This project provides a dedicated MCP (Model Context Protocol) server that wraps the @google/genai SDK. It exposes Google's Gemini model capabilities as standard MCP tools, allowing other LLMs (like Cline) or MCP-compatible systems to leverage Gemini's features as a backend workhorse.
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
When Vitest UI server is listening, arbitrary file can be read and executed
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided
process.env. You'll be asked to provide them before it can run.ALLOWED_OUTPUT_PATHS— "": "/var/opt/mcp-gemini-server/outputs,/tmp/mcp-gemini-outputs" // Optional: Comma-separated list of allowed output directories for mcpCallServerTool and writeToFileToolENABLE_HEALTH_CHECK— Enable health check server (options: true, false; default: true)EXAMPLE_ENABLE_LOGSEXAMPLE_GREETINGGEMINI_SAFE_FILE_BASE_DIRGITHUB_API_TOKEN— Personal Access Token for GitHub API access (required for GitHub code review features). For public repos, token needs 'public_repo' and 'read:user' scopes. For private repos, token needs 'repo' scope.GOOGLE_GEMINI_API_KEY— "": "YOUR_API_KEY",GOOGLE_GEMINI_CODE_MODELSGOOGLE_GEMINI_DEFAULT_MODELGOOGLE_GEMINI_DEFAULT_THINKING_BUDGET— Default thinking budget in tokens (0-24576) for controlling model reasoningGOOGLE_GEMINI_ENABLE_URL_CONTEXT— Enable URL context features (options: true, false; default: false)GOOGLE_GEMINI_IMAGE_MODELSGOOGLE_GEMINI_IMAGE_RESOLUTIONGOOGLE_GEMINI_MAX_IMAGE_SIZE_MBGOOGLE_GEMINI_MODEL— "": "gemini-1.5-flash", // Optional: Set a default modelGOOGLE_GEMINI_MODELSGOOGLE_GEMINI_ROUTING_PREFER_COSTGOOGLE_GEMINI_ROUTING_PREFER_QUALITYGOOGLE_GEMINI_ROUTING_PREFER_SPEEDGOOGLE_GEMINI_SUPPORTED_IMAGE_FORMATSGOOGLE_GEMINI_URL_ALLOWED_DOMAINS— Comma-separated list or JSON array of allowed domains (default: for all domains)GOOGLE_GEMINI_URL_BLOCKLIST— Comma-separated list or JSON array of blocked domains (default: empty)GOOGLE_GEMINI_URL_CONVERT_TO_MARKDOWN— Convert HTML content to markdown (options: true, false; default: true)GOOGLE_GEMINI_URL_ENABLE_CACHING— Enable URL content caching (options: true, false; default: true)GOOGLE_GEMINI_URL_FETCH_TIMEOUT_MS— Fetch timeout per URL in milliseconds (default: 10000)GOOGLE_GEMINI_URL_INCLUDE_METADATA— Include URL metadata in context (options: true, false; default: true)GOOGLE_GEMINI_URL_MAX_CONTENT_KB— Maximum content size per URL in KB (default: 100)GOOGLE_GEMINI_URL_MAX_COUNT— Maximum URLs per request (default: 20)GOOGLE_GEMINI_URL_USER_AGENT— Custom User-Agent header for URL requests (default: MCP-Gemini-Server/1.0)HEALTH_CHECK_PORT— Port for health check HTTP server (default: 3000)MCP_CLIENT_ID— Default client ID used when this server acts as a client to other MCP servers (defaults to "gemini-sdk-client")MCP_CONNECTION_TOKEN— "": "YOUR_GENERATED_CONNECTION_TOKEN", // Required: Use the token from step 4MCP_ENABLE_STREAMING— Enable SSE streaming for HTTP transport (options: true, false; default: false)MCP_LOG_LEVEL— Log level for MCP operations (options: debug, info, warn, error; default: info)MCP_SERVER_HOST— "": "localhost", // Required: Server hostMCP_SERVER_PORT— "": "8080", // Required: Server portMCP_SESSION_TIMEOUT— Session timeout in seconds for HTTP transport (default: 3600 = 1 hour)MCP_TRANSPORT— Transport to use for MCP server (options: stdio, sse, streamable, http; default: stdio)MCP_TRANSPORT_TYPE— Deprecated - Use MCP_TRANSPORT insteadMCP_WS_PORT— Deprecated - Use MCP_SERVER_PORT insteadPORTSESSION_STORE_TYPE— Session storage backend (memory or sqlite; default: memory)SQLITE_DB_PATH— Path to SQLite database file when using sqlite store (default: ./data/sessions.db)[](https://m8ven.ai/mcp/bsmi021-mcp-gemini-server-1fgpej)