Google Cloud Storage vs ONLYOFFICE Apps MCP Server

Google Cloud Storage 80

Google Cloud's status dashboard with a per-product incident feed (20). In the 90 days from 8 August, Cloud Storage appears in a high-severity incident on 20 August across 27 products (about 3 hours 40 minutes of timeouts and errors), a medium incident on 8 to 9 October with elevated upload and write errors, and a medium regional incident in europe-west2 on 20 October. One major outage (10). The request-rate guide gives numbers, no ramp-up needed below 1,000 writes or 5,000 reads a second per bucket, with gradual ramping above (15). The retry strategy page lists retryable responses, idempotent operations and preconditions that make writes safe to retry, and the client libraries back off exponentially (15). SLA with monthly uptime of 99.95 per cent for multi-region Standard and 99.9 per cent regional (10). Generally available, and the MCP server since 20 April 2026 (10). 20 + 10 + 15 + 15 + 10 + 10 = 80.

ONLYOFFICE Apps MCP Server 25

Hosted lines, for the public server at mcp.onlyoffice.com. No status page found. status.onlyoffice.com served the ONLYOFFICE Apps web app on 12 October and the site links none (0). No incident history to read (5). The self-hosted server's default limit, 1,000 requests a second per client on MCP endpoints, is documented in the configuration reference at v3.3.1, but the hosted instance's limits aren't (5 of 15, partial kept). The server exposes RateLimit and Retry-After headers through CORS in code, with no documented 429 handling or retry guidance for agents found in the docs (5 of 15, partial kept). No SLA found on any plan (0). Version 3.3.1 and the hosted endpoint are generally available (10).

Google Cloud Storage 88

Release notes on 4 November 2026 (30). Entries on 30 October, 13 October, 30 September, 10 September and 3 September (20). A closed service with dated release notes and paid support; issue trackers for the client libraries are public (15). Official client libraries in many languages (15). Libraries ship with end-to-end checksums by default since 30 September (8). 30 + 20 + 15 + 15 + 8 = 88.

ONLYOFFICE Apps MCP Server 45

Version 3.3.0 on 9 October 2026 changed tool annotations and metadata, and 3.3.1 on 30 October only updated Node.js in the toolchain and image, so recency rests on 3.3.0 (30). In the 90 days from 6 August, 3.3.0 counts in full and 3.3.1 (packaging-only) and the 20 October docs-site release that synced the MCP pages (documentation-only) count half, 2 in all (0). GitHub issues and pull requests couldn't be read (the site answers 403 and only the clone is used), so responsiveness rests on a support address on the npm package and the community forum (5 of 25). The release workflow publishes io.github.ONLYOFFICE/docspace to the official MCP registry, but presence in the registry was only ever read from the registry's JSON API, which this check doesn't use, so it isn't credited (0). CI runs licence checks, builds, type checks, lint and tests on push and pull requests, and 3.3.1 updated Node.js for a published Node.js flaw (10).

Google Cloud Storage 85

IAM roles on project, bucket and managed folder, V4 signed URLs, and an IAM permission per MCP method (mcp.tools.call plus the storage permission, such as storage.objects.delete for delete_object) (30). Read-only roles such as Storage Object Viewer, grantable down to a managed folder, soft delete with a pausable hard-deletion window and retention locks, but no confirmation step on delete_bucket or delete_object (17). read_object returns stored content to the model with no untrusted-content guidance on the MCP page (5). Cloud Audit Logs with Admin Activity and Data Access entries (15). google.com security.txt is valid to 2030-04-01 with a VRP policy link, per the Secret Manager listing's 1 November check, and Google Cloud publishes security bulletins; Cloud Storage's place in the SOC 2 scope wasn't read today (18). 30 + 17 + 5 + 15 + 18 = 85.

ONLYOFFICE Apps MCP Server 46

OAuth 2.0 with PKCE S256, revocation and dynamic client registration on the hosted server, but it strips scope parameters so every connection asks for all scopes, plus API keys and personal access tokens (22). The installation guide lists a username and password in the connection URL as an option, so 10 off (12 of 30). An operator can restrict a connection to read-only tools by toolset or tool list, and tools are annotated. The server itself has no confirmation step for destructive calls; the docs describe a confirmation dialog only in ONLYOFFICE's own AI Chat client (12 of 20, partial kept). download_file_as_text and folder listings return content any room member can write, and we found no prompt-injection guidance (0 of 15). Login and action tracking on Business plans, no per-call MCP log documented (10 of 15). Valid PGP-signed security.txt (expires 15 April 2027) and a HackerOne bug bounty that researchers join through security@onlyoffice.com. The security page says ONLYOFFICE isn't ISO-certified as a standalone product, and no SOC 2 was found (12 of 20, partial kept). No advisory for docspace-mcp on osv.dev.

Google Cloud Storage 85

Closed service under the Google Cloud terms; client libraries are Apache-2.0 (18). Google's privacy policy, the Cloud Data Processing Addendum and a sub-processor list last modified 19 October 2026 apply, per the Secret Manager listing's 1 November check (22). Dated notices in release notes and a deprecated read_text MCP tool that names its replacement; Google Cloud's deprecation policy wasn't re-read today (15). Sub-processors are listed with locations, and each bucket is created in a chosen location (18). 18 + 22 + 15 + 18 = 73.

ONLYOFFICE Apps MCP Server 66

MIT-licensed source on GitHub (30). The privacy policy (revision 2 July 2025) says data is kept as long as necessary, with no retention periods, says nothing about the hosted MCP server's handling of tokens, and names Ascensio System Limited once beside Ascensio System SIA (12 of 30). No deprecation policy for the server. The changelog keeps renamed options and keys working (5 of 20). The privacy policy names AWS for file storage, with the region set by the portal admin, and Google Analytics. No full subprocessor list checked (12 of 20).

Google Cloud Storage 81

The JSON API is described by a public Google API Discovery document, storage v1 revision 20261103 (25). docs.cloud.google.com/llms.txt and /storage/llms.txt return 404 (0). The reference explains each method and the docs say when to use XML, JSON or gRPC and that gsutil is legacy (14). Typed resources with enums for storage classes and predefined ACLs (14). Samples in every client library and an error reference with HTTP codes and reasons (13). API version v1 and dated release notes, the latest on 4 November 2026 (15). 25 + 0 + 14 + 14 + 13 + 15 = 81.

ONLYOFFICE Apps MCP Server 73

Every tool has a JSON Schema input generated from zod, and most reads have an output schema (25). llms.txt at api.onlyoffice.com with an MCP Server section, re-read on 4 November 2026, and Markdown docs in the repository (10). Descriptions are one line, such as 'Delete a file.', with no when-to-use or when-not-to-use (5 of 20). Room types and filter fields are enums and count is bounded 1 to 50, but the batch copy and move IDs are typed unknown to work round a Windsurf parsing bug (10 of 15). Example prompts, client configurations and troubleshooting pages per client, no documented tool error responses (8 of 15). Keep a Changelog with semver and dated releases, newest 3.3.1 on 30 October 2026 (15).

Google Cloud Storage 85

Graded as an API with a nine-tool MCP server. The fields parameter selects partial responses, and Range reads fetch part of an object (22). maxResults and pageToken paging, prefix and delimiter filters and match globs (20). JSON errors with code, message and reason, and a documented retry table (16). Generation and metageneration preconditions make retries safe; the MCP reference gives no read-only or destructive annotations (14). Client libraries in many languages with retries on by default, but every call needs Google auth and a project (13). 22 + 20 + 16 + 14 + 13 = 85.

ONLYOFFICE Apps MCP Server 80

23 tools (15), plus toolsets, per-connection enabled and disabled tool lists and a meta-tool mode that exposes five tools and loads schemas on demand (+10, 25). Folder reads take fields, count up to 50, startIndex, filters, search and sort (20). Errors come back as tool results with the API's message, and troubleshooting pages cover connection errors, but tool error codes aren't documented (10 of 20). Every tool carries readOnlyHint, destructiveHint and, since 3.3.0, openWorldHint. No idempotency keys, and 3.3.0 marks copy, move, archive and upload as non-destructive (15 of 20). One URL with OAuth, sensible defaults such as count 30 and room type 6, but fields is required on reads and there is one package, in TypeScript (10 of 15).