Skills/PyPI/mcp-gee-sweet

mcp-gee-sweet@0.9.6

CAUTION· not started

Publisher claims: "MCP server for Google Workspace — Sheets, Drive, Docs (HTML or Markdown), Calendar, and Gmail." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher khuisman · publishing for 146 daysInstalls 14,151Last detonated 37 min ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
AUTH_METHODCREDENTIALS_CONFIGCREDENTIALS_PATHGOOGLE_APPLICATION_CREDENTIALSGOOGLE_OAUTH_CLIENT_IDGOOGLE_OAUTH_CLIENT_SECRETGOOGLE_OAUTH_REFRESH_TOKENMCP_SERVER_TOKENOAUTH_CONSENT_TIMEOUT_SECONDSTOKEN_PATH or --from-refresh-token / --sender-token / --qa-tokenConfiguration, not credentials: ACCESS_LOG_FILE, CACHE_TTL, DEBUG_LEVEL, DRIVE_FOLDER_ID, ENABLED_TOOLS, FASTMCP_HOST, FASTMCP_PORT, GMAIL_SEND, GMAIL_SEND_WARN_RECIPIENTS, HTTP_TIMEOUT_SECONDS, LIST_ALL_EVENTS_MAX_CONCURRENCY, LOG_FILE, MAX_TOOL_RESPONSE_CHARS, SERVICE_ACCOUNT_PATH
Where it talks to
no vendor host named in the codeAlso gstatic.com, google.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names gstatic.com, google.com as well as its own vendor. The guard injects AUTH_METHOD, CREDENTIALS_CONFIG, CREDENTIALS_PATH, GOOGLE_APPLICATION_CREDENTIALS, GOOGLE_OAUTH_CLIENT_ID, GOOGLE_OAUTH_CLIENT_SECRET, GOOGLE_OAUTH_REFRESH_TOKEN, MCP_SERVER_TOKEN, OAUTH_CONSENT_TIMEOUT_SECONDS, TOKEN_PATH only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- uvx mcp-gee-sweet

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-14 and scored it 79/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathsscripts/qa_gmail_fixtures.py:29 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files--env-file PATH .env to read TEST_GMAIL_* from and write IDs toFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/oauth_setup.py:38 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesdotenv.load_dotenv(Path(__file__).parent.parent / "src" / "mcp_gee_sweet" / ".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/qa_gmail_fixtures.py:30 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files(default: <repo root>/.env)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/qa_gmail_fixtures.py:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesthe script is idempotent. Fixture IDs are written to the `.env` file only,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsCLAUDE.md:133 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…-response-size-cap-reevaluation-519.md` `__init__.py` loads `src/mcp_gee_sweet/.env` via `python-dotenv` before importing `server`, so env vars from that file are …Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/qa_gmail_fixtures.py:306 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# .env handlingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/oauth_setup.py:33 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Bootstrap package env so CREDENTIALS_PATH / TOKEN_PATH are resolved from .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/build_mcpb.py:13 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filessrc/mcp_gee_sweet/.env, and a deny-list that misses a new one would ship it;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/sync_slot_config.sh:20 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# - .env, src/mcp_gee_sweet/.env, .claude/settings.local.json: copied only whenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsCLAUDE.md:167 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…here stderr is dropped by the host). Runtime config lives in `src/mcp_gee_sweet/.env` (gitignored); template at `src/mcp_gee_sweet/.env.template`. **Tool registrat…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/sync_slot_config.sh:21 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# missing. A slot may hold deliberate local edits; .env propagation is #679.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/qa_revision_temp_doc_parent.py:11 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filessrc/mcp_gee_sweet/.env), and sets the connection's identity flag by --identity:Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/qa_revision_temp_doc_parent.py:29 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesimport mcp_gee_sweet # noqa: F401 (loads src/mcp_gee_sweet/.env)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/qa_gmail_fixtures.py:22 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesuv run python scripts/qa_gmail_fixtures.py seed # inserted fixtures + label + .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandscripts/qa_browser.sh:140 · File permission modification command — agent changes file ownership/permissionschmod 700 "$STATE_DIR"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandscripts/qa_browser.sh:146 · File permission modification command — agent changes file ownership/permissionschmod 700 "$PROFILE"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathssrc/mcp_gee_sweet/__init__.py:7 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# passes MCP_SERVER_TOKEN through as "" when its own .env doesn't set it.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagescripts/qa_browser.sh:18 · npx invocation of non-well-known package — may execute untrusted code# Why `install` exists: N `npx -y` processes starting together on a cold cacheFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathssrc/mcp_gee_sweet/local_files.py:85 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesstr(Path(__file__).parent / ".env"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathsMakefile:52 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesdev-logs: ## Tail MCP server log file (requires LOG_FILE set in src/mcp_gee_sweet/.env).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/build_mcpb.py:138 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandscripts/qa_browser.sh:170 · Process kill command — agent can terminate processeskill "$pid"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/mcp_gee_sweet/tools/cache.py:39 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesset CACHE_TTL in the environment/.env for the startup default.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp_gee_sweet/__init__.py:10 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesload_dotenv(Path(__file__).parent / ".env") # env var > src/mcp_gee_sweet/.env > defaultFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/kai_status.py:58 · Python subprocess execution detectedproc = subprocess.run(cmd, cwd=cwd, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Remote installer piped to shellDockerfile:21 · Remote installer piped to shellRUN curl -LsSf https://astral.sh/uv/install.sh | shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
HIGH
Access to sensitive file pathssrc/mcp_gee_sweet/local_files.py:78 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""The server's own files, as configured: credentials, `.env`, ADC key files,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagescripts/setup_team.sh:45 · npx invocation of non-well-known package — may execute untrusted code# Playwright servers at the same moment: concurrent `npx -y` runs on a coldFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Access to sensitive file pathsMakefile:57 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filestail -f $$(grep -E '^ACCESS_LOG_FILE=' src/mcp_gee_sweet/.env | cut -d= -f2)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/sync_slot_config.sh:32 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesSEED_ONLY_FILES=(.env src/mcp_gee_sweet/.env .claude/settings.local.json)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Pipe-to-shell patternDockerfile:21 · Pipe-to-shell pattern — downloads and immediately executes remote codeRUN curl -LsSf https://astral.sh/uv/install.sh | shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/qa_browser.sh:191 · npx invocation of non-well-known package — may execute untrusted codeinstall) npx -y "$PLAYWRIGHT_MCP_PACKAGE" --version ;;Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Access to sensitive file pathsMakefile:56 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesaccess-logs: ## Tail HTTP access log (requires ACCESS_LOG_FILE set in src/mcp_gee_sweet/.env).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/build_mcpb.py:63 · Python subprocess execution detectedreturn subprocess.run(["git", *args], cwd=ROOT, check=True, capture_output=True).stdoutFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathssrc/mcp_gee_sweet/__init__.py:6 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# A blank token counts as unset (http_auth), so let .env supply one: docker-composeFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathsMakefile:53 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filestail -f $$(grep -E '^LOG_FILE=' src/mcp_gee_sweet/.env | cut -d= -f2)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/build_mcpb.py:122 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagescripts/setup_team.sh:49 · npx invocation of non-well-known package — may execute untrusted codeecho "Installing $playwright_mcp into the npx cache"Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commandsrc/mcp_gee_sweet/tools/atomic_write.py:129 · File permission modification command — agent changes file ownership/permissionsbefore chmod because it can clear bits that chmod then sets.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandsrc/mcp_gee_sweet/cache.py:152 · File permission modification command — agent changes file ownership/permissions"""chmod `path` if it's a regular file owned by this user and looser than `mode`;Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandsrc/mcp_gee_sweet/cache.py:167 · File permission modification command — agent changes file ownership/permissions"""chmod the DB and its WAL sidecars to 0600: a file created before this rule,Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)src/mcp_gee_sweet/http_auth.py:6 · MCP server using network transport (SSE/HTTP) — data sent over network``MCP_SERVER_TOKEN`` set, every ``http`` request (whatever its path) and everyFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File type combined with upload actionsrc/mcp_gee_sweet/tools/drive/transfer.py:4053 · File type combined with upload action — agent may exfiltrate local data filesas supplementary context (#352), e.g. "notes.txt: upload_ok, 40231 bytesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File permission modification commandsrc/mcp_gee_sweet/tools/atomic_write.py:127 · File permission modification command — agent changes file ownership/permissionsanyone else can only pick a group they belong to. When the full chown isFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandsrc/mcp_gee_sweet/tools/atomic_write.py:128 · File permission modification command — agent changes file ownership/permissionsrefused, the group alone is still tried (PR #1001 QA round 1). chown runsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)src/mcp_gee_sweet/server.py:141 · MCP server using network transport (SSE/HTTP) — data sent over network# Loopback by default: any other address needs MCP_SERVER_TOKEN (http_auth.check_startup).Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04

Cost to the agent

Instructions loaded
≈22,916 tok
2 files · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Not checked against OSV yet; the weekly check has not reached this version.

What would make this Verified

1 point to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim khuisman: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
  4. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
  5. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  6. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim khuismanPropose a patch to the maintainer