Google Contacts Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Google Contacts Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP server for Google Contacts - list, search, and manage contacts.
Email lookup: "See the latest JIRA ticket that's come in. Can we email Sarah from the security team to get their input?" → finds Sarah's email and drafts the message.
Business card capture: After a networking event, snap photos of business cards → your assistant extracts the details and adds them as contacts with a note about where you met.
Find connections: "Who do I know at Google?" or "I'm visiting London next week - who should I catch up with?" → search your personal network.
Call reminder: "Remind me to call Mike at 3pm" → creates a calendar event with Mike's phone number attached so you can dial straight from the reminder.
Contact updates: You receive an out-of-office saying someone left their company with a new personal email → your assistant updates their contact automatically.
(These are just examples - any workflow that needs contact lookup or management can use this.)
http://localhost:3000/callback to Authorized redirect URIsGOOGLE_CLIENT_ID='your-client-id' \
GOOGLE_CLIENT_SECRET='your-client-secret' \
MCP_TRANSPORT=http \
npm startThe server runs on http://localhost:3000 by default. Change with PORT=3001.
claude mcp add --transport http google-contacts-mcp http://localhost:3000/mcpThis server acts as an OAuth proxy to Google:
graph LR
A[MCP client] <--> B[google-contacts-mcp] <--> C[Google OAuth/API]/.well-known/oauth-authorization-server/register returns the Google OAuth client credentials/authorize redirects to Google, encoding the client's callback URL in state/callback receives the code from Google and forwards to the client's callback/token proxies token requests to Google, injecting client credentials/mcp handles MCP requests, using the bearer token to call People APIThe server holds no tokens or state - it just proxies OAuth to Google.
| Tool | Description |
|---|---|
contacts_list | List contacts with names, emails, phones, and organizations |
contacts_search | Search contacts by name, email, or phone |
directory_search | Search organization directory for coworkers |
contact_get | Get detailed info for a single contact |
contact_create | Create a new contact |
contact_update | Update an existing contact |
contact_delete | Permanently delete a contact |
Pull requests are welcomed on GitHub! To get started:
npm installnpm run test to run testsnpm run buildVersions follow the semantic versioning spec.
To release:
npm version <major | minor | patch> to bump the versiongit push --follow-tags to push with tags~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.