google-contacts-mcp-server

The server employs robust security practices including OAuth 2.1 with PKCE, storing sensitive Google API credentials in AWS SSM Parameter Store (which can be configured as SecureString for enhanced protection), and utilizing DynamoDB with AWS-managed encryption and TTL for session, client, and authorization code data. It explicitly states a privacy-first design where no contact data is stored on the server. CORS is correctly configured. A minor note is that the initial CDK deployment places placeholder Google credentials as a `StringParameter`; users must manually update this to a `SecureString` in SSM to fully leverage the client's `WithDecryption` capability as outlined in the setup guide. Otherwise, it demonstrates strong security awareness.