{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-01","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Brixa Studio turns brand designs into reusable templates. Fill and resize designs, generate images or PDFs, and compose branded video from supplied footage. Manage project assets and publish templates or finished pieces to a gallery.","did":"a14598ab-cfb1-4c5b-8074-c5bb94bad1df","documentation_url":"https://brixastudio.com/","editorial_description":{"extended_description":"Brand tokens and editable slots organize colors, fonts, logos, photos, and changing content. Import designs, inspect or validate pieces, create batches and carousels, and keep projects private with role-based access and administrative approval.","schema_version":1,"summary":"Brixa Studio turns brand designs into reusable templates.\nFill and resize designs, generate images or PDFs, and compose branded video from supplied footage.\nManage project assets and publish templates or finished pieces to a gallery."},"homepage_url":"","icon":"https://brixastudio.com/icon.png","id":"a14598ab-cfb1-4c5b-8074-c5bb94bad1df","installs":0,"last_scanned":"","license":"","long_description":"Brand tokens and editable slots organize colors, fonts, logos, photos, and changing content. Import designs, inspect or validate pieces, create batches and carousels, and keep projects private with role-based access and administrative approval.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"Explicit tools remove durable brand/template assets.","reasoning":"They can destroy production creative work.","risk_type":"data_deletion","severity":"high","title":"Deletes projects, models, media, fonts and data rules","triggering_tools_or_skills":["delete_project","delete_model","delete_photo","delete_font","delete_data_rule"]},{"evidence":"These tools expose or withdraw branded content for audiences/community.","reasoning":"They publish as the connected brand/user.","risk_type":"messaging_as_user","severity":"high","title":"Publishes/unpublishes models and pieces","triggering_tools_or_skills":["publish_model","publish_piece","unpublish_model","unpublish_piece"]},{"evidence":"The explicit tool replaces an integration secret.","reasoning":"It is privileged credential administration.","risk_type":"credential_admin","severity":"high","title":"Rotates webhook secrets","triggering_tools_or_skills":["rotate_webhook_secret"]},{"evidence":"These tools persist external creative files.","reasoning":"They materially add assets.","risk_type":"file_write","severity":"medium","title":"Uploads photos, videos, fonts and imports Figma assets","triggering_tools_or_skills":["upload_photo","upload_photo_file","register_video","register_font","import_from_figma"]},{"evidence":"These tools trigger server-side creative workloads and automation.","reasoning":"They control production generation infrastructure.","risk_type":"deployment_infrastructure","severity":"high","title":"Runs render/generation/data-rule production jobs","triggering_tools_or_skills":["generate","generate_batch","run_data_rule","compose_video"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication scopes brand assets/projects/models; webhook rotation is privileged.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/a14598ab-cfb1-4c5b-8074-c5bb94bad1df.json","what_it_proves":"Candidate PR #125 record identity (name \"Brixa Studio\", publisher, type web_connector) and 54 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/a14598ab-cfb1-4c5b-8074-c5bb94bad1df: complete tool_names inventory (54 tools), remote streamable-http endpoint https://mcp.brixastudio.com/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Brixa can delete/publish brand assets, rotate secrets and run production generation jobs.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:a14598ab-cfb1-4c5b-8074-c5bb94bad1df","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 54 tools.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"true","deletes_data":"true","deployment_or_infrastructure":"true","dynamic_hidden_actions":"false","filesystem_or_repo_access":"true","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":54,"tools_or_skills_total":54},"name":"Brixa Studio","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=a14598ab-cfb1-4c5b-8074-c5bb94bad1df&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://brixastudio.com/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Brixa","publisher_url":"https://brixa.ai/","remote_url":"https://mcp.brixastudio.com/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can permanently remove data or resources. Review findings: They can destroy production creative work.","evidence":"Deletes projects, models, media, fonts and data rules: Explicit tools remove durable brand/template assets.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Deletes projects, models, media, fonts and data rules","triggering_tools":["delete_project","delete_model","delete_photo","delete_font","delete_data_rule"]},{"description":"This connector can publish or send messages and content using the connected identity. Review findings: They publish as the connected brand/user.","evidence":"Publishes/unpublishes models and pieces: These tools expose or withdraw branded content for audiences/community.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Publishes/unpublishes models and pieces","triggering_tools":["publish_model","publish_piece","unpublish_model","unpublish_piece"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: It is privileged credential administration.","evidence":"Rotates webhook secrets: The explicit tool replaces an integration secret.","manual_risk_type":"credential_admin","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"high","title":"Rotates webhook secrets","triggering_tools":["rotate_webhook_secret"]},{"description":"This connector can create, change, export, or otherwise write files. Review findings: They materially add assets.","evidence":"Uploads photos, videos, fonts and imports Figma assets: These tools persist external creative files.","manual_risk_type":"file_write","remediation":{"block_tool_categories":["state_change"],"steps":["Limit file access to a dedicated working directory.","Review generated or modified files before they are shared or executed."]},"risk_type":"filesystem_access","severity":"medium","title":"Uploads photos, videos, fonts and imports Figma assets","triggering_tools":["upload_photo","upload_photo_file","register_video","register_font","import_from_figma"]},{"description":"This connector can deploy code or change infrastructure and production environments. Review findings: They control production generation infrastructure.","evidence":"Runs render/generation/data-rule production jobs: These tools trigger server-side creative workloads and automation.","manual_risk_type":"deployment_infrastructure","remediation":{"block_tool_categories":["code_execution","state_change"],"steps":["Default to a sandbox or staging environment.","Require code review, human approval, audit logging, and a tested rollback path for production changes."]},"risk_type":"code_deployment","severity":"high","title":"Runs render/generation/data-rule production jobs","triggering_tools":["generate","generate_batch","run_data_rule","compose_video"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"diego@brixa.ai","tags":["code_deployment","deletes_data","filesystem_access","modifies_data","network_access","oauth_required","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"adopt_model"},{"description":"","name":"compose_reel"},{"description":"","name":"compose_video","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: They control production generation infrastructure."}},{"description":"","name":"confirm_photo_upload"},{"description":"","name":"create_project"},{"description":"","name":"delete_data_rule","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: They can destroy production creative work."}},{"description":"","name":"delete_font","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: They can destroy production creative work."}},{"description":"","name":"delete_model","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: They can destroy production creative work."}},{"description":"","name":"delete_photo","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: They can destroy production creative work."}},{"description":"","name":"delete_pieces"},{"description":"","name":"delete_project","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: They can destroy production creative work."}},{"description":"","name":"derive_model"},{"description":"","name":"describe_piece"},{"description":"","name":"duplicate_project"},{"description":"","name":"export_carousel"},{"description":"","name":"feature_model"},{"description":"","name":"feature_piece"},{"description":"","name":"generate","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: They control production generation infrastructure."}},{"description":"","name":"generate_batch","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: They control production generation infrastructure."}},{"description":"","name":"get_account"},{"description":"","name":"get_brand"},{"description":"","name":"get_capabilities"},{"description":"","name":"get_guide"},{"description":"","name":"get_model"},{"description":"","name":"get_piece"},{"description":"","name":"get_video_job"},{"description":"","name":"import_from_figma","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: They materially add assets."}},{"description":"","name":"list_community_models"},{"description":"","name":"list_data_rules"},{"description":"","name":"list_formats"},{"description":"","name":"list_models"},{"description":"","name":"list_photos"},{"description":"","name":"list_pieces"},{"description":"","name":"list_projects"},{"description":"","name":"patch_model"},{"description":"","name":"promote_to_slot"},{"description":"","name":"publish_model","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: They publish as the connected brand/user."}},{"description":"","name":"publish_piece","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: They publish as the connected brand/user."}},{"description":"","name":"register_font","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: They materially add assets."}},{"description":"","name":"register_video","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: They materially add assets."}},{"description":"","name":"register_video_origin"},{"description":"","name":"request_photo_upload"},{"description":"","name":"rotate_webhook_secret","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: It is privileged credential administration."}},{"description":"","name":"run_data_rule","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: They control production generation infrastructure."}},{"description":"","name":"save_model"},{"description":"","name":"set_data_rule"},{"description":"","name":"suggest_format"},{"description":"","name":"unfeature_model"},{"description":"","name":"unpublish_model","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: They publish as the connected brand/user."}},{"description":"","name":"unpublish_piece","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: They publish as the connected brand/user."}},{"description":"","name":"update_brand"},{"description":"","name":"upload_photo","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: They materially add assets."}},{"description":"","name":"upload_photo_file","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: They materially add assets."}},{"description":"","name":"validate"}],"tools_count":54,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/a14598ab-cfb1-4c5b-8074-c5bb94bad1df","uuid":"efb30e9a-f2a2-5727-967a-0cfea3c64f6b","verification_tier":"community","version":""},"query_key":"brixa studio","schema_version":1,"status":"match"}