github JavaScript analyzed b931890

anaborne/gdrive-write-mcp

MCP server giving AI assistants real write access to Google Drive: in-place edits that preserve file IDs, revision history, comments, and sharing.

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 9 tools

transport stdio · http counts 9 tools · 0 res · 0 prompts permission surface via code analysis

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit b931890 · analyzer v33 · 4d ago

over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose anaborne-gdrive-write-mcp-b931890/scripts/authorize.mjs :25 const DRIVE_SCOPE = 'https://www.googleapis.com/auth/drive';
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose anaborne-gdrive-write-mcp-b931890/src/auth.ts :14 export const DRIVE_SCOPE = 'https://www.googleapis.com/auth/drive';
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose anaborne-gdrive-write-mcp-b931890/src/errors.ts :92 'https://www.googleapis.com/auth/drive scope rather than drive.file or a read-only scope.'
credential in logs credential in log anaborne-gdrive-write-mcp-b931890/scripts/authorize.mjs :173 console.log(` GOOGLE_REFRESH_TOKEN=${tokens.refresh_token}\n`);

code evidence vHEAD · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 14

fs (weak) anaborne-gdrive-write-mcp-b931890/scripts/authorize.mjs :14 import { readFileSync, existsSync } from 'node:fs';
fs (weak) anaborne-gdrive-write-mcp-b931890/scripts/verify.mjs :13 import { readFileSync, existsSync } from 'node:fs';

shell (weak) anaborne-gdrive-write-mcp-b931890/scripts/verify.mjs :12 import { spawn } from 'node:child_process';

net (weak) anaborne-gdrive-write-mcp-b931890/scripts/authorize.mjs :13 import { createServer } from 'node:http';

secrets (weak) anaborne-gdrive-write-mcp-b931890/scripts/authorize.mjs :73 const clientSecret = process.env.GOOGLE_CLIENT_SECRET?.trim();
secrets (weak) anaborne-gdrive-write-mcp-b931890/scripts/verify.mjs :104 GOOGLE_CLIENT_SECRET: process.env.GOOGLE_CLIENT_SECRET,

prepublishOnly anaborne-gdrive-write-mcp-b931890/package.json :43 npm run build