google-cal-mcp

The server functions as an OAuth proxy, processing sensitive Google OAuth client credentials (client ID/secret) and access tokens in transit. It explicitly states it holds no long-term tokens or state, which is a strong security practice. Access tokens are used as keys in an in-memory cache for validation, but are not persisted. Environment variables are correctly used for credentials. The OAuth flow implementation (wrapping client redirect URIs in state) appears robust against common redirection attacks. No 'eval' or obvious obfuscation detected. The primary security considerations involve proper management of Google OAuth credentials by the user.