MCP Google Contacts Server: why it is not safe to use
Warn: this skill can create, update, and delete Google contacts, and deletions run immediately without a built-in confirmation step.
What we found
Our review did not find hidden instructions, hardcoded secrets, obfuscated code, undisclosed remote code execution, or behavior outside the stated purpose of working with Google Contacts through Google People and OAuth endpoints. Network use matched that purpose.
The main concern is that the skill exposes `create_contact`, `update_contact`, and `delete_contact` actions, and `delete_contact` executes immediately with no built-in confirmation step. In practice, that means a mistaken or poorly scoped tool call could remove contact data without an extra safety check inside the skill.
We also found that the integration reads Google OAuth credentials from environment variables and local credential or token files, and stores a token in the user's home config directory. That is typical for this type of integration, but it should be clearly disclosed so users understand where access tokens are read from and stored.
What to do instead
Use this skill only where contact write access is intended. Add an approval step before delete operations, or restrict the skill to read-only workflows if deletion is not necessary. Document the local token storage behavior and handle credential files and environment variables according to your normal secret management practices.
Source: https://github.com/RayanZaki/mcp-google-contacts-server
We report what our security review found at the time we checked, with the goal of keeping people safe. Projects change; if a maintainer has since fixed this, we are glad to recheck it. Email hello@agentpod.com.