39633c2217
Connector catalog, setup guides, and shared access documentation, followed by a final code-accuracy repair pass. This PR does not change application behavior. ## Final accuracy pass Checked against shipped Paperclip `v2026.916.0`, commit `dffc2b3ca1b9e88fa21cb17493083e682dffd1ca`, rather than the dirty local checkout or the earlier canary baseline. - Corrects connector/method-specific identity choices, human audiences, and managed GitHub versus PAT scope and verification. - Explains that **Always allow** covers different arguments for the same agent/action/connection, with project scope when present; uses actual button labels and removes the test-panel control from review instructions. - Qualifies new-action quarantine, including safe-default read exceptions. Removes unconditional approval guarantees. - Separates provider channel/repository reach from Paperclip sender authorization. - Completes sandbox sign-in and model credential-selection instructions from the current UI implementation. - Repairs Notion's hub summary, removes incomplete optional Notion/Sentry client-registration procedures, and corrects Linear's provider-versus-Paperclip attribution. - Removes unsupported Postman tier claims, contradictory Cloudinary/Mem0 verification assertions, API-equivalence claims, and overbroad successful-test assurances. - Retains Supabase's required project reference: both released method definitions explicitly require it. An earlier review suggested otherwise; release code is authoritative here. - Updates the release baseline and removes draft commit chronology from the public introduction. ## Availability and remaining runtime gates - **Google:** Verification is pending. Per the product-owner clarification, authorization can continue where Google offers an Advanced option; this is not available for every account and does not override Workspace policy or other Google prerequisites. Notices on the hub and all Google guides now distinguish an unverified-app warning from blocked authorization. - **Slack is available but not yet fully functional; follow-up fixes are planned.** For agent tools, the released OAuth endpoint/scope defaults differ from Slack's documented MCP contract. The page now warns against treating that route as production-ready and removes the misleading bot-scope walkthrough. Chat-channel bot setup remains separate. Engineering must reconcile the integration and run OAuth plus one read before removing this warning. Source: https://docs.slack.dev/ai/slack-mcp-server/ - No credentialed connector run was performed in this pass. Code consistency, provider documentation, UI rendering, and successful live execution are separate evidence levels. No claim of runtime certification for all connectors. ## Validation - Root build: 253 crawlable documentation pages. - Full `docs:test`: all eight suites passed locally, including root/subpath routes, sitemap history, fingerprints, navigation, skill source blocks, crawlable links, doc-link resolution, and SEO metadata. - Internal-link lint: 258 Markdown files; no broken internal links. - Latest cleanup: full build, all eight docs:test suites, internal-link lint and diff whitespace checks passed; 1,878 link-resolution checks. - Fixed the Calendar MCP reference URL; browser-checked the five inconclusive external destinations (Miro article loads; Asana, Google Cloud, OpenAI and xAI reach sign-in/console screens). Authenticated destinations were not tested beyond those screens. - Replaced the Sandbox providers editorial TODO with a scope note and removed the CLI overview's unfinished-guide announcement. - Browser client navigation: 687 checks passed using installed Chrome. Initial launch lacked the downloaded Playwright browser; rerun used `DOCS_CHROMIUM_PATH` without changing the tests. - Nine representative connector/shared pages at 1440px and 390px: HTTP 200, one article H1, no page-level horizontal overflow. Mobile screenshot inspected; approval page opened in the Codex browser. - Navigation audit reports three existing non-connector orphan files; this patch does not alter those files or their navigation. The previous revision's provider-page expansion, Google shared setup guide, navigation additions, and accidental node_modules-symlink cleanup remain in this PR. Internal review ledgers remain outside the publication branch. No merge or production deployment authorized. --------- Co-authored-by: DevRel Gemini <[email protected]> Co-authored-by: Paperclip <[email protected]> Co-authored-by: Claude Opus 5 (1M context) <[email protected]> Co-authored-by: Michael Nguyen <[email protected]>
8.3 KiB
seo_title: Google Sheets Connector seo_description: Two ways to connect Google Sheets: a Google sign-in, or sharing named spreadsheets with the Paperclip robot account. Groups, a read test, and fixes.
Google Sheets
Warning: Google verification pending. Paperclip has not yet completed Google app verification. You may see an unverified-app warning during authorization. If Google offers an Advanced option to continue to Paperclip, you can choose to proceed after reviewing the requested access. This option is not available for every account; Workspace administrator restrictions and other Google access requirements still apply. Contact [email protected] if you cannot connect.
Agents can read spreadsheet values and structure, and on a writing connection update them.
Sheets is the one connector with two genuinely different setups: sign in with Google, or share named spreadsheets with a Paperclip robot account. They differ in what agents can reach and what they can do, so choose before you start.
Which setup do you want?
| If you want | Use | Reach |
|---|---|---|
| Agents to work across the spreadsheets your Google account can already open | Google sign-in | Everything that account can open |
| Agents limited to a short, explicit list of spreadsheets | The Paperclip robot account | Only the spreadsheets you paste in |
The robot account is the stronger boundary: Paperclip checks each call against the connection's spreadsheet list, so reach does not depend on the provider's consent screen. It also exposes a wider set of operations, including row deletion. The Google sign-in path reaches more spreadsheets but cannot delete anything.
Note: The robot path's spreadsheet allowlist is specific to that method. Do not assume other connectors provide the same resource filter.
Option A: Google sign-in
Warning: This path needs Google Workspace Developer Preview registration before it will authorize. Google must register the Workspace email that signs in, and the Cloud project that owns the OAuth client if you bring your own. Apply first at Google Workspace Developer Preview.
Before you connect
- A Google Workspace account that can already open the spreadsheets you want agents to use, with Developer Preview registration confirmed.
- If you use your own client, complete Google OAuth setup, including API enablement, consent settings, scopes, and the callback URI.
Capability groups
| Group | What agents can do | Scopes requested |
|---|---|---|
| Read only | Read spreadsheet values and structure | drive.readonly, spreadsheets.readonly |
| Read & edit | The above, plus update values, formulas, and dimensions | drive.readonly, drive.file, spreadsheets |
Reviewed operations: get-spreadsheet and get-values in both groups; update-spreadsheet, update-values, update-formulas, and insert-dimension in the editing group only. There is no delete operation on this path.
Steps
- Open Connectors and select Google Sheets.
- On the Access step, choose the identity and which agents may use the connection.
- Choose the capability group, then Connect with Paperclip or Use your own Google OAuth app.
- Complete Google's consent screen with the registered Workspace account.
Note: The connector's guidance is that spreadsheet updates should be approved. Leave the write operations on Ask first.
Option B: the Paperclip robot account
Instead of connecting a Google identity, you share individual spreadsheets with a robot account that the instance owns. Agents then reach exactly those spreadsheets and nothing else.
This path requires the instance administrator to have configured a service account. If they have not, Paperclip reports "Google Sheets is not available on this instance yet." and the option cannot be used. It needs no Developer Preview registration.
Steps
- Open Connectors and select Google Sheets, then choose Use the Paperclip robot account.
- On the Access step, choose which agents may use the connection. This method does not ask for a personal Google identity.
- Paperclip shows the robot account's email address. In Google Sheets, share each spreadsheet with that address:
- Viewer is enough for reading.
- Editor is required for appending, updating, adding tabs, clearing values, or deleting rows.
- Paste the link to each shared spreadsheet. At least one link is required, and Paperclip rejects anything that is not a Google Sheets link.
- Finish setup. Paperclip verifies it can reach each spreadsheet you listed.
What agents can do on this path
| Operation | Class |
|---|---|
list_spreadsheets, get_spreadsheet_info, read_values, search_rows |
read |
append_rows, update_values, add_sheet_tab |
write |
clear_values, delete_rows |
destructive |
Every one of these is restricted to the spreadsheets on the connection's list. Adding a spreadsheet later means editing the connection's list — sharing it with the robot account alone is not enough.
Warning:
clear_valuesanddelete_rowsremove data and are not reversible from Paperclip. Leave them Off unless an agent genuinely needs them, and rely on Google Sheets version history for recovery.
Choose access
On the Google sign-in path, reach is whatever the authorizing account can open, and Paperclip does not narrow it. On the robot path, reach is the pasted list and Paperclip does enforce it.
Choose which agents may use either connection. The Google sign-in method also asks who may use the credential; the robot-account method uses the instance's configured service account rather than a personal Google sign-in. See How connector access works.
Try it
Use a spreadsheet you can open yourself, identified by its URL, and a cell whose value you already know. Substitute both:
In this spreadsheet — https://docs.google.com/spreadsheets/d/YOUR_SPREADSHEET_ID/edit
— read cell B2 of the "Headcount" tab and tell me its value. Do not change anything.
Expect the value you already know. Giving the URL rather than a title matters: the reviewed read operations take a spreadsheet identifier, and asking an agent to find a document "by title" tests discovery rather than the connection.
On the robot path, run list_spreadsheets first as a cheaper smoke test — but read what it proves narrowly. It returns the connection's configured list, so it confirms setup, not that Google will serve a cell. A spreadsheet can appear there and still fail to read if it was never actually shared with the robot account. Follow it with the cell read above.
Note: Illustrative task, not a recorded test result.
Troubleshooting and limitations
| Problem | Likely cause | Fix |
|---|---|---|
| Use the Paperclip robot account is unavailable | No service account is configured on the instance | Ask an administrator; the message is "Google Sheets is not available on this instance yet." |
| A pasted link is rejected | It is not a Google Sheets link | Use the spreadsheet's own URL, not a Drive folder or a published-to-web link |
| Robot path: the agent cannot see a spreadsheet you shared | It is not on the connection's list | Add the link to the connection; sharing alone does not grant reach |
| Robot path: reads work but writes fail | The robot account has Viewer, not Editor | Change the sharing role in Google Sheets |
| Google sign-in: authorization refused before consent | Developer Preview registration is incomplete | Finish registration and retry |
| Google sign-in: writes are absent | The connection was made with Read only | Make a connection with Read & edit |
| Needs attention | The credential expired or the grant was revoked | Select Reconnect |
Limitations: neither path creates or deletes whole spreadsheets. The Google sign-in path has no delete operation at all. Developer Preview applies to the Google sign-in path only.
Related guides
- Google Drive — find and create files.
- How connector access works
- Verify a connector and fix a broken one
- Google Sheets API MCP reference