gmail-mcp-server

The server utilizes direct file system operations for attachment handling (reading local files for sending, writing downloaded attachments to specified paths). While tool inputs are validated via Zod schemas, a compromised AI could theoretically direct file operations to sensitive areas or write malicious content. OAuth tokens are stored in plaintext with restricted file permissions (~/.gmail-mcp/credentials.json, chmod 600). However, the project provides comprehensive security documentation (SECURITY.md) detailing these risks, recommending best practices for users and developers (e.g., input validation for file paths, never committing credentials), and outlining a clear vulnerability reporting process. The local web server for OAuth runs only on localhost during authentication and shuts down immediately.