{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-04","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Accessibility Tracker connects projects, WCAG issues, scans, and reports to Claude. Compare findings, plan remediation, and review VPAT records. Scoped API keys control optional writes and scan jobs; permanent deletion is not exposed.","did":"9a2216d0-3a46-47c7-bdbd-8b75b9bda6c3","documentation_url":"https://accessibilitytracker.com/docs/mcp","editorial_description":{"extended_description":"Read workspace data and documentation, inspect conformance posture, and draft VPAT remarks for human review. With explicitly granted capabilities, create or update issues, add comments, import findings, and start or cancel scans.","schema_version":1,"summary":"Accessibility Tracker connects projects, WCAG issues, scans, and reports to Claude.\nCompare findings, plan remediation, and review VPAT records.\nScoped API keys control optional writes and scan jobs; permanent deletion is not exposed."},"homepage_url":"","icon":"","id":"9a2216d0-3a46-47c7-bdbd-8b75b9bda6c3","installs":0,"last_scanned":"","license":"","long_description":"Read workspace data and documentation, inspect conformance posture, and draft VPAT remarks for human review. With explicitly granted capabilities, create or update issues, add comments, import findings, and start or cancel scans.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"This adds collaborator-visible remediation discussion.","reasoning":"It communicates as the key owner.","risk_type":"messaging_as_user","severity":"high","title":"Posts issue comments","triggering_tools_or_skills":["comment_on_issue"]},{"evidence":"These tools control operational scanner jobs.","reasoning":"They launch/stop production assessment workloads.","risk_type":"deployment_infrastructure","severity":"high","title":"Starts/cancels website accessibility scan jobs","triggering_tools_or_skills":["start_scan","cancel_scan"]},{"evidence":"These tools persist remediation records.","reasoning":"They materially change workspace state.","risk_type":"data_modification","severity":"medium","title":"Creates/updates/imports accessibility issues","triggering_tools_or_skills":["create_issue","create_issues_bulk","update_issue","import_scan_results"]}],"assessment_status":"provisional","auth_and_scopes":"Scoped API keys grant explicit read/write/scan-job capabilities; permanent deletion is not exposed.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/9a2216d0-3a46-47c7-bdbd-8b75b9bda6c3.json","what_it_proves":"Candidate PR #125 record identity (name \"accessibilitytracker.com\", publisher, type web_connector) and 28 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/9a2216d0-3a46-47c7-bdbd-8b75b9bda6c3: complete tool_names inventory (28 tools), remote streamable-http endpoint https://accessibilitytracker.com/api/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Accessibility Tracker posts comments and controls scan jobs.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:9a2216d0-3a46-47c7-bdbd-8b75b9bda6c3","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 28 tools. No permanent deletion is exposed.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"true","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":28,"tools_or_skills_total":28},"name":"accessibilitytracker.com","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=9a2216d0-3a46-47c7-bdbd-8b75b9bda6c3&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://accessibilitytracker.com/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Accessible.org, LLC","publisher_url":"https://accessible.org/","remote_url":"https://accessibilitytracker.com/api/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: It communicates as the key owner.","evidence":"Posts issue comments: This adds collaborator-visible remediation discussion.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Posts issue comments","triggering_tools":["comment_on_issue"]},{"description":"This connector can deploy code or change infrastructure and production environments. Review findings: They launch/stop production assessment workloads.","evidence":"Starts/cancels website accessibility scan jobs: These tools control operational scanner jobs.","manual_risk_type":"deployment_infrastructure","remediation":{"block_tool_categories":["code_execution","state_change"],"steps":["Default to a sandbox or staging environment.","Require code review, human approval, audit logging, and a tested rollback path for production changes."]},"risk_type":"code_deployment","severity":"high","title":"Starts/cancels website accessibility scan jobs","triggering_tools":["start_scan","cancel_scan"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change workspace state.","evidence":"Creates/updates/imports accessibility issues: These tools persist remediation records.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Creates/updates/imports accessibility issues","triggering_tools":["create_issue","create_issues_bulk","update_issue","import_scan_results"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"contact@accessibilitytracker.com","tags":["code_deployment","modifies_data","network_access","oauth_required","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"cancel_scan","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: They launch/stop production assessment workloads."}},{"description":"","name":"comment_on_issue","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: It communicates as the key owner."}},{"description":"","name":"compare_scans"},{"description":"","name":"create_issue","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change workspace state."}},{"description":"","name":"create_issues_bulk","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change workspace state."}},{"description":"","name":"get_account_status"},{"description":"","name":"get_conformance_posture"},{"description":"","name":"get_document"},{"description":"","name":"get_issue"},{"description":"","name":"get_issue_metrics"},{"description":"","name":"get_project"},{"description":"","name":"get_report_status"},{"description":"","name":"get_scan"},{"description":"","name":"get_vpat"},{"description":"","name":"import_scan_results","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change workspace state."}},{"description":"","name":"list_issues"},{"description":"","name":"list_projects"},{"description":"","name":"list_reports"},{"description":"","name":"list_scan_pages"},{"description":"","name":"list_scan_results"},{"description":"","name":"list_scans"},{"description":"","name":"list_vpats"},{"description":"","name":"search_documents"},{"description":"","name":"search_issues"},{"description":"","name":"start_scan","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: They launch/stop production assessment workloads."}},{"description":"","name":"update_issue","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change workspace state."}},{"description":"","name":"update_issues_bulk"},{"description":"","name":"whoami"}],"tools_count":28,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/9a2216d0-3a46-47c7-bdbd-8b75b9bda6c3","uuid":"7f61e707-3ef7-5630-a01f-555bcc12494a","verification_tier":"community","version":""},"query_key":"accessible org llc accessibilitytracker com","schema_version":1,"status":"match"}