Secure Granola access for AI agents
AI meeting notetaker — capture, transcribe, and search meeting notes via the Granola MCP server
Through Granola, agents can search meeting notes, pull transcripts, and answer natural-language questions across your meetings — every call runs through your policies and is logged for audit.
Server URL: https://mcp.granola.ai/mcp
Setup
- Navigate to Resources and click Add Resource
- Select Granola from the catalog
- Choose Per-org dynamic registration — the gateway registers the OAuth client automatically and installs the resource immediately, with all tools and scopes pre-configured
- An Admin setup required dialog appears; its Setup guide button links back to Dynamic client registration below, since MCP has to be enabled on the Granola side
Each user connects their own Granola account via OAuth when they first use a Granola tool. Navigate to Connections to manage linked accounts.
Credential modes
Granola uses Dynamic Client Registration (RFC 7591) only — the gateway registers a per-organization OAuth client with Granola automatically on first install. SecureAuth-app and Bring-your-own-app modes are not available for this resource.
See Credential modes for how this compares to other catalog resources.
Dynamic client registration
The gateway registers its OAuth client with Granola automatically — no client ID or secret to configure. The prerequisites are all on the Granola side.
Plan. MCP works on any Granola plan, but pulling raw transcripts and meetings older than 30 days requires a paid plan (Business or above).
Enable MCP. On centrally managed workspaces MCP is off by default; a workspace admin must turn it on before anyone can connect — in Granola's workspace settings. The toggle is admin-only; members see "Workspace admin access required" until it's on.
Which workspace connects. MCP uses the user's active Granola workspace. To connect a different one, switch the active workspace in the Granola desktop app (top-left) before connecting — there's no picker during sign-in.
Once MCP is enabled, each user connects their own Granola account via a browser OAuth flow the first time they use a Granola tool.
Available tools
| Tool | Description |
|---|---|
get_account_info | Get the email and active workspace for the connected Granola account |
list_meeting_folders | List the user's meeting folders with ID, title, description, and note count |
list_meetings | List meeting notes within a time range (this week, last week, or last 30 days) |
get_meetings | Get private notes, AI summary, attendees, and metadata for one or more meeting IDs |
get_meeting_transcript | Get the full verbatim transcript for a specific meeting |
query_granola_meetings | Ask natural-language questions across meeting notes; returns cited responses |
Required scopes
offline_access— maintain access when the user is offline
Policy examples
Rules are evaluated first-match-wins from the top of the list, and every org starts with a seeded Allow all rule sitting at the bottom — so a recipe made only of allow rules restricts nothing. Deny-based examples like these work by adding denies above it.
- Read-only access: nothing to do — every Granola tool is read-only, so the whole surface already is
- Block transcript access while allowing summaries and search: deny
get_meeting_transcript - Restrict to natural-language search only: deny
list_meeting_folders,list_meetings,get_meetings, andget_meeting_transcript, leavingquery_granola_meetingsandget_account_info
Next steps
- Create a policy — start from the transcript-blocking pattern in Policy examples above.
- Credential modes — see how DCR compares to the other modes catalog resources use.