{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-06","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"reviewed","auth_posture":"auth_required","category":"Web Connector","confidence":"high","description":"Explore proprietary datasets through Carbon Arc. Find companies, locations or metrics and retrieve structured data tables. Compare trends across periods and regions using available account data.","did":"07e75423-4d9a-4a87-978f-9b75856e38d9","documentation_url":"https://docs.carbonarc.ai/platform/mcp/carbonarc-mcp","editorial_description":{"extended_description":"Tools expose a data library, entity and insight search, filter options, an ontology and documentation. Results depend on the datasets and metrics accessible to your authenticated Carbon Arc account.","schema_version":1,"summary":"Explore proprietary datasets through Carbon Arc.\nFind companies, locations or metrics and retrieve structured data tables.\nCompare trends across periods and regions using available account data."},"homepage_url":"","icon":"https://app.carbonarc.ai/favicon.ico","id":"07e75423-4d9a-4a87-978f-9b75856e38d9","installs":0,"last_scanned":"","license":"","long_description":"Tools expose a data library, entity and insight search, filter options, an ontology and documentation. Results depend on the datasets and metrics accessible to your authenticated Carbon Arc account.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"Official FAQ states calls consume daily MCP tokens and continue through purchased Primary MCP tokens after the included daily allotment is exhausted.","reasoning":"Once purchased tokens are reached, analytical calls irreversibly consume a monetary balance at data-volume pricing.","risk_type":"financial_transaction","severity":"high","title":"Analytical calls can consume purchased tokens","triggering_tools_or_skills":["framework_to_insight","text_to_insight"]},{"evidence":"Official documentation describes subscription-gated proprietary data assets and structured analytical results.","reasoning":"Licensed business signals may be confidential to the subscribing organization.","risk_type":"private_data_read","severity":"low","title":"Proprietary licensed datasets are readable","triggering_tools_or_skills":["framework_to_insight","get_insights_from_entity","get_entities_from_insight","text_to_insight"]},{"evidence":"Official docs describe queries over SEC filings, financial news, earnings transcripts, investment theses, and web content.","reasoning":"External source material is untrusted model input.","risk_type":"prompt_injection_exposure","severity":"low","title":"Documents and web-content signals enter context","triggering_tools_or_skills":["text_to_insight","search_docs","data_library"]}],"assessment_status":"reviewed","auth_and_scopes":"OAuth or bearer API key for a Carbon Arc account with MCP access; rotating refresh tokens can remain valid for 30 days after successful refresh.","blocked_missing_evidence":null,"confidence":"high","displayed_risk":"high","evidence_completeness":"complete","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/07e75423-4d9a-4a87-978f-9b75856e38d9.json","what_it_proves":"Candidate PR #125 record identity (name \"Carbon Arc\", publisher, type web_connector) and 10 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/07e75423-4d9a-4a87-978f-9b75856e38d9: complete tool_names inventory (10 tools), remote streamable-http endpoint https://mcp.carbonarc.ai/, auth_posture auth_required, directory tier community"},{"accessed_at":"2026-10-10T20:51:36Z","url_or_path":"https://docs.carbonarc.ai/platform/mcp/mcp-faqs","what_it_proves":"Official FAQ describes structured data queries, subscription token allotments, daily reset, and purchased Primary MCP tokens consumed after included tokens."},{"accessed_at":"2026-10-10T20:51:36Z","url_or_path":"https://docs.carbonarc.ai/platform/mcp/carbonarc-mcp","what_it_proves":"Official overview bounds the core connector to discovery, structured analytical frameworks, entities, insights, and formatted read results."}],"primary_reason":"The core tools are read-only analytical queries, but official pricing confirms calls may consume purchased non-expiring tokens.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":false,"review_key":"claude:07e75423-4d9a-4a87-978f-9b75856e38d9","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all ten names against official MCP overview and FAQ; discovery calls may be free, but framework and text insight calls consume metered tokens and can reach purchased balance.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"false","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"true"},"tools_or_skills_reviewed":10,"tools_or_skills_total":10},"name":"Carbon Arc","needs_runtime_verification":false,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=07e75423-4d9a-4a87-978f-9b75856e38d9&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.carbonarc.ai/privacy-policy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Carbon Arc","publisher_url":"https://www.carbonarc.ai/","remote_url":"https://mcp.carbonarc.ai/","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Once purchased tokens are reached, analytical calls irreversibly consume a monetary balance at data-volume pricing.","evidence":"Analytical calls can consume purchased tokens: Official FAQ states calls consume daily MCP tokens and continue through purchased Primary MCP tokens after the included daily allotment is exhausted.","manual_risk_type":"financial_transaction","remediation":{"block_tool_categories":["financial"],"steps":["Set provider-side spending limits and require approval for every financial action.","Use a dedicated low-balance account and review transaction logs."]},"risk_type":"spends_money","severity":"high","title":"Analytical calls can consume purchased tokens","triggering_tools":["framework_to_insight","text_to_insight"]},{"description":"This connector can read information available to the connected account and return it to the AI. Review findings: Licensed business signals may be confidential to the subscribing organization.","evidence":"Proprietary licensed datasets are readable: Official documentation describes subscription-gated proprietary data assets and structured analytical results.","manual_risk_type":"private_data_read","remediation":{"block_tool_categories":["data_exfiltration"],"steps":["Use a least-privilege account limited to the information required by the workflow.","Restrict folders, projects, tenants, and other data scopes wherever the provider allows it.","Review access logs for unexpected reads or bulk retrieval."]},"risk_type":"reads_private_data","severity":"low","title":"Proprietary licensed datasets are readable","triggering_tools":["framework_to_insight","get_insights_from_entity","get_entities_from_insight","text_to_insight"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"auto_support@carbonarc.co ","tags":["network_access","oauth_required","reads_private_data","spends_money","web_connector"],"tools":[{"description":"","name":"data_library"},{"description":"","name":"framework_to_insight","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Once purchased tokens are reached, analytical calls irreversibly consume a monetary balance at data-volume pricing."}},{"description":"","name":"get_entities_from_insight"},{"description":"","name":"get_filter_options"},{"description":"","name":"get_insights_from_entity"},{"description":"","name":"ontology"},{"description":"","name":"search_docs"},{"description":"","name":"search_entities"},{"description":"","name":"search_insights"},{"description":"","name":"text_to_insight","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Once purchased tokens are reached, analytical calls irreversibly consume a monetary balance at data-volume pricing."}}],"tools_count":10,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/07e75423-4d9a-4a87-978f-9b75856e38d9","uuid":"2c380bad-b042-5d1f-8a44-9e53d9435c21","verification_tier":"community","version":""},"query_key":"carbon arc carbon arc","schema_version":1,"status":"match"}