MCP servers for Gmail, Google Calendar/Docs/Sheets/Drive/Tasks, Slack, Hetzner, Vercel, RunPod, and weather. 416 workflow-level tools, 3,955 tests.
B low
- capability exposure inferred + 10
- tool safety inferred + 12
inferred
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
grade last moved 1w ago · see ecosystem CVEs →
Inferred surface — each links to servers holding it:
No known CVEs for this server.
- high dangerous code
committed secret: Slack token
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 07c5814 · analyzer v33 · 1w ago
danger signals30
- suspicious endpoint 93.184.216.34 oneKn8-smart-mcps-07c5814/packages/slack-smart/src/__tests__/files-client.test.ts :271
http.get("http://93.184.216.34/logo.png", () => - suspicious endpoint 93.184.216.34 oneKn8-smart-mcps-07c5814/packages/slack-smart/src/__tests__/safe-fetch.test.ts :145
http.get("https://93.184.216.34/a.bin", () => - suspicious endpoint 169.254.169.254 (cloud metadata) oneKn8-smart-mcps-07c5814/packages/slack-smart/src/__tests__/safe-fetch.test.ts :167
"http://169.254.169.254/latest/meta-data/", - over-broad OAuth scope gmail.modify oneKn8-smart-mcps-07c5814/packages/core/src/__tests__/google-oauth.test.ts :57
scopes: opts.scopes ?? ["https://www.googleapis.com/auth/gmail.modify"], - over-broad OAuth scope https://www.googleapis.com/auth/documents oneKn8-smart-mcps-07c5814/packages/docs-smart/src/__tests__/client.test.ts :58
"https://www.googleapis.com/auth/documents", - over-broad OAuth scope https://www.googleapis.com/auth/documents oneKn8-smart-mcps-07c5814/packages/docs-smart/src/bin/docs-smart-auth.ts :30
"https://www.googleapis.com/auth/documents https://www.googleapis.com/auth/drive.file"; - over-broad OAuth scope https://www.googleapis.com/auth/documents oneKn8-smart-mcps-07c5814/packages/docs-smart/src/client.ts :11
const DOCS_REQUIRED_SCOPE = "https://www.googleapis.com/auth/documents"; - over-broad OAuth scope gmail.modify oneKn8-smart-mcps-07c5814/packages/email-smart/src/__tests__/client-drafts.test.ts :46
scopes: ["https://www.googleapis.com/auth/gmail.modify"], - over-broad OAuth scope gmail.modify oneKn8-smart-mcps-07c5814/packages/email-smart/src/__tests__/client-modify.test.ts :46
scopes: ["https://www.googleapis.com/auth/gmail.modify"], - over-broad OAuth scope gmail.modify oneKn8-smart-mcps-07c5814/packages/email-smart/src/__tests__/client-read.test.ts :46
scopes: ["https://www.googleapis.com/auth/gmail.modify"], - over-broad OAuth scope https://mail.google.com/ oneKn8-smart-mcps-07c5814/packages/email-smart/src/__tests__/client-sharing-delete.test.ts :47
scopes: ["https://mail.google.com/"], - over-broad OAuth scope gmail.modify oneKn8-smart-mcps-07c5814/packages/email-smart/src/__tests__/client.test.ts :55
scopes: opts.scopes ?? ["https://www.googleapis.com/auth/gmail.modify"], - over-broad OAuth scope gmail.modify oneKn8-smart-mcps-07c5814/packages/email-smart/src/__tests__/send-tool.test.ts :297
"scope insufficient for account alice — re-run python3 ~/.santo-agent/bin/auth.py --account alice after expanding scope to gmail.modify", - over-broad OAuth scope https://mail.google.com/ oneKn8-smart-mcps-07c5814/packages/email-smart/src/bin/__tests__/email-smart-auth.test.ts :23
const MAIL_SCOPE = "https://mail.google.com/"; - over-broad OAuth scope https://mail.google.com/ oneKn8-smart-mcps-07c5814/packages/email-smart/src/bin/email-smart-auth.ts :44
"https://mail.google.com/", - over-broad OAuth scope gmail.modify oneKn8-smart-mcps-07c5814/packages/email-smart/src/client.ts :1201
`scope insufficient for account ${account} — re-run python3 ~/.santo-agent/bin/auth.py --account ${account} after expanding scope to gmail.modify`, - over-broad OAuth scope https://mail.google.com/ oneKn8-smart-mcps-07c5814/packages/email-smart/src/client.ts :1282
return mapScopeAuthError(err, account, "https://mail.google.com/"); - over-broad OAuth scope gmail.modify oneKn8-smart-mcps-07c5814/packages/flow-smart/src/watcher-script.ts :123
"https://www.googleapis.com/auth/gmail.modify", - over-broad OAuth scope https://www.googleapis.com/auth/drive oneKn8-smart-mcps-07c5814/packages/gdrive-smart/src/__tests__/client.test.ts :62
scopes: ["https://www.googleapis.com/auth/drive"], - over-broad OAuth scope https://www.googleapis.com/auth/drive oneKn8-smart-mcps-07c5814/packages/gdrive-smart/src/bin/gdrive-smart-auth.ts :29
export const GDRIVE_SCOPE = "https://www.googleapis.com/auth/drive"; - over-broad OAuth scope https://www.googleapis.com/auth/drive oneKn8-smart-mcps-07c5814/packages/gdrive-smart/src/client.ts :11
const GDRIVE_REQUIRED_SCOPE = "https://www.googleapis.com/auth/drive"; - over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets oneKn8-smart-mcps-07c5814/packages/sheets-smart/src/__tests__/client.test.ts :63
"https://www.googleapis.com/auth/spreadsheets", - over-broad OAuth scope https://www.googleapis.com/auth/drive oneKn8-smart-mcps-07c5814/packages/sheets-smart/src/__tests__/client.test.ts :64
"https://www.googleapis.com/auth/drive", - over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets oneKn8-smart-mcps-07c5814/packages/sheets-smart/src/bin/__tests__/sheets-smart-auth.test.ts :23
const SPREADSHEETS_SCOPE = "https://www.googleapis.com/auth/spreadsheets"; - over-broad OAuth scope https://www.googleapis.com/auth/drive oneKn8-smart-mcps-07c5814/packages/sheets-smart/src/bin/__tests__/sheets-smart-auth.test.ts :24
const DRIVE_SCOPE = "https://www.googleapis.com/auth/drive"; - over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets oneKn8-smart-mcps-07c5814/packages/sheets-smart/src/bin/sheets-smart-auth.ts :30
"https://www.googleapis.com/auth/spreadsheets", - over-broad OAuth scope https://www.googleapis.com/auth/drive oneKn8-smart-mcps-07c5814/packages/sheets-smart/src/bin/sheets-smart-auth.ts :31
"https://www.googleapis.com/auth/drive", - over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets oneKn8-smart-mcps-07c5814/packages/sheets-smart/src/client.ts :13
"https://www.googleapis.com/auth/spreadsheets", - over-broad OAuth scope https://www.googleapis.com/auth/drive oneKn8-smart-mcps-07c5814/packages/sheets-smart/src/client.ts :14
"https://www.googleapis.com/auth/drive", - committed secret Slack token oneKn8-smart-mcps-07c5814/packages/slack-smart/src/__tests__/client.test.ts :90
xoxp-u…(15 chars, redacted)
[](https://mcpobservatory.com/servers/github:oneKn8/smart-mcps/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of oneKn8.