{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-10","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"ANAV connects construction planning, workload, and time tracking to Claude. Inspect or manage projects, assignments, availability, expenses, and recorded work. You choose authorized organizations, and operations remain within your ANAV permissions.","did":"abc83477-1eaf-4787-b41b-3f9e1739e133","documentation_url":"https://docs.anav.app/","editorial_description":{"extended_description":"Maintain customers, collaborators, milestones, reminders, absences, and supported schedules. You can change the authorized organizations or revoke the connection through ANAV's connected-app settings.","schema_version":1,"summary":"ANAV connects construction planning, workload, and time tracking to Claude.\nInspect or manage projects, assignments, availability, expenses, and recorded work.\nYou choose authorized organizations, and operations remain within your ANAV permissions."},"homepage_url":"","icon":"","id":"abc83477-1eaf-4787-b41b-3f9e1739e133","installs":0,"last_scanned":"","license":"","long_description":"Maintain customers, collaborators, milestones, reminders, absences, and supported schedules. You can change the authorized organizations or revoke the connection through ANAV's connected-app settings.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"These tools change project financial records.","reasoning":"They have consequential accounting/budget effects.","risk_type":"financial_transaction","severity":"high","title":"Creates/updates/deletes actual and forecast expenses","triggering_tools_or_skills":["actual_expense_create","actual_expense_update","actual_expense_delete","forecasted_expense_create"]},{"evidence":"Explicit tools remove durable operational records.","reasoning":"They can cause broad planning/history loss.","risk_type":"data_deletion","severity":"high","title":"Deletes absences, expenses, assignments, milestones, tasks, pauses and reminders","triggering_tools_or_skills":["absence_delete","actual_expense_delete","affectation_delete","milestone_delete","cutting_task_delete"]},{"evidence":"These tools administer workforce identities/access context.","reasoning":"They are privileged organization actions.","risk_type":"credential_admin","severity":"high","title":"Creates/archives collaborators and contractors","triggering_tools_or_skills":["collaborator_create","collaborator_archive","contractor_create"]},{"evidence":"These tools alter live project/workforce operations.","reasoning":"They control consequential workflow state.","risk_type":"deployment_infrastructure","severity":"high","title":"Finishes projects and generates time logs/assignments","triggering_tools_or_skills":["project_finish","affectation_generate_time_logs"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication/selected organization scopes construction planning, employees and expenses.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/abc83477-1eaf-4787-b41b-3f9e1739e133.json","what_it_proves":"Candidate PR #125 record identity (name \"ANAV\", publisher, type web_connector) and 80 stored tool names (truncated vs Directory); no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/abc83477-1eaf-4787-b41b-3f9e1739e133: complete tool_names inventory (90 tools), remote streamable-http endpoint https://anav.app/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"ANAV changes financial records, deletes planning data and administers workforce/project state.","provisional_risk":null,"publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:abc83477-1eaf-4787-b41b-3f9e1739e133","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 90 stored tools; packet is truncated but explicit High actions are sufficient.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"true","deletes_data":"true","deployment_or_infrastructure":"true","dynamic_hidden_actions":"false","filesystem_or_repo_access":"true","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"true"},"tools_or_skills_reviewed":90,"tools_or_skills_total":90},"name":"ANAV","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=abc83477-1eaf-4787-b41b-3f9e1739e133&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://enbref.anav.app/legal/politique-de-confidentialite","provisional_risk":null,"publication_recommendation":"fix","publisher":"ANAV","publisher_url":"https://enbref.anav.app/","remote_url":"https://anav.app/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: They have consequential accounting/budget effects.","evidence":"Creates/updates/deletes actual and forecast expenses: These tools change project financial records.","manual_risk_type":"financial_transaction","remediation":{"block_tool_categories":["financial"],"steps":["Set provider-side spending limits and require approval for every financial action.","Use a dedicated low-balance account and review transaction logs."]},"risk_type":"spends_money","severity":"high","title":"Creates/updates/deletes actual and forecast expenses","triggering_tools":["actual_expense_create","actual_expense_update","actual_expense_delete","forecasted_expense_create"]},{"description":"This connector can permanently remove data or resources. Review findings: They can cause broad planning/history loss.","evidence":"Deletes absences, expenses, assignments, milestones, tasks, pauses and reminders: Explicit tools remove durable operational records.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Deletes absences, expenses, assignments, milestones, tasks, pauses and reminders","triggering_tools":["absence_delete","actual_expense_delete","affectation_delete","milestone_delete","cutting_task_delete"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They are privileged organization actions.","evidence":"Creates/archives collaborators and contractors: These tools administer workforce identities/access context.","manual_risk_type":"credential_admin","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"high","title":"Creates/archives collaborators and contractors","triggering_tools":["collaborator_create","collaborator_archive","contractor_create"]},{"description":"This connector can deploy code or change infrastructure and production environments. Review findings: They control consequential workflow state.","evidence":"Finishes projects and generates time logs/assignments: These tools alter live project/workforce operations.","manual_risk_type":"deployment_infrastructure","remediation":{"block_tool_categories":["code_execution","state_change"],"steps":["Default to a sandbox or staging environment.","Require code review, human approval, audit logging, and a tested rollback path for production changes."]},"risk_type":"code_deployment","severity":"high","title":"Finishes projects and generates time logs/assignments","triggering_tools":["project_finish","affectation_generate_time_logs"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"contact@anav.app","tags":["accesses_calendar","code_deployment","deletes_data","modifies_data","network_access","oauth_required","spends_money","web_connector"],"tools":[{"description":"","name":"absence_delete","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: They can cause broad planning/history loss."}},{"description":"","name":"absence_list"},{"description":"","name":"absence_reason_list"},{"description":"","name":"absence_update"},{"description":"","name":"actual_expense_create","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: They have consequential accounting/budget effects."}},{"description":"","name":"actual_expense_delete","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: They can cause broad planning/history loss."}},{"description":"","name":"actual_expense_list"},{"description":"","name":"actual_expense_update","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: They have consequential accounting/budget effects."}},{"description":"","name":"actual_expenses_bulk_create"},{"description":"","name":"affectation_create"},{"description":"","name":"affectation_delete","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: They can cause broad planning/history loss."}},{"description":"","name":"affectation_generate_time_logs","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: They control consequential workflow state."}},{"description":"","name":"affectation_list"},{"description":"","name":"affectation_update"},{"description":"","name":"agent_skill"},{"description":"","name":"anav_context"},{"description":"","name":"basic_availability_create"},{"description":"","name":"basic_availability_delete"},{"description":"","name":"basic_availability_list"},{"description":"","name":"basic_availability_update"},{"description":"","name":"biweekly_availability_create"},{"description":"","name":"biweekly_availability_delete"},{"description":"","name":"biweekly_availability_list"},{"description":"","name":"biweekly_availability_update"},{"description":"","name":"calendar_resolve"},{"description":"","name":"capability_list"},{"description":"","name":"collaborator_archive","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They are privileged organization actions."}},{"description":"","name":"collaborator_create","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They are privileged organization actions."}},{"description":"","name":"collaborator_list"},{"description":"","name":"collaborator_restore"},{"description":"","name":"collaborator_update"},{"description":"","name":"collaborator_work_day_context"},{"description":"","name":"contractor_create","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They are privileged organization actions."}},{"description":"","name":"contractor_list"},{"description":"","name":"contractor_restore"},{"description":"","name":"contractor_update"},{"description":"","name":"create_absences"},{"description":"","name":"current_user_time_log_create"},{"description":"","name":"current_user_time_log_list"},{"description":"","name":"current_user_time_log_update"},{"description":"","name":"customer_archive"},{"description":"","name":"customer_create"},{"description":"","name":"customer_list"},{"description":"","name":"customer_restore"},{"description":"","name":"customer_update"},{"description":"","name":"cutting_task_delete","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: They can cause broad planning/history loss."}},{"description":"","name":"cutting_task_group_delete"},{"description":"","name":"cutting_task_group_update"},{"description":"","name":"cutting_task_groups_bulk_create"},{"description":"","name":"cutting_task_update"},{"description":"","name":"cutting_tasks_bulk_create"},{"description":"","name":"forecasted_expense_create","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: They have consequential accounting/budget effects."}},{"description":"","name":"forecasted_expense_delete"},{"description":"","name":"forecasted_expense_list"},{"description":"","name":"forecasted_expense_update"},{"description":"","name":"global_search"},{"description":"","name":"hashtag_list"},{"description":"","name":"load_summary"},{"description":"","name":"milestone_create"},{"description":"","name":"milestone_delete","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: They can cause broad planning/history loss."}},{"description":"","name":"milestone_list"},{"description":"","name":"milestone_update"},{"description":"","name":"organization_list"},{"description":"","name":"pause_create_for_root_skill"},{"description":"","name":"pause_create_for_task"},{"description":"","name":"pause_delete"},{"description":"","name":"pause_list_by_task"},{"description":"","name":"pause_list_root_skills"},{"description":"","name":"pause_update"},{"description":"","name":"progress_update_create"},{"description":"","name":"progress_update_list"},{"description":"","name":"project_create"},{"description":"","name":"project_document_context"},{"description":"","name":"project_finish","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: They control consequential workflow state."}},{"description":"","name":"project_list"},{"description":"","name":"project_state_list"},{"description":"","name":"project_tag_list"},{"description":"","name":"project_update"},{"description":"","name":"read_document"},{"description":"","name":"reminder_create"},{"description":"","name":"reminder_delete"},{"description":"","name":"reminder_list"},{"description":"","name":"reminder_update"},{"description":"","name":"role_list"},{"description":"","name":"site_list"},{"description":"","name":"skill_tree"},{"description":"","name":"task_category_list"},{"description":"","name":"time_log_list"},{"description":"","name":"week_schedule_list"},{"description":"","name":"work_explorer"}],"tools_count":90,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/abc83477-1eaf-4787-b41b-3f9e1739e133","uuid":"fd6e5a7c-36ee-5165-a027-eaaf8f66e6f7","verification_tier":"community","version":""},"query_key":"anav anav","schema_version":1,"status":"match"}