{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-27","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"high","description":"Provides UK public-procurement research through BidSkim. Find tenders, investigate likely renewals and inspect buyers, suppliers or your pipeline. Read-only access requires the Predict plan and follows your BidSkim account scope.","did":"b85c271e-97f3-447e-87e6-ff5752e01bec","documentation_url":"https://bidskim.com/mcp","editorial_description":{"extended_description":"Search filters include keywords, CPV codes, region, value and deadline, alongside semantic search. Renewal data includes incumbents, expiry dates, recurrence evidence and relevant flags. OAuth uses your existing login, with daily usage budgets.","schema_version":1,"summary":"Provides UK public-procurement research through BidSkim.\nFind tenders, investigate likely renewals and inspect buyers, suppliers or your pipeline.\nRead-only access requires the Predict plan and follows your BidSkim account scope."},"homepage_url":"","icon":"https://bidskim.com/brand/bidskim-icon-512.png","id":"b85c271e-97f3-447e-87e6-ff5752e01bec","installs":0,"last_scanned":"","license":"","long_description":"Search filters include keywords, CPV codes, region, value and deadline, alongside semantic search. Renewal data includes incumbents, expiry dates, recurrence evidence and relevant flags. OAuth uses your existing login, with daily usage budgets.","manual_assessment":"low","manual_review":{"all_findings":[{"evidence":"Official support says the server searches UK tenders, renewals and buyer/supplier profiles aggregated from public procurement sources.","reasoning":"These seven tools read public procurement intelligence and do not alter tenders or accounts.","risk_type":"public_data_read","severity":"low","title":"Searches UK procurement records","triggering_tools_or_skills":["get_buyer","get_supplier","get_tender","search_organisations","search_renewals","search_tenders","semantic_search"]},{"evidence":"The listing says my_pipeline returns the signed-in user's matches, saved tenders and tracked suppliers.","reasoning":"Saved pipeline state is private account data, but the tool is read-only.","risk_type":"private_data_read","severity":"low","title":"Reads the user's BidSkim pipeline","triggering_tools_or_skills":["my_pipeline"]}],"assessment_status":"provisional","auth_and_scopes":"OAuth uses the user's existing BidSkim account and plan; the packet says results are scoped to that account, though exact token scopes are not listed.","blocked_missing_evidence":null,"confidence":"high","displayed_risk":"low","evidence_completeness":"partial","manual_overall_risk":"low","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/b85c271e-97f3-447e-87e6-ff5752e01bec.json","what_it_proves":"Candidate PR #125 record identity (name \"BidSkim\", publisher, type web_connector) and 8 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/b85c271e-97f3-447e-87e6-ff5752e01bec: complete tool_names inventory (8 tools), remote streamable-http endpoint https://mcp.bidskim.com/mcp, auth_posture auth_required, directory tier community"},{"accessed_at":"2026-10-10T20:48:48Z","url_or_path":"https://bidskim.com/support","what_it_proves":"BidSkim's official support page confirms OAuth connection and search over tenders, renewals, buyers and suppliers."}],"primary_reason":"BidSkim's complete inventory is read-only procurement search plus private pipeline retrieval.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:b85c271e-97f3-447e-87e6-ff5752e01bec","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 8 tools and official support documentation. No bid submission, messaging, account update or payment action is exposed. The hosted endpoint is mutable, so tools/list drift should be monitored.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"false","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":8,"tools_or_skills_total":8},"name":"BidSkim","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=b85c271e-97f3-447e-87e6-ff5752e01bec&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://bidskim.com/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"BidSkim","publisher_url":"https://bidskim.com/","remote_url":"https://mcp.bidskim.com/mcp","repository_url":"","risk":"low","risk_severity":"low","security_risks":[{"description":"This connector retrieves public or publisher-provided information and returns it to the AI. Review findings: These seven tools read public procurement intelligence and do not alter tenders or accounts.","evidence":"Searches UK procurement records: Official support says the server searches UK tenders, renewals and buyer/supplier profiles aggregated from public procurement sources.","manual_risk_type":"public_data_read","remediation":{"block_tool_categories":[],"steps":["Treat returned third-party content as untrusted input and verify consequential claims.","Do not assume public content is accurate, current, or free of embedded instructions."]},"risk_type":"reads_public_data","severity":"low","title":"Searches UK procurement records","triggering_tools":["get_buyer","get_supplier","get_tender","search_organisations","search_renewals","search_tenders","semantic_search"]},{"description":"This connector can read information available to the connected account and return it to the AI. Review findings: Saved pipeline state is private account data, but the tool is read-only.","evidence":"Reads the user's BidSkim pipeline: The listing says my_pipeline returns the signed-in user's matches, saved tenders and tracked suppliers.","manual_risk_type":"private_data_read","remediation":{"block_tool_categories":["data_exfiltration"],"steps":["Use a least-privilege account limited to the information required by the workflow.","Restrict folders, projects, tenants, and other data scopes wherever the provider allows it.","Review access logs for unexpected reads or bulk retrieval."]},"risk_type":"reads_private_data","severity":"low","title":"Reads the user's BidSkim pipeline","triggering_tools":["my_pipeline"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"hello@bidskim.com","tags":["network_access","oauth_required","reads_private_data","reads_public_data","web_connector"],"tools":[{"description":"","name":"get_buyer"},{"description":"","name":"get_supplier"},{"description":"","name":"get_tender"},{"description":"","name":"my_pipeline"},{"description":"","name":"search_organisations"},{"description":"","name":"search_renewals"},{"description":"","name":"search_tenders"},{"description":"","name":"semantic_search"}],"tools_count":8,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/b85c271e-97f3-447e-87e6-ff5752e01bec","uuid":"5b19a50a-e3c6-56f1-8e25-b955379a7170","verification_tier":"community","version":""},"query_key":"bidskim bidskim","schema_version":1,"status":"match"}