google-drive-mcp

The server implements a robust OAuth proxy architecture to Google Drive API. It explicitly avoids holding tokens or state, relying on environment variables for Google OAuth credentials (`GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET`, `GOOGLE_ACCESS_TOKEN`). The `/authorize` and `/callback` endpoints securely handle redirects by encoding the client's `redirect_uri` within a base64url encoded `state` parameter, mitigating open redirect vulnerabilities. Token validation is performed using Google's `tokeninfo` endpoint and a cache, improving efficiency and preventing processing requests with expired tokens. No `eval`, code obfuscation, or obvious malicious patterns were found in the provided source. The broad `drive` scope is a user configuration choice rather than an inherent server vulnerability.