{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-02","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Provides read-only asset-backed-finance analytics from CardoAI. Find authorized securitization transactions and retrieve preconfigured portfolio-analysis tables. Results use the latest synchronized snapshot, with OAuth and per-transaction access limits.","did":"b1b30ff0-8b91-4499-b070-c1de209923da","documentation_url":"https://cardoai.com/abf-mcp/","editorial_description":{"extended_description":"Tools list available analytics views and filterable columns. Supported filters can narrow results by region, value thresholds, dates or status flags. The connector does not create, modify or delete platform data.","schema_version":1,"summary":"Provides read-only asset-backed-finance analytics from CardoAI.\nFind authorized securitization transactions and retrieve preconfigured portfolio-analysis tables.\nResults use the latest synchronized snapshot, with OAuth and per-transaction access limits."},"homepage_url":"","icon":"https://cardoai.com/","id":"b1b30ff0-8b91-4499-b070-c1de209923da","installs":0,"last_scanned":"","license":"","long_description":"Tools list available analytics views and filterable columns. Supported filters can narrow results by region, value thresholds, dates or status flags. The connector does not create, modify or delete platform data.","manual_assessment":"low","manual_review":{"all_findings":[{"evidence":"All six tools are get/list/read operations.","reasoning":"The listing explicitly describes read-only access.","risk_type":"private_data_read","severity":"low","title":"Reads private securitization transactions and analytics","triggering_tools_or_skills":["list_transactions","list_transaction_analytics","get_stratification_analytics_data","read_resource"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication scopes authorized asset-backed finance transactions/resources.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"low","evidence_completeness":"partial","manual_overall_risk":"low","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/b1b30ff0-8b91-4499-b070-c1de209923da.json","what_it_proves":"Candidate PR #125 record identity (name \"CardoAI ABF MCP\", publisher, type web_connector) and 6 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/b1b30ff0-8b91-4499-b070-c1de209923da: complete tool_names inventory (6 tools), remote streamable-http endpoint https://abf-backend.uat.cardoaiapps.com/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"CardoAI ABF is read-only structured-finance analytics.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:b1b30ff0-8b91-4499-b070-c1de209923da","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all six tools.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"false","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":6,"tools_or_skills_total":6},"name":"CardoAI ABF MCP","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=b1b30ff0-8b91-4499-b070-c1de209923da&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://cardoai.com/mcp-privacy-policy/","provisional_risk":null,"publication_recommendation":"accept","publisher":"CardoAI","publisher_url":"https://cardoai.com/","remote_url":"https://abf-backend.uat.cardoaiapps.com/mcp","repository_url":"","risk":"low","risk_severity":"low","security_risks":[{"description":"This connector can read information available to the connected account and return it to the AI. Review findings: The listing explicitly describes read-only access.","evidence":"Reads private securitization transactions and analytics: All six tools are get/list/read operations.","manual_risk_type":"private_data_read","remediation":{"block_tool_categories":["data_exfiltration"],"steps":["Use a least-privilege account limited to the information required by the workflow.","Restrict folders, projects, tenants, and other data scopes wherever the provider allows it.","Review access logs for unexpected reads or bulk retrieval."]},"risk_type":"reads_private_data","severity":"low","title":"Reads private securitization transactions and analytics","triggering_tools":["list_transactions","list_transaction_analytics","get_stratification_analytics_data","read_resource"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@cardoai.com","tags":["network_access","oauth_required","reads_private_data","web_connector"],"tools":[{"description":"","name":"get_filterable_columns"},{"description":"","name":"get_stratification_analytics_data"},{"description":"","name":"list_resources"},{"description":"","name":"list_transaction_analytics"},{"description":"","name":"list_transactions"},{"description":"","name":"read_resource"}],"tools_count":6,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/b1b30ff0-8b91-4499-b070-c1de209923da","uuid":"4323ba98-f8c7-5c92-a669-d4e90ab7d76d","verification_tier":"community","version":""},"query_key":"cardoai cardoai abf mcp","schema_version":1,"status":"match"}