{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-13","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Connects your coding assistant to Baz's indexed repositories and review platform. Search code and files, retrieve organization review standards and read branch discussions. Push or update session plans in Baz for team collaboration.","did":"29c1487d-477c-414d-a5d9-63d7dd3802ec","documentation_url":"https://baz.ai/docs/capabilities/model-context-protocol","editorial_description":{"extended_description":"Search spans repositories without manually browsing each codebase. Review resources include guidelines and reviewer configurations, while open discussions provide context for the branch under review. The listed write action updates plans, not repository code.","schema_version":1,"summary":"Connects your coding assistant to Baz's indexed repositories and review platform.\nSearch code and files, retrieve organization review standards and read branch discussions.\nPush or update session plans in Baz for team collaboration."},"homepage_url":"","icon":"","id":"29c1487d-477c-414d-a5d9-63d7dd3802ec","installs":0,"last_scanned":"","license":"","long_description":"Search spans repositories without manually browsing each codebase. Review resources include guidelines and reviewer configurations, while open discussions provide context for the branch under review. The listed write action updates plans, not repository code.","manual_assessment":"medium","manual_review":{"all_findings":[{"evidence":"The inventory contains update_plan and the description says it pushes or updates session plans for team collaboration/review.","reasoning":"This persistently changes shared review-platform data.","risk_type":"data_modification","severity":"medium","title":"Writes collaborative session plans to Baz","triggering_tools_or_skills":["update_plan"]},{"evidence":"The listed tools search indexed code, files, guidelines and branch review discussions.","reasoning":"It exposes private source and untrusted review text but does not edit repository files.","risk_type":"private_data_read","severity":"low","title":"Searches private repositories and review discussions","triggering_tools_or_skills":["remote_file_search","remote_grep","repo_search","get_review_discussions","load_resources"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication is required for Baz-indexed repositories and reviews; repository, branch and plan-write scopes are not documented.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"medium","evidence_completeness":"partial","manual_overall_risk":"medium","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/29c1487d-477c-414d-a5d9-63d7dd3802ec.json","what_it_proves":"Candidate PR #125 record identity (name \"Baz\", publisher, type web_connector) and 7 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/29c1487d-477c-414d-a5d9-63d7dd3802ec: complete tool_names inventory (7 tools), remote streamable-http endpoint https://baz.co/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Baz can persistently update shared review plans while reading private repository content.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:29c1487d-477c-414d-a5d9-63d7dd3802ec","reviewed_at":"2026-10-10","reviewer_notes":"The official docs URL was inaccessible. Verify update_plan visibility and whether remote searches can cross repository/org boundaries.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"true","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":7,"tools_or_skills_total":7},"name":"Baz","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=29c1487d-477c-414d-a5d9-63d7dd3802ec&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://baz.ai/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Baz Technologies Inc","publisher_url":"https://baz.ai/","remote_url":"https://baz.co/mcp","repository_url":"","risk":"medium","risk_severity":"medium","security_risks":[{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: This persistently changes shared review-platform data.","evidence":"Writes collaborative session plans to Baz: The inventory contains update_plan and the description says it pushes or updates session plans for team collaboration/review.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Writes collaborative session plans to Baz","triggering_tools":["update_plan"]},{"description":"This connector can read information available to the connected account and return it to the AI. Review findings: It exposes private source and untrusted review text but does not edit repository files.","evidence":"Searches private repositories and review discussions: The listed tools search indexed code, files, guidelines and branch review discussions.","manual_risk_type":"private_data_read","remediation":{"block_tool_categories":["data_exfiltration"],"steps":["Use a least-privilege account limited to the information required by the workflow.","Restrict folders, projects, tenants, and other data scopes wherever the provider allows it.","Review access logs for unexpected reads or bulk retrieval."]},"risk_type":"reads_private_data","severity":"low","title":"Searches private repositories and review discussions","triggering_tools":["remote_file_search","remote_grep","repo_search","get_review_discussions","load_resources"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@baz.co","tags":["modifies_data","network_access","oauth_required","reads_private_data","web_connector"],"tools":[{"description":"","name":"get_review_discussions"},{"description":"","name":"load_resources"},{"description":"","name":"organizational_review_guidelines"},{"description":"","name":"remote_file_search"},{"description":"","name":"remote_grep"},{"description":"","name":"repo_search"},{"description":"","name":"update_plan","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: This persistently changes shared review-platform data."}}],"tools_count":7,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/29c1487d-477c-414d-a5d9-63d7dd3802ec","uuid":"b29e4990-22b6-5172-af65-24f14add4ef8","verification_tier":"community","version":""},"query_key":"baz technologies inc baz","schema_version":1,"status":"match"}