inside-hair-mcp-google-meet-and-calendar

Security Findings (46)

• HighAS-012

  🔄Tool Drift

  Tool set changed silently at vsmithery: 25 tool(s) added, 29 tool(s) removed without a version bump.

  + 25 added

  calendar_v3_create_eventcalendar_v3_delete_eventcalendar_v3_freebusy_querycalendar_v3_get_eventcalendar_v3_list_calendarscalendar_v3_list_eventscalendar_v3_quick_addcalendar_v3_update_eventget_current_timehealth_checkmeet_v2_create_spacemeet_v2_end_active_conferencemeet_v2_get_conference_recordmeet_v2_get_participantmeet_v2_get_participant_sessionmeet_v2_get_recordingmeet_v2_get_spacemeet_v2_get_transcriptmeet_v2_list_conference_recordsmeet_v2_list_participant_sessionsmeet_v2_list_participantsmeet_v2_list_recordingsmeet_v2_list_transcript_entriesmeet_v2_list_transcriptsmeet_v2_update_space

  − 29 removed

  GOOGLECALENDAR_ACL_PATCHGOOGLECALENDAR_CALENDARS_DELETEGOOGLECALENDAR_CALENDARS_UPDATEGOOGLECALENDAR_CALENDAR_LIST_INSERTGOOGLECALENDAR_CALENDAR_LIST_UPDATEGOOGLECALENDAR_CLEAR_CALENDARGOOGLECALENDAR_CREATE_EVENTGOOGLECALENDAR_DELETE_EVENTGOOGLECALENDAR_DUPLICATE_CALENDARGOOGLECALENDAR_EVENTS_INSTANCESGOOGLECALENDAR_EVENTS_LISTGOOGLECALENDAR_EVENTS_MOVEGOOGLECALENDAR_EVENTS_WATCHGOOGLECALENDAR_FIND_EVENTGOOGLECALENDAR_FIND_FREE_SLOTSGOOGLECALENDAR_FREE_BUSY_QUERYGOOGLECALENDAR_GET_CALENDARGOOGLECALENDAR_GET_CURRENT_DATE_TIMEGOOGLECALENDAR_LIST_ACL_RULESGOOGLECALENDAR_LIST_CALENDARSGOOGLECALENDAR_PATCH_CALENDARGOOGLECALENDAR_PATCH_EVENTGOOGLECALENDAR_QUICK_ADDGOOGLECALENDAR_REMOVE_ATTENDEEGOOGLECALENDAR_SETTINGS_LISTGOOGLECALENDAR_SETTINGS_WATCHGOOGLECALENDAR_SYNC_EVENTSGOOGLECALENDAR_UPDATE_ACL_RULEGOOGLECALENDAR_UPDATE_EVENT

  Fix: The set of tools exposed by this server changed between scans of the same version — a sign the package was silently updated without a version bump. Audit the changelog and all tool definitions before trusting this server. Pin to a specific commit hash rather than a floating version tag.

• HighAS-002

  ⚠️Excessive Permissions ×6

  tool declares exec permission

  calendar_v3_create_eventcalendar_v3_update_eventmeet_v2_create_spacemeet_v2_get_transcriptmeet_v2_list_transcript_entries

  tool declares network permission

  calendar_v3_freebusy_query

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• MediumAS-002

  ⚠️Excessive Permissions ×6

  tool declares fs permission

  calendar_v3_create_eventcalendar_v3_update_eventcalendar_v3_delete_eventmeet_v2_create_spacemeet_v2_update_space

  tool declares db permission

  calendar_v3_freebusy_query

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• LowAS-002

  ⚠️Excessive Permissions ×2

  input schema exposes 12 properties (threshold: 10)

  calendar_v3_create_event

  input schema exposes 11 properties (threshold: 10)

  calendar_v3_update_event

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• LowAS-011

  ℹ️Missing Rate-Limit / Timeout ×6

  tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration

  calendar_v3_create_eventcalendar_v3_update_eventcalendar_v3_freebusy_querymeet_v2_create_spacemeet_v2_get_transcriptmeet_v2_list_transcript_entries

  Fix: Declare explicit rate-limit, timeout, and retry configuration for all network and execution tools. Implement exponential back-off and surface resource state to the calling agent.

• InfoAS-014

  ℹ️Dependency Inventory Unavailable ×25

  Tool did not expose metadata.dependencies or repo_url, so supply-chain coverage is limited.

  health_checkcalendar_v3_list_calendarscalendar_v3_list_eventscalendar_v3_get_eventcalendar_v3_create_eventcalendar_v3_update_eventcalendar_v3_delete_eventcalendar_v3_freebusy_querycalendar_v3_quick_addmeet_v2_create_spacemeet_v2_get_spacemeet_v2_update_spacemeet_v2_end_active_conferencemeet_v2_list_conference_recordsmeet_v2_get_conference_recordmeet_v2_list_recordingsmeet_v2_get_recordingmeet_v2_list_transcriptsmeet_v2_get_transcriptmeet_v2_list_transcript_entriesmeet_v2_get_participantmeet_v2_list_participantsmeet_v2_get_participant_sessionmeet_v2_list_participant_sessionsget_current_time

  Fix: Review and remediate the identified issue.