GitHub Security Advisory: GHSA-52cq-7v8r-62c6
Package: gmaps-mcp (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-20: Improper Input Validation, CWE-306: Missing Authentication for Critical Function
Vulnerable versions: <= 0.1.2
Patched in: 0.1.3

Summary: gmaps-mcp's unauthenticated HTTP transport allows unlimited Google Maps API calls at operator expense

Details:
## Unauthenticated HTTP Transport Allows Unlimited Google Maps API Calls at Operator Expense

The `gmaps-mcp` codebase was reviewed at commit `e671db68c804c9e67d51582d3280839ffa65f127` and three issues worth flagging were discovered — one high-severity, one medium, one structural. There were no preexisiting CVEs for this package yet and the repository had no prior security issues.

The primary issue is that the HTTP transport in `server.py` skips authentication entirely when `MCP_API_KEY` is not set — which is the default, since `.env.example` ships the key as a blank value. Any unauthenticated caller who knows the server's public URL can invoke all six tools and generate live, billed Google Maps API requests against the operator's key. Because the README explicitly instructs operators to expose the server via ngrok (`ngrok http 8000`, then point MCP clients at the ngrok URL), this configuration gets deployed internet-facing as a matter of normal usage.

**Affected files and exact lines:**

`src/google_maps_mcp/server.py`, lines 186–192:
```python
expected_key = os.getenv("MCP_API_KEY")

if not expected_key:
    # If no MCP_API_KEY is set, allow all requests (development mode)
    return await call_next(request)

if api_key != expected_key:
    return JSONResponse(
        {"error": "Invalid or missing API key. Provide X-API-Key header."},
        status_code=401
    )
```

`run.py` lines 37 and 38 bind to `0.0.0.0:8000` by default (`MCP_HOST=0.0.0.0`, `MCP_PORT=8000`). No rate-limiting middleware exists anywhere in the codebase — not in the middleware stack, not in `GoogleMapsClient`, not in the tool handlers.

**Attack model:** operator deploys with default config (blank `MCP_API_KEY`), exposes via ngrok per the README instructions, attacker discovers the ngrok URL through ngrok's public endpoint scan surface or via a targeted test of shared URLs. No credentials needed to call the server.

**PoC — reproduces from the default config:**
```bash
# Start with default .env.example (MCP_API_KEY blank/unset)
export GOOGLE_MAPS_API_KEY=<operator_key>
python run.py  # binds 0.0.0.0:8000

# From attacker machine — no X-API-Key header needed:
curl -X POST http://<server>:8000/mcp/ \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"geocode","arguments":{"address":"Times Square New York"}}}'
# Returns geocoding results. Request billed to operator's GCP project.
```

The financial harm is real and accumulates fast. Google's $200/month free credit exhausts in roughly 3 hours at Places API pricing (~$17/1,000 requests) with a sustained 1 req/sec flood. More practically: any developer testing the ngrok URL, sharing it in a project thread, or posting it in a demo context creates a window where anyone with the link can silently drain quota. The attacker doesn't need the `GOOGLE_MAPS_API_KEY` value — they only need the MCP server URL.

**Fix — three concrete changes, no new dependencies:**

1. In HTTP tr