{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-18","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"TryMermaid creates, validates, previews, and stores Mermaid diagrams. Check syntax, obtain image or edit links, and create, update, or delete saved diagrams. The connector requires a TryMermaid Pro account and uses OAuth rather than an API key.","did":"512816e6-0130-4d2c-9880-7f0e9bad9823","documentation_url":"https://trymermaid.app/docs/mcp","editorial_description":{"extended_description":"Validation uses the Mermaid parser and returns error locations and expected tokens. Previews can be generated without saving. Supported types include flowcharts, sequence diagrams, ER diagrams, timelines, Gantt charts, and more. Saved flowcharts can also be arranged in the web editor, with hand-positioned shapes preserved on updates.","schema_version":1,"summary":"TryMermaid creates, validates, previews, and stores Mermaid diagrams.\nCheck syntax, obtain image or edit links, and create, update, or delete saved diagrams.\nThe connector requires a TryMermaid Pro account and uses OAuth rather than an API key."},"homepage_url":"","icon":"","id":"512816e6-0130-4d2c-9880-7f0e9bad9823","installs":0,"last_scanned":"","license":"","long_description":"Validation uses the Mermaid parser and returns error locations and expected tokens. Previews can be generated without saving. Supported types include flowcharts, sequence diagrams, ER diagrams, timelines, Gantt charts, and more. Saved flowcharts can also be arranged in the web editor, with hand-positioned shapes preserved on updates.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"Tool explicitly deletes a saved diagram.","reasoning":"Deletion of meaningful user content is High.","risk_type":"data_deletion","severity":"high","title":"Deletes saved diagrams","triggering_tools_or_skills":["trymermaid_delete_diagram"]},{"evidence":"Tools persist new and changed diagram content.","reasoning":"Meaningful content edits are Medium.","risk_type":"data_modification","severity":"medium","title":"Creates and updates diagrams","triggering_tools_or_skills":["trymermaid_create_diagram","trymermaid_update_diagram"]},{"evidence":"The remote hosted implementation is not pinned.","reasoning":"Runtime capabilities may change after review.","risk_type":"provenance_uncertainty","severity":"low","title":"Hosted implementation is mutable","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"OAuth/account authorization required; exact scopes are not documented.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/512816e6-0130-4d2c-9880-7f0e9bad9823.json","what_it_proves":"Candidate PR #125 record identity (name \"trymermaid.app\", publisher, type web_connector) and 9 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/512816e6-0130-4d2c-9880-7f0e9bad9823: complete tool_names inventory (9 tools), remote streamable-http endpoint https://trymermaid.app/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"TryMermaid persists diagrams and can delete them.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:512816e6-0130-4d2c-9880-7f0e9bad9823","reviewed_at":"2026-10-10","reviewer_notes":"All nine names reviewed; preview/validate are non-persistent.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":9,"tools_or_skills_total":9},"name":"trymermaid.app","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=512816e6-0130-4d2c-9880-7f0e9bad9823&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://trymermaid.app/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Alee Hamza","publisher_url":"https://aleehamza.vercel.app/","remote_url":"https://trymermaid.app/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can permanently remove data or resources. Review findings: Deletion of meaningful user content is High.","evidence":"Deletes saved diagrams: Tool explicitly deletes a saved diagram.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Deletes saved diagrams","triggering_tools":["trymermaid_delete_diagram"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Meaningful content edits are Medium.","evidence":"Creates and updates diagrams: Tools persist new and changed diagram content.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Creates and updates diagrams","triggering_tools":["trymermaid_create_diagram","trymermaid_update_diagram"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@trymermaid.app","tags":["deletes_data","modifies_data","network_access","oauth_required","web_connector"],"tools":[{"description":"","name":"trymermaid_create_diagram","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Meaningful content edits are Medium."}},{"description":"","name":"trymermaid_delete_diagram","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion of meaningful user content is High."}},{"description":"","name":"trymermaid_get_diagram"},{"description":"","name":"trymermaid_get_diagram_type"},{"description":"","name":"trymermaid_list_diagram_types"},{"description":"","name":"trymermaid_list_diagrams"},{"description":"","name":"trymermaid_preview_diagram"},{"description":"","name":"trymermaid_update_diagram","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Meaningful content edits are Medium."}},{"description":"","name":"trymermaid_validate_diagram"}],"tools_count":9,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/512816e6-0130-4d2c-9880-7f0e9bad9823","uuid":"1a98f0b9-ac1b-5fc6-b3da-1ed7e2658ee0","verification_tier":"community","version":""},"query_key":"alee hamza trymermaid app","schema_version":1,"status":"match"}