Mcp Drive — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mcp Drive (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP server for Google Drive integration with file operations, folder navigation, search capabilities, and sharing management
Requires Node.js >=20. The examples use npx, included with npm, to run this server and @mcp-z/cli.
MCP supports stdio and HTTP.
Both the 2025 and 2026-07-28 protocol revisions are served, over either transport, from the same server. Your client negotiates whichever it speaks. A 2025 client keeps working with no change, and support for it is not being dropped. The 2026-07-28 revision is stateless, so a client speaking it sends no initialize handshake and carries no session id.
Stdio
{
"mcpServers": {
"drive": {
"command": "npx",
"args": ["-y", "@mcp-z/mcp-drive"]
}
}
}HTTP
{
"mcpServers": {
"drive": {
"type": "http",
"url": "http://localhost:9001/mcp",
"start": {
"command": "npx",
"args": ["-y", "@mcp-z/mcp-drive", "--port=9001"]
}
}
}
}start is an extension used by npx @mcp-z/cli up to launch HTTP servers for you.
Configure via environment variables or the env block in .mcp.json. The configuration reference below lists every option.
Environment variables:
GOOGLE_CLIENT_ID=your-client-id
GOOGLE_CLIENT_SECRET=your-client-secretExample (stdio) - Create .mcp.json:
{
"mcpServers": {
"drive": {
"command": "npx",
"args": ["-y", "@mcp-z/mcp-drive"],
"env": {
"GOOGLE_CLIENT_ID": "your-client-id"
}
}
}
}Example (http) - Create .mcp.json:
{
"mcpServers": {
"drive": {
"type": "http",
"url": "http://localhost:3000/mcp",
"start": {
"command": "npx",
"args": ["-y", "@mcp-z/mcp-drive", "--port=3000"],
"env": {
"GOOGLE_CLIENT_ID": "your-client-id"
}
}
}
}
}Local (default): omit REDIRECT_URI → ephemeral loopback. Cloud: set REDIRECT_URI to your public /oauth/callback and expose the service publicly.
Note: the start block is a helper in npx @mcp-z/cli up for starting an HTTP server from your .mcp.json. See @mcp-z/cli for details.
Environment variables:
AUTH_MODE=service-account
GOOGLE_SERVICE_ACCOUNT_KEY_FILE=/path/to/service-account.jsonExample:
{
"mcpServers": {
"drive": {
"command": "npx",
"args": ["-y", "@mcp-z/mcp-drive", "--auth=service-account"],
"env": {
"GOOGLE_SERVICE_ACCOUNT_KEY_FILE": "/path/to/service-account.json"
}
}
}
}HTTP only. Requires a public base URL.
{
"mcpServers": {
"drive-dcr": {
"command": "npx",
"args": [
"-y",
"@mcp-z/mcp-drive",
"--auth=dcr",
"--port=3456",
"--base-url=https://oauth.example.com"
],
"env": {
"GOOGLE_CLIENT_ID": "your-client-id",
"GOOGLE_CLIENT_SECRET": "your-client-secret"
}
}
}
}# Start the configured server and list its tools
npx -y @mcp-z/cli inspect --servers drive --tools
# Call a tool after authorizing Google Drive
npx -y @mcp-z/cli call-tool drive files-search '{"query":"name contains \\\"report\\\""}'See server.json for all supported environment variables, CLI arguments, and defaults.
OAuth tokens (TOKEN_STORE_URI) and DCR registrations (DCR_STORE_URI) are stored through keyv-registry, which picks an adapter from the URI protocol.
file:// (the default, under ~/.mcp-z/) and memory:// work with no extra setup.
Any other backend needs its adapter installed alongside this server. Adapters are resolved with require(), so a globally installed server finds a globally installed adapter:
npm install -g @mcp-z/mcp-drive @keyv/redis
TOKEN_STORE_URI=redis://localhost:6379 mcp-driveA protocol whose adapter is missing fails at startup naming the package to install.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.