Is gemini-mcp-tool safe?
1 unfixed advisory Facts from the mcp-audit registry about the npm package gemini-mcp-tool. The same data is served as JSON.
Check it from your terminal
mcp-audit vet gemini-mcp-toolOffline: it uses the registry bundled with mcp-audit. mcp-audit update-registry fetches the newest one.
Registry facts
| Maintainer | filecrop |
|---|---|
| Verified publisher | no |
| Entry last checked | 2026-08-22 |
| Hash pins | none recorded |
| Provenance expected | no |
| Repository | https://github.com/jamubc/gemini-mcp-tool |
Recorded advisories 1
| Advisory | CVSS | Summary | Fixed in |
|---|---|---|---|
| CVE-2026-0755 | not recorded | no summary recorded | no fix recorded |
Advisories with no recorded fix are listed first. CVE IDs link to NVD, GHSA IDs to GitHub and other IDs to OSV. A fixed advisory affects only versions below its fix; vet exits 1 only for advisories with no fix.
What it can do
- It can execute shell commands.
Capability tags come from the registry. mcp-audit uses them to find dangerous combinations with your other servers.
Check how you run it
This page describes the public package. What matters is your setup: which version you pin, which secrets you pass, and which other servers sit next to it.
mcp-audit checkBadge for your README
mcp-audit1 unfixed CVE
Preview drawn by this page. The real badge is rendered by shields.io from this JSON and updates when the registry does.
[](https://mcp-audit.dev/servers/npm/gemini-mcp-tool/)