{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-12","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Pumble connects workspace conversations and channel tasks to Claude. Search messages, read threads, retrieve files, and inspect workspace members. Send, edit, reply to, react to, or schedule messages and create channels.","did":"a492b396-7e56-4e18-81df-8a449573c182","documentation_url":"https://pumble.com/help/integrations/automation-workflow-integrations/how-to-use-the-pumble-mcp-server/#what-can-you-do-after-connecting-to-the-mcp-server","editorial_description":{"extended_description":"Manage scheduled messages, add users to channels, and generate call links.","schema_version":1,"summary":"Pumble connects workspace conversations and channel tasks to Claude.\nSearch messages, read threads, retrieve files, and inspect workspace members.\nSend, edit, reply to, react to, or schedule messages and create channels."},"homepage_url":"","icon":"","id":"a492b396-7e56-4e18-81df-8a449573c182","installs":0,"last_scanned":"","license":"","long_description":"Manage scheduled messages, add users to channels, and generate call links.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"These tools communicate to coworkers as the connected user.","reasoning":"They are user-representative messaging.","risk_type":"messaging_as_user","severity":"high","title":"Sends, schedules, edits and replies to workspace messages","triggering_tools_or_skills":["send_message","schedule_message","edit_message","reply_to_message"]},{"evidence":"The tool removes durable planned communication.","reasoning":"It can cancel user/team communications.","risk_type":"data_deletion","severity":"high","title":"Deletes scheduled messages","triggering_tools_or_skills":["delete_scheduled_message"]},{"evidence":"The tools change channel membership/access.","reasoning":"They administer collaboration-space access.","risk_type":"credential_admin","severity":"high","title":"Creates channels and adds users","triggering_tools_or_skills":["create_channel","add_user_to_channel"]},{"evidence":"The tool transfers private workspace files into Claude.","reasoning":"It accesses file content but does not alter the source.","risk_type":"file_write","severity":"medium","title":"Fetches workspace files","triggering_tools_or_skills":["fetch_file"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication uses Pumble workspace permissions.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/a492b396-7e56-4e18-81df-8a449573c182.json","what_it_proves":"Candidate PR #125 record identity (name \"Pumble\", publisher, type web_connector) and 19 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/a492b396-7e56-4e18-81df-8a449573c182: complete tool_names inventory (19 tools), remote streamable-http endpoint https://mcp.pumble.com/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Pumble sends messages and administers channel membership.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:a492b396-7e56-4e18-81df-8a449573c182","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 19 tools.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"true","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"true","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":19,"tools_or_skills_total":19},"name":"Pumble","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=a492b396-7e56-4e18-81df-8a449573c182&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://cake.com/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"CAKE.com","publisher_url":"https://cake.com/","remote_url":"https://mcp.pumble.com/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: They are user-representative messaging.","evidence":"Sends, schedules, edits and replies to workspace messages: These tools communicate to coworkers as the connected user.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Sends, schedules, edits and replies to workspace messages","triggering_tools":["send_message","schedule_message","edit_message","reply_to_message"]},{"description":"This connector can permanently remove data or resources. Review findings: It can cancel user/team communications.","evidence":"Deletes scheduled messages: The tool removes durable planned communication.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Deletes scheduled messages","triggering_tools":["delete_scheduled_message"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They administer collaboration-space access.","evidence":"Creates channels and adds users: The tools change channel membership/access.","manual_risk_type":"credential_admin","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"high","title":"Creates channels and adds users","triggering_tools":["create_channel","add_user_to_channel"]},{"description":"This connector can create, change, export, or otherwise write files. Review findings: It accesses file content but does not alter the source.","evidence":"Fetches workspace files: The tool transfers private workspace files into Claude.","manual_risk_type":"file_write","remediation":{"block_tool_categories":["state_change"],"steps":["Limit file access to a dedicated working directory.","Review generated or modified files before they are shared or executed."]},"risk_type":"filesystem_access","severity":"medium","title":"Fetches workspace files","triggering_tools":["fetch_file"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@pumble.com","tags":["accesses_messaging","deletes_data","filesystem_access","modifies_data","network_access","oauth_required","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"add_reaction_to_message"},{"description":"","name":"add_user_to_channel","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They administer collaboration-space access."}},{"description":"","name":"create_call_link"},{"description":"","name":"create_channel","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They administer collaboration-space access."}},{"description":"","name":"delete_scheduled_message","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: It can cancel user/team communications."}},{"description":"","name":"edit_message","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: They are user-representative messaging."}},{"description":"","name":"fetch_file","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: It accesses file content but does not alter the source."}},{"description":"","name":"get_channel_details"},{"description":"","name":"get_channel_messages"},{"description":"","name":"get_channels"},{"description":"","name":"get_latest_messages"},{"description":"","name":"get_scheduled_messages"},{"description":"","name":"get_thread_replies"},{"description":"","name":"get_users"},{"description":"","name":"get_workspace_info"},{"description":"","name":"reply_to_message","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: They are user-representative messaging."}},{"description":"","name":"schedule_message","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: They are user-representative messaging."}},{"description":"","name":"search_messages"},{"description":"","name":"send_message","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: They are user-representative messaging."}}],"tools_count":19,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/a492b396-7e56-4e18-81df-8a449573c182","uuid":"2048ffa5-8619-5c51-8333-8b07b178fabc","verification_tier":"community","version":""},"query_key":"cake com pumble","schema_version":1,"status":"match"}