wave-gmail-mcp

The server employs secure OAuth2 for Google authentication, storing tokens locally. It uses established libraries for email handling (googleapis, nodemailer) and data parsing (xlsx), reducing common vulnerabilities. String interpolation for bulk emails is simple replacement, not code execution. Local web servers for OAuth callback and data upload are intended for local interaction; the upload server's `Access-Control-Allow-Origin: *` is a minor relaxation for local convenience but is acceptable for a non-public service. No 'eval' or other dynamic code execution patterns were found, and sensitive credentials are handled via environment variables.