{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-08","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Schedules and publishes social posts through BulkPublish. Compose content once for connected networks such as Instagram, TikTok, LinkedIn and YouTube. Manage media and queued posts, then review publishing results and performance metrics.","did":"27e7992e-1f57-48d6-8a15-881dae340133","documentation_url":"https://app.bulkpublish.com/docs","editorial_description":{"extended_description":"Tools create, update, delete, publish or retry posts, and handle media uploads. Other supported channels include Facebook, X, Pinterest and Threads. Available networks depend on the accounts you have connected.","schema_version":1,"summary":"Schedules and publishes social posts through BulkPublish.\nCompose content once for connected networks such as Instagram, TikTok, LinkedIn and YouTube.\nManage media and queued posts, then review publishing results and performance metrics."},"homepage_url":"","icon":"","id":"27e7992e-1f57-48d6-8a15-881dae340133","installs":0,"last_scanned":"","license":"","long_description":"Tools create, update, delete, publish or retry posts, and handle media uploads. Other supported channels include Facebook, X, Pinterest and Threads. Available networks depend on the accounts you have connected.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The inventory explicitly contains publish_post and retry_post over connected channels.","reasoning":"Publishing social content communicates externally as the user or brand.","risk_type":"messaging_as_user","severity":"high","title":"Publishes posts to connected channels","triggering_tools_or_skills":["publish_post","create_post","retry_post"]},{"evidence":"The complete inventory explicitly includes delete_post.","reasoning":"Deleting a post resource is destructive and may remove public content or its account record.","risk_type":"data_deletion","severity":"high","title":"Deletes scheduled or published post records","triggering_tools_or_skills":["delete_post"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication is required for connected publishing channels; exact channel scopes, audience visibility and deletion recovery are not specified.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/27e7992e-1f57-48d6-8a15-881dae340133.json","what_it_proves":"Candidate PR #125 record identity (name \"BulkPublish\", publisher, type web_connector) and 20 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/27e7992e-1f57-48d6-8a15-881dae340133: complete tool_names inventory (20 tools), remote streamable-http endpoint https://mcp.bulkpublish.com/, auth_posture auth_required, directory tier community"}],"primary_reason":"BulkPublish can publish external posts and delete post resources across connected channels.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:27e7992e-1f57-48d6-8a15-881dae340133","reviewed_at":"2026-10-10","reviewer_notes":"Media upload and post updates are Medium writes. Verify whether delete_post removes already-published platform content and how multi-channel retries are confirmed.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":20,"tools_or_skills_total":20},"name":"BulkPublish","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=27e7992e-1f57-48d6-8a15-881dae340133&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.bulkpublish.com/privacy/","provisional_risk":null,"publication_recommendation":"accept","publisher":"BulkPublish","publisher_url":"https://www.bulkpublish.com/","remote_url":"https://mcp.bulkpublish.com/","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: Publishing social content communicates externally as the user or brand.","evidence":"Publishes posts to connected channels: The inventory explicitly contains publish_post and retry_post over connected channels.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Publishes posts to connected channels","triggering_tools":["publish_post","create_post","retry_post"]},{"description":"This connector can permanently remove data or resources. Review findings: Deleting a post resource is destructive and may remove public content or its account record.","evidence":"Deletes scheduled or published post records: The complete inventory explicitly includes delete_post.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Deletes scheduled or published post records","triggering_tools":["delete_post"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@bulkpublish.com","tags":["deletes_data","network_access","oauth_required","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"compose_post"},{"description":"","name":"create_media_upload"},{"description":"","name":"create_post","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Publishing social content communicates externally as the user or brand."}},{"description":"","name":"delete_post","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deleting a post resource is destructive and may remove public content or its account record."}},{"description":"","name":"finalize_media_upload"},{"description":"","name":"get_analytics"},{"description":"","name":"get_post"},{"description":"","name":"get_post_metrics"},{"description":"","name":"get_queue_slot"},{"description":"","name":"list_channels"},{"description":"","name":"list_media"},{"description":"","name":"list_posts"},{"description":"","name":"publish_post","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Publishing social content communicates externally as the user or brand."}},{"description":"","name":"retry_post","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Publishing social content communicates externally as the user or brand."}},{"description":"","name":"update_post"},{"description":"","name":"upload_media"},{"description":"","name":"view_analytics"},{"description":"","name":"view_channels"},{"description":"","name":"view_media"},{"description":"","name":"view_posts"}],"tools_count":20,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/27e7992e-1f57-48d6-8a15-881dae340133","uuid":"793b3a81-3f9d-532f-b8ab-97061824560d","verification_tier":"community","version":""},"query_key":"bulkpublish","schema_version":1,"status":"match"}