{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-06-29","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"high","description":"Analyze social performance and prepare content in Agorapulse. Review audience, brand, content and community-management metrics. Create drafts and calendar notes for review, without publishing to social accounts.","did":"cc9dff30-b1d2-442f-bb46-4b6af0033883","documentation_url":"https://support.agorapulse.com/en/articles/12960496-model-context-protocool-mcp-integration-explained","editorial_description":{"extended_description":"Inspect connected profiles, compare top-performing posts and filter performance by label. OAuth preserves your existing account access. The connector requires an active Agorapulse subscription and a compatible Claude plan.","schema_version":1,"summary":"Analyze social performance and prepare content in Agorapulse.\nReview audience, brand, content and community-management metrics.\nCreate drafts and calendar notes for review, without publishing to social accounts."},"homepage_url":"","icon":"https://design.agorapulse.com/iframe.html?id=actions-iconbutton--default&viewMode=story","id":"cc9dff30-b1d2-442f-bb46-4b6af0033883","installs":0,"last_scanned":"","license":"","long_description":"Inspect connected profiles, compare top-performing posts and filter performance by label. OAuth preserves your existing account access. The connector requires an active Agorapulse subscription and a compatible Claude plan.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"Official docs state the connector can reply to inbox items publicly or privately; replies may be queued for approval. No reply tool appears in the Directory packet.","reasoning":"Replies communicate externally as the user, so the current union is High even when approval workflow queues them.","risk_type":"messaging_as_user","severity":"high","title":"Current Agorapulse MCP can send public or private replies","triggering_tools_or_skills":[]},{"evidence":"The Directory tools and official docs confirm creation of drafts and notes but say drafts are not automatically published.","reasoning":"These actions persist internal content without themselves posting it.","risk_type":"data_modification","severity":"medium","title":"Draft posts and calendar notes can be created","triggering_tools_or_skills":["create_simple_draft","create_note"]},{"evidence":"The official capabilities page documents reply behavior and says the tool count will increase, but the packet lists only 12 analytics/draft/note tools.","reasoning":"The catalog must refresh the tool inventory and display the High messaging action.","risk_type":"identity_discrepancy","severity":"low","title":"Current reply actions are absent from the Directory inventory","triggering_tools_or_skills":[]},{"evidence":"The connector runs at https://api.openmcp.agorapulse.com/mcp without a pinned server implementation in the packet.","reasoning":"The hosted implementation can change independently of this catalog snapshot, requiring runtime verification and change monitoring.","risk_type":"provenance_uncertainty","severity":"low","title":"Agorapulse is a mutable remote service","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"OAuth inherits the Agorapulse user permissions and connected social profiles; official docs describe optional approval workflows for replies.","blocked_missing_evidence":null,"confidence":"high","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/cc9dff30-b1d2-442f-bb46-4b6af0033883.json","what_it_proves":"Candidate PR #125 record identity (name \"Agorapulse\", publisher, type web_connector) and 12 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/cc9dff30-b1d2-442f-bb46-4b6af0033883: complete tool_names inventory (12 tools), remote streamable-http endpoint https://api.openmcp.agorapulse.com/mcp, auth_posture auth_required, publisher-declared permissions text, directory tier community"},{"accessed_at":"2026-10-10T21:04:12Z","url_or_path":"https://support.agorapulse.com/en/articles/12960496-model-context-protocool-mcp-integration-explained","what_it_proves":"Current official docs add public/private inbox reply actions beyond the 12 Directory tools, while drafts themselves do not publish."}],"primary_reason":"Current Agorapulse MCP can send replies, but the catalog only lists analytics, notes and draft tools.","provisional_risk":null,"publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:cc9dff30-b1d2-442f-bb46-4b6af0033883","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 12 Directory tools plus the official current capabilities. Rate is based on the union; publication requires inventory refresh.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":12,"tools_or_skills_total":12},"name":"Agorapulse","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=cc9dff30-b1d2-442f-bb46-4b6af0033883&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.agorapulse.com/privacy-policy/","provisional_risk":null,"publication_recommendation":"fix","publisher":"Agorapulse","publisher_url":"https://www.agorapulse.com/","remote_url":"https://api.openmcp.agorapulse.com/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: Replies communicate externally as the user, so the current union is High even when approval workflow queues them.","evidence":"Current Agorapulse MCP can send public or private replies: Official docs state the connector can reply to inbox items publicly or privately; replies may be queued for approval. No reply tool appears in the Directory packet.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Current Agorapulse MCP can send public or private replies","triggering_tools":[]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions persist internal content without themselves posting it.","evidence":"Draft posts and calendar notes can be created: The Directory tools and official docs confirm creation of drafts and notes but say drafts are not automatically published.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Draft posts and calendar notes can be created","triggering_tools":["create_simple_draft","create_note"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@agorapulse.com","tags":["modifies_data","network_access","oauth_required","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"create_note","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions persist internal content without themselves posting it."}},{"description":"","name":"create_simple_draft","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions persist internal content without themselves posting it."}},{"description":"","name":"get_audience_insights"},{"description":"","name":"get_brand_performance"},{"description":"","name":"get_community_management_insights"},{"description":"","name":"get_content_insights"},{"description":"","name":"get_labeled_post_performance"},{"description":"","name":"get_organizations"},{"description":"","name":"get_profiles"},{"description":"","name":"get_top_contents"},{"description":"","name":"get_workspaces"},{"description":"","name":"search_notes"}],"tools_count":12,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/cc9dff30-b1d2-442f-bb46-4b6af0033883","uuid":"8a02b70c-251a-5f89-beb3-12bebb2e339f","verification_tier":"community","version":""},"query_key":"agorapulse agorapulse","schema_version":1,"status":"match"}