gmaps-mcp's unauthenticated HTTP transport allows unlimited Google Maps API calls at operator expense
## Unauthenticated HTTP Transport Allows Unlimited Google Maps API Calls at Operator Expense The `gmaps-mcp` codebase was reviewed at commit `e671db68c804c9e67d51582d3280839ffa65f127` and three issues worth flagging were discovered — one high-severity, one medium, one structural. There were no preexisiting CVEs for this package yet and the repository had no prior security issues. The primary issue is that the HTTP transport in `server.py` skips authentication entirely when `MCP_API_KEY` is not set — which is the default, since `.env.example` ships the key as a blank value. Any unauthenticated caller who knows the server's public URL can inv
- Update to 0.1.3
Published Updated