gmail-mcp-server

The most critical security/functional flaw is in `src/send/sendEmail.ts`, where the `userId` for sending an email is hardcoded to `"shrey.khanna.au@gmail.com"` instead of using the authenticated user's ID (`"me"`). This means all emails sent via the 'send_email' tool will originate from this hardcoded address, regardless of who authenticates the Gmail API access. This is a significant impersonation risk or a functional bug that prevents multi-user support. Additionally, `src/read/readGmail.ts` uses `process.exit(1)` upon failure, which can abruptly terminate the server. Credentials are read from local files (`credentials.json`, `token.json`) at fixed paths derived from `process.cwd()`, which requires careful handling of these files to prevent unauthorized access. No `eval` or obfuscation was found.