{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-12","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","catalog_reconciliation":{"basis":"Documented actions on the identified catalog surface; not an execution test.","confidence":"medium","evidence_completeness":"partial","previous":{"confidence":"low","detail_sha256":"798b1361b12e655f8adecbece2305d856b7f21ca27b4c232058bddb3ac3c1c7d","risk":"high"},"proposal_file":"claude-tail-proposals.json","rationale":"Vendor MCP page enumerates the action areas behind blackdiamond_invoke_tool: entity search, reporting reads (performance, holdings, cost basis, transactions), rebalancer (dashboard, start sessions, snooze attention items), client reports (queue render, status, download PDF), and NL SQL over the reporting warehouse. All mirror the user's Black Diamond permissions; scopes capped at 250 accounts per call. No trade execution, order routing, money movement, client sending, or deletion is documented; 'outstanding trades' appears only as a dashboard count. Sensitive regulated client financial data scoped to user entitlements plus bounded workflow starts fits Medium. First pass also Medium; full view confirmed no High card and that the High was raised from Low during manual review only because the gateway was unenumerated. Also the reads_private_data card is Low, which understates sensitive client holdings/PII; propose Medium.","review_key":"claudesec:e70ee54f-74a8-454f-9bd5-3a70e17da172","reviewed_at":"2026-10-12","runtime_verified":false,"sources":["https://bd3.bdreporting.com/info/mcp"],"status":"resolved"},"category":"Web Connector","confidence":"low","description":"Explore client and portfolio information in Black Diamond. Review holdings, tax lots, performance, private-fund activity, fees, and transactions. Run client reports and launch supported rebalance sessions.","did":"e70ee54f-74a8-454f-9bd5-3a70e17da172","documentation_url":"https://bd3.bdreporting.com/info/mcp","editorial_description":{"extended_description":"Advisors can investigate rebalancing or tax-loss-harvesting opportunities, search available tools, and retrieve navigation links or help documentation for their account context.","schema_version":1,"summary":"Explore client and portfolio information in Black Diamond.\nReview holdings, tax lots, performance, private-fund activity, fees, and transactions.\nRun client reports and launch supported rebalance sessions."},"homepage_url":"","icon":"https://bd3.bdreporting.com/content/logo.svg","id":"e70ee54f-74a8-454f-9bd5-3a70e17da172","installs":0,"last_scanned":"","license":"","long_description":"Advisors can investigate rebalancing or tax-loss-harvesting opportunities, search available tools, and retrieve navigation links or help documentation for their account context.","manual_assessment":"unassessed","manual_review":{"all_findings":[{"evidence":"The description explicitly includes launching rebalances, but the packet omits discovered tools/schemas.","reasoning":"Trading/portfolio/report actions and approval boundaries cannot be bounded.","risk_type":"generic_gateway","severity":"medium","title":"Dynamic tools can launch rebalance sessions and reports","triggering_tools_or_skills":["blackdiamond_search_tools","blackdiamond_invoke_tool"]},{"evidence":"The product description explicitly lists client/account lookup, holdings down to tax lots, private-fund activity, fees and transactions as queryable warehouse data.","reasoning":"This exposes sensitive financial-advisory information even before any hidden action is invoked.","risk_type":"private_data_read","severity":"low","title":"Client holdings, tax lots, fees and transactions are readable","triggering_tools_or_skills":["blackdiamond_ask_data_warehouse"]},{"evidence":"Dynamic business data is returned from client records and generated reports.","reasoning":"Those records may include externally authored text and must remain untrusted.","risk_type":"prompt_injection_exposure","severity":"low","title":"Client/report content enters model context","triggering_tools_or_skills":["blackdiamond_invoke_tool"]},{"evidence":"The connector runs at https://bd3.bdreporting.com/mcp without a pinned server implementation in the packet.","reasoning":"The implementation can change independently, so runtime verification and change monitoring remain necessary.","risk_type":"provenance_uncertainty","severity":"low","title":"Black Diamond is a mutable hosted service","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"OAuth connects advisor/client data, but a generic tool search/invoke gateway hides the downstream financial action set.","blocked_missing_evidence":"Complete discovered tool inventory and schemas, especially rebalance, trade/order, report delivery, billing and client-write actions.","confidence":"low","displayed_risk":"high","evidence_completeness":"insufficient","manual_overall_risk":"unassessed","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/e70ee54f-74a8-454f-9bd5-3a70e17da172.json","what_it_proves":"Candidate PR #125 record identity (name \"Black Diamond\", publisher, type web_connector) and 6 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/e70ee54f-74a8-454f-9bd5-3a70e17da172: complete tool_names inventory (6 tools), remote streamable-http endpoint https://bd3.bdreporting.com/mcp, auth_posture auth_required, directory tier partner"}],"primary_reason":"Black Diamond hides potentially financial rebalance/report actions behind a generic invoke gateway.","provisional_risk":"high","publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:e70ee54f-74a8-454f-9bd5-3a70e17da172","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 6 wrappers.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"unknown","deployment_or_infrastructure":"false","dynamic_hidden_actions":"true","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"unknown","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"unknown","sends_messages_as_user":"false","spends_or_moves_money":"unknown"},"tools_or_skills_reviewed":6,"tools_or_skills_total":6},"name":"Black Diamond","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=e70ee54f-74a8-454f-9bd5-3a70e17da172&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.ssctech.com/about/privacy","provisional_risk":"high","publication_recommendation":"fix","publisher":"SS&C Black Diamond","publisher_url":"https://www.sscblackdiamond.com/","remote_url":"https://bd3.bdreporting.com/mcp","repository_url":"","risk":"medium","risk_severity":"medium","security_risks":[{"description":"Reads permitted client accounts, contacts, holdings, tax lots, transactions and fees, including reporting-warehouse queries.","evidence":"Actions: blackdiamond_ask_data_warehouse, blackdiamond_invoke_tool. https://bd3.bdreporting.com/info/mcp — Entity search; Reporting data; Natural language querying sections; permissions mirror user","risk_type":"reads_private_data","severity":"medium","title":"Reads private client financial information"},{"description":"Starts rebalance sessions, snoozes attention items and queues client-report renders within your permissions.","evidence":"Actions: blackdiamond_invoke_tool. https://bd3.bdreporting.com/info/mcp — Rebalancer and Client reports sections","risk_type":"modifies_data","severity":"medium","title":"Starts rebalance and reporting workflows"}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"BlackDiamondMCPsupport@sscinc.com","tags":["reads_private_data","modifies_data"],"tools":[{"description":"","name":"blackdiamond_ask_data_warehouse"},{"description":"","name":"blackdiamond_get_navigation_links"},{"description":"","name":"blackdiamond_get_user_context"},{"description":"","name":"blackdiamond_invoke_tool","risk":{"category":"code_execution","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Trading/portfolio/report actions and approval boundaries cannot be bounded."}},{"description":"","name":"blackdiamond_search_help_documentation"},{"description":"","name":"blackdiamond_search_tools","risk":{"category":"code_execution","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Trading/portfolio/report actions and approval boundaries cannot be bounded."}}],"tools_count":6,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/e70ee54f-74a8-454f-9bd5-3a70e17da172","uuid":"d6197484-b3f5-56ec-b8a8-cd52be1b991d","verification_tier":"partner","version":""},"query_key":"black diamond","schema_version":1,"status":"match"}