MCP servers for Gmail, Google Calendar/Docs/Sheets/Drive/Tasks, Slack, Hetzner, Vercel, RunPod, and weather. 416 workflow-level tools, 3,955 tests.
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio · http counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 07c5814 · analyzer v33 · 1w ago
danger signals30
- suspicious endpoint 93.184.216.34 oneKn8-smart-mcps-07c5814/packages/slack-smart/src/__tests__/files-client.test.ts :271
http.get("http://93.184.216.34/logo.png", () => - suspicious endpoint 93.184.216.34 oneKn8-smart-mcps-07c5814/packages/slack-smart/src/__tests__/safe-fetch.test.ts :145
http.get("https://93.184.216.34/a.bin", () => - suspicious endpoint 169.254.169.254 (cloud metadata) oneKn8-smart-mcps-07c5814/packages/slack-smart/src/__tests__/safe-fetch.test.ts :167
"http://169.254.169.254/latest/meta-data/", - over-broad OAuth scope gmail.modify oneKn8-smart-mcps-07c5814/packages/core/src/__tests__/google-oauth.test.ts :57
scopes: opts.scopes ?? ["https://www.googleapis.com/auth/gmail.modify"], - over-broad OAuth scope https://www.googleapis.com/auth/documents oneKn8-smart-mcps-07c5814/packages/docs-smart/src/__tests__/client.test.ts :58
"https://www.googleapis.com/auth/documents", - over-broad OAuth scope https://www.googleapis.com/auth/documents oneKn8-smart-mcps-07c5814/packages/docs-smart/src/bin/docs-smart-auth.ts :30
"https://www.googleapis.com/auth/documents https://www.googleapis.com/auth/drive.file"; - over-broad OAuth scope https://www.googleapis.com/auth/documents oneKn8-smart-mcps-07c5814/packages/docs-smart/src/client.ts :11
const DOCS_REQUIRED_SCOPE = "https://www.googleapis.com/auth/documents"; - over-broad OAuth scope gmail.modify oneKn8-smart-mcps-07c5814/packages/email-smart/src/__tests__/client-drafts.test.ts :46
scopes: ["https://www.googleapis.com/auth/gmail.modify"], - over-broad OAuth scope gmail.modify oneKn8-smart-mcps-07c5814/packages/email-smart/src/__tests__/client-modify.test.ts :46
scopes: ["https://www.googleapis.com/auth/gmail.modify"], - over-broad OAuth scope gmail.modify oneKn8-smart-mcps-07c5814/packages/email-smart/src/__tests__/client-read.test.ts :46
scopes: ["https://www.googleapis.com/auth/gmail.modify"], - over-broad OAuth scope https://mail.google.com/ oneKn8-smart-mcps-07c5814/packages/email-smart/src/__tests__/client-sharing-delete.test.ts :47
scopes: ["https://mail.google.com/"], - over-broad OAuth scope gmail.modify oneKn8-smart-mcps-07c5814/packages/email-smart/src/__tests__/client.test.ts :55
scopes: opts.scopes ?? ["https://www.googleapis.com/auth/gmail.modify"], - over-broad OAuth scope gmail.modify oneKn8-smart-mcps-07c5814/packages/email-smart/src/__tests__/send-tool.test.ts :297
"scope insufficient for account alice — re-run python3 ~/.santo-agent/bin/auth.py --account alice after expanding scope to gmail.modify", - over-broad OAuth scope https://mail.google.com/ oneKn8-smart-mcps-07c5814/packages/email-smart/src/bin/__tests__/email-smart-auth.test.ts :23
const MAIL_SCOPE = "https://mail.google.com/"; - over-broad OAuth scope https://mail.google.com/ oneKn8-smart-mcps-07c5814/packages/email-smart/src/bin/email-smart-auth.ts :44
"https://mail.google.com/", - over-broad OAuth scope gmail.modify oneKn8-smart-mcps-07c5814/packages/email-smart/src/client.ts :1201
`scope insufficient for account ${account} — re-run python3 ~/.santo-agent/bin/auth.py --account ${account} after expanding scope to gmail.modify`, - over-broad OAuth scope https://mail.google.com/ oneKn8-smart-mcps-07c5814/packages/email-smart/src/client.ts :1282
return mapScopeAuthError(err, account, "https://mail.google.com/"); - over-broad OAuth scope gmail.modify oneKn8-smart-mcps-07c5814/packages/flow-smart/src/watcher-script.ts :123
"https://www.googleapis.com/auth/gmail.modify", - over-broad OAuth scope https://www.googleapis.com/auth/drive oneKn8-smart-mcps-07c5814/packages/gdrive-smart/src/__tests__/client.test.ts :62
scopes: ["https://www.googleapis.com/auth/drive"], - over-broad OAuth scope https://www.googleapis.com/auth/drive oneKn8-smart-mcps-07c5814/packages/gdrive-smart/src/bin/gdrive-smart-auth.ts :29
export const GDRIVE_SCOPE = "https://www.googleapis.com/auth/drive"; - over-broad OAuth scope https://www.googleapis.com/auth/drive oneKn8-smart-mcps-07c5814/packages/gdrive-smart/src/client.ts :11
const GDRIVE_REQUIRED_SCOPE = "https://www.googleapis.com/auth/drive"; - over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets oneKn8-smart-mcps-07c5814/packages/sheets-smart/src/__tests__/client.test.ts :63
"https://www.googleapis.com/auth/spreadsheets", - over-broad OAuth scope https://www.googleapis.com/auth/drive oneKn8-smart-mcps-07c5814/packages/sheets-smart/src/__tests__/client.test.ts :64
"https://www.googleapis.com/auth/drive", - over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets oneKn8-smart-mcps-07c5814/packages/sheets-smart/src/bin/__tests__/sheets-smart-auth.test.ts :23
const SPREADSHEETS_SCOPE = "https://www.googleapis.com/auth/spreadsheets"; - over-broad OAuth scope https://www.googleapis.com/auth/drive oneKn8-smart-mcps-07c5814/packages/sheets-smart/src/bin/__tests__/sheets-smart-auth.test.ts :24
const DRIVE_SCOPE = "https://www.googleapis.com/auth/drive"; - over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets oneKn8-smart-mcps-07c5814/packages/sheets-smart/src/bin/sheets-smart-auth.ts :30
"https://www.googleapis.com/auth/spreadsheets", - over-broad OAuth scope https://www.googleapis.com/auth/drive oneKn8-smart-mcps-07c5814/packages/sheets-smart/src/bin/sheets-smart-auth.ts :31
"https://www.googleapis.com/auth/drive", - over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets oneKn8-smart-mcps-07c5814/packages/sheets-smart/src/client.ts :13
"https://www.googleapis.com/auth/spreadsheets", - over-broad OAuth scope https://www.googleapis.com/auth/drive oneKn8-smart-mcps-07c5814/packages/sheets-smart/src/client.ts :14
"https://www.googleapis.com/auth/drive", - committed secret Slack token oneKn8-smart-mcps-07c5814/packages/slack-smart/src/__tests__/client.test.ts :90
xoxp-u…(15 chars, redacted)
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 551
filesystem 74
- fs (weak) oneKn8-smart-mcps-07c5814/packages/apps-script-smart/src/__tests__/client.test.ts :12
import * as fs from "node:fs"; - fs oneKn8-smart-mcps-07c5814/packages/apps-script-smart/src/bin/apps-script-smart-auth.ts :2
import * as fs from "node:fs"; - fs (weak) oneKn8-smart-mcps-07c5814/packages/calendar-smart/src/__tests__/client.test.ts :13
import * as fs from "node:fs"; - fs (weak) oneKn8-smart-mcps-07c5814/packages/calendar-smart/src/bin/__tests__/calendar-smart-auth.test.ts :12
import * as fs from "node:fs"; - fs oneKn8-smart-mcps-07c5814/packages/calendar-smart/src/bin/calendar-smart-auth.ts :2
import * as fs from "node:fs"; - fs (weak) oneKn8-smart-mcps-07c5814/packages/core/src/__tests__/auth.test.ts :2
import { writeFileSync, mkdirSync, rmSync } from "node:fs"; - fs (weak) oneKn8-smart-mcps-07c5814/packages/core/src/__tests__/google-oauth.test.ts :13
import * as fs from "node:fs"; - fs oneKn8-smart-mcps-07c5814/packages/core/src/auth.ts :1
import { existsSync, readFileSync } from "node:fs"; - fs oneKn8-smart-mcps-07c5814/packages/core/src/dotenv.ts :1
import { existsSync, readFileSync } from "node:fs"; - fs oneKn8-smart-mcps-07c5814/packages/core/src/google-oauth.ts :1
import * as fs from "node:fs"; - fs (weak) oneKn8-smart-mcps-07c5814/packages/docs-smart/src/__tests__/client.test.ts :13
import * as fs from "node:fs"; - fs oneKn8-smart-mcps-07c5814/packages/docs-smart/src/bin/docs-smart-auth.ts :2
import * as fs from "node:fs";
show 28 more
- fs (weak) oneKn8-smart-mcps-07c5814/packages/drive-smart/src/__tests__/roots.test.ts :2
import * as fs from "node:fs"; - fs (weak) oneKn8-smart-mcps-07c5814/packages/drive-smart/src/__tests__/scan-index.test.ts :2
import * as fs from "node:fs"; - fs oneKn8-smart-mcps-07c5814/packages/drive-smart/src/config.ts :1
import { existsSync, readFileSync } from "node:fs"; - fs oneKn8-smart-mcps-07c5814/packages/drive-smart/src/index-store.ts :1
import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"; - fs oneKn8-smart-mcps-07c5814/packages/drive-smart/src/roots.ts :1
import { existsSync, readdirSync } from "node:fs"; - fs oneKn8-smart-mcps-07c5814/packages/drive-smart/src/scan.ts :1
import { lstatSync, readdirSync, statSync } from "node:fs"; - fs (weak) oneKn8-smart-mcps-07c5814/packages/drive-smart/src/tools/__tests__/cleanup-tool.test.ts :2
import * as fs from "node:fs"; - fs (weak) oneKn8-smart-mcps-07c5814/packages/drive-smart/src/tools/__tests__/duplicates-tool.test.ts :2
import * as fs from "node:fs"; - fs (weak) oneKn8-smart-mcps-07c5814/packages/drive-smart/src/tools/__tests__/largest-tool.test.ts :2
import * as fs from "node:fs"; - fs (weak) oneKn8-smart-mcps-07c5814/packages/drive-smart/src/tools/__tests__/roots-tool.test.ts :2
import * as fs from "node:fs"; - fs (weak) oneKn8-smart-mcps-07c5814/packages/drive-smart/src/tools/__tests__/scan-tool.test.ts :2
import * as fs from "node:fs"; - fs (weak) oneKn8-smart-mcps-07c5814/packages/drive-smart/src/tools/__tests__/search-tool.test.ts :2
import * as fs from "node:fs"; - fs (weak) oneKn8-smart-mcps-07c5814/packages/drive-smart/src/tools/__tests__/stats-tool.test.ts :2
import * as fs from "node:fs"; - fs (weak) oneKn8-smart-mcps-07c5814/packages/email-smart/src/__tests__/account.test.ts :2
import * as fs from "node:fs"; - fs (weak) oneKn8-smart-mcps-07c5814/packages/email-smart/src/__tests__/audit-tool.test.ts :8
import * as fs from "node:fs"; - fs (weak) oneKn8-smart-mcps-07c5814/packages/email-smart/src/__tests__/audit.test.ts :8
import * as fs from "node:fs"; - fs (weak) oneKn8-smart-mcps-07c5814/packages/email-smart/src/__tests__/bulk-send-tool.test.ts :9
import * as fs from "node:fs"; - fs (weak) oneKn8-smart-mcps-07c5814/packages/email-smart/src/__tests__/bulk-unsubscribe-tool.test.ts :9
import * as fs from "node:fs"; - fs (weak) oneKn8-smart-mcps-07c5814/packages/email-smart/src/__tests__/client-drafts.test.ts :13
import * as fs from "node:fs"; - fs (weak) oneKn8-smart-mcps-07c5814/packages/email-smart/src/__tests__/client-modify.test.ts :13
import * as fs from "node:fs"; - fs (weak) oneKn8-smart-mcps-07c5814/packages/email-smart/src/__tests__/client-read.test.ts :13
import * as fs from "node:fs"; - fs (weak) oneKn8-smart-mcps-07c5814/packages/email-smart/src/__tests__/client-settings.test.ts :13
import * as fs from "node:fs"; - fs (weak) oneKn8-smart-mcps-07c5814/packages/email-smart/src/__tests__/client-sharing-delete.test.ts :13
import * as fs from "node:fs"; - fs (weak) oneKn8-smart-mcps-07c5814/packages/email-smart/src/__tests__/client.test.ts :13
import * as fs from "node:fs"; - fs (weak) oneKn8-smart-mcps-07c5814/packages/email-smart/src/__tests__/compose-thread-tool.test.ts :9
import * as fs from "node:fs"; - fs (weak) oneKn8-smart-mcps-07c5814/packages/email-smart/src/__tests__/delegates-tool.test.ts :2
import * as fs from "node:fs"; - fs (weak) oneKn8-smart-mcps-07c5814/packages/email-smart/src/__tests__/drafts-tool.test.ts :9
import * as fs from "node:fs"; - fs (weak) oneKn8-smart-mcps-07c5814/packages/email-smart/src/__tests__/filters-tool.test.ts :2
import * as fs from "node:fs";
34 more not shown — this panel samples each group; the count above is the real total.
network 16
- net oneKn8-smart-mcps-07c5814/packages/apps-script-smart/src/bin/apps-script-smart-auth.ts :3
import * as http from "node:http"; - net oneKn8-smart-mcps-07c5814/packages/calendar-smart/src/bin/calendar-smart-auth.ts :3
import * as http from "node:http"; - net oneKn8-smart-mcps-07c5814/packages/core/src/google-oauth.ts :231
response = await fetch(TOKEN_URL, { - net oneKn8-smart-mcps-07c5814/packages/core/src/http.ts :110
return await fetch(opts.url, { - net oneKn8-smart-mcps-07c5814/packages/docs-smart/src/bin/docs-smart-auth.ts :3
import * as http from "node:http"; - net oneKn8-smart-mcps-07c5814/packages/email-smart/src/bin/email-smart-auth.ts :3
import * as http from "node:http"; - net oneKn8-smart-mcps-07c5814/packages/email-smart/src/tools/bulk-unsubscribe.ts :204
return await fetch(url, { ...init, signal: ctrl.signal }); - net (weak) oneKn8-smart-mcps-07c5814/packages/gdrive-smart/src/__tests__/media.test.ts :25
// The media layer does RAW fetch (binary / multipart), so these tests stub the - net oneKn8-smart-mcps-07c5814/packages/gdrive-smart/src/bin/gdrive-smart-auth.ts :3
import * as http from "node:http"; - net oneKn8-smart-mcps-07c5814/packages/gdrive-smart/src/media.ts :159
const res = await fetch(url, { - net oneKn8-smart-mcps-07c5814/packages/sheets-smart/src/bin/sheets-smart-auth.ts :3
import * as http from "node:http"; - net oneKn8-smart-mcps-07c5814/packages/slack-smart/src/client.ts :863
res = await fetch(url, {
show 4 more
- net oneKn8-smart-mcps-07c5814/packages/slack-smart/src/safe-fetch.ts :2
import { isIP } from "node:net"; - net oneKn8-smart-mcps-07c5814/packages/tasks-smart/src/bin/tasks-smart-auth.ts :3
import * as http from "node:http"; - net oneKn8-smart-mcps-07c5814/packages/vercel-smart/src/client.ts :467
res = await fetch(finalUrl, { - net oneKn8-smart-mcps-07c5814/packages/vercel-smart/src/tools/canonical.ts :330
const res = await fetch(url, { redirect: "manual" });
secrets 12
- secrets (weak) oneKn8-smart-mcps-07c5814/packages/core/src/__tests__/auth.test.ts :17
delete process.env.TEST_KEY; - secrets (weak) oneKn8-smart-mcps-07c5814/packages/hetzner-smart/src/__tests__/client.test.ts :32
savedToken = process.env.HETZNER_API_TOKEN; - secrets (weak) oneKn8-smart-mcps-07c5814/packages/runpod-smart/src/__tests__/client.test.ts :24
savedKey = process.env.RUNPOD_API_KEY; - secrets (weak) oneKn8-smart-mcps-07c5814/packages/slack-smart/src/__tests__/client.test.ts :30
savedUserToken = process.env.SLACK_USER_TOKEN; - secrets (weak) oneKn8-smart-mcps-07c5814/packages/slack-smart/src/__tests__/conversations-client.test.ts :23
savedUserToken = process.env.SLACK_USER_TOKEN; - secrets (weak) oneKn8-smart-mcps-07c5814/packages/slack-smart/src/__tests__/files-client.test.ts :32
savedUserToken = process.env.SLACK_USER_TOKEN; - secrets (weak) oneKn8-smart-mcps-07c5814/packages/slack-smart/src/__tests__/messages-client.test.ts :27
savedUserToken = process.env.SLACK_USER_TOKEN; - secrets (weak) oneKn8-smart-mcps-07c5814/packages/slack-smart/src/__tests__/new-methods-client.test.ts :29
savedUserToken = process.env.SLACK_USER_TOKEN; - secrets (weak) oneKn8-smart-mcps-07c5814/packages/slack-smart/src/__tests__/pins-dnd-misc-client.test.ts :25
savedUserToken = process.env.SLACK_USER_TOKEN; - secrets (weak) oneKn8-smart-mcps-07c5814/packages/slack-smart/src/__tests__/search-reactions-client.test.ts :25
savedUserToken = process.env.SLACK_USER_TOKEN; - secrets (weak) oneKn8-smart-mcps-07c5814/packages/slack-smart/src/__tests__/users-client.test.ts :23
savedUserToken = process.env.SLACK_USER_TOKEN; - secrets (weak) oneKn8-smart-mcps-07c5814/packages/vercel-smart/src/__tests__/client.test.ts :23
savedToken = process.env.VERCEL_TOKEN;
declared dependencies 8
- @eslint/js@^9.39.4
- @types/node@^22.0.0
- @vitest/coverage-v8@^2.1.0
- eslint@^9.0.0
- msw@^2.6.0
- typescript@^5.7.0
- typescript-eslint@^8.59.3
- vitest@^2.1.0