github TypeScript analyzed 1bd5cd5

khill1269/servalsheets

Production-grade Google Sheets MCP server — 25 tools, 410 actions, TypeScript strict mode

maintainer: khill1269
license: MIT
first seen: 2026-06-24
last seen: 2026-07-08
releases · 30d: 0
short id

risk 59/100 · heuristic grade

C elevated

capability exposure inferred + 35
recent drift inferred + 12
tool safety inferred + 12

inferred

The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.

graded 57s ago · see ecosystem CVEs →

risk trajectory 5 movements

1w ago D · 67 → C · 59
3w ago C · 59 → D · 67
4w ago D · 61 → C · 59
5w ago C · 58 → D · 61
5w ago B · 23 → C · 58

capability exposure grade factor +35

Inferred surface — each links to servers holding it:

vulnerabilities 0 CVEs

No known CVEs for this server.

tool safety 1 findings · grade factor +12

high dangerous code

committed secret: committed .env · dynamic exec: new Function() · obfuscated payload: dynamic require()/import()

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 1bd5cd5 · analyzer v28 · 3d ago

skills & prompt files 8

danger signals88

dynamic code execution new Function() khill1269-servalsheets-1bd5cd5/src/connectors/connector-manager.ts :645 const result = new Function(`return (${cleaned})`)();
dynamic code execution new Function() khill1269-servalsheets-1bd5cd5/src/handlers/compute-actions/statistics.ts :84 const condFn = new Function(`"use strict"; return (${condSanitized})`);
suspicious endpoint http-intake.logs.datadoghq.com (telemetry) khill1269-servalsheets-1bd5cd5/examples/audit-logging-integration.ts :201 console.log(' export AUDIT_DATADOG_ENDPOINT=https://http-intake.logs.datadoghq.com/v1/input');
suspicious endpoint 169.254.169.254 (cloud metadata) khill1269-servalsheets-1bd5cd5/tests/services/webhook-manager.test.ts :518 await expect(registerWith('https://169.254.169.254/callback')).rejects.toThrow(
suspicious endpoint 169.254.169.254 (cloud metadata) khill1269-servalsheets-1bd5cd5/tests/simulation/action-fuzzer.test.ts :118 'http://169.254.169.254/latest/meta-data/',
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/examples/01-basic-read-write.ts :73 scopes: ['https://www.googleapis.com/auth/spreadsheets'],
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/examples/02-semantic-ranges.ts :94 scopes: ['https://www.googleapis.com/auth/spreadsheets'],
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/examples/03-safety-rails.ts :86 scopes: ['https://www.googleapis.com/auth/spreadsheets'],
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/examples/04-batch-operations.ts :76 scopes: ['https://www.googleapis.com/auth/spreadsheets'],
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/examples/05-oauth-setup.ts :63 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/examples/audit-logging-integration.ts :34 scopes: ['https://www.googleapis.com/auth/spreadsheets'],
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/src/config/oauth-scopes.ts :24 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/cloud-platform expected for this server's purpose khill1269-servalsheets-1bd5cd5/src/config/oauth-scopes.ts :57 'https://www.googleapis.com/auth/cloud-platform',
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose khill1269-servalsheets-1bd5cd5/src/config/oauth-scopes.ts :162 'https://www.googleapis.com/auth/drive':
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose khill1269-servalsheets-1bd5cd5/src/handlers/advanced-actions/chips.ts :96 scopes.includes('https://www.googleapis.com/auth/drive');
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/src/mcp/registration/prompt-registration.ts :618 https://www.googleapis.com/auth/spreadsheets`,
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose khill1269-servalsheets-1bd5cd5/src/security/incremental-scope.ts :194 this.currentScopes.includes('https://www.googleapis.com/auth/drive')
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/src/security/incremental-scope.ts :202 this.currentScopes.includes('https://www.googleapis.com/auth/spreadsheets')
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/src/security/operation-scopes-map.ts :50 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose khill1269-servalsheets-1bd5cd5/src/security/operation-scopes-map.ts :153 'https://www.googleapis.com/auth/drive',
over-broad OAuth scope https://www.googleapis.com/auth/cloud-platform expected for this server's purpose khill1269-servalsheets-1bd5cd5/src/services/google-api.ts :179 'https://www.googleapis.com/auth/cloud-platform',
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose khill1269-servalsheets-1bd5cd5/src/services/google-api.ts :1393 return this._scopes.includes('https://www.googleapis.com/auth/drive');
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose khill1269-servalsheets-1bd5cd5/src/utils/error-factory.ts :1021 if (scope === 'https://www.googleapis.com/auth/drive') {
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/audit/google-api-discovery.test.ts :130 const spreadsheetsScope = 'https://www.googleapis.com/auth/spreadsheets';
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/audit/google-api-discovery.test.ts :159 const restrictedDriveScope = 'https://www.googleapis.com/auth/drive';
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/compliance/audit-logging.test.ts :150 scopes: ['https://www.googleapis.com/auth/spreadsheets'],
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/config/oauth-scopes.test.ts :58 expect(scopes).toContain('https://www.googleapis.com/auth/spreadsheets');
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/config/oauth-scopes.test.ts :60 expect(scopes).not.toContain('https://www.googleapis.com/auth/drive');
over-broad OAuth scope https://www.googleapis.com/auth/cloud-platform expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/config/oauth-scopes.test.ts :129 expect(FULL_ACCESS_SCOPES).toContain('https://www.googleapis.com/auth/cloud-platform');
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/contracts/action-runtime-contract.test.ts :35 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/contracts/error-codes.test.ts :277 missingScopes: ['https://www.googleapis.com/auth/drive'],
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/contracts/error-codes.test.ts :278 currentScopes: ['https://www.googleapis.com/auth/spreadsheets'],
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/contracts/response-shapes.test.ts :603 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/core-verbosity.test.ts :96 scopes: ['https://www.googleapis.com/auth/spreadsheets'],
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/error-factory.test.ts :112 missingScopes: ['https://www.googleapis.com/auth/spreadsheets'],
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/handlers/advanced.test.ts :42 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/handlers/appsscript-prerequisites-bugfix.test.ts :35 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/handlers/auth-capabilities.test.ts :28 scopes: ['https://www.googleapis.com/auth/spreadsheets'],
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/handlers/auth.test.ts :19 scope: options?.scope?.join(' ') ?? 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/handlers/collaborate-approval.test.ts :174 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/handlers/collaborate-approval.test.ts :175 'https://www.googleapis.com/auth/drive',
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/handlers/collaborate-rate-limiter.test.ts :26 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/handlers/collaborate-rate-limiter.test.ts :27 'https://www.googleapis.com/auth/drive',
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/handlers/collaborate-version.test.ts :160 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/handlers/collaborate-version.test.ts :161 'https://www.googleapis.com/auth/drive',
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/handlers/collaborate.test.ts :181 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/handlers/collaborate.test.ts :182 'https://www.googleapis.com/auth/drive',
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/handlers/composite-generate.test.ts :165 auth: { hasElevatedAccess: false, scopes: ['https://www.googleapis.com/auth/spreadsheets'] },
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/handlers/composite-parameter-naming-bugfix.test.ts :190 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/handlers/composite-workflows.test.ts :120 auth: { hasElevatedAccess: false, scopes: ['https://www.googleapis.com/auth/spreadsheets'] },
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/handlers/composite.streaming.test.ts :32 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/handlers/composite.test.ts :59 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/handlers/composite.test.ts :60 'https://www.googleapis.com/auth/drive',
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/handlers/core.test.ts :157 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/handlers/core.test.ts :159 'https://www.googleapis.com/auth/drive',
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/handlers/elicitation-wizards.test.ts :203 auth: { hasElevatedAccess: false, scopes: ['https://www.googleapis.com/auth/spreadsheets'] },
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/handlers/progress-notifications.test.ts :149 scopes: ['https://www.googleapis.com/auth/spreadsheets'],
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/handlers/sampling-enhancements.test.ts :671 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/handlers/sampling-enhancements.test.ts :672 'https://www.googleapis.com/auth/drive',
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/handlers/task-id-support.test.ts :245 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/handlers/templates.test.ts :112 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/helpers/google-api-mocks.ts :189 scopes: ['https://www.googleapis.com/auth/spreadsheets'],
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/helpers/oauth-mocks.ts :30 'https://accounts.google.com/o/oauth2/v2/auth?client_id=test&redirect_uri=http://localhost:3000/callback&scope=https://www.googleapis.com/auth/spreadsheets&access_type=offline&response_type=code'
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/integration/analyze-sampling-context.test.ts :80 scopes: ['https://www.googleapis.com/auth/spreadsheets'],
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/integration/handler-chain.test.ts :18 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/integration/oauth-flow.test.ts :622 expect(googleScopes).toContain('https://www.googleapis.com/auth/spreadsheets');
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/live-api/auth/incremental-consent.live.test.ts :46 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/live-api/auth/incremental-consent.live.test.ts :51 expect(FULL_SCOPES).toContain('https://www.googleapis.com/auth/drive');
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/live-api/setup/live-api-client.ts :115 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/live-api/setup/live-api-client.ts :116 'https://www.googleapis.com/auth/drive',
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/live-api/setup/oauth-setup.ts :43 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/live-api/setup/oauth-setup.ts :44 'https://www.googleapis.com/auth/drive',
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/security/resource-indicators.test.ts :143 scope: 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/server/well-known.test.ts :46 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/server/well-known.test.ts :51 'https://www.googleapis.com/auth/drive',
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/services/google-api.test.ts :197 expect(DEFAULT_SCOPES).toContain('https://www.googleapis.com/auth/spreadsheets');
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/services/google-api.test.ts :201 DEFAULT_SCOPES.includes('https://www.googleapis.com/auth/drive') ||
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/simulation/ai-flow-simulator.ts :426 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/simulation/ai-flow-simulator.ts :428 'https://www.googleapis.com/auth/drive',
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/simulation/cat01-core-crud.test.ts :157 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/simulation/cat01-core-crud.test.ts :159 'https://www.googleapis.com/auth/drive',
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/simulation/cat05-visualization.test.ts :74 auth: { scopes: ['https://www.googleapis.com/auth/spreadsheets', 'https://www.googleapis.com/auth/drive', 'https://www.googleapis.com/auth/drive.file'] } as any,
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/simulation/cat06-collaboration.test.ts :71 auth: { scopes: ['https://www.googleapis.com/auth/spreadsheets', 'https://www.googleapis.com/auth/drive', 'https://www.googleapis.com/auth/drive.file'] } as any,
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/simulation/cat07-advanced-features.test.ts :50 auth: { scopes: ['https://www.googleapis.com/auth/spreadsheets', 'https://www.googleapis.com/auth/drive', 'https://www.googleapis.com/auth/drive.file'] } as any,
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/simulation/cat09-external-integrations.test.ts :122 auth: { scopes: ['https://www.googleapis.com/auth/spreadsheets', 'https://www.googleapis.com/auth/drive', 'https://www.googleapis.com/auth/bigquery', 'https://www.googleapis.com/auth/bigquery.readonly
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose khill1269-servalsheets-1bd5cd5/tests/simulation/cat13-elicitation-wizards.test.ts :77 'https://www.googleapis.com/auth/spreadsheets',
over-broad OAuth scope https://www.googleapis.com/auth/cloud-platform expected for this server's purpose khill1269-servalsheets-1bd5cd5/tools/gcloud-console-server/src/index.ts :34 'https://www.googleapis.com/auth/cloud-platform',
committed secret committed .env khill1269-servalsheets-1bd5cd5/.env.quickstart :1 env file shipped with populated values

other grade factors evidence elsewhere

recent drift +12 capability drift →

embed badge readme-ready

[![MCP Observatory risk grade](https://mcpobservatory.com/servers/github:khill1269/servalsheets/badge.svg)](https://mcpobservatory.com/servers/github:khill1269/servalsheets/security)

Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of khill1269.

khill1269/servalsheets

skills & prompt files 8

danger signals88

Navigate

Stream

Features

Display