{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-07","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Retrieves 8am MyCase legal-practice records from Claude. Look up matters, clients, tasks, deadlines, time entries, billing and portal messages. Reads use your existing MyCase permissions; documents and versions can also be downloaded.","did":"ba542ef5-98a6-4ed3-a06c-d6ac184737cd","documentation_url":"https://mcp.mycase.com/docs","editorial_description":{"extended_description":"Tools inspect leads, calls, notes, expenses, invoices and trust-account balances or ledger entries. Full-text search and document text support research, while feedback can be submitted about the connector.","schema_version":1,"summary":"Retrieves 8am MyCase legal-practice records from Claude.\nLook up matters, clients, tasks, deadlines, time entries, billing and portal messages.\nReads use your existing MyCase permissions; documents and versions can also be downloaded."},"homepage_url":"","icon":"https://www.8am.com/favicon.png","id":"ba542ef5-98a6-4ed3-a06c-d6ac184737cd","installs":0,"last_scanned":"","license":"","long_description":"Tools inspect leads, calls, notes, expenses, invoices and trust-account balances or ledger entries. Full-text search and document text support research, while feedback can be submitted about the connector.","manual_assessment":"low","manual_review":{"all_findings":[{"evidence":"The complete 73-tool inventory consists of get/list/search/download operations for cases, clients, documents, messages, billing, payments and trust accounts.","reasoning":"This exposes highly sensitive legal and financial data but no user-workspace write is declared.","risk_type":"private_data_read","severity":"low","title":"Reads legal matters, billing and trust data","triggering_tools_or_skills":["get_case","get_client","get_document_text","get_invoice","get_message_thread","list_trust_account_balances","list_trust_ledger_entries"]},{"evidence":"report_feedback forwards feedback to the publisher and is the only non-read-style tool name.","reasoning":"Feedback submission does not modify the user's MyCase records, so it is Low forwarding rather than a workspace write.","risk_type":"third_party_data_forwarding","severity":"low","title":"Submits connector feedback","triggering_tools_or_skills":["report_feedback"]},{"evidence":"Client documents and message threads are user/third-party-authored content returned to the model.","reasoning":"Legal correspondence can carry adversarial instructions in model context.","risk_type":"prompt_injection_exposure","severity":"low","title":"Loads client documents and messages","triggering_tools_or_skills":["get_document_text","get_message_thread","list_thread_messages"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication is required; the listing does not enumerate firm roles or OAuth scopes.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"low","evidence_completeness":"partial","manual_overall_risk":"low","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/ba542ef5-98a6-4ed3-a06c-d6ac184737cd.json","what_it_proves":"Candidate PR #125 record identity (name \"8am MyCase\", publisher, type web_connector) and 73 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/ba542ef5-98a6-4ed3-a06c-d6ac184737cd: complete tool_names inventory (73 tools), remote streamable-http endpoint https://mcp.mycase.com/mcp, auth_posture auth_required, directory tier partner"}],"primary_reason":"8am MyCase exposes a broad but read-only legal-practice data inventory.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:ba542ef5-98a6-4ed3-a06c-d6ac184737cd","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 73 tools. The official docs URL was inaccessible to the web fetcher; runtime verification should confirm download tools are read-only and report_feedback cannot alter case data.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"false","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":73,"tools_or_skills_total":73},"name":"8am MyCase","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=ba542ef5-98a6-4ed3-a06c-d6ac184737cd&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://mycase.com/terms/privacy/","provisional_risk":null,"publication_recommendation":"accept","publisher":"8am","publisher_url":"https://8am.com/","remote_url":"https://mcp.mycase.com/mcp","repository_url":"","risk":"low","risk_severity":"low","security_risks":[{"description":"This connector can read information available to the connected account and return it to the AI. Review findings: This exposes highly sensitive legal and financial data but no user-workspace write is declared.","evidence":"Reads legal matters, billing and trust data: The complete 73-tool inventory consists of get/list/search/download operations for cases, clients, documents, messages, billing, payments and trust accounts.","manual_risk_type":"private_data_read","remediation":{"block_tool_categories":["data_exfiltration"],"steps":["Use a least-privilege account limited to the information required by the workflow.","Restrict folders, projects, tenants, and other data scopes wherever the provider allows it.","Review access logs for unexpected reads or bulk retrieval."]},"risk_type":"reads_private_data","severity":"low","title":"Reads legal matters, billing and trust data","triggering_tools":["get_case","get_client","get_document_text","get_invoice","get_message_thread","list_trust_account_balances","list_trust_ledger_entries"]},{"description":"This connector can send caller-provided data to an external service or publisher. Review findings: Feedback submission does not modify the user's MyCase records, so it is Low forwarding rather than a workspace write.","evidence":"Submits connector feedback: report_feedback forwards feedback to the publisher and is the only non-read-style tool name.","manual_risk_type":"third_party_data_forwarding","remediation":{"block_tool_categories":["sends_externally"],"steps":["Do not include secrets, regulated data, or customer information unless the destination is approved.","Review the recipient's retention and deletion policy before enabling the connector."]},"risk_type":"forwards_data_to_third_party","severity":"low","title":"Submits connector feedback","triggering_tools":["report_feedback"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://supportcenter.mycase.com/en/","tags":["accesses_calendar","accesses_messaging","forwards_data_to_third_party","network_access","oauth_required","reads_private_data","web_connector"],"tools":[{"description":"","name":"download_document"},{"description":"","name":"download_document_version"},{"description":"","name":"full_text_search"},{"description":"","name":"get_call"},{"description":"","name":"get_case"},{"description":"","name":"get_case_billing_summary"},{"description":"","name":"get_case_folder"},{"description":"","name":"get_case_invoice_line_items"},{"description":"","name":"get_case_stage"},{"description":"","name":"get_client"},{"description":"","name":"get_company"},{"description":"","name":"get_custom_field"},{"description":"","name":"get_document"},{"description":"","name":"get_document_text"},{"description":"","name":"get_event"},{"description":"","name":"get_expense"},{"description":"","name":"get_firm"},{"description":"","name":"get_invoice"},{"description":"","name":"get_lead"},{"description":"","name":"get_location"},{"description":"","name":"get_me"},{"description":"","name":"get_message_thread"},{"description":"","name":"get_note"},{"description":"","name":"get_people_group"},{"description":"","name":"get_practice_area"},{"description":"","name":"get_referral_source"},{"description":"","name":"get_staff"},{"description":"","name":"get_task"},{"description":"","name":"get_time_entry"},{"description":"","name":"list_all_expenses"},{"description":"","name":"list_all_invoices"},{"description":"","name":"list_all_payments"},{"description":"","name":"list_all_time_entries"},{"description":"","name":"list_callers"},{"description":"","name":"list_calls"},{"description":"","name":"list_case_billing_expenses"},{"description":"","name":"list_case_billing_flat_fees"},{"description":"","name":"list_case_billing_payments"},{"description":"","name":"list_case_billing_time_entries"},{"description":"","name":"list_case_documents"},{"description":"","name":"list_case_invoices"},{"description":"","name":"list_case_notes"},{"description":"","name":"list_case_roles"},{"description":"","name":"list_case_stages"},{"description":"","name":"list_cases"},{"description":"","name":"list_client_cases"},{"description":"","name":"list_client_message_threads"},{"description":"","name":"list_client_notes"},{"description":"","name":"list_clients"},{"description":"","name":"list_companies"},{"description":"","name":"list_company_notes"},{"description":"","name":"list_contacts"},{"description":"","name":"list_custom_field_options"},{"description":"","name":"list_custom_fields"},{"description":"","name":"list_document_versions"},{"description":"","name":"list_document_versions_all"},{"description":"","name":"list_documents"},{"description":"","name":"list_events"},{"description":"","name":"list_folder_documents"},{"description":"","name":"list_folder_subfolders"},{"description":"","name":"list_leads"},{"description":"","name":"list_locations"},{"description":"","name":"list_message_threads"},{"description":"","name":"list_people_groups"},{"description":"","name":"list_practice_areas"},{"description":"","name":"list_referral_sources"},{"description":"","name":"list_staff"},{"description":"","name":"list_tasks"},{"description":"","name":"list_thread_messages"},{"description":"","name":"list_trust_account_balances"},{"description":"","name":"list_trust_bank_accounts"},{"description":"","name":"list_trust_ledger_entries"},{"description":"","name":"report_feedback"}],"tools_count":73,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/ba542ef5-98a6-4ed3-a06c-d6ac184737cd","uuid":"71204802-de4e-5c9d-9290-025f72f5babf","verification_tier":"partner","version":""},"query_key":"8am mycase","schema_version":1,"status":"match"}