mcp-servers

The server uses hardcoded OAuth client ID and client secret in `src/credentials.ts` for Google API access. While the README suggests this is for application identification, hardcoding client secrets in distributed source code is generally discouraged as it can be extracted and potentially misused, even for client-side OAuth flows. However, for local/personal use, the risk is mitigated by user consent. User tokens are stored securely in `~/Claude/.security/gdrive-token.json` with restricted permissions (0o600). Authentication uses a local callback server on `localhost:3035`, which is a standard and relatively secure practice for OAuth flows (PKCE). No 'eval' or obvious malicious patterns were found.