Atlas / MCP servers / hellotinah / Google Sheets & Forms

Google Sheets & FormsBLOCK

mcp/hellotinah/google-sheets-forms

MCP Code Example

Verdict
BLOCK
Grade
D
Trust score
69 /100
Exposed tools
6 3r · 3w · 0d
Transport
stdio
License
—
Stars
36
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

A simple MCP server that provides tools, resources, and prompts for working with Google Sheets and Google Forms.

Features

Tools

  • list_spreadsheets - List your Google Spreadsheets
  • read_sheet - Read data from a Google Sheet
  • write_sheet - Write data to a Google Sheet
  • append_sheet - Append data to a Google Sheet
  • create_spreadsheet - Create a new spreadsheet
  • create_form - Create a new Google Form

Resources

  • sheet://{spreadsheet_id}/{range_name} - Access sheet data as a resource

Prompts

  • analyze_sheet_data - Template for analyzing sheet data
  • create_report_template - Template for creating report spreadsheets
  • form_to_sheet - Template for form-to-sheet workflow

Setup

1. Create virtual environment

cd gsheets-mcp-server
python -m venv .venv
source .venv/bin/activate  # On Windows: .venv\Scripts\activate

2. Install dependencies

pip install -r requirements.txt

3. Get Google API Credentials

  1. Go to Google Cloud Console
  2. Create a new project or select existing one
  3. Enable the following APIs:
  4. Google Sheets API
  5. Google Forms API
  6. Google Drive API
  7. Go to "Credentials" → "Create Credentials" → "OAuth client ID"
  8. Choose "Desktop app" as application type
  9. Download the credentials JSON file
  10. Save it as credentials.json in this directory

4. Test the server with MCP Inspector

npx @modelcontextprotocol/inspector python gsheets_server.py

Claude Desktop Configuration

Add this to your Claude Desktop config file:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json Windows: %APPDATA%\Claude\claude_desktop_config.json

{
"mcpServers": {
"gsheets": {
"command": "python",
"args": [
"/FULL/PATH/TO/gsheets-mcp-server/gsheets_server.py"
],
"env": {
"GOOGLE_CREDENTIALS_PATH": "/FULL/PATH/TO/gsheets-
Read from source at commit ac067a307d55OBSERVED · 2026-10-08
Advertisement
02

Exposed tools (6)

3 read · 3 write · 0 destructive.

ToolRiskDescription
append_sheetread
create_formwrite
create_spreadsheetwrite
list_spreadsheetsread
read_sheetread
write_sheetwrite
03

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
none-observed
Shell
declared (1 observation(s))
Dependencies
not all pinned
Secrets in source
none-found

Findings (3)

HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95
gsheets_server.py:32
creds = pickle.load(token)
Why it matters. deserialises untrusted bytes into live objects
Fix. use json or yaml.safe_load
LOWInventory / provenance · inv.no_license · CWE-1104
Why it matters. no LICENSE file and no repo licence
Fix. add a licence
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
requirements.txt
fastmcp, google-auth-oauthlib, google-auth-httplib2, google-api-python-client
Why it matters. 4 requirement(s) not pinned with ==
Fix. pin exact versions

Gates applied: no_behavioural_pass, no_license.

Audited 2026-10-08 · audit v0.4.1 · source sha ac067a307d55full audit observations/trust-audit/mcp-server/hellotinah__google-sheets-forms.json · Report an issue / request a re-scan
04

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-08ac067a307d55BLOCKD69first audit
05

Questions

What is the Google Sheets & Forms MCP server?

MCP Code Example

What tools does Google Sheets & Forms expose?

6 in total: 3 read-only, 3 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is Google Sheets & Forms safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.

What credentials does Google Sheets & Forms need?

It reads GOOGLE_CREDENTIALS_PATH from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does Google Sheets & Forms run?

It speaks stdio, so it runs as a local process your client starts.

How current is this page?

The grade is for one exact copy of the source (ac067a307d55), read on 2026-10-08. The repository is watched and re-audited when it changes.

Advertisement