stateful-auth-for-mcp-servers

The server has a critical prompt injection vulnerability as explicitly stated in the README. Email content, fetched by the `read_emails` tool, is passed directly to the AI model without sanitization. This allows malicious instructions embedded in emails to manipulate the AI into performing unintended calendar actions (e.g., creating, updating, or deleting events). While a stateful authorization layer was added to prevent deletion of *external* calendar events, it does not mitigate the risk of: 1) creating new malicious events, 2) updating existing events (even external ones), or 3) deleting MCP-created events based on injected prompts. The AI model retains full `calendar` scope, allowing broad manipulation. The README advises against production use.