Gmail plugin: create_filter / list_filters fail with 403 — OAuth missing gmail.settings.basic

Summary

The Gmail connector exposes create_filter, list_filters (and related filter tools), but calling them fails with 403 after trying upscoping. Google Account → Linked Apps shows the Cursor/Grok app only has “See (but not change) your email settings”, so filter create/list cannot work. Re-auth does not help: Google never requests a settings-write scope during consent.

Environment

• Product: Grok Bot / Cursor Gmail MCP connector
• Plugin id (from install): 45893410
• MCP server id: user-Gmail--shark5060-gmail-com
• Account: personal Gmail (example: shark5060@gmail.com)
• Other Gmail tools work: list_labels, search_threads, label apply, etc.

Steps to reproduce

1. Install/connect the Gmail plugin and complete OAuth.
2. Confirm mail tools work (e.g. list_labels, search_threads).
3. Call list_filters or create_filter (e.g. criteria from: youtube.com, action add a user label + remove INBOX).
4. Optionally force re-auth (AuthenticateMcpServer with force_reauth) and approve all consent screens again.
5. Retry create_filter / list_filters.

Expected

• Filter tools succeed, or
• OAuth consent requests https://www.googleapis.com/auth/gmail.settings.basic so Linked Apps shows edit/create/change settings & filters, then tools work after re-consent.

Actual

• Tool call error (approx.): HTTP MCP tool execution failed: … Server returned 403 after trying upscoping
• Google Linked Apps for the Cursor app under Gmail includes wording like:
  • See (but not change) your email settings
  • View your settings (e.g., filters and labels)
• There is no Linked Apps toggle to grant settings write; only delete connection.
• Label create/update and message labeling still work (consistent with gmail.modify, not settings write).

Why this matters

Without users.settings.filters.*, agents cannot install durable server-side routing (skip Inbox + apply label) and must re-label mail after arrival. The tools being present implies filter management is intended.

API / scope note

Per Gmail API users.settings.filters.create, create requires:

https://www.googleapis.com/auth/gmail.settings.basic

(Gmail scopes: that scope is “See, edit, create, or change your email settings and filters in Gmail.”)

gmail.modify covers labels/messages but not filter settings write — matching the Linked Apps “see but not change” text.

Suggested fix

1. Add gmail.settings.basic to the Gmail plugin OAuth client / consent scope list.
2. Document that existing users must re-consent after the scope is added.
3. Ensure upscoping actually requests that scope (current “403 after trying upscoping” suggests upscope does not obtain write settings).

Workaround

Create filters manually (or via browser automation) in Gmail Settings → Filters and Blocked Addresses until the connector requests the correct scope.

Related (third-party, not Cursor)

Other Gmail MCP projects have discussed the same scope requirement, e.g. needing gmail.settings.basic for filter tools — same underlying Google API constraint.

Locate the Gmail plugin's OAuth client and consent-scope configuration, then trace the upscoping entry point used by create_filter and list_filters. Confirm that the settings scope is requested and that existing-user re-consent is documented; done means filter tools no longer fail with the reported 403 after authorization.