Best OpenClaw CLIs for Email and Calendar: gogcli vs gws vs PortEden

Quick Comparison

1. PortEden CLI

PortEden (github.com/porteden/cli) takes a fundamentally different approach from the other tools. While gogcli and gws connect your agent directly to Google's APIs, PortEden acts as a data firewall between the agent and your email and calendar providers. Every request passes through PortEden's rules engine before any data is returned or any action is executed.

Email Capabilities

Full email access across both Google and Microsoft: list and search messages (by date, sender, subject, keyword, unread status, attachments), read individual messages and full threads, send new emails, reply and reply-all, forward messages, modify labels, and delete. The CLI uses -jc (compact JSON) output that strips metadata noise and delivers clean, flat data optimized for LLM consumption.

Calendar Capabilities

Full calendar access across both Google and Microsoft: list calendars, query events by date range and keyword, search events by contact, create events with attendees, update event fields, manage attendees (add/remove with notifications), delete events, and RSVP (accepted/declined/tentative). Free/busy queries are also supported.

Security: Six Layers of Access Control

This is the core differentiator. PortEden's access rules give you six configurable layers that are enforced on every request:

1. Visibility: Show full event details or restrict to free/busy only. Show email subjects but redact body content.
2. Contact Rules: Block the agent from seeing emails or events involving specific people or domains.
3. Action Limits: Read-only mode, draft-only mode for email, or full read/write. Prevent the agent from sending, deleting, or modifying anything.
4. Time Windows: Limit how far back and forward the agent can see. Show only the next two weeks, block all historical data.
5. Account Scope: Choose which calendars and inboxes the agent can access. Work calendar only, personal inbox excluded.
6. Data Reduction: Field-level redaction that strips sensitive fields before data reaches the agent.

Every request is logged with a full audit trail: what was asked, what was returned, what was blocked, and whether write operations were attempted. If something goes wrong, you know exactly what happened.

And if you need to cut off access, one click revokes all agent access across every connected provider. Instantly.

Context Hygiene

PortEden does not just forward API responses. It actively cleans the data before delivering it to your agent. Raw email and calendar API responses from Google and Microsoft are full of nested structures, timezone metadata, organizer objects, and fields that waste tokens. PortEden reduces token usage by up to 80%. A calendar event drops from around 180 tokens to around 35 tokens. This means better answers, fewer hallucinations, faster responses, and lower API costs.

Pros and Cons

Pros:

• Google and Microsoft. One tool for Gmail, Outlook, Google Calendar, and Outlook Calendar. No need for separate tools per provider.
• Six layers of access control. Visibility, contact rules, action limits, time windows, account scope, and data reduction. No other OpenClaw CLI offers any of these.
• Full audit trail. Every request logged with what was asked, returned, blocked, and redacted.
• Context hygiene. Up to 80% token reduction. Cleaner data in, better answers out.
• One-click revocation. Instantly cut off all agent access across all providers.
• No Google Cloud project required. Authentication is handled through the PortEden dashboard. No OAuth client setup, no client secret JSON files.
• Free tier available. Core security features are included at no cost.

Cons:

• Requires a PortEden account and API key (the proxy model means data routes through PortEden's infrastructure).

Best for Anyone who wants secure, controlled AI agent access to email and calendar, especially if you use both Google and Microsoft.

2. gogcli

gogcli (github.com/steipete/gogcli) is an open-source Go CLI for interacting with Google services, built by Peter Steinberger. It provides direct access to Gmail and Google Calendar through the Google APIs and is available as an OpenClaw skill on ClawHub.

Email Capabilities

gogcli provides solid Gmail coverage. You can search threads using Gmail query syntax (gog gmail search 'newer_than:7d'), read individual messages and full threads, send emails with HTML body and attachments, reply to threads, manage labels, download attachments, and export filter definitions. It supports Gmail's native search operators, which is a strong point for power users.

Calendar Capabilities

Calendar support includes listing calendars, querying events by date range, creating and updating events, deleting events, and checking free/busy status. It covers the core Google Calendar API operations.

Authentication and Security

gogcli uses OAuth 2.0 with a Google Cloud "Desktop app" OAuth client. You need to set up your own Google Cloud project, create OAuth credentials, and download the client secret JSON file. The CLI stores refresh tokens in the OS keychain (macOS Keychain, Windows Credential Manager, Linux secret-service). Multi-account support is available, and it also supports service accounts with domain-wide delegation for enterprise use.

Pros and Cons

Pros:

• Strong Gmail coverage including labels, filters, and attachments
• Native Gmail search query syntax
• Credential storage in OS keychain (not plaintext)
• Multi-account and service account support
• Open source and actively maintained
• JSON output for agent consumption

Cons:

• Google only. No Microsoft Outlook support. If you use both Google and Microsoft, you need a second tool.
• No access controls. Once the agent has the OAuth token, it has full access to everything the token allows. No visibility filtering, no contact blocking, no action limits.
• No audit trail. No logging of what the agent accessed or what data was returned.
• Requires Google Cloud project setup. You need to create your own OAuth credentials, which adds friction for non-developers.
• Raw API responses. While JSON output is available, responses include full Google API payloads with metadata the agent does not need.

Best for Developers who only use Google and want a straightforward, no-frills CLI for Gmail and Calendar.

3. Google Workspace CLI (gws)

The Google Workspace CLI (gws), published at github.com/googleworkspace/cli. Despite the official-looking name, Google's own disclaimer states: "This is not an officially supported Google product." It is a developer sample with no SLA and no backward compatibility guarantees. It is written in Rust and distributed via npm.

Email Capabilities

gws provides access to the full Gmail API surface. It is dynamically built from Google's Discovery Service at runtime, which means when Google adds new API endpoints, gws picks them up automatically. You get search, read, send, draft creation, label management, filter management, and settings access. It ships with over 100 Agent Skills (SKILL.md files) and 50 curated recipes for common workflows.

Calendar Capabilities

Full Google Calendar API access: listing calendars, creating, updating, and deleting events, managing attendees, and querying by date range. Like Gmail, it covers the complete API surface. It also supports auto-pagination and --dry-run mode for previewing requests before executing them.

Authentication and Security

gws uses OAuth 2.0 via gws auth login with a Google Cloud project. A significant limitation: unverified (testing mode) Google Cloud projects are limited to roughly 25 OAuth scopes. If you need broad Workspace access, you must go through Google's verification process. Personal @gmail.com accounts have reported invalid_scope errors in certain configurations.

gws also includes a built-in MCP server mode via gws mcp, exposing Workspace APIs as structured tools for Claude Desktop, Gemini CLI, VS Code, and other OpenClaw-compatible agents.

Pros and Cons

Pros:

• Covers the entire Google Workspace API surface (not just email and calendar)
• Auto-discovers new API endpoints from Google's Discovery Service
• Built-in MCP server mode for seamless agent integration
• Dry-run mode for previewing requests
• Auto-pagination for large result sets
• Ships with 100+ skill definitions and 50 curated workflows

Cons:

• Google only. Same limitation as gogcli. No Microsoft support whatsoever.
• Not officially supported by Google. The repository explicitly states it is a developer sample.
• No access controls. No visibility filtering, no contact blocking, no action limits. The agent sees and does whatever the OAuth token allows.
• No audit trail. No request logging or data access tracking.
• OAuth scope limitations. Unverified projects are capped at roughly 25 scopes. Personal Gmail accounts have reported authentication issues.
• Requires npm/Node.js. The Rust binary is distributed via npm, which adds a dependency on the Node.js ecosystem.

Best for Developers who want broad Google Workspace coverage beyond email and calendar, and are comfortable with an unsupported developer sample.

Detailed Feature Comparison

Email Features

Calendar Features

Security and Control

Which CLI Should You Use?

Choose PortEden if...

• You use both Google and Microsoft. PortEden is the only option that covers Gmail, Outlook, Google Calendar, and Outlook Calendar with a single tool.
• Security matters. If your email contains sensitive information (client data, legal correspondence, financial details, personal conversations), you need access controls. Neither gogcli nor gws offers any.
• You want an audit trail. Knowing what your AI agent accessed and when is not optional for professional or enterprise use.
• You want to control what your agent can do. Draft-only email, read-only calendar, contact blocking, time window limits. These features do not exist in the other tools.
• You want lower token costs. Up to 80% token reduction from context hygiene translates directly to lower API costs and better response quality.
• You do not want to manage OAuth credentials. PortEden handles the provider connection through its dashboard. No Google Cloud project setup required.

Choose gogcli if...

• You only use Google (Gmail + Google Calendar)
• You are a developer comfortable with Google Cloud project setup
• You need advanced Gmail features like filter export or nested label management
• Security controls are not a priority (personal use, low-risk data)

Choose gws if...

• You need access to the full Google Workspace suite (Drive, Docs, Sheets, Slides, Chat) beyond email and calendar
• You want the broadest possible API surface coverage from a single tool
• You want the built-in MCP server mode for seamless agent integration

The Bottom Line

Full disclosure: we are the team behind PortEden. We will be upfront about that and let the comparison tables above speak for themselves.

We built PortEden because we ran into the same problem every team hits when connecting AI agents to email and calendar: the existing tools solved access but not control. After connecting our own agents to production inboxes, we realized the missing piece was not more API coverage. It was knowing what the agent actually did, and being able to set boundaries on what it could see and do.

That said, not everyone needs what we built.

gogcli (repo) is a well-maintained, no-frills Go CLI. If you only use Google, your data is low-risk, and you are comfortable managing your own OAuth credentials, it is a solid choice. The Gmail query syntax support and label management are genuinely strong.

gws (repo) covers the broadest API surface of any tool in this comparison. If you need Google Drive, Docs, Sheets, and Chat alongside email and calendar, nothing else comes close. The auto-discovery from Google's Discovery Service is a clever design that keeps it current without manual updates.

Where PortEden (repo) fits is when the data flowing through your agent matters. When your inbox has client contracts, legal threads, and personal conversations sitting next to work email. When you need to know exactly what the agent accessed last Tuesday. When you want an agent that can schedule meetings but cannot read your private calendar. Those are the problems we set out to solve, and as far as we can tell, no other OpenClaw CLI addresses them yet.

Whichever tool you choose, switching later is straightforward. All three work as OpenClaw skills. You can start with one and move to another as your needs change.