mcp-google-slides

The server employs browser-based OAuth 2.1 with PKCE for authentication, which is a secure method for desktop applications. Tokens are stored locally with appropriate file permissions (0600). Environment variables (MCP_GSLIDES_CLIENT_ID, MCP_GSLIDES_CLIENT_SECRET) are used for OAuth credentials, which is best practice. However, the `src/auth/config.ts` file contains placeholder client ID/secret values directly in the code, which could be a theoretical risk if they were ever active and not overridden by environment variables. The application relies on Google's API to fetch images from provided URLs, shifting the security responsibility for URL validation and content fetching to Google's infrastructure. No direct use of `eval()` or arbitrary command execution from user input was found.