{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-27","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"reviewed","auth_posture":"auth_required","category":"Web Connector","confidence":"high","description":"Gives Claude read-only access to your B2B Wave wholesale store. Find orders, products, customers, customer-specific pricing and store settings. Requires an owner admin account on a store with the connector enabled.","did":"1df879a9-4a04-4082-b344-242ea75fdcf5","documentation_url":"https://docs.b2bwave.com/article/256-mcp-server","editorial_description":{"extended_description":"Filter orders by customer, date, status, sales rep or product; draft orders are included unless excluded. Catalog searches cover variants and customer ordering permissions. The connecting admin owns the access key and can restrict its readable areas or revoke it in B2B Wave.","schema_version":1,"summary":"Gives Claude read-only access to your B2B Wave wholesale store.\nFind orders, products, customers, customer-specific pricing and store settings.\nRequires an owner admin account on a store with the connector enabled."},"homepage_url":"","icon":"","id":"1df879a9-4a04-4082-b344-242ea75fdcf5","installs":0,"last_scanned":"","license":"","long_description":"Filter orders by customer, date, status, sales rep or product; draft orders are included unless excluded. Catalog searches cover variants and customer ordering permissions. The connecting admin owns the access key and can restrict its readable areas or revoke it in B2B Wave.","manual_assessment":"low","manual_review":{"all_findings":[{"evidence":"Official docs explicitly call MCP access read-only; every inventory name is list/status/config retrieval.","reasoning":"It exposes private wholesale operations but performs no mutation.","risk_type":"private_data_read","severity":"low","title":"Reads wholesale customers, orders, prices and store configuration","triggering_tools_or_skills":["customers_list","orders_list","pricelists_list","product_prices_list","products_list","store_configuration"]}],"assessment_status":"reviewed","auth_and_scopes":"Admin login authorizes a client-owned MCP API key with default read-only access to the store's customers, orders, products and prices; access can later be disabled in API keys.","blocked_missing_evidence":null,"confidence":"high","displayed_risk":"low","evidence_completeness":"complete","manual_overall_risk":"low","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/1df879a9-4a04-4082-b344-242ea75fdcf5.json","what_it_proves":"Candidate PR #125 record identity (name \"B2B Wave\", publisher, type web_connector) and 9 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/1df879a9-4a04-4082-b344-242ea75fdcf5: complete tool_names inventory (9 tools), remote streamable-http endpoint https://mcp.b2bwave.com/v1/mcp, auth_posture auth_required, directory tier community"},{"accessed_at":"2026-10-10T21:19:34Z","url_or_path":"https://docs.b2bwave.com/article/256-mcp-server","what_it_proves":"Official docs state default MCP access is read-only for orders, products, prices and customers and is owned by the authorizing admin."}],"primary_reason":"B2B Wave officially limits this nine-tool connector to read-only store data.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":false,"review_key":"claude:1df879a9-4a04-4082-b344-242ea75fdcf5","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 9 names against official access documentation; prompt-injection exposure comes from customer and order text.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"false","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":9,"tools_or_skills_total":9},"name":"B2B Wave","needs_runtime_verification":false,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=1df879a9-4a04-4082-b344-242ea75fdcf5&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.b2bwave.com/privacy-policy","provisional_risk":null,"publication_recommendation":"accept","publisher":"B2B Wave Inc.","publisher_url":"https://www.b2bwave.com/","remote_url":"https://mcp.b2bwave.com/v1/mcp","repository_url":"","risk":"low","risk_severity":"low","security_risks":[{"description":"This connector can read information available to the connected account and return it to the AI. Review findings: It exposes private wholesale operations but performs no mutation.","evidence":"Reads wholesale customers, orders, prices and store configuration: Official docs explicitly call MCP access read-only; every inventory name is list/status/config retrieval.","manual_risk_type":"private_data_read","remediation":{"block_tool_categories":["data_exfiltration"],"steps":["Use a least-privilege account limited to the information required by the workflow.","Restrict folders, projects, tenants, and other data scopes wherever the provider allows it.","Review access logs for unexpected reads or bulk retrieval."]},"risk_type":"reads_private_data","severity":"low","title":"Reads wholesale customers, orders, prices and store configuration","triggering_tools":["customers_list","orders_list","pricelists_list","product_prices_list","products_list","store_configuration"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@b2bwave.com","tags":["network_access","oauth_required","reads_private_data","web_connector"],"tools":[{"description":"","name":"customers_list"},{"description":"","name":"orders_list"},{"description":"","name":"pricelists_list"},{"description":"","name":"product_price_variants_list"},{"description":"","name":"product_prices_list"},{"description":"","name":"products_list"},{"description":"","name":"status_orders_list"},{"description":"","name":"status_products_list"},{"description":"","name":"store_configuration"}],"tools_count":9,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/1df879a9-4a04-4082-b344-242ea75fdcf5","uuid":"551893d8-3695-5bae-a99c-b3a1d5c2a527","verification_tier":"community","version":""},"query_key":"b2b wave","schema_version":1,"status":"match"}