io.github.chrischall/gogcli-mcp-drive

The materials indicate it requires GOG_ACCOUNT and GOG_PATH. The former appears account-related and sensitive, while the latter may point to a local binary or config path; misconfiguration could enable account misuse or path hijacking, but there is no explicit sign of credential theft in the provided materials.

The remote endpoint field is listed as none, but the stated functionality—Google Drive search, upload, download, and permissions—strongly implies communication with Google Drive or services required by gogcli. This is normal egress for the declared purpose, and the materials show no red flags of exfiltration to unrelated or unknown endpoints.

The system checks explicitly mark executes-code, and the name/description indicate it works through a local gogcli binary, meaning it can spawn local processes and run commands. This is a standard MCP capability, and the provided materials do not show requests for system privileges beyond its stated purpose.

Based on the description, the tool can search, upload, download, and modify Google Drive permissions, so it can access cloud file contents and metadata; GOG_PATH also suggests reading a local binary or configuration path. This access scope is consistent with the stated purpose, with no clear evidence of overbroad authorization, but it does involve sensitive files and sharing controls.

The source is an official registry entry and there is an auditable open-source repository with updates within the last year; these are strong positive signals. Community stars are 0 and the README is absent, which limits transparency and external validation, but that alone does not constitute high risk.