Is ExpenseBot MCP server safe?

Findings (2)

• highWrite-action tools reachable without authenticationauth.open-write
• lowUnusually long tool description (over 2,000 characters)poison.long-description

  tool get_spreadsheet_url: …Return the user's master ExpenseBot Google Sheet plus authenticated ExpenseBot workspace links, each with a label and a description of when to use it. Use this when the user asks to open, view, check, or edit their spreadsheet; review expenses or income; manually scan Gmail; reconcile; connect or manage a bank/credit card; open Automation Hub or General Settings; create or open reports; or asks where a submitted receipt went. Choose and show the one or two links relevant to the request instead of listing the entire catalog. After a receipt submission, prefer Review expenses plus the Google Sheet. After an income write, prefer Review income plus the Sheet. For a Gmail scan or connection request, use the Scan Gmail link, which opens the existing Gmail scanning interface. Bank/card requests use the Reconcile link; configuration requests use the returned Automation Hub or General Settings link. Category, G/L, and account-code requests use Category management; client, project, and trip groups use Group management; questions about what counts as Personal use Personal rules. For client billing setup, use the returned clientBillingHandoffs instead of giving a generic dashboard tour: manageClients creates or manages the client list, tagReadyExpenses opens Review Expenses filtered to blank or default-Business rows, and createClientReport opens report creation by group after expenses have been assigned. Choose the one next step that matches the user's current state. If the user names a client and an exact expense scope and asks the assistant to do the work, use search_expenses and group_expenses instead; show its grounded preview and require explicit confirmation before changing any rows. When the user asks to choose receipt images from Google Photos, use the returned Google Photos link; it opens the existing authenticated picker and handles any required Google consent in ExpenseBot. When they ask where ExpenseBot stores receipt files, return the Drive folder link only when it is available; never invent or request a folder ID. For a complete, unambiguous cash expense or mileage trip, use the direct write tool. Use the returned Manual expense link for multiple entries, credits/refunds, detailed tax/tip entry, per diem, incomplete details, or visual review. Use the Mileage and travel link for route calculation, mileage settings, repeated trips, calendar/rideshare imports, per diem, or visual review. These links open the existing reviewed app forms. When the user wants to import income from a screenshot, PDF, or CSV but no attachment is available in chat (or the review is visually complex), use the returned Import income links — they open the existing Add Income importer, which parses the file and shows every row for review before anything is saved. Team setup requests use the returned role-aware Team setup handoff: eligible solo business owners open Add teammates, while existing team owners and co-admins open License Manager. If the handoff says owner access is required, explain that instead of presenting a broken link. Complex or visually reviewed report requests use the returned Create report link. Read-only; this tool does not create or modify spreadsheet rows.…