🔒ADMIN USE ONLY. This connector holds domain-wide super-admin power over all of Melinda Maria’s Google Workspace (92 accounts). It runs only on David’s Mac, under his login, with credentials that never leave that machine — no one else and no other computer can operate it. Every change is previewed and needs a human “yes,” and user deletion is blocked by policy. Treat it like the keys to the company.
GAM7 — Google Workspace Admin
ADMIN ONLY · full admin · human-gated
Administer all of Google Workspace by asking Claude in plain English — create & suspend users, manage groups, org units, Gmail/Drive/Calendar settings, devices, security policies, reports, and bulk changes. Claude translates your request into the exact command, shows a preview, and waits for your approval before anything changes.
Engine: GAM7 v7.46.03 (open-source)Access: full admin — 42 scopes; deletes blockedRuns on: David’s Mac (Control-your-Mac)Domain: melindamaria.com · 92 usersStatus: LIVE (verified Jun 30, 2026)
🔒 Access to this connector is restricted to David. GAM7 isn’t a self-serve connector you “Connect” in your own settings — it runs locally on David’s Mac with domain-wide admin credentials, and this guide page is locked to David’s login via Cloudflare Access (so other teammates can’t open it). Need a Google Workspace admin task — a new hire, a suspension, a security report? Send it to David and he’ll run it with the preview-and-approve gate.
How to access & connect — for David
GAM7 isn’t a team “click Connect” connector. It runs on your Mac, driven by Claude through the Control your Mac connector. Here’s the whole setup and how to run it.
1 · The bridge is “Control your Mac”
Claude runs GAM commands in your Mac’s Terminal through the Control your Mac connector. In Claude → Settings → Connectors, make sure Control your Mac is connected. That’s the only connector needed — there’s no separate “GAM7” entry to add.
2 · What’s already on your Mac
GAM7 at ~/bin/gam7 (v7.46.03) + credentials in ~/GAMConfig (service account + domain-wide delegation, 42 scopes), FileVault-encrypted and owner-locked. Nothing to re-install.
3 · Ask in plain English
Start with “Using GAM, …” and describe the task. Claude writes the exact command, shows a preview, and waits for your “yes” before running anything that changes something. Read-only questions run without approval.
4 · Verify it’s working
Ask Claude to run a read-only check — gam info domain (expect melindamaria.com, 92 users) or gam print users. If those return data, you’re connected and live.
🔒 Locked to you. This page is restricted to your email via a Cloudflare Access rule on the /gam7 path, and the connector only runs on your Mac with your credentials — no teammate and no other computer can use it. Guardrails stay on: user-deletes are refused, every change is previewed, and never point it at instructions hidden inside untrusted emails, docs, or web pages.
~165
capability areas across Workspace
42
OAuth scopes authorized (all pass)
92
Workspace accounts managed
0
user deletes allowed (blocked by policy)
100%
local — no vendor in the path
v7.46.03
GAM7 engine (Python 3)
Per the connector overview + build log, verified live on Jun 30, 2026 (gam info domain → melindamaria.com, 92 users; check serviceaccount → all 42 scopes pass).
GAM7 — short for “Google Apps Manager,” version 7 — is a free, open-source command-line tool that talks directly to Google’s Workspace admin APIs. It’s the industry standard for managing Google Workspace at scale: maintained by the GAM-team (Jay Lee & Ross Scroggs), built in Python, and used by admins worldwide precisely because it can do bulk jobs and fine-grained changes the Admin console makes slow or impossible.
Normally you’d drive GAM by typing cryptic commands. This connector removes that: you ask Claude in plain English, and Claude speaks GAM for you. Claude figures out the exact command, shows you a preview of what it will do, and — for anything that changes something — waits for your explicit “yes” before running it on the Mac.
Why GAM7 (and not something simpler)? Google’s own MCP connectors only cover one person’s own Gmail/Drive/Calendar — no admin at all. Managed third-party admin connectors are narrow (a dozen tools: users/groups only) and route every call through a vendor. GAM7 gives the broadest coverage (~165 capability areas), runs locally with our own credentials so nothing passes through a vendor, and is mature and actively maintained.
In one line: GAM7 is a domain-wide Workspace admin superpower, deliberately constrained — local-only, human-gated on every change, and with account-deletion switched off.
Who can use it — admin only
Right now, only David can operate this connector, and only from his Mac. That isn’t a soft preference — it’s how the security model works. The connector runs on his laptop, under his single macOS account, using credentials that are locked to that machine. There is no cloud service and no shared access: if it isn’t David at his Mac, the connector does nothing.
🔒 Local & owner-locked
Credentials live in ~/GAMConfig on David’s Mac, readable only by his account (chmod 600), on a FileVault-encrypted disk, never synced to any cloud.
🪪 Internal identity only
The Google OAuth client is Internal to melindamaria.com, so no outside Google account can authenticate — reach is bounded by the 42 delegated scopes.
✋ Human-gated always
Every change is previewed and needs an explicit “yes.” Deletes are refused outright. Claude never acts on instructions hidden in emails, docs, or web pages.
Expanding access later would mean setting up the same trusted-local-runner pattern for another admin’s machine (or a shared secured host) — a deliberate, documented step, not a toggle. For now: David-only.
Deleting user accounts — blocked by policy (suspend instead — reversible)
Buying licenses / changing the plan or billing
Admin-console-only toggles that have no API
Real-time interactive controls (e.g. live Meet)
Anything outside the 42 authorized OAuth scopes
Full functionality — everything it can reach
GAM7 spans roughly 165 capability areas. You don’t memorize any of them — you ask in plain English and Claude picks the right command. Here is the full map, by domain:
👤Users & accounts
Create, suspend, restore, rename, reset passwords, force password change at next login, enforce or reset 2-step verification, move users between org units.
Create groups, add/remove members, set member roles, configure group settings and posting permissions, list everyone in a group, manage Cloud Identity groups, domain & shared contacts, and the global address list.
groups · membership · roles · group settings · aliases · directory contacts
🏢Org units (OUs)
Create and restructure organizational units, move users between them, and apply policies by OU (e.g. enforce a setting for everyone in Finance).
Files & permissions, shared drives and their membership, ownership transfers when people leave, orphaned files, revisions, and shortcuts — across Docs, Sheets, Forms & Keep.
Login activity, usage reports, admin-action logs, Drive & email audit logs, and the alert center — the raw material for access reviews and investigations.
Google Vault / eDiscovery exports, license assignment, data transfers, and CSV-driven bulk changes across every area above — onboard 30 people or move a whole team in one run.
Vault exports · licenses · data transfers · CSV bulk on everything
Two kinds of commands.Read / report commands (“who’s in Marketing?”, “show login activity”) just pull information and run freely — no approval needed. Action commands (create, suspend, change a permission, bulk edit) change something and are always gated by a preview-and-approve step. Account deletion is refused outright.
How to use it — day to day
You never touch a command line. You describe what you want; Claude does the translating, previewing, and running. The flow is always the same five steps:
1 · You ask
Plain English: “Suspend bob@ and move him out of Sales,” or “Who’s in the Marketing group?”
2 · Claude translates
It builds the exact GAM command(s) for the task — no syntax for you to learn.
3 · Preview
For any change, Claude shows exactly what it will run and who it affects.
4 · You approve
A clear “yes” before anything risky runs. (Read-only questions skip this.)
5 · Done
Claude runs it on the Mac and reports back the result.
🗣️ How to phrase it
Just start with “Using GAM…” (or “in Workspace…”) and describe the outcome. Add a CSV for bulk jobs.
Tip for bulk work: attach or point to a CSV and say “show me the plan before running.” Claude will lay out every row it will touch so you can eyeball it before a single change is made.
Running it from Claude — the local-terminal bridge
Yes — this connector works by Claude operating a terminal on the local computer. That’s the whole mechanism. GAM7 is a command-line program, so Claude needs a way to type commands into a real terminal on the machine where GAM7 and its credentials live. Here’s exactly how that works and what it takes.
The bridge: a local-terminal connector
Claude drives GAM7 through “Control your Mac” — an Anthropic connector that runs commands in Terminal on the Mac (via macOS osascript). Claude writes the exact gam command, the connector runs it locally, and the result comes back to Claude. Desktop Commander (persistent local shell) is an equivalent bridge — either one lets Claude operate your actual computer’s terminal.
What must be on that computer
Three things, all present on David’s Mac: (1) GAM7 installed at ~/bin/gam7; (2) the authorized credentials in ~/GAMConfig (service account + domain-wide delegation, 42 scopes); (3) a local-terminal connector (Control your Mac / Desktop Commander) enabled in Claude.
What can’t run it: Cowork’s cloud sandbox — the Linux shell Claude uses to build files and run code — is not your computer. It can’t see GAM7 or the Mac’s credentials, so GAM commands must go through a connector that operates the real local machine where GAM7 and the keys live. That’s why this is tied to a specific Mac, not the cloud.
Safety is unchanged on the terminal path: Claude still previews every command and waits for your “yes” before running anything that changes something; you stay at the keyboard for any Google sign-in (Claude never types credentials); and user-deletes are refused. The local-terminal bridge doesn’t loosen any of the gates.
For another teammate to run it from their computer: they’d install GAM7 + the authorized credentials on their machine (or a shared, secured host) and enable a local-terminal connector — the same trusted-local-runner setup David has. Until that’s deliberately done, it stays David-only.
Example prompts — from one-liners to full orchestration
Tags: Action changes something (gated) · Read pulls info (runs freely) · Automation scheduled/recurring · Interactive builds a live view. Any other connector named must also be added to Claude.
GAM only — everyday admin
“Using GAM, create jane.doe@melindamaria.com in the Marketing OU, add her to mmj-marketing-team@, set a temp password, and force a change at first login.”
Action onboard a new hire
“Using GAM, suspend edgar@melindamaria.com, reset his sign-in cookies, transfer his Drive to his manager, and remove him from every group. (Suspend — never delete.)”
Action clean offboarding
“Using GAM, show every active user without 2-step verification enrolled, grouped by org unit.”
Read security gap check
“Using GAM, list groups with zero members or only suspended members so we can decide what to retire.”
Read stale-group sweep
“Using GAM, from this CSV of 12 employees, move each into the OU in column B — show me the plan before running.”
Action bulk OU move from CSV
“Using GAM, list every user with external email forwarding turned on — a common data-leak risk — and rank by how long it’s been active.”
Read forwarding-leak scan
“Using GAM, show licenses used vs. owned, and list suspended accounts still holding a paid license we could reclaim.”
Read reclaim licenses
“Using GAM, list every account with any admin role, what role each holds, and flag anyone with super-admin who shouldn’t have it.”
Read super-admin audit
“Using GAM, find every user who hasn’t logged in for 90+ days, with last-login date, so we can review for suspension.”
Read inactive-account sweep
“Using GAM, create a bookable ‘Conference Room B’ calendar resource and let everyone in the company reserve it.”
Action provision a resource calendar
“Using GAM, for everyone in the Finance org unit, turn on 2-step enforcement — list who’s affected and confirm before applying.”
Action enforce 2-step on a group
“Using GAM, show every third-party app our users have granted access to and which scopes, flagging any with broad Gmail or Drive access.”
Read OAuth app-grant review
GAM + one connector
“Using GAM and Asana, pull active users by org unit and cross-reference open Asana projects each team owns, then build a live dashboard of headcount vs. active project load per department.”
Interactive GAM + Asana
“Using GAM and Slack, create the Workspace account for our new hire, add them to the right groups, then draft a welcome with their email and starter links for #team.”
Action GAM + Slack — new-hire kit
“Using GAM and Gmail, every Monday at 8am, pull last week’s admin actions and failed logins, flag anything from outside the US, and email me the summary.”
Automation GAM + Gmail — weekly access audit
“Using GAM and QuickBooks, match our Workspace license count to the Google subscription cost and build a live page showing cost-per-active-user and reclaimable spend from suspended accounts.”
Interactive GAM + QuickBooks — license spend
“Using GAM and Box, compare who has access to our ‘Marketing Assets’ shared drive against the matching Box folder, and fix Drive to match — show me the diff before applying.”
Action GAM + Box — access parity
“Using GAM and Slack, each morning check for any newly created or recently un-suspended Workspace accounts and post them to #it-security so nothing slips by.”
Automation GAM + Slack — shadow-account watch
“Using GAM and Google Calendar, create the ‘Q3 Planning’ group, add these eight people, then put a recurring weekly planning meeting on their calendars.”
Action GAM + Google Calendar
Multi-connector orchestration
“Using GAM, Asana, Slack, and Gmail: for our new hire, create the Workspace account & groups, generate an Asana onboarding project from our template, post a welcome to #team, and draft their first-day email — show me everything before any of it sends.”
Action full onboarding pipeline
“Using GAM, Box, Asana, Slack, and Gmail: on a termination, suspend the Workspace account, transfer Drive & Box to the manager, revoke all app tokens, build a handoff checklist in Asana, post to #offboarding, and email HR a completion report — confirm before the suspend.”
ActionAutomation end-to-end offboarding
“Using GAM, QuickBooks, and NuOrder: for our top 10 wholesale accounts, combine booking activity, open balances, and their Workspace contact/owner into one interactive account-health view.”
Interactive GAM + QuickBooks + NuOrder
“Using GAM, Shopify, ShipHero, and Slack: every Monday, combine new Workspace user changes, DTC sales, and fulfillment stats into one digest, post it to #ops, and email leadership a PDF.”
Automation weekly ops digest
Very complex — act + automate + visualize
“Using GAM, Slack, and Gmail: build a live Workspace security command center — 2-step gaps, external forwarding, suspended-but-licensed, risky logins, stale admin roles — refreshed on open, that pings #it-security and emails me whenever a new high-risk item appears.”
InteractiveAutomation security command center
“Using GAM, Slack, and Gmail: if a Workspace login looks compromised (impossible-travel, mass forwarding added), suspend the account, kill its sessions, alert #it-security, and email me the timeline — pause for my OK before the suspend.”
ActionAutomation account-takeover response
“Using GAM, Shopify, NuORDER, Gorgias, ShipHero, Slack, and Gmail: every Monday 7am, build one interactive ‘company pulse’ page — headcount & access changes, DTC + wholesale revenue, support load, fulfillment health — flag anything off-trend, open Asana tasks for each flag, post highlights to #leadership, and email me the PDF.”
InteractiveAutomation full company pulse (7+ connectors)
“Using GAM, Asana, Slack, and Gmail: from an uploaded roster of seasonal hires, create all Workspace accounts and groups, generate one Asana onboarding project per person, post a roster to #team, and email me a status sheet — preview the batch first.”
ActionAutomation seasonal hiring ramp
📊 Live artifacts, dashboards & spreadsheets
“Create a live artifact: a workspace admin dashboard — user count, recent joiners and suspensions, refreshed each open (reads only).”
GAM7 — David-only
“Make a spreadsheet (.xlsx) of all 92 users with last-login and 2FA status for the security review.”
GAM7 — xlsx
“Build a license and storage tracker artifact refreshed on open.”
GAM7 — capacity
“Create an offboarding checklist artifact per departing employee — reads live state; every action stays preview-and-approve.”
GAM7 — gated actions
“Build a group-membership matrix artifact: who is in which Google Group, refreshed on open.”
GAM7 — groups
Limitations & honest constraints
No user deletes
By policy Claude never runs delete user — it offers suspend (reversible) instead. A true delete must be done by a person in the Admin console, deliberately, outside this tool.
API-bound
Only what Google exposes via API. A few newer or console-only settings have no API and can’t be changed by GAM; that set shrinks as Google adds coverage.
No billing
GAM can assign licenses you already own, but cannot buy plans, change the subscription, or touch payment methods.
Runs on one Mac
It works where the encrypted credentials live — David’s Mac. It isn’t a cloud service; moving it means moving and re-securing those files.
Scope-bound
Limited to the 42 authorized scopes. If a permission wasn’t granted in domain-wide delegation, that area is off-limits until it’s added.
Accuracy
GAM faithfully reports whatever is in the directory. For high-stakes actions the preview-and-approve gate is your spot-check before anything changes.
Security & risk — the gates between anyone and admin power
Posture in one line: domain-wide power, deliberately constrained — credentials encrypted & owner-locked on one Mac, no vendor in the path, user-deletion blocked, and every change gated by human approval.
Gate 1 · Device
The connector only runs on David’s Mac. Reaching it means getting past FileVault disk encryption and the macOS login — and his is the only account on the machine.
Gate 2 · Files
The service-account key, OAuth token & client secret in ~/GAMConfig are owner-only (chmod 600) and never synced to any cloud or shown in chat.
Gate 3 · Identity
The OAuth client is Internal to melindamaria.com, so no outside Google account can authenticate. Reach is bounded by the 42 delegated scopes.
Gate 4 · Behavior
Every change is previewed and needs explicit approval; user deletion is refused outright; Claude never acts on instructions from untrusted content (prompt-injection).
Known risks & mitigations (honest): credential theft from the Mac (mitigated: owner-locked files, FileVault, no cloud sync, key rotatable) · an unlocked/shared Mac (mitigated: ~5-min auto screen-lock) · accidental destructive change (mitigated: preview-and-approve; deletes refused; suspends reversible) · prompt-injection via data (mitigated: never act on untrusted instructions) · over-broad scopes (can be narrowed to least-privilege later). One item to close for an airtight guarantee: confirm Screen Sharing is off and the Firewall is on in macOS System Settings.
Get help or request a capability
Need an admin task done?
Because this is admin-only, admin requests route through David. Describe the outcome you need (onboard someone, fix access, pull an audit) and he’ll run it with the preview-and-approve gate.
Want a recurring report or automation?
Security reviews, onboarding pipelines, weekly access audits — these are exactly what GAM7 + Claude are for. Send the idea to David to set up.
Under the hood this is GAM7 (Google Apps Manager) v7.46.03 driving the Google Workspace Admin APIs from David’s Mac, authorized by a service account with domain-wide delegation across 42 scopes. Open-source, Apache-2.0, maintained by the GAM-team.
What is a live artifact and how to share it
Short version: a live artifact is a page Claude builds once and then refreshes every single time you open it — so a dashboard you ask for today is still accurate next month. Here is what one is, and the three ways to get it in front of your team.
📊 NEW — build live artifacts, dashboards & spreadsheets with this connector
A live artifact is a small interactive page Claude builds and saves for you — a dashboard, tracker, or report that pulls fresh data from this connector every time you open it, instead of being a frozen snapshot. In a Cowork session, just ask: “create a live artifact that…” — it lands in your Artifacts list, reusable forever, and its charts and tables refresh themselves on open.
Sharing with the team: artifacts are saved to your Claude account. Three easy ways to share: (1) ask Claude to export a snapshot (PDF, image, or .xlsx) and drop it in Slack; (2) send a teammate the prompt that built it — their copy fills with live data through their own connector sign-in; (3) for a permanent all-team dashboard, that’s the MM Intelligence project on the AI roadmap.
How it works — architecture
A local connector: no cloud service. Claude drives GAM7 on David’s Mac through the “Control your Mac” connector; GAM7 uses our own Google credentials (service account + domain-wide delegation) to call the Workspace admin APIs.
This mirrors the trusted-local-runner pattern behind our other connectors, but with an important difference: GAM7 lives on the Mac, not on Cloudflare, because that’s where the credentials sit. Moving it would mean moving (and re-securing) those credential files. GAM is the mature, widely-used standard for Workspace admin — actively maintained, not a one-off script.
Melinda Maria · GAM7 Google Workspace Admin — Team Guide · engine GAM7 v7.46.03 · ADMIN USE ONLY · runs locally on David’s Mac · verified live Jun 30, 2026.
Domain-wide admin, deliberately constrained: local-only, human-gated on every change, user-deletion blocked. Questions & access requests → David. · ← Back to all connectors
The Next Evolution of Melinda Maria.A smarter warehouse, one plain-English question away.
