← Back to search

@klodr/gmail-mcp

GitHub Actions Scanned 5d ago

Gmail MCP server — scope-gated tools + attachment/download path jails + supply-chain hardening. Fork of GongRzhe/Gmail-MCP-Server via ArtyMcLabin's intermediate fork.

npm ↗
B
87.2 / 100

Versions

1.3.3latest
Jul 27, 2026
1.3.2
Jul 27, 2026
1.3.1
Jul 8, 2026
1.2.0
May 13, 2026
1.1.8
May 12, 2026
+ show 14 moreshow less
1.1.5
May 9, 2026
1.1.3
May 8, 2026
1.1.2
May 7, 2026
1.1.1
May 7, 2026
1.1.0
May 3, 2026
1.0.0
Apr 28, 2026
0.30.1
Apr 27, 2026
0.21.1
Apr 25, 2026
0.21.0
Apr 25, 2026
0.20.0
Apr 25, 2026
0.10.0
Apr 23, 2026
0.9.2
Apr 23, 2026
0.9.1
Apr 22, 2026
0.9.0
Apr 22, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 3

test-client
annotations: verified low

readOnlyHint true idempotentHint true destructiveHint false
validation-test
annotations: verified low

readOnlyHint true
gmail
annotations: none low

Permissions 3

network medium
Server uses network capabilities via: fetch()
filesystem low
Server uses filesystem capabilities via: fs, fs sync ops, path
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 22

info
Tool 'test-client' annotations are consistent annotation_checker · 80%
info
Tool 'validation-test' annotations are consistent annotation_checker · 80%
low
Tool 'gmail' has no annotations annotation_checker · 100%
high
Hardcoded OAuth client secret in klodr-gmail-mcp-59ced41/test/oauth-flow.test.ts auth_checker · 95%
medium
OAuth implementation without PKCE auth_checker · 75%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Buffer.from base64 in klodr-gmail-mcp-59ced41/test/email-send.test.ts:158 entropy_analyzer · 75%
medium
Buffer.from base64 in klodr-gmail-mcp-59ced41/test/email-send.test.ts:183 entropy_analyzer · 75%
medium
Buffer.from base64 in klodr-gmail-mcp-59ced41/test/email-send.test.ts:206 entropy_analyzer · 75%
medium
Buffer.from base64 in klodr-gmail-mcp-59ced41/src/mime-walkers.ts:58 entropy_analyzer · 75%
info
package.json metadata manifest_parser · 100%
info
Tool: test-client manifest_parser · 75%
info
Tool: validation-test manifest_parser · 75%
info
Tool: gmail manifest_parser · 75%
info
Transport: stdio manifest_parser · 90%
info
Required env vars (13) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
low
Permission: filesystem access detected permission_analyzer · 90%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 745 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%