google-workspace-mcp

The server employs robust input validation for metadata fields, including HTML escaping to prevent XSS and URL whitelisting (specifically enforcing `https://*.claude.ai`) to mitigate phishing and data exfiltration risks. A key security design principle is the intentional exclusion of destructive operations (like deletion or permanent removal of events/documents/emails) to prevent accidental data loss through AI interaction. Authentication tokens are stored locally using `pickle.dumps`/`loads`, with a clear justification for `pickle.loads` as it's deserializing trusted, internal data. No direct use of `eval` or other highly dangerous patterns was observed. Overall, it follows a 'safe-by-design' approach.