slides-mcp-server

The server uses standard Google OAuth 2.0 for authentication, requiring the user to set up a Google Cloud Project, enable APIs, and configure OAuth credentials. It explicitly requests high-privilege scopes (`drive.readonly`, `drive.file`, `presentations`) which grant full read/write access to Google Slides presentations and management of app-created files. The `setup.sh` script attempts to fetch OAuth configuration from an external API using `API_KEY`, which introduces a dependency on the security of that external service. All sensitive credentials (`.env`, `credentials.json`, `token.json`) are handled via environment variables and local files, with warnings in the README not to commit them. File-based logging (`logs.txt`) is optional but can contain sensitive information if enabled; users are warned to secure this file. There are no obvious 'eval' or malicious patterns, and Google API client output is suppressed from console.