mcp-gcalendar

The server implements strong security practices by using per-request OAuth2 tokens, meaning user credentials are not stored server-side. It explicitly disables automatic token refresh from the Google API client library to ensure the client is responsible for valid access tokens. Server-side OAuth client credentials are loaded securely from environment variables. Input validation is performed using Pydantic schemas and custom validation functions (e.g., for timezones and emails). There is no use of `eval` or obvious obfuscation. Comprehensive error handling is in place, providing informative but non-revealing messages for authentication failures.