github TypeScript analyzed 1bd5cd5

khill1269/servalsheets

github

Production-grade Google Sheets MCP server — 25 tools, 410 actions, TypeScript strict mode

maintainer: khill1269
licence: MIT
first seen: 2026-06-24
last seen: 2026-07-08
releases · 30d: 0
short id

Drift inferred · capture-to-capture

HIGH 2026-07-10 code analysis flagged committed secret, dynamic code execution ×2 in khill1269/servalsheets
HIGH 2026-06-24 code analysis flagged committed secret ×2, dynamic code execution ×2 in khill1269/servalsheets

capabilities 14 tools

transport stdio · streamable-http · http · sse counts 14 tools · 0 res · 0 prompts permission surface via code analysis

tools

gcloud_enable_api
gcloud_get_logs
gcloud_get_metrics
gcloud_get_project
gcloud_get_quotas
gcloud_list_enabled_apis
gcloud_list_iam_policies
gcloud_list_projects
gcloud_validate_permissions
google_api_changelog
google_api_docs
google_best_practices
google_deprecations
google_quota_limits

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 1bd5cd5 · analyzer v33 · 16h ago

skills & prompt files 28

danger signals46

dynamic code execution new Function() khill1269-servalsheets-1bd5cd5/src/connectors/connector-manager.ts :645 const result = new Function(`return (${cleaned})`)();
dynamic code execution new Function() khill1269-servalsheets-1bd5cd5/src/handlers/compute-actions/statistics.ts :84 const condFn = new Function(`"use strict"; return (${condSanitized})`);
suspicious endpoint http-intake.logs.datadoghq.com (telemetry) khill1269-servalsheets-1bd5cd5/examples/audit-logging-integration.ts :201 console.log(' export AUDIT_DATADOG_ENDPOINT=https://http-intake.logs.datadoghq.com/v1/input');
suspicious endpoint 169.254.169.254 (cloud metadata) khill1269-servalsheets-1bd5cd5/tests/services/webhook-manager.test.ts :518 await expect(registerWith('https://169.254.169.254/callback')).rejects.toThrow(
suspicious endpoint 169.254.169.254 (cloud metadata) khill1269-servalsheets-1bd5cd5/tests/simulation/action-fuzzer.test.ts :118 'http://169.254.169.254/latest/meta-data/',
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/examples/01-basic-read-write.ts :73 scopes: ['https://www.googleapis.com/auth/spreadsheets'],
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/examples/02-semantic-ranges.ts :94 scopes: ['https://www.googleapis.com/auth/spreadsheets'],
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/examples/03-safety-rails.ts :86 scopes: ['https://www.googleapis.com/auth/spreadsheets'],
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/examples/04-batch-operations.ts :76 scopes: ['https://www.googleapis.com/auth/spreadsheets'],
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/examples/05-oauth-setup.ts :63 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/examples/audit-logging-integration.ts :34 scopes: ['https://www.googleapis.com/auth/spreadsheets'],
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/src/config/oauth-scopes.ts :24 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/cloud-platform expected for this server's purpose khill1269-servalsheets-1bd5cd5/src/config/oauth-scopes.ts :57 'https://www.googleapis.com/auth/cloud-platform',
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose khill1269-servalsheets-1bd5cd5/src/config/oauth-scopes.ts :162 'https://www.googleapis.com/auth/drive':
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose khill1269-servalsheets-1bd5cd5/src/handlers/advanced-actions/chips.ts :96 scopes.includes('https://www.googleapis.com/auth/drive');
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/src/mcp/registration/prompt-registration.ts :618 https://www.googleapis.com/auth/spreadsheets`,
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose khill1269-servalsheets-1bd5cd5/src/security/incremental-scope.ts :194 this.currentScopes.includes('https://www.googleapis.com/auth/drive')
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/src/security/incremental-scope.ts :202 this.currentScopes.includes('https://www.googleapis.com/auth/spreadsheets')
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/src/security/operation-scopes-map.ts :50 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose khill1269-servalsheets-1bd5cd5/src/security/operation-scopes-map.ts :153 'https://www.googleapis.com/auth/drive',
over-broad OAuth scope https://www.googleapis.com/auth/cloud-platform expected for this server's purpose khill1269-servalsheets-1bd5cd5/src/services/google-api.ts :179 'https://www.googleapis.com/auth/cloud-platform',
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose khill1269-servalsheets-1bd5cd5/src/services/google-api.ts :1393 return this._scopes.includes('https://www.googleapis.com/auth/drive');
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose khill1269-servalsheets-1bd5cd5/src/utils/error-factory.ts :1021 if (scope === 'https://www.googleapis.com/auth/drive') {
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/audit/google-api-discovery.test.ts :130 const spreadsheetsScope = 'https://www.googleapis.com/auth/spreadsheets';
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/audit/google-api-discovery.test.ts :159 const restrictedDriveScope = 'https://www.googleapis.com/auth/drive';
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/compliance/audit-logging.test.ts :150 scopes: ['https://www.googleapis.com/auth/spreadsheets'],
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/config/oauth-scopes.test.ts :58 expect(scopes).toContain('https://www.googleapis.com/auth/spreadsheets');
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/config/oauth-scopes.test.ts :60 expect(scopes).not.toContain('https://www.googleapis.com/auth/drive');
over-broad OAuth scope https://www.googleapis.com/auth/cloud-platform expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/config/oauth-scopes.test.ts :129 expect(FULL_ACCESS_SCOPES).toContain('https://www.googleapis.com/auth/cloud-platform');
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/contracts/action-runtime-contract.test.ts :35 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/contracts/error-codes.test.ts :277 missingScopes: ['https://www.googleapis.com/auth/drive'],
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/contracts/error-codes.test.ts :278 currentScopes: ['https://www.googleapis.com/auth/spreadsheets'],
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/contracts/response-shapes.test.ts :603 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/core-verbosity.test.ts :96 scopes: ['https://www.googleapis.com/auth/spreadsheets'],
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/error-factory.test.ts :112 missingScopes: ['https://www.googleapis.com/auth/spreadsheets'],
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/handlers/advanced.test.ts :42 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/handlers/appsscript-prerequisites-bugfix.test.ts :35 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/handlers/auth-capabilities.test.ts :28 scopes: ['https://www.googleapis.com/auth/spreadsheets'],
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/handlers/auth.test.ts :19 scope: options?.scope?.join(' ') ?? 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/handlers/collaborate-approval.test.ts :174 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/handlers/collaborate-approval.test.ts :175 'https://www.googleapis.com/auth/drive',
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/handlers/collaborate-rate-limiter.test.ts :26 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/handlers/collaborate-rate-limiter.test.ts :27 'https://www.googleapis.com/auth/drive',
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/handlers/collaborate-version.test.ts :160 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/handlers/collaborate-version.test.ts :161 'https://www.googleapis.com/auth/drive',
committed secret committed .env khill1269-servalsheets-1bd5cd5/.env.quickstart :1 env file shipped with populated values

code evidence vv2.0.0 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 1772

filesystem 172

fs khill1269-servalsheets-1bd5cd5/.serval/generate-state.mjs :11 import { readFileSync, writeFileSync, existsSync, readdirSync } from 'node:fs';
fs (weak) khill1269-servalsheets-1bd5cd5/examples/05-oauth-setup.ts :35 import { promises as fs } from 'fs';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/add-frontmatter.ts :7 import { readFileSync, writeFileSync } from 'node:fs';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/analysis/agents/documentation-validator-agent.ts :16 import * as fs from 'fs';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/analysis/agents/testing-agent.ts :13 import * as fs from 'fs';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/analysis/auto-fix-imports.ts :14 import * as fs from 'fs';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/analysis/auto-fixer.ts :16 import * as fs from 'fs';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/analysis/cli.ts :13 import * as fs from 'fs';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/analysis/generate-complete-file-audit.mjs :3 import fs from 'node:fs';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/analysis/multi-agent-analysis.ts :12 import * as fs from 'fs';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/analysis/orchestrator.ts :18 import * as fs from 'fs';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/analysis/pre-implementation-audit.ts :29 import * as fs from 'fs';

show 28 more

fs (weak) khill1269-servalsheets-1bd5cd5/scripts/analysis/report-generator.ts :13 import * as fs from 'fs';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/analyze-claude-code-debug.ts :10 import { createReadStream } from 'node:fs';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/analyze-claude-logs.ts :9 import { createReadStream } from 'node:fs';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/analyze-docs-deep.ts :7 import { readFileSync, statSync, writeFileSync } from 'node:fs';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/aquivr-check-doc-counts.mjs :15 import { readFileSync, existsSync } from 'node:fs';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/audit-actions.ts :13 import { readdirSync, readFileSync } from 'fs';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/audit-env-ownership.mjs :2 import fs from 'node:fs';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/audit-google-api-compliance.mjs :18 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/audit-with-exceptions.mjs :11 import { readFileSync } from 'fs';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/check-action-aliases.mjs :25 import { readFile } from 'node:fs/promises';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/check-audit-score.mjs :3 import fs from 'node:fs';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/check-cache-invalidation-coverage.mjs :19 import { readFileSync } from 'fs';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/check-code-count-drift.ts :9 import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/check-devcontainer-ci-parity.mjs :3 import fs from 'node:fs';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/check-doc-action-counts.mjs :3 import { existsSync, readFileSync, readdirSync, statSync } from 'fs';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/check-doc-freshness.ts :7 import fs from 'node:fs';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/check-external-links.ts :7 import fs from 'node:fs';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/check-frontmatter.ts :7 import fs from 'node:fs';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/check-integration-wiring.mjs :3 import { existsSync, readFileSync } from 'node:fs';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/check-markdownlint-baseline.mjs :3 import fs from 'node:fs';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/check-math-random.mjs :12 import { readFileSync } from 'fs';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/check-mutation-action-coverage.mjs :28 import { readFileSync, readdirSync } from 'fs';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/check-mutation-actions.mjs :22 import { readFileSync } from 'fs';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/check-promotion-candidates.mjs :15 import { readFileSync } from 'fs';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/check-registry-readiness.mjs :1 import { existsSync } from 'fs';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/check-release-surface.ts :1 import { readFileSync } from 'node:fs';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/check-security-exceptions.mjs :3 import fs from 'node:fs';
fs (weak) khill1269-servalsheets-1bd5cd5/scripts/check-sheets-fields-mask.ts :4 import { readFileSync } from 'node:fs';

132 more not shown — this panel samples each group; the count above is the real total.

shell / exec 52

shell khill1269-servalsheets-1bd5cd5/.serval/generate-state.mjs :12 import { execSync } from 'node:child_process';
shell (weak) khill1269-servalsheets-1bd5cd5/scripts/analysis/agents/security-agent.ts :470 // Check for child_process.exec/spawn with user input.
shell (weak) khill1269-servalsheets-1bd5cd5/scripts/analysis/pre-implementation-audit.ts :28 import { execSync } from 'child_process';
shell (weak) khill1269-servalsheets-1bd5cd5/scripts/audit-google-api-compliance.mjs :19 import { execSync } from 'node:child_process';
shell (weak) khill1269-servalsheets-1bd5cd5/scripts/audit-with-exceptions.mjs :10 import { execSync } from 'child_process';
shell (weak) khill1269-servalsheets-1bd5cd5/scripts/check-doc-freshness.ts :9 import { execSync } from 'node:child_process';
shell (weak) khill1269-servalsheets-1bd5cd5/scripts/check-markdownlint-baseline.mjs :4 import { spawnSync } from 'node:child_process';
shell (weak) khill1269-servalsheets-1bd5cd5/scripts/check-sheets-fields-mask.ts :3 import { execSync } from 'node:child_process';
shell (weak) khill1269-servalsheets-1bd5cd5/scripts/check-source-dist-consistency.ts :8 import { execFileSync } from 'node:child_process';
shell (weak) khill1269-servalsheets-1bd5cd5/scripts/dead-code-triage.mjs :20 import { spawnSync } from 'child_process';
shell (weak) khill1269-servalsheets-1bd5cd5/scripts/doctor-vscode.mjs :2 import { execFileSync } from 'node:child_process';
shell (weak) khill1269-servalsheets-1bd5cd5/scripts/export-openapi.ts :18 import { execSync } from 'child_process';

show 28 more

shell (weak) khill1269-servalsheets-1bd5cd5/scripts/fix-frontmatter-dates.ts :8 import { execSync } from 'node:child_process';
shell (weak) khill1269-servalsheets-1bd5cd5/scripts/gen-doc-tables.mjs :27 import { execSync } from 'child_process';
shell (weak) khill1269-servalsheets-1bd5cd5/scripts/generate-dashboard.ts :11 import { execSync } from 'child_process';
shell (weak) khill1269-servalsheets-1bd5cd5/scripts/generate-doc-metrics.ts :8 import { execSync } from 'node:child_process';
shell (weak) khill1269-servalsheets-1bd5cd5/scripts/generate-ground-truth-registry.mjs :15 import { execSync } from 'child_process';
shell (weak) khill1269-servalsheets-1bd5cd5/scripts/generate-health-snapshot.ts :24 import { execSync } from 'node:child_process';
shell (weak) khill1269-servalsheets-1bd5cd5/scripts/generate-sdks.ts :11 import { execSync } from 'node:child_process';
shell (weak) khill1269-servalsheets-1bd5cd5/scripts/lib/docs-facts.mjs :1 import { spawnSync } from 'child_process';
shell (weak) khill1269-servalsheets-1bd5cd5/scripts/live-probe.mjs :8 import { spawn } from 'child_process';
shell (weak) khill1269-servalsheets-1bd5cd5/scripts/run-audit-framework.js :18 import { execSync } from 'child_process';
shell (weak) khill1269-servalsheets-1bd5cd5/scripts/run-full-test-suite.mjs :17 import { execSync, spawnSync } from 'child_process';
shell (weak) khill1269-servalsheets-1bd5cd5/scripts/run-quick-audit.js :16 import { execSync } from 'child_process';
shell (weak) khill1269-servalsheets-1bd5cd5/scripts/sync-audit-to-docs.ts :15 import { execSync } from 'child_process';
shell (weak) khill1269-servalsheets-1bd5cd5/scripts/track-benchmarks.mjs :83 const { execSync } = await import('node:child_process');
shell (weak) khill1269-servalsheets-1bd5cd5/scripts/validate-package-versions.ts :8 import { execSync } from 'child_process';
shell (weak) khill1269-servalsheets-1bd5cd5/scripts/verify-aliases.mjs :11 import { execSync } from 'child_process';
shell (weak) khill1269-servalsheets-1bd5cd5/scripts/verify-annotations.mjs :15 const { execSync } = await import('child_process');
shell (weak) khill1269-servalsheets-1bd5cd5/scripts/verify-dist-integrity.mjs :21 import { spawn } from 'node:child_process';
shell khill1269-servalsheets-1bd5cd5/src/cli/auth-setup.ts :271 // Use execFile (not exec) to prevent command injection via URL
shell khill1269-servalsheets-1bd5cd5/src/services/keychain-store.ts :22 import { execFile } from 'child_process';
shell khill1269-servalsheets-1bd5cd5/src/services/python-worker.ts :133 # Blocking compile() breaks basic Python constructs. Only block exec() and open()
shell (weak) khill1269-servalsheets-1bd5cd5/tests/benchmarks/performance-baseline.ts :13 import { execSync } from 'node:child_process';
shell (weak) khill1269-servalsheets-1bd5cd5/tests/chaos/resilience.test.ts :19 import { spawn, ChildProcess } from 'child_process';
shell (weak) khill1269-servalsheets-1bd5cd5/tests/compliance/mcp-2025-11-25.test.ts :8 import { spawn } from 'node:child_process';
shell (weak) khill1269-servalsheets-1bd5cd5/tests/config/effective-tool-mode.test.ts :18 import { spawnSync } from 'node:child_process';
shell (weak) khill1269-servalsheets-1bd5cd5/tests/contracts/mcp-http-transport-auth-security.test.ts :2 import { spawnSync } from 'node:child_process';
shell (weak) khill1269-servalsheets-1bd5cd5/tests/contracts/mcp-protocol.test.ts :13 import { spawn } from 'node:child_process';
shell (weak) khill1269-servalsheets-1bd5cd5/tests/contracts/source-dist-consistency-script.test.ts :2 import { spawnSync } from 'node:child_process';

12 more not shown — this panel samples each group; the count above is the real total.

network 62

net (weak) khill1269-servalsheets-1bd5cd5/examples/05-oauth-setup.ts :33 import http from 'http';
net (weak) khill1269-servalsheets-1bd5cd5/scripts/audit-google-api-compliance.mjs :85 const resp = await fetch(api.url, {
net (weak) khill1269-servalsheets-1bd5cd5/scripts/benchmarks/benchmark-optimizations.ts :148 // Simulate API fetch (5ms)
net (weak) khill1269-servalsheets-1bd5cd5/scripts/check-external-links.ts :8 import https from 'node:https';
net (weak) khill1269-servalsheets-1bd5cd5/scripts/generate-sdks.ts :108 import axios, { AxiosInstance, AxiosRequestConfig } from 'axios';
net (weak) khill1269-servalsheets-1bd5cd5/scripts/live-monitor.ts :14 import { request } from 'node:http';
net (weak) khill1269-servalsheets-1bd5cd5/scripts/live-test-setup.mjs :119 const response = await fetch(
net khill1269-servalsheets-1bd5cd5/src/admin/dashboard.js :37 const response = await fetch(`${API_BASE}/admin/api/server-info`);
net khill1269-servalsheets-1bd5cd5/src/auth/oauth-provider.ts :1379 await fetch(
net khill1269-servalsheets-1bd5cd5/src/cli/auth-setup.ts :26 import * as http from 'http';
net khill1269-servalsheets-1bd5cd5/src/cli/schema-manager.ts :49 await this.fetch(options);
net khill1269-servalsheets-1bd5cd5/src/config/secrets.ts :67 * Uses Node.js built-in fetch (no external deps). TTL-aware in-memory cache

show 28 more

net khill1269-servalsheets-1bd5cd5/src/connectors/alpha-vantage.ts :61 const resp = await fetch(
net khill1269-servalsheets-1bd5cd5/src/connectors/docs-connector.ts :57 const resp = await fetch('https://www.googleapis.com/drive/v3/about?fields=user', {
net khill1269-servalsheets-1bd5cd5/src/connectors/drive-connector.ts :56 const resp = await fetch(
net khill1269-servalsheets-1bd5cd5/src/connectors/finnhub.ts :63 const resp = await fetch(`${BASE_URL}/stock/symbol?exchange=US&token=${this.apiKey}`, {
net khill1269-servalsheets-1bd5cd5/src/connectors/fmp.ts :58 const resp = await fetch(`${BASE_URL}/stock/list?apikey=${this.apiKey}`);
net khill1269-servalsheets-1bd5cd5/src/connectors/fred.ts :58 const resp = await fetch(
net khill1269-servalsheets-1bd5cd5/src/connectors/gmail-connector.ts :56 const resp = await fetch('https://www.googleapis.com/gmail/v1/users/me/profile', {
net khill1269-servalsheets-1bd5cd5/src/connectors/openfigi-connector.ts :66 const resp = await fetch(`${BASE_URL}/search?query=Apple`, {
net khill1269-servalsheets-1bd5cd5/src/connectors/polygon.ts :58 const resp = await fetch(`${BASE_URL}/v3/reference/tickers?limit=1&apiKey=${this.apiKey}`);
net khill1269-servalsheets-1bd5cd5/src/connectors/rest-generic.ts :158 const resp = await fetch(url.toString(), {
net khill1269-servalsheets-1bd5cd5/src/connectors/sec-edgar-connector.ts :60 const resp = await fetch(
net khill1269-servalsheets-1bd5cd5/src/connectors/world-bank-connector.ts :51 const resp = await fetch(`${BASE_URL}/country?format=json&per_page=1`);
net khill1269-servalsheets-1bd5cd5/src/handlers/advanced-actions/chips.ts :217 // ISSUE-019: Require range to prevent unbounded full-grid fetch (chipRuns requires includeGridData)
net khill1269-servalsheets-1bd5cd5/src/handlers/appsscript-actions/serval-installer.ts :94 var response = UrlFetchApp.fetch(CALLBACK_URL, {
net khill1269-servalsheets-1bd5cd5/src/handlers/appsscript.ts :553 const response = await fetch(url, fetchOptions);
net khill1269-servalsheets-1bd5cd5/src/handlers/bigquery-actions/scheduled-queries.ts :60 const response = await fetch(url, {
net khill1269-servalsheets-1bd5cd5/src/handlers/dependencies-actions/scenario.ts :244 // Fallback: API-based value fetch (original behavior)
net khill1269-servalsheets-1bd5cd5/src/observability/otel-export.ts :227 const response = await fetch(`${this.config.endpoint}/v1/traces`, {
net khill1269-servalsheets-1bd5cd5/src/observability/tracing.ts :202 const response = await fetch(`${OTLP_ENDPOINT}/v1/traces`, {
net khill1269-servalsheets-1bd5cd5/src/security/oidc-provider.ts :237 const res = await fetch(this.config.discoveryUrl);
net khill1269-servalsheets-1bd5cd5/src/security/resource-indicators.ts :193 const response = await fetch(
net khill1269-servalsheets-1bd5cd5/src/server/metrics-server.ts :8 import { createServer, type Server, type IncomingMessage, type ServerResponse } from 'node:http';
net khill1269-servalsheets-1bd5cd5/src/services/audit-logger.ts :598 const response = await fetch(config.endpoint, {
net khill1269-servalsheets-1bd5cd5/src/services/discovery-client.ts :218 const response = await fetch(baseUrl, {
net khill1269-servalsheets-1bd5cd5/src/services/formula-callback.ts :186 const response = await fetch('https://api.anthropic.com/v1/messages', {
net khill1269-servalsheets-1bd5cd5/src/services/google-api.ts :44 import { Agent as HttpAgent } from 'http';
net khill1269-servalsheets-1bd5cd5/src/services/llm-fallback.ts :131 const response = await fetch(`${config.baseUrl}/v1/messages`, {
net khill1269-servalsheets-1bd5cd5/src/services/sampling-health-probe.ts :142 const response = await fetch(url, {

22 more not shown — this panel samples each group; the count above is the real total.

secrets 45

secrets (weak) khill1269-servalsheets-1bd5cd5/examples/01-basic-read-write.ts :70 if (process.env.GOOGLE_APPLICATION_CREDENTIALS) {
secrets (weak) khill1269-servalsheets-1bd5cd5/examples/02-semantic-ranges.ts :91 if (process.env.GOOGLE_APPLICATION_CREDENTIALS) {
secrets (weak) khill1269-servalsheets-1bd5cd5/examples/03-safety-rails.ts :83 if (process.env.GOOGLE_APPLICATION_CREDENTIALS) {
secrets (weak) khill1269-servalsheets-1bd5cd5/examples/04-batch-operations.ts :73 if (process.env.GOOGLE_APPLICATION_CREDENTIALS) {
secrets (weak) khill1269-servalsheets-1bd5cd5/examples/05-oauth-setup.ts :57 const CLIENT_SECRET = process.env.GOOGLE_CLIENT_SECRET || '';
secrets (weak) khill1269-servalsheets-1bd5cd5/examples/billing-integration-example.ts :106 stripeSecretKey: process.env.STRIPE_SECRET_KEY!,
secrets (weak) khill1269-servalsheets-1bd5cd5/scripts/generate-sdks.ts :386 apiKey: process.env.SERVALSHEETS_API_KEY,
secrets khill1269-servalsheets-1bd5cd5/src/auth/oauth-provider.ts :1678 const expectedToken = process.env['OAUTH_DCR_CONSENT_TOKEN'];
secrets khill1269-servalsheets-1bd5cd5/src/cli/auth-setup.ts :524 process.env['ENCRYPTION_KEY'] ?? existingKeyMatch?.[1] ?? randomBytes(32).toString('hex');
secrets khill1269-servalsheets-1bd5cd5/src/cli/replay.ts :292 const accessToken = process.env['GOOGLE_ACCESS_TOKEN'];
secrets khill1269-servalsheets-1bd5cd5/src/config/embedded-oauth.ts :35 clientSecret: process.env['OAUTH_CLIENT_SECRET'] ?? 'REPLACE_WITH_REAL_OAUTH_CLIENT_SECRET',
secrets khill1269-servalsheets-1bd5cd5/src/config/runtime-config-store.ts :62 return process.env['CONNECTOR_ENCRYPTION_KEY'] ?? process.env['ENCRYPTION_KEY'];

show 28 more

secrets khill1269-servalsheets-1bd5cd5/src/config/secrets.ts :349 const vaultToken = process.env['VAULT_TOKEN'];
secrets khill1269-servalsheets-1bd5cd5/src/connectors/connector-manager.ts :84 const password = process.env['CONNECTOR_ENCRYPTION_KEY'];
secrets khill1269-servalsheets-1bd5cd5/src/handlers/analyze-actions/semantic-search.ts :28 const apiKey = process.env['GOOGLE_API_KEY'];
secrets khill1269-servalsheets-1bd5cd5/src/handlers/auth-actions/feature-setup.ts :384 process.env['ANTHROPIC_API_KEY'] = apiKey;
secrets khill1269-servalsheets-1bd5cd5/src/handlers/auth-actions/status.ts :103 const googleApiKeyConfigured = Boolean(process.env['GOOGLE_API_KEY']);
secrets khill1269-servalsheets-1bd5cd5/src/handlers/auth.ts :71 this.tokenStoreKey = options.tokenStoreKey ?? process.env['ENCRYPTION_KEY'];
secrets khill1269-servalsheets-1bd5cd5/src/http-server-entry.ts :31 process.env['OAUTH_CLIENT_SECRET'] !== undefined
secrets khill1269-servalsheets-1bd5cd5/src/http-server.ts :176 process.env['OAUTH_CLIENT_SECRET'] !== undefined
secrets khill1269-servalsheets-1bd5cd5/src/server/health.ts :165 process.env['GOOGLE_SERVICE_ACCOUNT_KEY'] ??
secrets khill1269-servalsheets-1bd5cd5/src/services/audit-logger.ts :202 const encKeyPassword = options?.encryptionKey ?? process.env['AUDIT_LOG_ENCRYPTION_KEY'];
secrets khill1269-servalsheets-1bd5cd5/src/services/formula-callback.ts :175 const apiKey = claudeApiKey ?? process.env['ANTHROPIC_API_KEY'];
secrets khill1269-servalsheets-1bd5cd5/src/services/llm-fallback.ts :75 process.env['LLM_API_KEY'] ||
secrets khill1269-servalsheets-1bd5cd5/src/services/user-profile-manager.ts :20 const ENCRYPTION_KEY_HEX = process.env['PROFILE_ENCRYPTION_KEY'];
secrets khill1269-servalsheets-1bd5cd5/src/startup/lifecycle.ts :57 const hasEncryptionKey = Boolean(process.env['ENCRYPTION_KEY']);
secrets khill1269-servalsheets-1bd5cd5/src/startup/preflight-validation.ts :184 const encryptionKey = process.env['ENCRYPTION_KEY'];
secrets khill1269-servalsheets-1bd5cd5/src/utils/google-api-options.ts :20 const inlineKey = process.env['GOOGLE_SERVICE_ACCOUNT_KEY'];
secrets khill1269-servalsheets-1bd5cd5/src/utils/oauth-config.ts :25 const envClientSecret = process.env['GOOGLE_CLIENT_SECRET'] ?? process.env['OAUTH_CLIENT_SECRET'];
secrets (weak) khill1269-servalsheets-1bd5cd5/tests/benchmarks/http2-latency.test.ts :24 const hasCredentials = process.env['GOOGLE_CLIENT_ID'] && process.env['GOOGLE_CLIENT_SECRET'];
secrets (weak) khill1269-servalsheets-1bd5cd5/tests/benchmarks/live-api/action-level.bench.ts :408 serviceAccountKeyPath: process.env['GOOGLE_APPLICATION_CREDENTIALS'],
secrets (weak) khill1269-servalsheets-1bd5cd5/tests/benchmarks/live-api/tool-level.bench.ts :60 serviceAccountKeyPath: process.env['GOOGLE_APPLICATION_CREDENTIALS'],
secrets (weak) khill1269-servalsheets-1bd5cd5/tests/chaos/resilience.test.ts :28 token: process.env.TEST_TOKEN || 'test-token',
secrets (weak) khill1269-servalsheets-1bd5cd5/tests/connectors/persistence.test.ts :74 process.env['CONNECTOR_ENCRYPTION_KEY'] = 'test-encryption-key-32-chars-min!!';
secrets (weak) khill1269-servalsheets-1bd5cd5/tests/handlers/analyze-semantic-search.test.ts :86 originalEnv = process.env['GOOGLE_API_KEY'];
secrets (weak) khill1269-servalsheets-1bd5cd5/tests/handlers/auth-capabilities.test.ts :44 delete process.env['OAUTH_CLIENT_SECRET'];
secrets (weak) khill1269-servalsheets-1bd5cd5/tests/handlers/auth.test.ts :164 delete process.env['OAUTH_CLIENT_SECRET'];
secrets (weak) khill1269-servalsheets-1bd5cd5/tests/helpers/credential-loader.ts :94 const googleCredsPath = process.env['GOOGLE_APPLICATION_CREDENTIALS'];
secrets (weak) khill1269-servalsheets-1bd5cd5/tests/live-api/auth/incremental-consent.live.test.ts :108 access_token: process.env['GOOGLE_ACCESS_TOKEN'] ?? 'test-token',
secrets (weak) khill1269-servalsheets-1bd5cd5/tests/load/stress-1k.test.ts :199 Authorization: `Bearer ${process.env.TEST_TOKEN || 'test-token'}`,

5 more not shown — this panel samples each group; the count above is the real total.

database 7

db khill1269-servalsheets-1bd5cd5/src/core/task-store.ts :11 import type { RedisClientType } from 'redis';
db khill1269-servalsheets-1bd5cd5/src/mcp/event-store.ts :15 import type { RedisClientType } from 'redis';
db khill1269-servalsheets-1bd5cd5/src/services/quota-manager.ts :28 import { type Redis } from 'ioredis';
db khill1269-servalsheets-1bd5cd5/src/services/request-recorder.ts :8 import Database from 'better-sqlite3';
db khill1269-servalsheets-1bd5cd5/src/services/user-rate-limiter.ts :16 * import { createClient } from 'redis';
db khill1269-servalsheets-1bd5cd5/src/storage/session-store.ts :2 import { createClient } from 'redis';
db (weak) khill1269-servalsheets-1bd5cd5/tools/test-intelligence-server/src/index.ts :20 import Database from 'better-sqlite3';

tool registrations 14

gcloud_list_projects khill1269-servalsheets-1bd5cd5/tools/gcloud-console-server/src/index.ts :120
gcloud_get_project khill1269-servalsheets-1bd5cd5/tools/gcloud-console-server/src/index.ts :137
gcloud_list_enabled_apis khill1269-servalsheets-1bd5cd5/tools/gcloud-console-server/src/index.ts :151
gcloud_enable_api khill1269-servalsheets-1bd5cd5/tools/gcloud-console-server/src/index.ts :169
gcloud_get_quotas khill1269-servalsheets-1bd5cd5/tools/gcloud-console-server/src/index.ts :187
gcloud_list_iam_policies khill1269-servalsheets-1bd5cd5/tools/gcloud-console-server/src/index.ts :205
gcloud_get_logs khill1269-servalsheets-1bd5cd5/tools/gcloud-console-server/src/index.ts :223
gcloud_get_metrics khill1269-servalsheets-1bd5cd5/tools/gcloud-console-server/src/index.ts :249
gcloud_validate_permissions khill1269-servalsheets-1bd5cd5/tools/gcloud-console-server/src/index.ts :275
google_api_docs khill1269-servalsheets-1bd5cd5/tools/google-docs-server/src/index.ts :373
google_api_changelog khill1269-servalsheets-1bd5cd5/tools/google-docs-server/src/index.ts :387
google_quota_limits khill1269-servalsheets-1bd5cd5/tools/google-docs-server/src/index.ts :400

show 2 more

google_best_practices khill1269-servalsheets-1bd5cd5/tools/google-docs-server/src/index.ts :413
google_deprecations khill1269-servalsheets-1bd5cd5/tools/google-docs-server/src/index.ts :428

install hooks 2

prepare khill1269-servalsheets-1bd5cd5/package.json :129 npm run build
prepublishOnly khill1269-servalsheets-1bd5cd5/packages/serval-core/package.json :54 npm run build

declared dependencies 107

@modelcontextprotocol/sdk@^1.29.0
@apollo/server@^5.4.0
@duckdb/node-api@^1.5.0-r.1
@node-saml/node-saml@^5.1.0
@opentelemetry/api@^1.9.0
@opentelemetry/auto-instrumentations-node@^0.78.0
@opentelemetry/exporter-prometheus@^0.220.0
@opentelemetry/sdk-metrics@^2.9.0
@opentelemetry/sdk-node@^0.220.0
@opentelemetry/sdk-trace-node@^2.9.0
@serval/core@workspace:*
@serval/mcp-client@workspace:*

show 28 more

@serval/mcp-http@workspace:*
@serval/mcp-runtime@workspace:*
@serval/mcp-stdio@workspace:*
@types/node-cron@^3.0.11
better-sqlite3@^12.11.1
chalk@^5.6.2
cli-table3@^0.6.5
commander@^14.0.3
compression@^1.8.1
cors@^2.8.6
deep-diff@^1.0.2
dotenv@^17.2.4
express@^5.2.1
express-rate-limit@^8.3.2
google-auth-library@^10.5.0
googleapis@^171.4.0
graphql@^16.12.0
helmet@^8.1.0
hyperformula@^3.2.0
jsonwebtoken@^9.0.3
lru-cache@^11.3.5
node-cron@^4.2.1
open@^11.0.0
p-queue@^9.1.2
prom-client@^15.1.3
stripe@^17.5.0
swagger-ui-express@^5.0.1
typescript@^5.9.3

67 more not shown — this panel samples each group; the count above is the real total.

obfuscation 2

dynamic require()/import() khill1269-servalsheets-1bd5cd5/scripts/test-infrastructure/schema-reader.ts :91 const schemaModule = await import(`../../src/schemas/${tool.replace('sheets_', '')}.js`);
dynamic require()/import() khill1269-servalsheets-1bd5cd5/tests/config/effective-tool-mode.test.ts :43 import('${CONSTANTS_MODULE.replace(/\\/g, '\\\\')}').then(c => {

transport_posture 2

network-listening, binds all interfaces, no auth detected khill1269-servalsheets-1bd5cd5/tests/http-server/runtime-config.test.ts :31 host: '0.0.0.0',
binds all interfaces (0.0.0.0) khill1269-servalsheets-1bd5cd5/tests/packages/mcp-http/create-http-server.test.ts :49 host: '0.0.0.0',

khill1269/servalsheets

Drift inferred · capture-to-capture

tools

skills & prompt files 28

danger signals46

filesystem 172

shell / exec 52

network 62

secrets 45

database 7

tool registrations 14

install hooks 2

declared dependencies 107

obfuscation 2

transport_posture 2

Navigate

Stream

Features

Display