Google Workspace Unlimited MCP Server

google-workspace-unlimited PyPI v3.0.0

Published by dipseth — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.

Comprehensive MCP server for Google Workspace integration - 72+ tools across Gmail, Drive, Docs, Sheets, Slides, Calendar, Forms, Chat, and Photos with OAuth 2.1 + PKCE authentication

View on PyPI ↗ Repository ↗ Raw report (JSON) ↗

Trust grade

87/100

Last scanned 2026-09-04 get badge →

Trust

B · 87/100

Adoption risk for you: the threat score, then adjusted down for blast radius, publisher verification and how much the scan could see. Deterministic; every point is auditable.

Capability

Critical

Blast radius if it went rogue — what the server’s tools could reach. Independent of trust.

Coverage

Source

How much the scan could actually inspect. Shallow coverage is stated, never hidden.

B Why this grade threat 98 − adoption risk = 87/100

The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.

1. Threat score — 100 − 2.2 = 98. What the published surface and source actually contain:

Points	What was found	Category
−2.2	Hardcoded Google API key in test/example/packaging ×4 MTC-SRC-008	exfiltration

2. Client adoption risk — 98 − 11 = 87. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:

Points	Adoption-risk factor
−10	capability blast radius (critical) — client exposure if the model is manipulated
−1	publisher verification (public source) — no provenance, but the source is public and inspectable

Capability observations and info notes are shown under Findings but never scored. Open any row's finding below for the file, line and evidence behind a deduction.

Findings 9

critical Completed toxic-flow trifecta across toolsMTC-FLOW-002

This server (without client built-ins) exposes a complete data-exfiltration chain: export_and_download_presentation → list_drive_items → send_smart_email. Untrusted input is ingested, private data is read, and it can be sent to an external sink via the agent composing the tools (→). Static analysis proves the primitive exists, not that a specific run will occur.

Fix: Remove one leg of the trifecta: isolate untrusted-input tools from secret-reading tools and from egress tools, or require human approval between them.

Location: flow export_and_download_presentation → list_drive_items → send_smart_email

high Shell/command execution in server code (adapters/module_wrapper/domain_mixin.py)MTC-SRC-002

In the server's implementation (`adapters/module_wrapper/domain_mixin.py:220`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: y: result = subprocess.run( [sys.executable, "-m", "pip", "install", install_target],

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server adapters/module_wrapper/domain_mixin.py

high Shell/command execution in server code (config/qdrant_docker.py)MTC-SRC-002

In the server's implementation (`config/qdrant_docker.py:65`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: result = subprocess.run( ["docker", "info"], capture_output=True, tim

Location: server config/qdrant_docker.py

high Shell/command execution in server code (gmail/mjml_wrapper.py)MTC-SRC-002

In the server's implementation (`gmail/mjml_wrapper.py:77`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: result = subprocess.run( ["mjml", "--stdin", "--stdout"], input=mjml_source,

Location: server gmail/mjml_wrapper.py

low Hardcoded Google API key in test/example/packaging (scripts/test_button_params.py)MTC-SRC-008

A hardcoded Google API key (a public Firebase/web API key) appears in `scripts/test_button_params.py:27`. Verify whether this is a real credential; if so, remove and rotate it.

Evidence: Google API key: AIza…(redacted)

Fix: Remove the secret, rotate it, and load credentials from the environment or a secret store.

Location: server scripts/test_button_params.py

low Hardcoded Google API key in test/example/packaging (scripts/test_cache_webhook_demo.py)MTC-SRC-008

A hardcoded Google API key (a public Firebase/web API key) appears in `scripts/test_cache_webhook_demo.py:23`. Verify whether this is a real credential; if so, remove and rotate it.

Evidence: Google API key: AIza…(redacted)

Fix: Remove the secret, rotate it, and load credentials from the environment or a secret store.

Location: server scripts/test_cache_webhook_demo.py

low Hardcoded Google API key in test/example/packaging (scripts/test_textparagraph_markdown.py)MTC-SRC-008

A hardcoded Google API key (a public Firebase/web API key) appears in `scripts/test_textparagraph_markdown.py:24`. Verify whether this is a real credential; if so, remove and rotate it.

Evidence: Google API key: AIza…(redacted)

Fix: Remove the secret, rotate it, and load credentials from the environment or a secret store.

Location: server scripts/test_textparagraph_markdown.py

low Hardcoded Google API key in test/example/packaging (scripts/test_variation_webhook_demo.py)MTC-SRC-008

A hardcoded Google API key (a public Firebase/web API key) appears in `scripts/test_variation_webhook_demo.py:23`. Verify whether this is a real credential; if so, remove and rotate it.

Evidence: Google API key: AIza…(redacted)

Fix: Remove the secret, rotate it, and load credentials from the environment or a secret store.

Location: server scripts/test_variation_webhook_demo.py

low Shell/command execution in packaging/dev tooling (scripts/test_v2_card_builder.py)MTC-SRC-002

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/test_v2_card_builder.py:96`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: h}", ] result = subprocess.run(cmd, capture_output=True, text=True) return result def main(): print("=

Location: server scripts/test_v2_card_builder.py

Tools 61

Each tool and what it can reach — statically extracted from the published source.

export_and_download_presentationingests untrusted input
fetchingests untrusted input
list_drive_itemsreads sensitive data
send_smart_emailnetwork egress
add_questions_to_formno sensitive capability
add_slideno sensitive capability
analyze_sentimentno sensitive capability
check_drive_authno sensitive capability
create_calendarno sensitive capability
create_drive_fileno sensitive capability

Show 51 more tools ↓

create_formno sensitive capability
create_gmail_filterno sensitive capability
create_presentationno sensitive capability
create_sheetno sensitive capability
create_spreadsheetno sensitive capability
delete_gmail_filterno sensitive capability
draft_gmail_forwardno sensitive capability
draft_gmail_messageno sensitive capability
draft_gmail_replyno sensitive capability
forward_gmail_messageno sensitive capability
get_eventno sensitive capability
get_formno sensitive capability
get_form_responseno sensitive capability
get_gmail_filterno sensitive capability
get_gmail_thread_contentno sensitive capability
get_module_componentno sensitive capability
get_photo_detailsno sensitive capability
get_photos_library_infono sensitive capability
get_presentation_infono sensitive capability
get_spreadsheet_infono sensitive capability
gmail_draft_apply_editsno sensitive capability
gmail_draft_discardno sensitive capability
gmail_draft_saveno sensitive capability
gmail_draft_sendno sensitive capability
list_calendarsno sensitive capability
list_eventsno sensitive capability
list_form_responsesno sensitive capability
list_gmail_filtersno sensitive capability
list_messagesno sensitive capability
list_module_componentsno sensitive capability
list_photos_albumsno sensitive capability
list_spreadsheetsno sensitive capability
list_thingsno sensitive capability
list_wrapped_modulesno sensitive capability
manage_drive_filesno sensitive capability
manage_gmail_labelno sensitive capability
modify_gmail_message_labelsno sensitive capability
modify_sheet_valuesno sensitive capability
move_events_between_calendarsno sensitive capability
photos_batch_detailsno sensitive capability
photos_performance_statsno sensitive capability
publish_form_publiclyno sensitive capability
read_sheet_valuesno sensitive capability
reply_to_gmail_messageno sensitive capability
search_messagesno sensitive capability
send_gmail_messageno sensitive capability
set_form_publish_stateno sensitive capability
share_drive_filesno sensitive capability
update_form_questionsno sensitive capability
update_slide_contentno sensitive capability
wrap_moduleno sensitive capability

Toxic flows 1

Cross-tool combinations that form a data-exfiltration primitive (untrusted input → sensitive source → external sink).

What this scan could not see

Tools were statically extracted from the published source (61 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".

Versions 10

Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.

Version	Score	Findings	Engine	Scanned
`v3.0.0` latest	B 87/100	9	1.13.0	2026-09-04
`v2.14.0`	B 87/100	9	1.13.0	2026-09-01
`v2.13.0`	B 87/100	9	1.13.0	2026-08-31
`v2.11.1`	B 87/100	9	1.13.0	2026-08-27
`v2.11.0`	B 87/100	9	1.13.0	2026-08-25

Show 5 more versions ↓

`v2.10.0`	B 87/100	9	1.12.1	2026-08-21
`v2.9.1`	B 87/100	9	1.12.1	2026-08-20
`v2.9.0`	B 87/100	9	1.12.1	2026-08-19
`v2.8.0`	B 87/100	9	1.12.1	2026-08-18
`v2.7.0`	B 87/100	9	1.12.1	2026-08-17

Embed this score

Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.

Markdown (GitHub README)

[![MCP Trust Score](https://mcptrustchecker.com/registry/google-workspace-unlimited/badge.svg)](https://mcptrustchecker.com/registry/google-workspace-unlimited)

HTML

<a href="https://mcptrustchecker.com/registry/google-workspace-unlimited"><img src="https://mcptrustchecker.com/registry/google-workspace-unlimited/badge.svg" alt="MCP Trust Score" height="20"></a>

Prefer shields.io styling? Point it at https://mcptrustchecker.com/registry/google-workspace-unlimited/badge.json via https://img.shields.io/endpoint?url=…

Verify this score yourself

The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.

npx mcptrustchecker scan google-workspace-unlimited --online --registry pypi

Use the free API → How scoring works

More in AI, Memory & Reasoning

483 Risk Radar by Health AI Remote

https://radar.healthai.com/api/mcp

FDA device & vehicle recall risk for AI agents: recall history, MAUDE trend, risk score.

AI, Memory & Reasoning Score 100/100 0 findings Cap. Minimal

Agent402 Source verified npm

agent402-mcp

Open-source MCP server exposing Agent402.Tools' catalog — 500+ strong: 400+ self-hostable tools + 100 multi-tool skill packs (security-audit, trend-analysis, structured-scrape, decode-blob, forecasting-bake-off) for AI agents — browser, web search & answe

AI, Memory & Reasoning Score 100/100 0 findings 878/wk Cap. Minimal

Agentsmd Memory Source verified npm

agentsmd-memory

Zero-dependency MCP server that gives AI agents a self-updating project memory in AGENTS.md. Returns merge instructions instead of mutating state, so every change is a reviewable diff.

AI, Memory & Reasoning Score 100/100 0 findings 105/wk Cap. Minimal

Apps Official npm

@n8n/mcp-apps

MCP Apps UI resources and server helpers for n8n

AI, Memory & Reasoning Score 100/100 0 findings 39k/wk Cap. Minimal

Bookstack Source verified npm

bookstack-mcp-server

MCP server providing comprehensive access to BookStack knowledge management system

AI, Memory & Reasoning Score 100/100 0 findings 413/wk Cap. Minimal

Bragdoc Source verified npm

bragdoc-mcp

MCP server for tracking achievements with STAR methodology