gmail-mcp

The server follows standard practices for Gmail API integration and OAuth2 authentication, relying on `client_secret.json` and `token.json` files for credentials, whose paths can be customized via environment variables. No 'eval' or apparent malicious patterns were found. Network communication is primarily with Google's APIs. Error handling in utility functions (`decode_base64_text`, `parse_date`, `decode_rfc2047_filename`) uses broad `except Exception` clauses and `errors='ignore'` for decoding, which prioritizes robustness over strict error propagation and could silently mask malformed data issues, though it's not a direct security vulnerability. Sensitive tokens are stored locally in `token.json` after the initial OAuth flow.