google-tasks-mcp

The server demonstrates strong security practices. Sensitive data, specifically Google access and refresh tokens, are encrypted at rest using AES-256-GCM with a PBKDF2-derived key, requiring a secure `ENCRYPTION_SECRET`. Logs are meticulously designed for privacy, automatically redacting tokens, client secrets, and user IDs. It implements OAuth 2.0 with PKCE for secure authentication. Network security includes robust CORS configuration, rate limiting based on IP and path, and the application of various HTTP security headers (e.g., Strict-Transport-Security, Content-Security-Policy). There are no `eval` statements or obvious malicious patterns in the provided source code. Session management includes timeouts and cleanup. Overall, it's very well-engineered for privacy and security.