google-mcp-server

The server manages sensitive OAuth2 credentials (credentials.json, token.json) which are critical for Google API access. While the code itself avoids hardcoded secrets and uses standard secure practices for OAuth, the security score assumes the user follows documented best practices for securing these files (e.g., .gitignore, environment variables/secrets for deployment). The server requires filesystem access to these credential files and for file uploads/downloads, which is inherent to its functionality. No 'eval' or other dynamic code execution is present, and all network communication relies on secure HTTPS via Google APIs.