google-docs-mcp-server

The server uses Google's OAuth2 for authentication, storing tokens and reading client credentials from a local `credentials.json` file. Input validation is applied to document IDs, indices, text content, and numerical ranges, with search queries explicitly sanitized to prevent injection vulnerabilities. The implementation of `find_and_replace` leverages the Google Docs API's `replaceAllText` for secure mass operations. No direct `eval` or blatant dynamic code execution points were identified. The OAuth callback server runs locally, minimizing network exposure. The primary security consideration is ensuring `credentials.json` is protected and not committed to source control.