{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-01","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Work with Anvilogic security detections, alerts and investigations from Claude. Author detection content, triage events, manage cases and run saved workflows. An active subscription and your organization's OAuth permissions govern access.","did":"c568b941-a1cd-44fa-8197-f435d51b9c9f","documentation_url":"https://docs.anvilogic.com/anvilogic-platform/anvilogic-ai/anvilogic-mcp-server","editorial_description":{"extended_description":"Tools cover Threat Identifiers, multi-stage Threat Scenarios, macros, allowlists and Blueprint sessions. Analysts can review findings and MITRE ATT&CK mappings, attach events to cases and deploy or tune suppression behavior. Administrators can restrict available tools; actions affecting deployed behavior are annotated so clients can request confirmation.","schema_version":1,"summary":"Work with Anvilogic security detections, alerts and investigations from Claude.\nAuthor detection content, triage events, manage cases and run saved workflows.\nAn active subscription and your organization's OAuth permissions govern access."},"homepage_url":"","icon":"","id":"c568b941-a1cd-44fa-8197-f435d51b9c9f","installs":0,"last_scanned":"","license":"","long_description":"Tools cover Threat Identifiers, multi-stage Threat Scenarios, macros, allowlists and Blueprint sessions. Analysts can review findings and MITRE ATT&CK mappings, attach events to cases and deploy or tune suppression behavior. Administrators can restrict available tools; actions affecting deployed behavior are annotated so clients can request confirmation.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"These tools deploy or cancel detection infrastructure changes.","reasoning":"They materially change production security controls.","risk_type":"deployment_infrastructure","severity":"high","title":"Deploys security detections and allowlists","triggering_tools_or_skills":["MacroDeploy","AllowlistEntryDeploy","MacroCancelDeployment"]},{"evidence":"The tool explicitly deletes security configuration.","reasoning":"It can remove a meaningful control resource.","risk_type":"data_deletion","severity":"high","title":"Deletes allowlist entries","triggering_tools_or_skills":["AllowlistEntryDelete"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication covers a security-detection workspace; deployment and mutation roles are unspecified.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/c568b941-a1cd-44fa-8197-f435d51b9c9f.json","what_it_proves":"Candidate PR #125 record identity (name \"Anvilogic\", publisher, type web_connector) and 44 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/c568b941-a1cd-44fa-8197-f435d51b9c9f: complete tool_names inventory (44 tools), remote streamable-http endpoint https://secure.anvilogic.com/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Anvilogic deploys detection macros/allowlists and deletes allowlist entries.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:c568b941-a1cd-44fa-8197-f435d51b9c9f","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 44 names; deployment actions are explicit.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"true","deletes_data":"true","deployment_or_infrastructure":"true","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":44,"tools_or_skills_total":44},"name":"Anvilogic","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=c568b941-a1cd-44fa-8197-f435d51b9c9f&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.anvilogic.com/legal/privacy-policy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Anvilogic","publisher_url":"https://www.anvilogic.com/","remote_url":"https://secure.anvilogic.com/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can deploy code or change infrastructure and production environments. Review findings: They materially change production security controls.","evidence":"Deploys security detections and allowlists: These tools deploy or cancel detection infrastructure changes.","manual_risk_type":"deployment_infrastructure","remediation":{"block_tool_categories":["code_execution","state_change"],"steps":["Default to a sandbox or staging environment.","Require code review, human approval, audit logging, and a tested rollback path for production changes."]},"risk_type":"code_deployment","severity":"high","title":"Deploys security detections and allowlists","triggering_tools":["MacroDeploy","AllowlistEntryDeploy","MacroCancelDeployment"]},{"description":"This connector can permanently remove data or resources. Review findings: It can remove a meaningful control resource.","evidence":"Deletes allowlist entries: The tool explicitly deletes security configuration.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Deletes allowlist entries","triggering_tools":["AllowlistEntryDelete"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@anvilogic.com","tags":["accesses_calendar","accesses_messaging","code_deployment","deletes_data","network_access","oauth_required","web_connector"],"tools":[{"description":"","name":"AllowlistEntryCreate"},{"description":"","name":"AllowlistEntryDelete","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: It can remove a meaningful control resource."}},{"description":"","name":"AllowlistEntryDeploy","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: They materially change production security controls."}},{"description":"","name":"AllowlistEntryRead"},{"description":"","name":"AllowlistEntryUpdate"},{"description":"","name":"AnvilogicMutate"},{"description":"","name":"AnvilogicRead"},{"description":"","name":"AnvilogicSearchAPIDocs"},{"description":"","name":"BlueprintCreate"},{"description":"","name":"BlueprintCreateSession"},{"description":"","name":"BlueprintGetMessage"},{"description":"","name":"BlueprintGetSession"},{"description":"","name":"BlueprintRetrieve"},{"description":"","name":"BlueprintSearchSessions"},{"description":"","name":"BlueprintSendMessage"},{"description":"","name":"BlueprintUpdate"},{"description":"","name":"CaseAddEvents"},{"description":"","name":"CaseCreate"},{"description":"","name":"CaseRead"},{"description":"","name":"CaseSearch"},{"description":"","name":"CaseUpdate"},{"description":"","name":"MacroCancelDeployment","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: They materially change production security controls."}},{"description":"","name":"MacroCreate"},{"description":"","name":"MacroDeploy","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: They materially change production security controls."}},{"description":"","name":"MacroGetChildMacros"},{"description":"","name":"MacroGetDeploymentStats"},{"description":"","name":"MacroGetGoldSilverBronzeTables"},{"description":"","name":"MacroGetInfo"},{"description":"","name":"MacroGetVersion"},{"description":"","name":"MacroListDataRetrievalMacros"},{"description":"","name":"MacroListVersions"},{"description":"","name":"MacroUpdate"},{"description":"","name":"ThreatIdentifierCreate"},{"description":"","name":"ThreatIdentifierGetInfo"},{"description":"","name":"ThreatIdentifierSearch"},{"description":"","name":"ThreatIdentifierUpdate"},{"description":"","name":"ThreatScenarioCreate"},{"description":"","name":"ThreatScenarioList"},{"description":"","name":"ThreatScenarioUpdate"},{"description":"","name":"TriageAgentResult"},{"description":"","name":"TriageAgentStart"},{"description":"","name":"TriageAlertSearch"},{"description":"","name":"TriageAlertUpdate"},{"description":"","name":"UseCaseFilterSearch"}],"tools_count":44,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/c568b941-a1cd-44fa-8197-f435d51b9c9f","uuid":"842555f0-8dc4-5b19-a882-3449045d6fb4","verification_tier":"community","version":""},"query_key":"anvilogic","schema_version":1,"status":"match"}