MCP server that creates Google Docs with native Tabs (Oct 2024 sidebar feature) — for Claude Desktop and Claude Code
B low
- capability exposure inferred + 35
- trust mitigators mixed − 3
inferred mixed
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
graded 1m ago · see ecosystem CVEs →
- A · 0 → B · 32
Inferred surface — each links to servers holding it:
No known CVEs for this server.
No tool-safety findings — heuristic detectors run on the compute-risk cadence; a finding appears when a tool trips a rule.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 46e0fa4 · analyzer v28 · 1d ago
skills & prompt files 1
- agent-rules Sundeepg98-google-docs-mcp-46e0fa4/CLAUDE.md
danger signals21
- over-broad OAuth scope https://www.googleapis.com/auth/documents
expected for this server's purpose
Sundeepg98-google-docs-mcp-46e0fa4/src/appscriptly/auth.py :55
"https://www.googleapis.com/auth/documents", - over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets
expected for this server's purpose
Sundeepg98-google-docs-mcp-46e0fa4/src/appscriptly/auth.py :82
"https://www.googleapis.com/auth/spreadsheets", - over-broad OAuth scope https://mail.google.com/
expected for this server's purpose
Sundeepg98-google-docs-mcp-46e0fa4/src/appscriptly/services/apps_script/api.py :145
"https://mail.google.com/", - over-broad OAuth scope gmail.modify Sundeepg98-google-docs-mcp-46e0fa4/src/appscriptly/services/apps_script/api.py :147
"https://www.googleapis.com/auth/gmail.modify", - over-broad OAuth scope https://www.googleapis.com/auth/drive
expected for this server's purpose
Sundeepg98-google-docs-mcp-46e0fa4/src/appscriptly/services/apps_script/api.py :154
"https://www.googleapis.com/auth/drive", - over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets
expected for this server's purpose
Sundeepg98-google-docs-mcp-46e0fa4/tests/unit/services/apps_script/test_lifecycle_tools.py :286
manifest={"oauth_scopes": ["https://www.googleapis.com/auth/spreadsheets"]}, - over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets
expected for this server's purpose
Sundeepg98-google-docs-mcp-46e0fa4/tests/unit/services/apps_script/test_manifest_builder.py :214
scope = "https://www.googleapis.com/auth/spreadsheets" - over-broad OAuth scope https://mail.google.com/
expected for this server's purpose
Sundeepg98-google-docs-mcp-46e0fa4/tests/unit/services/apps_script/test_manifest_builder.py :276
"https://mail.google.com/", - over-broad OAuth scope gmail.modify Sundeepg98-google-docs-mcp-46e0fa4/tests/unit/services/apps_script/test_manifest_builder.py :278
"https://www.googleapis.com/auth/gmail.modify", - over-broad OAuth scope https://www.googleapis.com/auth/drive
expected for this server's purpose
Sundeepg98-google-docs-mcp-46e0fa4/tests/unit/services/apps_script/test_manifest_builder.py :281
"https://www.googleapis.com/auth/drive", - over-broad OAuth scope https://www.googleapis.com/auth/documents
expected for this server's purpose
Sundeepg98-google-docs-mcp-46e0fa4/tests/unit/services/apps_script/test_manifest_builder.py :322
"https://www.googleapis.com/auth/documents", - over-broad OAuth scope https://www.googleapis.com/auth/drive
expected for this server's purpose
Sundeepg98-google-docs-mcp-46e0fa4/tests/unit/test_base_tier_scopes.py :21
"https://www.googleapis.com/auth/drive", - over-broad OAuth scope https://mail.google.com/
expected for this server's purpose
Sundeepg98-google-docs-mcp-46e0fa4/tests/unit/test_base_tier_scopes.py :25
"https://mail.google.com/", - over-broad OAuth scope gmail.modify Sundeepg98-google-docs-mcp-46e0fa4/tests/unit/test_base_tier_scopes.py :27
"https://www.googleapis.com/auth/gmail.modify", - over-broad OAuth scope https://www.googleapis.com/auth/documents
expected for this server's purpose
Sundeepg98-google-docs-mcp-46e0fa4/tests/unit/test_base_tier_scopes.py :48
"https://www.googleapis.com/auth/documents", - over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets
expected for this server's purpose
Sundeepg98-google-docs-mcp-46e0fa4/tests/unit/test_base_tier_scopes.py :50
"https://www.googleapis.com/auth/spreadsheets", - over-broad OAuth scope https://www.googleapis.com/auth/documents
expected for this server's purpose
Sundeepg98-google-docs-mcp-46e0fa4/tests/unit/test_credentials.py :77
"https://www.googleapis.com/auth/documents", - over-broad OAuth scope https://www.googleapis.com/auth/documents
expected for this server's purpose
Sundeepg98-google-docs-mcp-46e0fa4/tests/unit/test_scope_union_single_source.py :60
"https://www.googleapis.com/auth/documents", - over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets
expected for this server's purpose
Sundeepg98-google-docs-mcp-46e0fa4/tests/unit/test_scope_union_single_source.py :62
"https://www.googleapis.com/auth/spreadsheets", - over-broad OAuth scope https://www.googleapis.com/auth/documents
expected for this server's purpose
Sundeepg98-google-docs-mcp-46e0fa4/tests/unit/test_setup_apps_script_for_user.py :288
"https://www.googleapis.com/auth/documents", - over-broad OAuth scope https://mail.google.com/
expected for this server's purpose
Sundeepg98-google-docs-mcp-46e0fa4/tests/unit/test_user_store.py :286
assert _valid_gas_url("https://mail.google.com/macros/s/X/exec") is False
[](https://mcpobservatory.com/servers/github:Sundeepg98/google-docs-mcp/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of Sundeepg98.