{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-18","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Import and export Shopify store data with Altera using Excel or CSV. Prepare bulk changes to products, inventory, orders, metafields and other records. Review import effects, run jobs and inspect results through your connected store.","did":"128a57b2-b50f-4659-8cff-b2298de3099f","documentation_url":"https://support.getaltera.com/","editorial_description":{"extended_description":"Workflows include prices, SEO fields, translations, publishing settings, customers, collections and media. Reference tools provide supported fields, filters, locations, markets and taxonomy. Job status, cancellation and result downloads help manage imports; changes can affect many records at once.","schema_version":1,"summary":"Import and export Shopify store data with Altera using Excel or CSV.\nPrepare bulk changes to products, inventory, orders, metafields and other records.\nReview import effects, run jobs and inspect results through your connected store."},"homepage_url":"","icon":"https://www.getaltera.com/favicon.svg","id":"128a57b2-b50f-4659-8cff-b2298de3099f","installs":0,"last_scanned":"","license":"","long_description":"Workflows include prices, SEO fields, translations, publishing settings, customers, collections and media. Reference tools provide supported fields, filters, locations, markets and taxonomy. Job status, cancellation and result downloads help manage imports; changes can affect many records at once.","manual_assessment":"medium","manual_review":{"all_findings":[{"evidence":"The listing says import jobs create and bulk-update products, customers, orders, collections, prices, inventory, publishing and files; the declared tools create and run jobs and upload their data.","reasoning":"Import execution persists broad commerce and catalog changes.","risk_type":"data_modification","severity":"medium","title":"Bulk imports and updates Shopify store data","triggering_tools_or_skills":["import_create","job_run","request_media_upload_url","request_upload_url","upload_file_data"]},{"evidence":"The listing explicitly includes export of products, orders, customers, discounts, pages and other shop resources.","reasoning":"Exports can expose private customer and commercial data.","risk_type":"private_data_read","severity":"low","title":"Exports store, order and customer data","triggering_tools_or_skills":["export_create","job_download_url","list_shops","shop_customer_segments"]},{"evidence":"The connector consumes merchant spreadsheets and reads Shopify document and resource content.","reasoning":"Imported or store-supplied text can contain adversarial instructions.","risk_type":"prompt_injection_exposure","severity":"low","title":"Shop records and uploaded spreadsheets contain untrusted text","triggering_tools_or_skills":["read_doc","search_docs","upload_file_data"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication scopes the connector to authorized Shopify shops; exact resources, sales-channel and file permissions are not documented in the packet.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"medium","evidence_completeness":"partial","manual_overall_risk":"medium","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/128a57b2-b50f-4659-8cff-b2298de3099f.json","what_it_proves":"Candidate PR #125 record identity (name \"mcp.getaltera.com\", publisher, type web_connector) and 27 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/128a57b2-b50f-4659-8cff-b2298de3099f: complete tool_names inventory (27 tools), remote streamable-http endpoint https://mcp.getaltera.com/mcp, auth_posture auth_required, directory tier community"},{"accessed_at":"2026-10-10T21:05:11Z","url_or_path":"https://support.getaltera.com/en/","what_it_proves":"The official Altera help center identifies the product as a Shopify import/export system and links first-export and first-product-import tutorials."}],"primary_reason":"The connector creates and runs bulk Shopify import jobs but exposes no declared delete, send, payment or code-execution action.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:128a57b2-b50f-4659-8cff-b2298de3099f","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 27 names. Runtime verification should confirm whether job_run can invoke any deletion mode and whether import jobs require an explicit preview/confirmation step.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":27,"tools_or_skills_total":27},"name":"mcp.getaltera.com","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=128a57b2-b50f-4659-8cff-b2298de3099f&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.getaltera.com/privacy-policy/","provisional_risk":null,"publication_recommendation":"accept","publisher":"Altera","publisher_url":"https://www.getaltera.com/","remote_url":"https://mcp.getaltera.com/mcp","repository_url":"","risk":"medium","risk_severity":"medium","security_risks":[{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Import execution persists broad commerce and catalog changes.","evidence":"Bulk imports and updates Shopify store data: The listing says import jobs create and bulk-update products, customers, orders, collections, prices, inventory, publishing and files; the declared tools create and run jobs and upload their data.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Bulk imports and updates Shopify store data","triggering_tools":["import_create","job_run","request_media_upload_url","request_upload_url","upload_file_data"]},{"description":"This connector can read information available to the connected account and return it to the AI. Review findings: Exports can expose private customer and commercial data.","evidence":"Exports store, order and customer data: The listing explicitly includes export of products, orders, customers, discounts, pages and other shop resources.","manual_risk_type":"private_data_read","remediation":{"block_tool_categories":["data_exfiltration"],"steps":["Use a least-privilege account limited to the information required by the workflow.","Restrict folders, projects, tenants, and other data scopes wherever the provider allows it.","Review access logs for unexpected reads or bulk retrieval."]},"risk_type":"reads_private_data","severity":"low","title":"Exports store, order and customer data","triggering_tools":["export_create","job_download_url","list_shops","shop_customer_segments"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@getaltera.com","tags":["modifies_data","network_access","oauth_required","reads_private_data","web_connector"],"tools":[{"description":"","name":"export_create"},{"description":"","name":"import_create","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Import execution persists broad commerce and catalog changes."}},{"description":"","name":"job_cancel"},{"description":"","name":"job_download_url"},{"description":"","name":"job_run","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Import execution persists broad commerce and catalog changes."}},{"description":"","name":"job_status"},{"description":"","name":"list_jobs"},{"description":"","name":"list_shops"},{"description":"","name":"read_doc"},{"description":"","name":"ref_fields"},{"description":"","name":"ref_filters"},{"description":"","name":"ref_metafields"},{"description":"","name":"ref_operators"},{"description":"","name":"ref_resources"},{"description":"","name":"request_media_upload_url","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Import execution persists broad commerce and catalog changes."}},{"description":"","name":"request_upload_url","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Import execution persists broad commerce and catalog changes."}},{"description":"","name":"search_docs"},{"description":"","name":"shop_customer_segments"},{"description":"","name":"shop_locations"},{"description":"","name":"shop_markets"},{"description":"","name":"shop_metafield_definitions"},{"description":"","name":"shop_metaobject_definitions"},{"description":"","name":"taxonomy_browse"},{"description":"","name":"taxonomy_search"},{"description":"","name":"taxonomy_validate"},{"description":"","name":"upload_file_data","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Import execution persists broad commerce and catalog changes."}},{"description":"","name":"whoami"}],"tools_count":27,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/128a57b2-b50f-4659-8cff-b2298de3099f","uuid":"faa91829-e254-5e5d-8882-1f4538012675","verification_tier":"community","version":""},"query_key":"altera mcp getaltera com","schema_version":1,"status":"match"}