Safe Gmail Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Safe Gmail Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A security-hardened Gmail MCP server for Claude Code. Supports reading, labeling, archiving, and drafting emails - but cannot send or delete.
git clone <this-repo>
cd safe-gmail-mcp
npm install
npm run initThe setup wizard will guide you through:
The original Gmail MCP has powerful capabilities that could be dangerous if misused:
This fork removes those dangerous operations while keeping everything needed for email triage workflows.
| Tool | Description |
|---|---|
draft_email | Create a draft email (you send manually) |
send_email | Send email to yourself only (for reminders) |
read_email | Read email content by ID |
search_emails | Search with Gmail syntax |
list_email_labels | List all labels |
create_label | Create a new label |
update_label | Update a label |
delete_label | Delete a user-created label |
get_or_create_label | Get existing or create new label |
modify_email | Add/remove labels from an email |
batch_modify_emails | Bulk label modifications |
download_attachment | Save attachment to disk |
| Command | Description |
|---|---|
npm run init | Interactive setup wizard |
npm run auth | Re-authenticate (if token expires) |
npm run status | Check authentication status |
npm start | Run the MCP server |
If you prefer not to use the wizard:
mkdir -p ~/.safe-gmail-mcp
chmod 700 ~/.safe-gmail-mcp
mv ~/Downloads/client_secret_*.json ~/.safe-gmail-mcp/gcp-oauth.keys.json
chmod 600 ~/.safe-gmail-mcp/gcp-oauth.keys.jsonnpm run authAdd to your .mcp.json:
{
"mcpServers": {
"safe-gmail": {
"command": "node",
"args": ["/path/to/safe-gmail-mcp/src/index.js"],
"env": {
"GMAIL_OAUTH_PATH": "/Users/you/.safe-gmail-mcp/gcp-oauth.keys.json",
"GMAIL_CREDENTIALS_PATH": "/Users/you/.safe-gmail-mcp/credentials.json"
}
}
}
}Enable Gmail API: APIs & Services > Library > Gmail API > Enable
Add your email as a test user in the OAuth consent screen.
Run npm run auth to re-authenticate.
The auth flow tries ports 3000, 3001, 3002. Close any apps using these ports.
See SECURITY.md for detailed security design documentation.
ISC (inherited from original project)
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.