googleapis/mcp-toolbox

Is googleapis/mcp-toolbox safe to use?

googleapis/mcp-toolbox has not been scored against the OWASP MCP Top 10 yet, so this page shows no grade. Most MCP servers are credential-gated — a scan has to actually connect, and we will not guess a number we did not measure. Unknown is not unsafe. Point the open-source scanner at it yourself with `npx mcpr scan`.

How grades are assigned, the ten checks behind it, and the point maths are all on how we score MCP server trust.

Capabilities

Not yet declared in the manifest.

Embed the live badge

Always reflects the current grade. Score drops → badge drops. No vanity lock.

[![MCP trust score](https://mcp-registry-dh5.pages.dev/api/badge/googleapis-mcp-toolbox.svg)](https://mcp-registry-dh5.pages.dev/servers/googleapis-mcp-toolbox/)

Install

One-click cross-client install (Claude Code, Claude Desktop, Cursor, Windsurf) coming soon. The registry will write the correct config fragment to the correct file — no copy-paste.

Frequently asked questions

Is googleapis/mcp-toolbox safe to use?

googleapis/mcp-toolbox has not been scored against the OWASP MCP Top 10 yet, so this page shows no grade. Most MCP servers are credential-gated — a scan has to actually connect, and we will not guess a number we did not measure. Unknown is not unsafe. Point the open-source scanner at it yourself with `npx mcpr scan`.

What is the googleapis/mcp-toolbox trust score based on?

Ten checks derived from the OWASP MCP Top 10, run against the live server by the open-source MCP Vouch scanner. Applicable checks are summed and scaled to 0–100; checks that do not apply to the server's transport are skipped and leave the denominator entirely.

How do I install googleapis/mcp-toolbox?

googleapis/mcp-toolbox is installed like any other MCP server — add it to your client's MCP configuration. Cross-client one-click install is coming to MCP Registry; until then, the repository and homepage links on this page carry the maintainer's own instructions.