Moist — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Moist (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Gmail MCP Connector
"Neither rain nor snow nor stranded tokens shall stay this messenger."
Moist is an MCP server that exposes Gmail operations as tools. It handles OAuth 2.0, token refresh, rate limiting, and MIME parsing so consuming applications don't have to.
http://localhost:3000/oauth/callback as an authorized redirect URIAdd Moist to your MCP client configuration:
{
"mcpServers": {
"moist": {
"command": "npx",
"args": ["@ticktockbent/moist"],
"env": {
"MOIST_CLIENT_ID": "your_client_id",
"MOIST_CLIENT_SECRET": "your_client_secret"
}
}
}
}On the first connection, Moist opens your browser for Google OAuth consent. Once authorized, tokens are encrypted and stored locally at ~/.moist/tokens.json. Subsequent runs authenticate automatically.
| Variable | Required | Description |
|---|---|---|
MOIST_CLIENT_ID | Yes | Google OAuth 2.0 Client ID |
MOIST_CLIENT_SECRET | Yes | Google OAuth 2.0 Client Secret |
MOIST_REDIRECT_URI | No | OAuth callback URI (default: http://localhost:3000/oauth/callback) |
| Tool | Description |
|---|---|
moist_auth_status | Check authentication state, email, scopes, and token expiry |
moist_auth_logout | Revoke tokens and clear stored credentials |
| Tool | Description |
|---|---|
moist_list_messages | Search and list messages with pagination and label filtering |
moist_get_message | Get full message details including body, headers, and attachments |
moist_send_message | Send an email (supports replies via replyTo and threading via threadId) |
moist_trash_message | Move a message to trash |
moist_delete_message | Permanently delete a message (irreversible) |
| Tool | Description |
|---|---|
moist_list_threads | List threads with search and label filtering |
moist_get_thread | Get a thread with all its messages |
moist_trash_thread | Move an entire thread to trash |
| Tool | Description |
|---|---|
moist_list_labels | List all labels (system and user-created) |
moist_modify_labels | Add or remove labels from a message |
| Tool | Description |
|---|---|
moist_search | Search messages using Gmail's full query syntax |
Gmail search supports operators like from:, to:, subject:, has:attachment, is:unread, is:starred, label:, after:, before:, filename:, and "exact phrases". Operators can be combined:
from:[email protected] has:attachment after:2024/01/01 subject:statement| Tool | Description |
|---|---|
moist_create_draft | Create a new draft email |
moist_list_drafts | List drafts with pagination |
moist_delete_draft | Delete a draft |
moist_send_draft | Send an existing draft |
src/
├── index.ts # MCP server entry point (stdio transport)
├── types.ts # TypeScript interfaces
├── auth/
│ ├── oauth.ts # OAuth 2.0 flow, token refresh, browser consent
│ └── storage.ts # Encrypted token persistence (~/.moist/)
├── client/
│ ├── gmail.ts # Gmail API wrapper, MIME parsing, message building
│ └── rate-limiter.ts # Sliding-window quota tracker
└── tools/
├── auth.ts # Auth status and logout tools
├── messages.ts # Message CRUD tools
├── threads.ts # Thread tools
├── labels.ts # Label tools
├── search.ts # Search tool
└── drafts.ts # Draft toolsAll tools return consistent error shapes:
{
"error": "not_found",
"message": "Human-readable description",
"details": {}
}| Error Code | Meaning |
|---|---|
not_found | Message, thread, or label doesn't exist |
rate_limited | Gmail API quota exceeded (includes retryAfter) |
auth_failed | Token expired or revoked |
invalid_request | Bad parameters |
api_error | Gmail API error (details included) |
Moist requests these scopes during authorization:
| Scope | Purpose |
|---|---|
gmail.readonly | Read messages, threads, and labels |
gmail.send | Send messages |
gmail.modify | Modify labels, trash/untrash |
gmail.compose | Create and manage drafts |
# Install dependencies
npm install
# Build
npm run build
# Watch mode
npm run devMIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.