google-maps-mcp-server

The server's source code (server.js) is minimal, primarily importing and running the @googlemaps/code-assist-mcp package, which limits direct code-level vulnerabilities in the wrapper. Critical security aspects like handling of secrets (GCP_PROJECT_ID, GCP_SA_KEY) are delegated to GitHub Secrets, which are encrypted and not stored in the repository. The project's documentation (docs/SECURITY.md) provides excellent guidance on best practices, including principle of least privilege for IAM roles, key rotation, and monitoring. The default deployment configuration allows unauthenticated access, which is explicitly noted as a production recommendation to change by configuring IAM. No hardcoded secrets or suspicious patterns like 'eval' were found in the provided server.js file.