npm JavaScript analyzed 1.10.0

@google-cloud/cloud-run-mcp

v1.10.0

npm

MCP server to deploy apps to Cloud Run

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools

transport stdio · streamable-http · http · sse counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals npm-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v1.10.0 · analyzer v32 · 34m ago

over-broad OAuth scope https://www.googleapis.com/auth/cloud-platform expected for this server's purpose package/constants.js :4 CLOUD_PLATFORM: 'https://www.googleapis.com/auth/cloud-platform',

code evidence v1.10.0 · npm-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 47

fs package/lib/deployment/helpers.js :18 import fs from 'fs';
fs package/lib/deployment/source-processor.js :18 import fs from 'node:fs';
fs package/lib/deployment/universal-maker.js :18 import fs from 'fs';
fs (weak) package/test/local/gemini-extension.test.js :3 import fs from 'node:fs';
fs (weak) package/test/local/npx.test.js :3 import fs from 'node:fs';
fs (weak) package/test/need-gcp/workflows/deployment-workflows.test.js :17 import fs from 'fs/promises';

shell package/lib/deployment/source-processor.js :22 import { exec } from 'node:child_process';
shell package/lib/deployment/universal-maker.js :17 import { exec } from 'child_process';
shell (weak) package/test/local/mcp-server-stdio.test.js :3 import { spawn } from 'child_process';
shell (weak) package/test/local/mcp-server-streamable-http.test.js :5 import { spawn } from 'child_process';

net package/lib/cloud-api/metadata.js :21 * @param {string} path - The metadata path to fetch (e.g., `/computeMetadata/v1/...`).
net (weak) package/test/local/mcp-server-streamable-http.test.js :101 const response = await fetch(

secrets package/lib/clients.js :21 const CLIENT_SECRET = process.env.GOOGLE_OAUTH_CLIENT_SECRET;