io.github.shigechika/gws-mcp

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Code Safety

• npm/install.js:40mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

   */
  async function download(url, dest) {
    const res = await fetch(url, { redirect: "follow" });
  
    if (!res.ok) {

Auth Posture

• authentication_model

  stdio transport: the client launches the server as a subprocess, so the OS process boundary is the auth boundary — `03` §4 does not penalise absent auth here

• transport_security

  declared transport: stdio — launched as a subprocess by the client, so the security boundary is the client process, not a network port (`03` §4)

• secret_handling

  Private Key at crates/google-workspace-cli/src/auth.rs:680; …and 70 more matches

• authorization_granularity

  no tool registration was recognised anywhere in the source. An MCP server registers tools by definition, so this is a gap in our detection rather than a server with none, and `03` §4's threshold cannot be applied to it.

Dependency Health

• pnpm-lock.yamlshell-quote 1.10.0 — GHSA-pqg4-j6r4-53mv

  transitive, CVSS 9.2, fixed in 1.11.0

  https://osv.dev/vulnerability/GHSA-pqg4-j6r4-53mv
• Cargo.lockquinn-proto 0.11.16 — RUSTSEC-2026-0340

  direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 7.5, fixed in 0.11.18

  https://osv.dev/vulnerability/RUSTSEC-2026-0340
• Cargo.lockquinn-proto 0.11.16 — RUSTSEC-2026-0341

  direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 7.5, fixed in 0.11.17

  https://osv.dev/vulnerability/RUSTSEC-2026-0341
• Cargo.lockrustls 0.23.45 — RUSTSEC-2026-0346

  direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 4.0, fixed in 0.23.46

  https://osv.dev/vulnerability/RUSTSEC-2026-0346
• Cargo.lockrustls 0.23.45 — RUSTSEC-2026-0348

  direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 3.7, fixed in 0.23.46

  https://osv.dev/vulnerability/RUSTSEC-2026-0348
• Cargo.lockrustls 0.23.45 — RUSTSEC-2026-0349

  direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 3.7, fixed in 0.23.46

  https://osv.dev/vulnerability/RUSTSEC-2026-0349
• Cargo.lockrustls 0.23.45 — RUSTSEC-2026-0347

  direct or transitive unknown — no parseable manifest for this ecosystem, CVSS 2.3, fixed in 0.23.46

  https://osv.dev/vulnerability/RUSTSEC-2026-0347
• Cargo.locklru 0.16.4 — RUSTSEC-2026-0253

  direct or transitive unknown — no parseable manifest for this ecosystem, no CVSS published, fixed in 0.18.2

  https://osv.dev/vulnerability/RUSTSEC-2026-0253
• Cargo.lockquinn-proto 0.11.16 — RUSTSEC-2026-0338

  direct or transitive unknown — no parseable manifest for this ecosystem, no CVSS published, fixed in 0.11.18

  https://osv.dev/vulnerability/RUSTSEC-2026-0338
• Cargo.lockquinn-proto 0.11.16 — RUSTSEC-2026-0339

  direct or transitive unknown — no parseable manifest for this ecosystem, no CVSS published, fixed in 0.11.17

  https://osv.dev/vulnerability/RUSTSEC-2026-0339
• Cargo.lockquinn-proto 0.11.16 — RUSTSEC-2026-0342

  direct or transitive unknown — no parseable manifest for this ecosystem, no CVSS published, fixed in 0.11.17

  https://osv.dev/vulnerability/RUSTSEC-2026-0342

Maintenance

• recency

  last commit 15 day(s) before 2026-10-16

• issue_responsiveness

  every issue read was filed by the project itself (5 by its maintainers or bots), so none is someone outside waiting for an answer, and `03` §5's question — will anyone read an issue I file? — has nothing to measure.

• release_cadence

  released 15 day(s) ago (by releases), inside `03` §5's 30-day window

• bus_factor

  3 authors with >= 5 commits in 12 months

• repository_signals

  `03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

• license

  LICENSE present with no SPDX-License-Identifier tag; identified as 'Apache-2.0' from its text

• readme_quality

  README.md: installation instructions (+25), configuration documented (+25), exposed tools or resources enumerated (+30)

• declared_scopes

  neither the README nor the MCP manifest documents what the server accesses or what side effects it has

• changelog

  CHANGELOG.md present

• security_contact

  SECURITY.md present