{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-19","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","catalog_reconciliation":{"basis":"Documented actions on the identified catalog surface; not an execution test.","confidence":"medium","evidence_completeness":"partial","previous":{"confidence":"low","detail_sha256":"4ea31105f6879ed567ebc2038fbc6e950d3348ab84742f68a8890d9c82673797","risk":"high"},"proposal_file":"claude-tail-proposals.json","rationale":"Low-confidence entry; primary evidence largely resolves the 'share semantics undocumented' gap. OAuth metadata limits the connector to conversations:read, transcripts:read and sharables:write. The Fieldy app guide says a share link covers one conversation (title, date, summary, transcript), is viewable by anyone with the link, can be turned off with Make Private, and 'Fieldy does not send conversations to people'. So fieldy_share_conversation creates a revocable link returned to the user. It does not send messages as the user, and it is not an admin/permission change. Sensitive private transcript reads plus a bounded, reversible link creation => Medium. High would need evidence that the tool sends or publishes content, or exposes more than one conversation.","review_key":"claudesec:97bcbd6a-41b4-4113-8726-88e6993e56ae","reviewed_at":"2026-10-12","runtime_verified":false,"sources":["https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community","https://www.fieldy.ai/guides","https://www.fieldy.ai/guides/fieldy-app","https://api.fieldy.ai/.well-known/oauth-protected-resource","https://www.fieldy.ai/blog/introducing-fieldy-developer-platform-public-api-mcp"],"status":"resolved"},"category":"Web Connector","confidence":"low","description":"Fieldy retrieves conversations captured in your Fieldy account. Browse recent recordings or date ranges and open available summaries and transcripts. Retrieve timestamped transcript lines with speaker labels, or share a conversation.","did":"97bcbd6a-41b4-4113-8726-88e6993e56ae","documentation_url":"https://www.fieldy.ai/guides","editorial_description":{"extended_description":"","schema_version":1,"summary":"Fieldy retrieves conversations captured in your Fieldy account.\nBrowse recent recordings or date ranges and open available summaries and transcripts.\nRetrieve timestamped transcript lines with speaker labels, or share a conversation."},"homepage_url":"","icon":"","id":"97bcbd6a-41b4-4113-8726-88e6993e56ae","installs":0,"last_scanned":"","license":"","long_description":"","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The explicit tool shares private conversation content outside its default view.","reasoning":"It communicates sensitive material as the user.","risk_type":"messaging_as_user","severity":"high","title":"Shares a captured conversation","triggering_tools_or_skills":["fieldy_share_conversation"]},{"evidence":"Sharing changes who can access a transcript/summary.","reasoning":"It is a privileged visibility/access action.","risk_type":"credential_admin","severity":"high","title":"Changes conversation sharing/access","triggering_tools_or_skills":["fieldy_share_conversation"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication is required; captured conversation access follows Fieldy account permissions; share semantics are undocumented.","blocked_missing_evidence":null,"confidence":"low","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/97bcbd6a-41b4-4113-8726-88e6993e56ae.json","what_it_proves":"Candidate PR #125 record identity (name \"Fieldy\", publisher, type web_connector) and 5 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/97bcbd6a-41b4-4113-8726-88e6993e56ae: complete tool_names inventory (5 tools), remote streamable-http endpoint https://api.fieldy.ai/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Fieldy can share private captured conversations, but audience/link controls are undocumented.","provisional_risk":null,"publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:97bcbd6a-41b4-4113-8726-88e6993e56ae","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all five tools. Public docs were not located; runtime schema should identify recipients, expiration, revocation and whether sharing emails a recipient or creates a link.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"true","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"false","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":5,"tools_or_skills_total":5},"name":"Fieldy","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=97bcbd6a-41b4-4113-8726-88e6993e56ae&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.fieldy.ai/policy/privacy-policy","provisional_risk":null,"publication_recommendation":"fix","publisher":"Adomas Valiukevicius","publisher_url":"https://www.linkedin.com/in/adomasv/","remote_url":"https://api.fieldy.ai/mcp","repository_url":"","risk":"medium","risk_severity":"medium","security_risks":[{"description":"Retrieves private conversation summaries and timestamped transcripts, including other participants’ speech.","evidence":"Actions: fieldy_get_conversation, fieldy_list_conversations_in_time_range, fieldy_list_recent_conversations, fieldy_list_transcripts. https://api.fieldy.ai/.well-known/oauth-protected-resource — scopes_supported conversations:read, transcripts:read; https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community — id 97bcbd6a description: retrieve transcripts with speaker labels","risk_type":"reads_private_data","severity":"medium","title":"Reads recorded conversations and transcripts"},{"description":"Creates a revocable link that anyone holding it can open to view one conversation’s title, date, summary and transcript. The link is returned to you for sharing.","evidence":"Actions: fieldy_share_conversation. https://api.fieldy.ai/.well-known/oauth-protected-resource — scope sharables:write; https://www.fieldy.ai/guides/fieldy-app — 'Sharing Conversations': link covers one conversation; 'Make Private: turn the link off'; 'Fieldy does not send conversations to people who were in the room'","risk_type":"modifies_data","severity":"medium","title":"Creates a public link to one conversation"}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://support.fieldy.ai","tags":["reads_private_data","modifies_data"],"tools":[{"description":"","name":"fieldy_get_conversation"},{"description":"","name":"fieldy_list_conversations_in_time_range"},{"description":"","name":"fieldy_list_recent_conversations"},{"description":"","name":"fieldy_list_transcripts"},{"description":"","name":"fieldy_share_conversation","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: It is a privileged visibility/access action."}}],"tools_count":5,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/97bcbd6a-41b4-4113-8726-88e6993e56ae","uuid":"b82ed195-05c5-593b-9016-bec1d41ab789","verification_tier":"community","version":""},"query_key":"adomas valiukevicius fieldy","schema_version":1,"status":"match"}