Gmail Gdoc Mcp Server — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Gmail Gdoc Mcp Server (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This is a Python-based Model Context Protocol (MCP) style server integrating Google Docs and Gmail. It is built with FastAPI and runs on a local web server, exposing endpoints to append text to Google Documents and create email drafts in Gmail.
Before any action is executed, the server prompts the user in the terminal for approval: Approve? (y/n).
google-mcp-server/
├── server.py # FastAPI server with tool endpoints & terminal approval logic
├── auth.py # Google OAuth 2.0 authentication flow
├── docs_tool.py # Google Docs tool (append content to document)
├── gmail_tool.py # Gmail tool (create email draft)
├── requirements.txt # Python package dependencies
├── README.md # Setup and usage instructions
├── credentials.json # (NOT committed) OAuth client credentials downloaded from Google Cloud
└── token.json # (NOT committed) Auto-generated user token after successful loginTo run this server, you need to acquire a Google client configuration file:
https://www.googleapis.com/auth/documents (to append to documents)https://www.googleapis.com/auth/gmail.compose (to create drafts)credentials.json and place it in the root of this project directory. cd "c:\Users\amoln\Airtribe Projects\gmail_gdrive_mcp_server" python -m venv venv
# On Windows (PowerShell):
.\venv\Scripts\Activate.ps1
# On macOS/Linux:
source venv/bin/activate pip install -r requirements.txtThe authentication module auth.py automatically checks for a token.json file. If it doesn't exist, it opens a local browser server to execute the Google login flow.
You can trigger authentication manually before running the server:
python auth.pyThis will open your browser. Grant the necessary permissions for Google Docs and Gmail, and the script will save token.json in the root folder. Future runs will read token.json directly and skip the browser login.
Start the FastAPI server:
python server.pyThe server will start listening on http://127.0.0.1:8005.
POST /append_to_doc {
"doc_id": "YOUR_GOOGLE_DOCUMENT_ID",
"content": "This text will be appended to the document.\n"
} curl -X POST "http://127.0.0.1:8005/append_to_doc" \
-H "Content-Type: application/json" \
-d "{\"doc_id\": \"1234567890abcdefghijklmnopqrstuvwxyz\", \"content\": \"Hello Google Docs!\n\"}"POST /create_email_draft {
"to": "[email protected]",
"subject": "Hello from MCP Server",
"body": "This is the body of the draft email."
} curl -X POST "http://127.0.0.1:8005/create_email_draft" \
-H "Content-Type: application/json" \
-d "{\"to\": \"[email protected]\", \"subject\": \"Test Subject\", \"body\": \"This is a test draft body.\"}"Whenever a request is sent to either of the endpoints, the server output will print the request details in the terminal and block:
========================================
ACTION NAME: append_to_doc
PAYLOAD:
doc_id: 1234567890abcdefghijklmnopqrstuvwxyz
content: Hello Google Docs!
========================================
Approve? (y/n): 200 OK response.403 Forbidden response: {"detail":"Action rejected by user."}.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.