google-docs-mcp

The server requests broad Google API scopes ('https://www.googleapis.com/auth/documents' and 'https://www.googleapis.com/auth/drive') for full read/write access to all Google Docs and Drive files, which is high privilege but necessary for full functionality. The 'insertLocalImage' tool explicitly makes uploaded images publicly readable on Google Drive, a significant privacy consideration, though it is documented. Service account authentication relies on an environment variable (`SERVICE_ACCOUNT_PATH`) pointing to a sensitive key file, which if compromised, could expose credentials. Input validation using Zod schemas for tool parameters helps prevent common injection vectors. No direct 'eval' or obvious command injection vulnerabilities were found in the provided code.