{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-03","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Inspect electronic invoices, tax-report status, and business figures in B2Brouter. Review validation errors, payment aging, and recipient delivery channels with supporting documentation. Access is read-only and limited to accounts available under your existing permissions.","did":"def1086c-63f4-4896-9b99-279027de1423","documentation_url":"https://docs.b2brouter.net/en/user-guide/connect/mcp/","editorial_description":{"extended_description":"Search invoices or tax reports, inspect literal authority responses, and retrieve financial summaries or company routing codes. The connector cannot create, change, send, or delete records, and queries appear in your MCP Activity log.","schema_version":1,"summary":"Inspect electronic invoices, tax-report status, and business figures in B2Brouter.\nReview validation errors, payment aging, and recipient delivery channels with supporting documentation.\nAccess is read-only and limited to accounts available under your existing permissions."},"homepage_url":"","icon":"","id":"def1086c-63f4-4896-9b99-279027de1423","installs":0,"last_scanned":"","license":"","long_description":"Search invoices or tax reports, inspect literal authority responses, and retrieve financial summaries or company routing codes. The connector cannot create, change, send, or delete records, and queries appear in your MCP Activity log.","manual_assessment":"low","manual_review":{"all_findings":[{"evidence":"All ten tools are read/validate/search operations and the product statement explicitly excludes create, modify, send and delete.","reasoning":"Invoices and tax data are sensitive but read-only.","risk_type":"private_data_read","severity":"low","title":"Invoices, tax reports and financial summaries are readable","triggering_tools_or_skills":["list_invoices","show_invoice","get_tax_report","account_financial_summary"]},{"evidence":"Counterparty documents and documentation are returned.","reasoning":"They should remain untrusted.","risk_type":"prompt_injection_exposure","severity":"low","title":"Invoice and documentation text enters model context","triggering_tools_or_skills":["show_invoice","knowledge_document"]},{"evidence":"The connector runs at https://app.b2brouter.net/mcp without a pinned server implementation in the packet.","reasoning":"The implementation can change independently, so runtime verification and change monitoring remain necessary.","risk_type":"provenance_uncertainty","severity":"low","title":"B2Brouter is a mutable hosted service","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"OAuth applies the signed-in member identity and account permissions; all activity is logged and the connector explicitly excludes writes.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"low","evidence_completeness":"partial","manual_overall_risk":"low","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/def1086c-63f4-4896-9b99-279027de1423.json","what_it_proves":"Candidate PR #125 record identity (name \"B2Brouter\", publisher, type web_connector) and 10 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/def1086c-63f4-4896-9b99-279027de1423: complete tool_names inventory (10 tools), remote streamable-http endpoint https://app.b2brouter.net/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"B2Brouter is a logged, permission-scoped read-only view of invoicing and tax data.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:def1086c-63f4-4896-9b99-279027de1423","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 10 tools.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"false","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":10,"tools_or_skills_total":10},"name":"B2Brouter","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=def1086c-63f4-4896-9b99-279027de1423&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.b2brouter.net/global/privacy-policy/","provisional_risk":null,"publication_recommendation":"accept","publisher":"B2Brouter Global S.L.","publisher_url":"https://www.b2brouter.net/","remote_url":"https://app.b2brouter.net/mcp","repository_url":"","risk":"low","risk_severity":"low","security_risks":[{"description":"This connector can read information available to the connected account and return it to the AI. Review findings: Invoices and tax data are sensitive but read-only.","evidence":"Invoices, tax reports and financial summaries are readable: All ten tools are read/validate/search operations and the product statement explicitly excludes create, modify, send and delete.","manual_risk_type":"private_data_read","remediation":{"block_tool_categories":["data_exfiltration"],"steps":["Use a least-privilege account limited to the information required by the workflow.","Restrict folders, projects, tenants, and other data scopes wherever the provider allows it.","Review access logs for unexpected reads or bulk retrieval."]},"risk_type":"reads_private_data","severity":"low","title":"Invoices, tax reports and financial summaries are readable","triggering_tools":["list_invoices","show_invoice","get_tax_report","account_financial_summary"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://www.b2brouter.net/global/contact/","tags":["network_access","oauth_required","reads_private_data","web_connector"],"tools":[{"description":"","name":"account_financial_summary"},{"description":"","name":"directory_lookup"},{"description":"","name":"get_tax_report"},{"description":"","name":"knowledge_document"},{"description":"","name":"knowledge_index"},{"description":"","name":"list_accounts"},{"description":"","name":"list_invoices"},{"description":"","name":"list_tax_reports"},{"description":"","name":"show_invoice"},{"description":"","name":"validate_invoice"}],"tools_count":10,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/def1086c-63f4-4896-9b99-279027de1423","uuid":"9ef4ea85-c2aa-533f-b70e-07f7fe2b3b19","verification_tier":"community","version":""},"query_key":"b2brouter","schema_version":1,"status":"match"}