google-mcp

The server stores Google OAuth refresh tokens and the generated API keys directly in the D1 database without application-level encryption or hashing. While Cloudflare D1 provides encryption at rest, a compromise of the database (e.g., through an SQL injection vulnerability or a Cloudflare internal breach) would expose all user API keys and refresh tokens. This contradicts the README's claims of 'Hashed' for API Keys and 'Encrypted' for OAuth Tokens, which are misleading if interpreted as application-level security measures. Refresh tokens grant long-term access to a user's Google account, making their direct storage a critical vulnerability. Other security aspects like input validation (Zod), proper OAuth flow implementation, and use of environment variables for secrets are well-handled. There is no usage of 'eval' or obvious malicious patterns.