Live survey286 models · 13 providers · 19,992 auditsAudited verification-before-completion · SAFE →What changedHow we verifyllms.txt

MCP server · Audited from source

Google Gen AI MCP server

by googleapis/python-genaiApache-2.0 licenceAudited 21 Sep 2026 · source 82f6e39d5df6

PyPI google-genaistreamable-http★ 3,983
✕BLOCKGrade D · 63/100 · 21 Sep 2026 · 82f6e39
Safer alternativesView source on GitHub ↗

Is it safe? No — BLOCK, grade D (63/100). It exposes 9 tools: 6 read, 3 write and 0 destructive. The audit recorded 32 findings (0 critical, 1 high, 5 medium, 22 low). Maintainer's description: Google Gen AI Python SDK provides an interface for developers to integrate Google's generative models into their Python applications.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
CoCopilotAIGoogle AI Mode
Cite

Cite this page

ModelsAtlas. “Google Gen AI MCP server (googleapis/python-genai)”. Retrieved 21 Sep 2026. https://modelsatlas.com/mcp/googleapis/google-gen-ai

Why this is BLOCK. The audit found 0 critical and 1 high findings; the most severe is Prompt injection at CHANGELOG.md:1038. Each finding is listed below with its file and line.

Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.

Trust audit

Audit 0.4.1 · full source read 21 Sep 2026

Trust score63/100✕BLOCK D
0 critical1 high5 medium22 low4 info

32 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

  • FilesystemDeclared1 observation
  • NetworkDeclared4 observations
  • ShellDeclared3 observations
  • DependenciesNot pinnedSome ranges float
  • SecretsFoundSee the findings

Findings (32)

Sorted by severity · the 25 most severe of 32 are listed

HIGHPrompt injectionprompt.override · CHANGELOG.md:1038
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
* Support jailbreak in HarmCategory and BlockedReason ([011e218](https://github.com/googleapis/python-genai/commit/011e218b8d06444c848fbc8ba11c01608ff2d613))
Why
asks the agent to drop prior instructions or safety
Fix
remove the instruction
MEDIUMCode injectioncode.dynamic_import · google/genai/__init__.py:33
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
module = importlib.import_module(f'.{name}', __name__)
Why
No further detail recorded for this rule.
Fix
—
MEDIUMCode injectioncode.dynamic_import · google/genai/_gaos/sdk.py:168
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
return importlib.import_module(modname, package=__package__)
Why
No further detail recorded for this rule.
Fix
—
MEDIUMCode injectioncode.dynamic_import · google/genai/_gaos/sdk.py:397
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
return importlib.import_module(modname, package=__package__)
Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · google/genai/tests/gaos/test_credentials_lifecycle.py:175
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · google/genai/tests/live/test_live.py:2252
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
LOWInventory / provenanceinv.binary · docs/objects.inv
F-13 Inventory / provenanceCWE-1104Layer L0
objects.inv
Why
a compiled or binary member cannot be reviewed from source
Fix
ship source, or explain the binary in the README
LOWInventory / provenanceinv.binary · google/genai/tests/data/pixel.m4a
F-13 Inventory / provenanceCWE-1104Layer L0
pixel.m4a
Why
a compiled or binary member cannot be reviewed from source
Fix
ship source, or explain the binary in the README
LOWInventory / provenanceinv.binary · google/genai/tests/data/voice_sample.wav
F-13 Inventory / provenanceCWE-1104Layer L0
voice_sample.wav
Why
a compiled or binary member cannot be reviewed from source
Fix
ship source, or explain the binary in the README
LOWInventory / provenanceinv.hidden_file · docs/.nojekyll
F-13 Inventory / provenanceCWE-1104Layer L0
.nojekyll
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWCode injectioncode.deserialize · google/genai/tests/errors/test_api_error.py:372
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
pickled_error = pickle.loads(pickle.dumps(errors.APIError(1, {})))
Why
deserialises untrusted bytes into live objects
Fix
use json or yaml.safe_load
LOWCode injectioncode.eval_exec · docs/_static/doctools.js:60
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
Documentation.PLURAL_EXPR = new Function(
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
LOWInsecure cryptocrypto.weak_hash · google/genai/_local_tokenizer_loader.py:166
F-09 Insecure cryptoCWE-327 · CWE-338Layer L1
filename = hashlib.sha1(file_url.encode()).hexdigest()
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · google/genai/tests/conftest.py:174
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
'../../../../../google/cloud/aiplatform/sdk/genai/replays',
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · google/genai/tests/models/test_generate_content.py:520
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
model='gemini-2.5-flash/../../upload/v1beta/files',
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · google/genai/tests/shared/models/test_edit_image.py:27
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
os.path.join(os.path.dirname(__file__), '../../data/google.png')
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · google/genai/tests/shared/models/test_edit_image.py:31
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
os.path.join(os.path.dirname(__file__), '../../data/checkerboard.png')
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · google/genai/tests/shared/models/test_segment_image.py:27
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
os.path.join(os.path.dirname(__file__), '../../data/google.png')
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · google/genai/tests/gaos/test_credentials_lifecycle.py:127
F-04 Network egressCWE-200 · CWE-319Layer L1
"base_url": f"http://127.0.0.1:{server.server_port}",
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · google/genai/tests/gaos/test_credentials_lifecycle.py:261
F-04 Network egressCWE-200 · CWE-319Layer L1
"base_url": f"http://127.0.0.1:{server.server_port}",
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · google/genai/tests/gaos/test_credentials_lifecycle.py:315
F-04 Network egressCWE-200 · CWE-319Layer L1
"base_url": f"http://127.0.0.1:{server.server_port}",
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · google/genai/tests/gaos/test_environments_lifecycle.py:119
F-04 Network egressCWE-200 · CWE-319Layer L1
"base_url": f"http://127.0.0.1:{server.server_port}",
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · google/genai/tests/gaos/test_environments_lifecycle.py:185
F-04 Network egressCWE-200 · CWE-319Layer L1
"base_url": f"http://127.0.0.1:{server.server_port}",
Why
No further detail recorded for this rule.
Fix
—
LOWObfuscation / stealthobf.decode_call · google/genai/live.py:822
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
data=base64.b64decode(blob_input.data),
Why
No further detail recorded for this rule.
Fix
—
LOWObfuscation / stealthobf.decode_call · google/genai/tests/types/test_bytes_internal.py:43
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
assert base64.b64decode(_BASE64_NOT_URL_SAFE) == _RAW_BYTES
Why
No further detail recorded for this rule.
Fix
—

Tools it exposes

9 declared in source · 0 destructive

6 read3 write0 destructive
ToolWhat it doesRisk
add_numbersAdd two numbers together.write
create_endpointCreates an endpointwrite
update_endpointUpdates a Vertex AI Endpoint resource.write
get_weatherGet the weather in a city.read
get_weather_2Different tool to get the weather.read
list_endpointsLists endpointsread
tooltool-descriptionread
tool1tool1-descriptionread
tool2tool2-descriptionread

Safer alternatives

We could not match this server to a job, so we cannot suggest a like-for-like alternative. Read-only servers are the least-privilege place to start.

Audit history

  1. ✕BLOCK D 63 / 100

    Source changed, verdict held · 82f6e39d5df6

  2. ✕BLOCK D 63 / 100

    First audit · c9d168fc9f45

README badge

Badges show the current verdict, BLOCK included

ModelsAtlas: BLOCK DMODELSATLASBLOCK · D

A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.

Questions about Google Gen AI MCP server

What is the Google Gen AI MCP server?
Google Gen AI Python SDK provides an interface for developers to integrate Google's generative models into their Python applications.
What tools does Google Gen AI expose?
9 in total: 6 read-only, 3 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Google Gen AI safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (63/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does Google Gen AI need?
It reads GEMINI_API_KEY, GOOGLE_API_KEY, GOOGLE_APPLICATION_CREDENTIALS, GOOGLE_GENAI_ACCESS_TOKEN and GOOGLE_GENAI_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Google Gen AI run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on PyPI as google-genai.
How current is this page?
The grade is for one exact copy of the source (82f6e39d5df6), read on 2026-09-21. The repository is watched and re-audited when it changes.
I already installed Google Gen AI. What should I do?
Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.
Can the verdict change?
Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.

Sources

  • googleapis/python-genai on GitHub — the source we read, its licence, stars and activityObserved · 21 Sep 2026
  • ModelsAtlas trust audit — BLOCK verdict for commit 82f6e39d5df6Observed · 21 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.