gcal-mcp-server

The server uses Google OAuth 2.0 for authentication, storing `credentials.json` and `token.json` in a detected repository root or user config directory, which is a standard and acceptable practice. It sets up a temporary local HTTP server on `localhost:8080` for the OAuth callback, confining network exposure. The Python TUI component interacts with the `claude` CLI via `subprocess.create_subprocess_exec` to provide AI recommendations, passing event data through a temporary JSON file (`event-prompt.json`). This interaction pattern is transparent and common for CLI integrations, but relies on the security of the `claude` executable itself. No `eval` or obvious hardcoded secrets were found in the provided source code.