that an LLM could make incorrect judgments and accidentally send emails or perform unintended operations. By allowing users to restrict scopes to read-only access (e.g., gmail.readonly), we can prevent such mishaps and implement safer configurations for production environments.

Proposed Solution

Implement customizable OAuth scope configuration that allows users to:

• Define which Gmail scopes to authorize during the OAuth flow
• Restrict permissions to only necessary operations (e.g., read-only access)
• Configure scopes through the extension configuration file

Example Use Case

A user can grant only gmail.readonly instead of full Gmail modification permissions to prevent accidental email sending due to LLM misinterpretation.