{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-24","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Build workouts using the MyMovement.Space exercise catalog. Choose exercises and session details, then review and save the proposed plan. Follow approved sessions in the app; a subscription is required.","did":"0c741a49-14e5-453e-8a60-ee11d9b7670d","documentation_url":"https://www.mymovement.space/integrations/mcp","editorial_description":{"extended_description":"Exercise searches provide technique information, and the connector can retrieve progress. Approved sessions appear in the app with its exercise demonstrations and logging tools. Other app features, including Garmin analytics, Apple Health synchronization and its separate coaching assistant, are not established as connector operations.","schema_version":1,"summary":"Build workouts using the MyMovement.Space exercise catalog.\nChoose exercises and session details, then review and save the proposed plan.\nFollow approved sessions in the app; a subscription is required."},"homepage_url":"","icon":"","id":"0c741a49-14e5-453e-8a60-ee11d9b7670d","installs":0,"last_scanned":"","license":"","long_description":"Exercise searches provide technique information, and the connector can retrieve progress. Approved sessions appear in the app with its exercise demonstrations and logging tools. Other app features, including Garmin analytics, Apple Health synchronization and its separate coaching assistant, are not established as connector operations.","manual_assessment":"medium","manual_review":{"all_findings":[{"evidence":"The explicit create_session tool persists a new movement or training session in the authenticated account.","reasoning":"It changes personal activity and progress state.","risk_type":"data_modification","severity":"medium","title":"Exercise sessions can be created","triggering_tools_or_skills":["create_session"]},{"evidence":"The remaining tools retrieve personal progress and search exercise content.","reasoning":"Health or fitness progress can be sensitive personal data.","risk_type":"private_data_read","severity":"low","title":"Exercise progress is readable","triggering_tools_or_skills":["get_progress","search_exercises"]},{"evidence":"Search results can contain publisher-authored free-form exercise instructions.","reasoning":"Retrieved text is untrusted model input.","risk_type":"prompt_injection_exposure","severity":"low","title":"Exercise descriptions enter context","triggering_tools_or_skills":["search_exercises"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication required for MyMovement.Space exercise catalog, progress, and session records; exact profile scope and token lifetime are undocumented.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"medium","evidence_completeness":"partial","manual_overall_risk":"medium","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/0c741a49-14e5-453e-8a60-ee11d9b7670d.json","what_it_proves":"Candidate PR #125 record identity (name \"MyMovement.Space\", publisher, type web_connector) and 3 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/0c741a49-14e5-453e-8a60-ee11d9b7670d: complete tool_names inventory (3 tools), remote streamable-http endpoint https://mcp.mymovement.space/api/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"The sole write action creates persistent exercise sessions; no delete, send, execution, or payment action is declared.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:0c741a49-14e5-453e-8a60-ee11d9b7670d","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all three names. Official docs lookup was uninformative, so session semantics, medical-data handling, edit or notification side effects, and OAuth scope require runtime verification.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":3,"tools_or_skills_total":3},"name":"MyMovement.Space","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=0c741a49-14e5-453e-8a60-ee11d9b7670d&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://mymovement.space/privacy-policy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Birken Sports","publisher_url":"https://mymovement.space/","remote_url":"https://mcp.mymovement.space/api/mcp","repository_url":"","risk":"medium","risk_severity":"medium","security_risks":[{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: It changes personal activity and progress state.","evidence":"Exercise sessions can be created: The explicit create_session tool persists a new movement or training session in the authenticated account.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Exercise sessions can be created","triggering_tools":["create_session"]},{"description":"This connector can read information available to the connected account and return it to the AI. Review findings: Health or fitness progress can be sensitive personal data.","evidence":"Exercise progress is readable: The remaining tools retrieve personal progress and search exercise content.","manual_risk_type":"private_data_read","remediation":{"block_tool_categories":["data_exfiltration"],"steps":["Use a least-privilege account limited to the information required by the workflow.","Restrict folders, projects, tenants, and other data scopes wherever the provider allows it.","Review access logs for unexpected reads or bulk retrieval."]},"risk_type":"reads_private_data","severity":"low","title":"Exercise progress is readable","triggering_tools":["get_progress","search_exercises"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"team@mymovement.space","tags":["modifies_data","network_access","oauth_required","reads_private_data","web_connector"],"tools":[{"description":"","name":"create_session","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: It changes personal activity and progress state."}},{"description":"","name":"get_progress"},{"description":"","name":"search_exercises"}],"tools_count":3,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/0c741a49-14e5-453e-8a60-ee11d9b7670d","uuid":"1789845e-b039-5901-9bfe-9fe74786f083","verification_tier":"community","version":""},"query_key":"birken sports mymovement space","schema_version":1,"status":"match"}