npm JavaScript analyzed 4.0.1

@aaronsb/google-workspace-mcp

v4.0.1

MCP server for Google Workspace with progressive context disclosure and multi-account orchestration

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools

transport stdio · http verified reported listed in the official MCP registry counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals npm-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v4.0.1 · analyzer v33 · 4w ago

over-broad OAuth scope gmail.modify package/build/accounts/oauth.js :11 gmail: ['https://www.googleapis.com/auth/gmail.modify'],
over-broad OAuth scope https://www.googleapis.com/auth/drive package/build/accounts/oauth.js :12 drive: ['https://www.googleapis.com/auth/drive'],
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets package/build/accounts/oauth.js :14 sheets: ['https://www.googleapis.com/auth/spreadsheets'],
over-broad OAuth scope https://www.googleapis.com/auth/documents package/build/accounts/oauth.js :15 docs: ['https://www.googleapis.com/auth/documents'],

code evidence v4.0.1 · npm-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 144

fs package/build/accounts/credentials.js :1 import * as fs from 'node:fs/promises';
fs package/build/accounts/registry.js :1 import * as fs from 'node:fs/promises';
fs package/build/coverage/baseline.js :4 import * as fs from 'node:fs';
fs package/build/executor/file-output.js :9 import * as fs from 'node:fs/promises';
fs package/build/executor/workspace.js :8 import * as fs from 'node:fs/promises';
fs package/build/factory/generator.js :10 import { readFileSync, readdirSync } from 'node:fs';
fs package/build/google/client.js :19 import { createWriteStream } from 'node:fs';
fs package/build/google/descriptor.js :16 import { readFile } from 'node:fs/promises';
fs package/build/node-floor.js :15 import { writeSync } from 'node:fs';
fs package/build/server/handlers/workspace.js :8 import * as fs from 'node:fs/promises';
fs package/build/server/scratchpad/adapters/import-doc.js :8 import * as fs from 'node:fs/promises';
fs package/build/server/scratchpad/adapters/import-drive.js :5 import * as fs from 'node:fs/promises';

show 5 more

fs package/build/server/scratchpad/adapters/import-email.js :5 import * as fs from 'node:fs/promises';
fs package/build/server/scratchpad/adapters/send-workspace.js :5 import * as fs from 'node:fs/promises';
fs package/build/server/scratchpad/handler.js :7 import * as fs from 'node:fs/promises';
fs package/build/services/drive/patch.js :9 import * as fs from 'node:fs/promises';
fs package/build/services/gmail/mail.js :10 import { readFile } from 'node:fs/promises';

shell package/build/accounts/oauth.js :3 import { exec, execFile } from 'node:child_process';

net package/build/accounts/oauth.js :1 import { createServer } from 'node:http';
net package/build/accounts/token-service.js :44 const response = await fetch(GOOGLE_TOKEN_URL, {
net package/build/coverage/discover.js :60 const response = await fetch(service.discoveryUrl);

secrets package/build/server/handlers/accounts.js :68 const clientSecret = process.env.GOOGLE_CLIENT_SECRET;