Multiple Google accounts (Gmail, Calendar, Drive, Contacts, Tasks) in one Claude connector.
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport streamable-http · http
verified
reported
listed in the official MCP registry counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit fbf4cec · analyzer v33 · 2w ago
danger signals7
- over-broad OAuth scope gmail.modify ItsBreeze-google-multi-account-mcp-fbf4cec/src/services/google_oauth.js :29
'https://www.googleapis.com/auth/gmail.modify', - over-broad OAuth scope https://www.googleapis.com/auth/drive ItsBreeze-google-multi-account-mcp-fbf4cec/src/services/google_oauth.js :31
'https://www.googleapis.com/auth/drive', - over-broad OAuth scope gmail.modify ItsBreeze-google-multi-account-mcp-fbf4cec/test/gmail_accounts.test.js :32
tokens: { access_token:'at-'+email, refresh_token:'rt-'+email, expires_in:3600, scope:'gmail.modify' } }); - over-broad OAuth scope gmail.modify ItsBreeze-google-multi-account-mcp-fbf4cec/test/google_products.test.js :197
const GMAIL = 'https://www.googleapis.com/auth/gmail.modify'; - over-broad OAuth scope gmail.modify ItsBreeze-google-multi-account-mcp-fbf4cec/test/mcp_oauth.e2e.js :264
check('requests gmail.modify scope', scopes.includes('auth/gmail.modify')); - over-broad OAuth scope gmail.modify ItsBreeze-google-multi-account-mcp-fbf4cec/test/tenant_isolation.test.js :81
'https://www.googleapis.com/auth/gmail.modify', - over-broad OAuth scope https://www.googleapis.com/auth/drive ItsBreeze-google-multi-account-mcp-fbf4cec/test/tenant_isolation.test.js :83
'https://www.googleapis.com/auth/drive',
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 43
filesystem 1
- fs (weak) ItsBreeze-google-multi-account-mcp-fbf4cec/test/text_extract.test.js :11
const fs = require('fs');
network 4
- net ItsBreeze-google-multi-account-mcp-fbf4cec/src/services/google_http.js :50
const res = await fetch(url, { - net ItsBreeze-google-multi-account-mcp-fbf4cec/src/services/google_oauth.js :112
const res = await fetch(TOKEN_URL, { - net (weak) ItsBreeze-google-multi-account-mcp-fbf4cec/test/mcp_oauth.e2e.js :39
const prm = await fetch(`${BASE}/.well-known/oauth-protected-resource`).then(r => r.json()); - net (weak) ItsBreeze-google-multi-account-mcp-fbf4cec/test/smoke_live.js :78
const registration = await fetch(`${BASE}/mcp/oauth/register`, {
secrets 9
- secrets ItsBreeze-google-multi-account-mcp-fbf4cec/src/routes/gmail_link.js :97
process.env.JWT_SECRET, - secrets ItsBreeze-google-multi-account-mcp-fbf4cec/src/services/crypto_box.js :20
const raw = process.env.TOKEN_ENC_KEY; - secrets ItsBreeze-google-multi-account-mcp-fbf4cec/src/services/google_oauth.js :75
const clientSecret = (process.env.GOOGLE_CLIENT_SECRET || '').trim(); - secrets ItsBreeze-google-multi-account-mcp-fbf4cec/src/services/identity.js :60
const base = process.env.JWT_SECRET; - secrets ItsBreeze-google-multi-account-mcp-fbf4cec/src/services/mcp_oauth.js :43
const base = process.env.JWT_SECRET; - secrets (weak) ItsBreeze-google-multi-account-mcp-fbf4cec/test/gmail_accounts.test.js :8
process.env.TOKEN_ENC_KEY = require('crypto').randomBytes(32).toString('base64'); - secrets (weak) ItsBreeze-google-multi-account-mcp-fbf4cec/test/smoke_live.js :29
const OWNER_KEY = process.env.SMOKE_OWNER_KEY; - secrets (weak) ItsBreeze-google-multi-account-mcp-fbf4cec/test/tenant_isolation.test.js :24
process.env.JWT_SECRET = process.env.JWT_SECRET || 'test-jwt-secret'; - secrets (weak) ItsBreeze-google-multi-account-mcp-fbf4cec/test/token_separation.test.js :15
process.env.JWT_SECRET = 'dummy-test-secret-not-a-real-key-000000';
database 1
- db ItsBreeze-google-multi-account-mcp-fbf4cec/src/db/pool.js :1
const { Pool } = require('pg');
declared dependencies 5
- dotenv@^16.4.5
- express@^4.19.2
- express-rate-limit@^7.3.1
- jsonwebtoken@^9.0.2
- pg@^8.11.5
perm:untrusted 1
- untrusted (weak) ItsBreeze-google-multi-account-mcp-fbf4cec/test/mcp_oauth.e2e.js :39
const prm = await fetch(`${BASE}/.well-known/oauth-protected-resource`).then(r => r.json());