gogcli for Grok Build
gogcli is an open-source Go CLI by Peter Steinberger (steipete) that exposes Gmail and Google Calendar to Grok Build agents. Here's what it does, how to install it, whether it's safe, and how PortEden adds the access controls and audit log gogcli doesn't ship.
gogcli · google · gmail · calendar · openclaw
The capability, in one paragraph
gogcli is a solid, no-frills bridge between an Grok Build agent and Google Workspace — exactly what its README says it is. What it explicitly does not provide is the layer above the API: no per-agent access scoping, no visibility filtering, no contact or domain block-lists, no field-level redaction, no audit trail of what the agent actually saw or did, no one-click revocation. Once the agent has the OAuth token, it has the same access the token allows. For personal use on low-risk data, that's fine. For any inbox that contains client correspondence, legal threads, or regulated data, you need an access layer that sits between gogcli and the agent. That's what PortEden adds.
A few flags, predictable output
Is gogcli safe to use?
gogcli itself is open source, actively maintained, and stores credentials in your OS keychain — not in plaintext files. The 'safe' question is really about what the agent can do once gogcli is connected: gogcli does not restrict the agent's actions in any way. If you want safety guardrails (read-only mode, draft-only sending, contact blocking, audit logs), you need to put a control layer between gogcli and the agent — which is exactly what PortEden does.
gogcli vs gws (Google Workspace CLI)
gws is Google's own developer sample. It covers more of Google Workspace (Drive, Docs, Sheets, Chat in addition to email/calendar) but is explicitly 'not officially supported' and has the same fundamental gap as gogcli: no access controls, no audit trail. Pick gws if you need broad Workspace coverage; pick gogcli for tighter Gmail/Calendar focus. Pick PortEden if you need either provider plus Outlook and want enforceable rules.
gogcli + PortEden = the access layer gogcli is missing
PortEden runs as a proxy between Grok Build and Google. Configure gogcli to call PortEden's API instead of Gmail/Calendar directly, and every request is filtered through your access rules: visibility, contact blocking, action limits, time windows, account scope, and field-level redaction. Every request is logged. One click revokes the agent's access entirely.
Five minutes, three commands
Install the PortEden CLI
Grok Build skills delegate every API call to the porteden binary. Install once with Homebrew or Go — the agent runtime invokes it on your behalf.
brew install porteden/tap/porteden # orgo install github.com/porteden/cli/cmd/porteden@latest Authenticate
Browser-based login is recommended — credentials are written to your OS keyring. Token-based login is available for headless environments.
porteden auth login # headless / CIporteden auth login --token <PE_API_KEY> porteden auth status Add gogcli to your Grok Build skills directory
Grok Build loads SKILL.md files from .grok/skills/. Drop the canonical SKILL.md into that directory and Grok picks it up on next session.
mkdir -p .grok/skills/gogcli curl -fsSL https://porteden.com/skills/grok-build/gogcli/SKILL.md \ -o .grok/skills/gogcli/SKILL.md Install gogcli — Google CLI for Grok Build Agents in five minutes. No credit card required.
Free tier covers personal Gmail, Outlook, Google Calendar, and Drive accounts. Upgrade for organization-wide policy and audit log.
Related Resources
Related Skills
Install gogcli — Google CLI for Grok Build Agents Without Inheriting the Audit Tail
Browser auth, keyring-bound credentials, server-side audit log. The same data firewall behind every PortEden integration — wrapped for xAI's Grok Build runtime.
Regulated org or 200+ seats? Talk to sales →