MCP Observatory
2m ago Tracked 26,758 Last 2m ago 24h 1,572
github TypeScript analyzed 1bd5cd5

khill1269/servalsheets

github

Production-grade Google Sheets MCP server — 25 tools, 410 actions, TypeScript strict mode

maintainer
khill1269
license
MIT
first seen
2026-06-24
last seen
2026-07-08
releases · 30d
0
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged committed secret, dynamic code execution ×2 in khill1269/servalsheets
  2. HIGH code analysis flagged committed secret ×2, dynamic code execution ×2 in khill1269/servalsheets
capabilities 0 tools
transport stdio · streamable-http · http · sse counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 1bd5cd5 · analyzer v28 · 3d ago

skills & prompt files 8

danger signals88

code evidence vv2.0.0 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 1767

filesystem 29

  • fs khill1269-servalsheets-1bd5cd5/.serval/generate-state.mjs :11 import { readFileSync, writeFileSync, existsSync, readdirSync } from 'node:fs';
  • fs khill1269-servalsheets-1bd5cd5/src/cli/auth-setup.ts :24 import { promises as fsPromises } from 'fs';
  • fs khill1269-servalsheets-1bd5cd5/src/config/runtime-config-store.ts :19 import * as fs from 'fs';
  • fs khill1269-servalsheets-1bd5cd5/src/connectors/connector-manager.ts :12 import * as fs from 'fs';
  • fs khill1269-servalsheets-1bd5cd5/src/http-server/openapi-docs-routes.ts :1 import { existsSync, readFileSync } from 'fs';
  • fs khill1269-servalsheets-1bd5cd5/src/resources/guides.ts :14 import { readFile } from 'node:fs/promises';
  • fs khill1269-servalsheets-1bd5cd5/src/resources/knowledge-deferred.ts :21 import { readFile } from 'fs/promises';
  • fs khill1269-servalsheets-1bd5cd5/src/security/tool-hash-registry.ts :17 import { readFileSync, existsSync } from 'fs';
  • fs khill1269-servalsheets-1bd5cd5/src/server.ts :13 import { readFileSync } from 'fs';
  • fs khill1269-servalsheets-1bd5cd5/src/services/agent/checkpoints.ts :9 import { unlink } from 'fs/promises';
  • fs khill1269-servalsheets-1bd5cd5/src/services/agent/plan-store.ts :8 import { writeFile, readFile, mkdir, unlink } from 'fs/promises';
  • fs khill1269-servalsheets-1bd5cd5/src/services/audit-logger.ts :137 import { existsSync, mkdirSync, promises as fs } from 'fs';
  • fs khill1269-servalsheets-1bd5cd5/src/services/idempotency-manager.ts :16 import fs from 'node:fs';
  • fs khill1269-servalsheets-1bd5cd5/src/services/request-recorder.ts :10 import { existsSync, mkdirSync, chmodSync } from 'fs';
  • fs khill1269-servalsheets-1bd5cd5/src/services/scheduled-intelligence.ts :472 await fs.mkdir(dir, { recursive: true });
  • fs khill1269-servalsheets-1bd5cd5/src/services/scheduler.ts :11 import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'fs';
  • fs khill1269-servalsheets-1bd5cd5/src/services/schema-cache.ts :18 import fs from 'node:fs/promises';
  • fs khill1269-servalsheets-1bd5cd5/src/services/template-store.ts :24 import * as fs from 'node:fs/promises';
  • fs khill1269-servalsheets-1bd5cd5/src/services/token-store.ts :19 import { promises as fs } from 'fs';
  • fs khill1269-servalsheets-1bd5cd5/src/services/transaction-wal.ts :17 import { promises as fsPromises, existsSync, mkdirSync } from 'fs';
  • fs khill1269-servalsheets-1bd5cd5/src/services/user-profile-manager.ts :9 import * as fs from 'fs/promises';
  • fs khill1269-servalsheets-1bd5cd5/src/services/workspace-events.ts :14 import { existsSync, readFileSync } from 'node:fs';
  • fs khill1269-servalsheets-1bd5cd5/src/startup/preflight-validation.ts :16 import { existsSync, accessSync, constants as fsConstants } from 'fs';
  • fs khill1269-servalsheets-1bd5cd5/src/startup/restart-policy.ts :19 import { promises as fs } from 'fs';
  • fs khill1269-servalsheets-1bd5cd5/src/ui/tracing.ts :7 import { readFileSync } from 'node:fs';
  • fs khill1269-servalsheets-1bd5cd5/src/utils/ast-schema-parser.ts :22 import * as fs from 'fs';
  • fs khill1269-servalsheets-1bd5cd5/src/utils/checkpoint.ts :11 import fs from 'fs/promises';
  • fs khill1269-servalsheets-1bd5cd5/src/utils/google-api-options.ts :1 import { writeFileSync, mkdirSync } from 'fs';
  • fs khill1269-servalsheets-1bd5cd5/src/utils/runtime-paths.ts :1 import { existsSync } from 'node:fs';

shell / exec 4

  • shell khill1269-servalsheets-1bd5cd5/.serval/generate-state.mjs :12 import { execSync } from 'node:child_process';
  • shell khill1269-servalsheets-1bd5cd5/src/cli/auth-setup.ts :271 // Use execFile (not exec) to prevent command injection via URL
  • shell khill1269-servalsheets-1bd5cd5/src/services/keychain-store.ts :7 * @dependencies keytar (optional), security CLI (macOS), node:child_process
  • shell khill1269-servalsheets-1bd5cd5/src/services/python-worker.ts :133 # Blocking compile() breaks basic Python constructs. Only block exec() and open()

network 42

  • net khill1269-servalsheets-1bd5cd5/src/admin/dashboard.js :37 const response = await fetch(`${API_BASE}/admin/api/server-info`);
  • net khill1269-servalsheets-1bd5cd5/src/auth/oauth-provider.ts :1379 await fetch(
  • net khill1269-servalsheets-1bd5cd5/src/cli/auth-setup.ts :26 import * as http from 'http';
  • net khill1269-servalsheets-1bd5cd5/src/cli/schema-manager.ts :49 await this.fetch(options);
  • net khill1269-servalsheets-1bd5cd5/src/config/secrets.ts :67 * Uses Node.js built-in fetch (no external deps). TTL-aware in-memory cache
  • net khill1269-servalsheets-1bd5cd5/src/connectors/alpha-vantage.ts :61 const resp = await fetch(
  • net khill1269-servalsheets-1bd5cd5/src/connectors/docs-connector.ts :57 const resp = await fetch('https://www.googleapis.com/drive/v3/about?fields=user', {
  • net khill1269-servalsheets-1bd5cd5/src/connectors/drive-connector.ts :56 const resp = await fetch(
  • net khill1269-servalsheets-1bd5cd5/src/connectors/finnhub.ts :63 const resp = await fetch(`${BASE_URL}/stock/symbol?exchange=US&token=${this.apiKey}`, {
  • net khill1269-servalsheets-1bd5cd5/src/connectors/fmp.ts :58 const resp = await fetch(`${BASE_URL}/stock/list?apikey=${this.apiKey}`);
  • net khill1269-servalsheets-1bd5cd5/src/connectors/fred.ts :58 const resp = await fetch(
  • net khill1269-servalsheets-1bd5cd5/src/connectors/gmail-connector.ts :56 const resp = await fetch('https://www.googleapis.com/gmail/v1/users/me/profile', {
  • net khill1269-servalsheets-1bd5cd5/src/connectors/openfigi-connector.ts :66 const resp = await fetch(`${BASE_URL}/search?query=Apple`, {
  • net khill1269-servalsheets-1bd5cd5/src/connectors/polygon.ts :58 const resp = await fetch(`${BASE_URL}/v3/reference/tickers?limit=1&apiKey=${this.apiKey}`);
  • net khill1269-servalsheets-1bd5cd5/src/connectors/rest-generic.ts :158 const resp = await fetch(url.toString(), {
  • net khill1269-servalsheets-1bd5cd5/src/connectors/sec-edgar-connector.ts :60 const resp = await fetch(
  • net khill1269-servalsheets-1bd5cd5/src/connectors/world-bank-connector.ts :51 const resp = await fetch(`${BASE_URL}/country?format=json&per_page=1`);
  • net khill1269-servalsheets-1bd5cd5/src/handlers/advanced-actions/chips.ts :217 // ISSUE-019: Require range to prevent unbounded full-grid fetch (chipRuns requires includeGridData)
  • net khill1269-servalsheets-1bd5cd5/src/handlers/appsscript-actions/serval-installer.ts :94 var response = UrlFetchApp.fetch(CALLBACK_URL, {
  • net khill1269-servalsheets-1bd5cd5/src/handlers/appsscript.ts :553 const response = await fetch(url, fetchOptions);
  • net khill1269-servalsheets-1bd5cd5/src/handlers/bigquery-actions/scheduled-queries.ts :60 const response = await fetch(url, {
  • net khill1269-servalsheets-1bd5cd5/src/handlers/dependencies-actions/scenario.ts :244 // Fallback: API-based value fetch (original behavior)
  • net khill1269-servalsheets-1bd5cd5/src/observability/otel-export.ts :227 const response = await fetch(`${this.config.endpoint}/v1/traces`, {
  • net khill1269-servalsheets-1bd5cd5/src/observability/tracing.ts :202 const response = await fetch(`${OTLP_ENDPOINT}/v1/traces`, {
  • net khill1269-servalsheets-1bd5cd5/src/security/oidc-provider.ts :237 const res = await fetch(this.config.discoveryUrl);
  • net khill1269-servalsheets-1bd5cd5/src/security/resource-indicators.ts :193 const response = await fetch(
  • net khill1269-servalsheets-1bd5cd5/src/server/metrics-server.ts :8 import { createServer, type Server, type IncomingMessage, type ServerResponse } from 'node:http';
  • net khill1269-servalsheets-1bd5cd5/src/services/audit-logger.ts :598 const response = await fetch(config.endpoint, {
  • net khill1269-servalsheets-1bd5cd5/src/services/discovery-client.ts :218 const response = await fetch(baseUrl, {
  • net khill1269-servalsheets-1bd5cd5/src/services/formula-callback.ts :186 const response = await fetch('https://api.anthropic.com/v1/messages', {
  • net khill1269-servalsheets-1bd5cd5/src/services/google-api.ts :44 import { Agent as HttpAgent } from 'http';
  • net khill1269-servalsheets-1bd5cd5/src/services/llm-fallback.ts :131 const response = await fetch(`${config.baseUrl}/v1/messages`, {
  • net khill1269-servalsheets-1bd5cd5/src/services/sampling-health-probe.ts :142 const response = await fetch(url, {
  • net khill1269-servalsheets-1bd5cd5/src/services/scheduled-intelligence.ts :432 const response = await fetch(webhookUrl, {
  • net khill1269-servalsheets-1bd5cd5/src/services/semantic-search.ts :79 const response = await fetch(`${GEMINI_API_URL}?key=${encodeURIComponent(apiKey)}`, {
  • net khill1269-servalsheets-1bd5cd5/src/services/webhook-worker.ts :205 fetch(job.webhookUrl, {
  • net khill1269-servalsheets-1bd5cd5/src/services/workspace-events.ts :386 const response = await fetch(`${WORKSPACE_EVENTS_BASE_URL}${path}`, {
  • net khill1269-servalsheets-1bd5cd5/src/startup/preflight-validation.ts :20 import { get as httpsGet } from 'https';
  • net khill1269-servalsheets-1bd5cd5/src/ui/tracing-dashboard/src/api.ts :11 const response = await fetch(`${BASE_URL}/recent?limit=${limit}`);
  • net khill1269-servalsheets-1bd5cd5/src/utils/api-key-server.ts :9 import http from 'http';
  • net khill1269-servalsheets-1bd5cd5/src/utils/oauth-callback-server.ts :22 import http from 'http';
  • net khill1269-servalsheets-1bd5cd5/tools/google-docs-server/src/index.ts :20 import axios from 'axios';

secrets 22

  • secrets khill1269-servalsheets-1bd5cd5/src/auth/oauth-provider.ts :1678 const expectedToken = process.env['OAUTH_DCR_CONSENT_TOKEN'];
  • secrets khill1269-servalsheets-1bd5cd5/src/cli/auth-setup.ts :524 process.env['ENCRYPTION_KEY'] ?? existingKeyMatch?.[1] ?? randomBytes(32).toString('hex');
  • secrets khill1269-servalsheets-1bd5cd5/src/cli/replay.ts :292 const accessToken = process.env['GOOGLE_ACCESS_TOKEN'];
  • secrets khill1269-servalsheets-1bd5cd5/src/config/embedded-oauth.ts :35 clientSecret: process.env['OAUTH_CLIENT_SECRET'] ?? 'REPLACE_WITH_REAL_OAUTH_CLIENT_SECRET',
  • secrets khill1269-servalsheets-1bd5cd5/src/config/runtime-config-store.ts :62 return process.env['CONNECTOR_ENCRYPTION_KEY'] ?? process.env['ENCRYPTION_KEY'];
  • secrets khill1269-servalsheets-1bd5cd5/src/config/secrets.ts :349 const vaultToken = process.env['VAULT_TOKEN'];
  • secrets khill1269-servalsheets-1bd5cd5/src/connectors/connector-manager.ts :84 const password = process.env['CONNECTOR_ENCRYPTION_KEY'];
  • secrets khill1269-servalsheets-1bd5cd5/src/handlers/analyze-actions/semantic-search.ts :28 const apiKey = process.env['GOOGLE_API_KEY'];
  • secrets khill1269-servalsheets-1bd5cd5/src/handlers/auth-actions/feature-setup.ts :384 process.env['ANTHROPIC_API_KEY'] = apiKey;
  • secrets khill1269-servalsheets-1bd5cd5/src/handlers/auth-actions/status.ts :103 const googleApiKeyConfigured = Boolean(process.env['GOOGLE_API_KEY']);
  • secrets khill1269-servalsheets-1bd5cd5/src/handlers/auth.ts :71 this.tokenStoreKey = options.tokenStoreKey ?? process.env['ENCRYPTION_KEY'];
  • secrets khill1269-servalsheets-1bd5cd5/src/http-server-entry.ts :31 process.env['OAUTH_CLIENT_SECRET'] !== undefined
  • secrets khill1269-servalsheets-1bd5cd5/src/http-server.ts :176 process.env['OAUTH_CLIENT_SECRET'] !== undefined
  • secrets khill1269-servalsheets-1bd5cd5/src/server/health.ts :165 process.env['GOOGLE_SERVICE_ACCOUNT_KEY'] ??
  • secrets khill1269-servalsheets-1bd5cd5/src/services/audit-logger.ts :202 const encKeyPassword = options?.encryptionKey ?? process.env['AUDIT_LOG_ENCRYPTION_KEY'];
  • secrets khill1269-servalsheets-1bd5cd5/src/services/formula-callback.ts :175 const apiKey = claudeApiKey ?? process.env['ANTHROPIC_API_KEY'];
  • secrets khill1269-servalsheets-1bd5cd5/src/services/llm-fallback.ts :75 process.env['LLM_API_KEY'] ||
  • secrets khill1269-servalsheets-1bd5cd5/src/services/user-profile-manager.ts :20 const ENCRYPTION_KEY_HEX = process.env['PROFILE_ENCRYPTION_KEY'];
  • secrets khill1269-servalsheets-1bd5cd5/src/startup/lifecycle.ts :57 const hasEncryptionKey = Boolean(process.env['ENCRYPTION_KEY']);
  • secrets khill1269-servalsheets-1bd5cd5/src/startup/preflight-validation.ts :184 const encryptionKey = process.env['ENCRYPTION_KEY'];
  • secrets khill1269-servalsheets-1bd5cd5/src/utils/google-api-options.ts :20 const inlineKey = process.env['GOOGLE_SERVICE_ACCOUNT_KEY'];
  • secrets khill1269-servalsheets-1bd5cd5/src/utils/oauth-config.ts :25 const envClientSecret = process.env['GOOGLE_CLIENT_SECRET'] ?? process.env['OAUTH_CLIENT_SECRET'];

database 6

  • db khill1269-servalsheets-1bd5cd5/src/core/task-store.ts :11 import type { RedisClientType } from 'redis';
  • db khill1269-servalsheets-1bd5cd5/src/mcp/event-store.ts :15 import type { RedisClientType } from 'redis';
  • db khill1269-servalsheets-1bd5cd5/src/services/quota-manager.ts :28 import { type Redis } from 'ioredis';
  • db khill1269-servalsheets-1bd5cd5/src/services/request-recorder.ts :8 import Database from 'better-sqlite3';
  • db khill1269-servalsheets-1bd5cd5/src/services/user-rate-limiter.ts :16 * import { createClient } from 'redis';
  • db khill1269-servalsheets-1bd5cd5/src/storage/session-store.ts :2 import { createClient } from 'redis';

install hooks 2

  • prepare khill1269-servalsheets-1bd5cd5/package.json :129 npm run build
  • prepublishOnly khill1269-servalsheets-1bd5cd5/packages/serval-core/package.json :54 npm run build

declared dependencies 107

  • @modelcontextprotocol/sdk@^1.29.0
  • @apollo/server@^5.4.0
  • @duckdb/node-api@^1.5.0-r.1
  • @node-saml/node-saml@^5.1.0
  • @opentelemetry/api@^1.9.0
  • @opentelemetry/auto-instrumentations-node@^0.78.0
  • @opentelemetry/exporter-prometheus@^0.220.0
  • @opentelemetry/sdk-metrics@^2.9.0
  • @opentelemetry/sdk-node@^0.220.0
  • @opentelemetry/sdk-trace-node@^2.9.0
  • @serval/core@workspace:*
  • @serval/mcp-client@workspace:*
  • @serval/mcp-http@workspace:*
  • @serval/mcp-runtime@workspace:*
  • @serval/mcp-stdio@workspace:*
  • @types/node-cron@^3.0.11
  • better-sqlite3@^12.11.1
  • chalk@^5.6.2
  • cli-table3@^0.6.5
  • commander@^14.0.3
  • compression@^1.8.1
  • cors@^2.8.6
  • deep-diff@^1.0.2
  • dotenv@^17.2.4
  • express@^5.2.1
  • express-rate-limit@^8.3.2
  • google-auth-library@^10.5.0
  • googleapis@^171.4.0
  • graphql@^16.12.0
  • helmet@^8.1.0
  • hyperformula@^3.2.0
  • jsonwebtoken@^9.0.3
  • lru-cache@^11.3.5
  • node-cron@^4.2.1
  • open@^11.0.0
  • p-queue@^9.1.2
  • prom-client@^15.1.3
  • stripe@^17.5.0
  • swagger-ui-express@^5.0.1
  • typescript@^5.9.3
  • uuid@^13.0.0
  • winston@^3.19.0
  • zod@^4.3.6
  • @emnapi/core@^1.10.0
  • @emnapi/runtime@^1.10.0
  • @emnapi/wasi-threads@^1.2.1
  • @flydotio/dockerfile@^0.7.10
  • @stryker-mutator/core@^9.6.0
  • @stryker-mutator/jest-runner@^9.6.0
  • @stryker-mutator/typescript-checker@^9.6.0
  • @stryker-mutator/vitest-runner@^9.6.0
  • @types/better-sqlite3@^7.6.13
  • @types/compression@^1.8.1
  • @types/cors@^2.8.19
  • @types/deep-diff@^1.0.5
  • @types/express@^5.0.6
  • @types/jsonwebtoken@^9.0.10
  • @types/node@^20.17.0
  • @types/react@^18.3.28
  • @types/react-dom@^18.3.7
  • @types/stripe@^8.0.416
  • @types/supertest@^7.2.0
  • @types/swagger-ui-express@^4.1.8
  • @types/ws@^8.5.13
  • @typescript-eslint/eslint-plugin@^8.58.0
  • @typescript-eslint/parser@^8.54.0
  • @vitejs/plugin-react@^5.1.4
  • @vitest/coverage-v8@^4.1.2
  • ajv@^8.18.0
  • ajv-formats@^3.0.1
  • autocannon@^8.0.0
  • bindings@^1.5.0
  • chokidar@^5.0.0
  • cspell@^9.6.4
  • dependency-cruiser@^17.3.10
  • eslint@^9.39.2
  • eslint-plugin-boundaries@^5.4.0
  • fast-check@^4.5.3
  • husky@^9.1.7
  • knip@^6.1.1
  • lint-staged@^16.2.7
  • markdownlint-cli2@^0.22.0
  • npm-run-all@^4.1.5
  • openapi-types@^12.1.3
  • prettier@^3.8.1
  • react@^18.3.1
  • react-dom@^18.3.1
  • search-insights@^2.17.3
  • supertest@^7.2.2
  • syncpack@^14.3.0
  • ts-prune@^0.10.3
  • tsx@^4.21.0
  • turbo@^2.9.3
  • typedoc@^0.28.16
  • vite@^7.3.1
  • vitepress@^1.6.4
  • vitest@^4.1.2
  • yaml@^2.8.2
  • zod-to-json-schema@^3.25.2
  • @esbuild/darwin-arm64@^0.28.0
  • @oxc-parser/binding-darwin-arm64@^0.127.0
  • @oxc-resolver/binding-darwin-arm64@^11.19.1
  • @rollup/rollup-darwin-arm64@^4.60.2
  • ioredis@^5.10.0
  • keytar@7.9.0
  • pyodide@^0.29.3
  • redis@5.11.0

obfuscation 2

  • dynamic require()/import() khill1269-servalsheets-1bd5cd5/scripts/test-infrastructure/schema-reader.ts :91 const schemaModule = await import(`../../src/schemas/${tool.replace('sheets_', '')}.js`);
  • dynamic require()/import() khill1269-servalsheets-1bd5cd5/tests/config/effective-tool-mode.test.ts :43 import('${CONSTANTS_MODULE.replace(/\\/g, '\\\\')}').then(c => {

transport_posture 2

  • network-listening, binds all interfaces, no auth detected khill1269-servalsheets-1bd5cd5/tests/http-server/runtime-config.test.ts :31 host: '0.0.0.0',
  • binds all interfaces (0.0.0.0) khill1269-servalsheets-1bd5cd5/tests/packages/mcp-http/create-http-server.test.ts :49 host: '0.0.0.0',