{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-28","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Carly connects email, CRM, calendars, files, and recurring workflows. Read or send mail, update contacts, manage meetings, and maintain tasks or knowledge. Create, test, run, pause, or schedule workflows that continue after the conversation.","did":"a7d3d29e-9c97-4f34-91c3-f77d87b8ce4f","documentation_url":"https://www.usecarly.com/mcp","editorial_description":{"extended_description":"Use Gmail or Outlook drafts and replies, labels, folders, and unsubscribe actions. Coordinate booking pages or availability polls and work with Google Drive, Docs, OneDrive, and structured data. Connected services and account context determine the available content.","schema_version":1,"summary":"Carly connects email, CRM, calendars, files, and recurring workflows.\nRead or send mail, update contacts, manage meetings, and maintain tasks or knowledge.\nCreate, test, run, pause, or schedule workflows that continue after the conversation."},"homepage_url":"","icon":"","id":"a7d3d29e-9c97-4f34-91c3-f77d87b8ce4f","installs":0,"last_scanned":"","license":"","long_description":"Use Gmail or Outlook drafts and replies, labels, folders, and unsubscribe actions. Coordinate booking pages or availability polls and work with Google Drive, Docs, OneDrive, and structured data. Connected services and account context determine the available content.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"These tools communicate or share resources as the connected user.","reasoning":"They are user-representative actions.","risk_type":"messaging_as_user","severity":"high","title":"Sends emails/replies and shares calendars/files","triggering_tools_or_skills":["send_email","send_gmail","send_mail_reply","send_outlook_mail","share_calendar","share_onedrive_item"]},{"evidence":"The tools execute caller-supplied code over connected data.","reasoning":"Arbitrary code execution is High.","risk_type":"code_execution","severity":"high","title":"Runs Python, pandas and calendar code","triggering_tools_or_skills":["run_python","run_pandas","run_calendar_code"]},{"evidence":"Explicit tools remove durable personal/business data.","reasoning":"They can cause broad data loss.","risk_type":"data_deletion","severity":"high","title":"Deletes events, memory, todos, rows and booking pages; trashes mail","triggering_tools_or_skills":["delete_event","delete_memory","delete_data_rows","delete_booking_page_tool","trash_mail_message"]},{"evidence":"The tools control recurring production automation.","reasoning":"They can autonomously trigger consequential actions.","risk_type":"deployment_infrastructure","severity":"high","title":"Creates/runs/schedules workflows and tasks","triggering_tools_or_skills":["create_workflow","run_workflow_now","schedule_task","resume_workflow"]},{"evidence":"These actions establish privileged integrations or resource access.","reasoning":"They administer credentials/authorization.","risk_type":"credential_admin","severity":"high","title":"Connects integrations and changes shared access","triggering_tools_or_skills":["connect_integration","share_calendar","share_onedrive_item"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication links email, calendars, CRM, files, data tables and integrations.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/a7d3d29e-9c97-4f34-91c3-f77d87b8ce4f.json","what_it_proves":"Candidate PR #125 record identity (name \"Carly\", publisher, type web_connector) and 80 stored tool names (truncated vs Directory); no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/a7d3d29e-9c97-4f34-91c3-f77d87b8ce4f: complete tool_names inventory (122 tools), remote streamable-http endpoint https://carlyassistant.com/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Carly can send mail, execute code, delete data and run cross-service automations.","provisional_risk":null,"publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:a7d3d29e-9c97-4f34-91c3-f77d87b8ce4f","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 122 stored tools; packet is truncated but explicit High actions are sufficient.","risk_domains":{"arbitrary_network_access":"true","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"true","deletes_data":"true","deployment_or_infrastructure":"true","dynamic_hidden_actions":"true","filesystem_or_repo_access":"true","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"true","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":122,"tools_or_skills_total":122},"name":"Carly","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=a7d3d29e-9c97-4f34-91c3-f77d87b8ce4f&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://calbotservice.com/privacy","provisional_risk":null,"publication_recommendation":"fix","publisher":"Carly AI","publisher_url":"https://www.usecarly.com/","remote_url":"https://carlyassistant.com/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: They are user-representative actions.","evidence":"Sends emails/replies and shares calendars/files: These tools communicate or share resources as the connected user.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Sends emails/replies and shares calendars/files","triggering_tools":["send_email","send_gmail","send_mail_reply","send_outlook_mail","share_calendar","share_onedrive_item"]},{"description":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Arbitrary code execution is High.","evidence":"Runs Python, pandas and calendar code: The tools execute caller-supplied code over connected data.","manual_risk_type":"code_execution","remediation":{"block_tool_categories":["code_execution"],"steps":["Run only in a sandbox with least-privilege credentials and strict resource limits.","Disable generic execution gateways unless their reachable action set is fully understood.","Require approval before execution against production systems or sensitive data."]},"risk_type":"runs_code","severity":"high","title":"Runs Python, pandas and calendar code","triggering_tools":["run_python","run_pandas","run_calendar_code"]},{"description":"This connector can permanently remove data or resources. Review findings: They can cause broad data loss.","evidence":"Deletes events, memory, todos, rows and booking pages; trashes mail: Explicit tools remove durable personal/business data.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Deletes events, memory, todos, rows and booking pages; trashes mail","triggering_tools":["delete_event","delete_memory","delete_data_rows","delete_booking_page_tool","trash_mail_message"]},{"description":"This connector can deploy code or change infrastructure and production environments. Review findings: They can autonomously trigger consequential actions.","evidence":"Creates/runs/schedules workflows and tasks: The tools control recurring production automation.","manual_risk_type":"deployment_infrastructure","remediation":{"block_tool_categories":["code_execution","state_change"],"steps":["Default to a sandbox or staging environment.","Require code review, human approval, audit logging, and a tested rollback path for production changes."]},"risk_type":"code_deployment","severity":"high","title":"Creates/runs/schedules workflows and tasks","triggering_tools":["create_workflow","run_workflow_now","schedule_task","resume_workflow"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They administer credentials/authorization.","evidence":"Connects integrations and changes shared access: These actions establish privileged integrations or resource access.","manual_risk_type":"credential_admin","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"high","title":"Connects integrations and changes shared access","triggering_tools":["connect_integration","share_calendar","share_onedrive_item"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@calbotservice.com","tags":["accesses_calendar","accesses_messaging","code_deployment","deletes_data","modifies_data","network_access","oauth_required","runs_code","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"add_todo"},{"description":"","name":"aggregate_crm"},{"description":"","name":"append_onedrive_workbook_row"},{"description":"","name":"append_to_google_doc"},{"description":"","name":"archive_workflow"},{"description":"","name":"cancel_scheduled_task"},{"description":"","name":"check_calendar"},{"description":"","name":"complete_todo"},{"description":"","name":"connect_integration","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They administer credentials/authorization."}},{"description":"","name":"create_availability_poll"},{"description":"","name":"create_booking_page_tool"},{"description":"","name":"create_calendar"},{"description":"","name":"create_column"},{"description":"","name":"create_data_table"},{"description":"","name":"create_drive_folder"},{"description":"","name":"create_event"},{"description":"","name":"create_gmail_draft"},{"description":"","name":"create_gmail_drafts"},{"description":"","name":"create_google_doc"},{"description":"","name":"create_onedrive_folder"},{"description":"","name":"create_outlook_draft"},{"description":"","name":"create_outlook_drafts"},{"description":"","name":"create_workflow","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: They can autonomously trigger consequential actions."}},{"description":"","name":"create_workflow_from_template"},{"description":"","name":"delete_booking_page_tool","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: They can cause broad data loss."}},{"description":"","name":"delete_data_rows","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: They can cause broad data loss."}},{"description":"","name":"delete_event","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: They can cause broad data loss."}},{"description":"","name":"delete_memory","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: They can cause broad data loss."}},{"description":"","name":"delete_todo"},{"description":"","name":"describe_workflow_trigger"},{"description":"","name":"download_onedrive_file"},{"description":"","name":"draft_mail_reply"},{"description":"","name":"edit_todo"},{"description":"","name":"find_event"},{"description":"","name":"find_files"},{"description":"","name":"find_free"},{"description":"","name":"flag_mail_message"},{"description":"","name":"get_booking"},{"description":"","name":"get_booking_page"},{"description":"","name":"get_contact_emails"},{"description":"","name":"get_crm_schema"},{"description":"","name":"get_user_preferences"},{"description":"","name":"get_workflow"},{"description":"","name":"get_workflow_blueprint"},{"description":"","name":"get_workflow_runs"},{"description":"","name":"grep_memory"},{"description":"","name":"label_mail_message"},{"description":"","name":"list_booking_pages"},{"description":"","name":"list_bookings"},{"description":"","name":"list_calendar_names"},{"description":"","name":"list_calendars"},{"description":"","name":"list_data_tables"},{"description":"","name":"list_drive_files"},{"description":"","name":"list_event_types"},{"description":"","name":"list_events"},{"description":"","name":"list_integrations"},{"description":"","name":"list_mail_accounts"},{"description":"","name":"list_mail_attachments"},{"description":"","name":"list_mail_folders"},{"description":"","name":"list_mail_labels"},{"description":"","name":"list_onedrive_files"},{"description":"","name":"list_scheduled_tasks"},{"description":"","name":"list_skills"},{"description":"","name":"list_slots"},{"description":"","name":"list_todos"},{"description":"","name":"list_workflow_templates"},{"description":"","name":"list_workflow_trigger_calendars"},{"description":"","name":"list_workflow_trigger_mailboxes"},{"description":"","name":"list_workflows"},{"description":"","name":"load_skill"},{"description":"","name":"lookup_person"},{"description":"","name":"move_event"},{"description":"","name":"move_mail_message"},{"description":"","name":"pause_workflow"},{"description":"","name":"preview_workflow"},{"description":"","name":"query_availability_poll"},{"description":"","name":"query_crm"},{"description":"","name":"query_data"},{"description":"","name":"read_attachment"},{"description":"","name":"read_knowledge_file"},{"description":"","name":"read_mail_message"},{"description":"","name":"read_memory"},{"description":"","name":"read_onedrive_workbook"},{"description":"","name":"resolve_onedrive_share_link"},{"description":"","name":"resume_workflow","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: They can autonomously trigger consequential actions."}},{"description":"","name":"run_calendar_code","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Arbitrary code execution is High."}},{"description":"","name":"run_pandas","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Arbitrary code execution is High."}},{"description":"","name":"run_python","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Arbitrary code execution is High."}},{"description":"","name":"run_skill"},{"description":"","name":"run_workflow_now","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: They can autonomously trigger consequential actions."}},{"description":"","name":"save_memory"},{"description":"","name":"save_skill"},{"description":"","name":"schedule_task","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: They can autonomously trigger consequential actions."}},{"description":"","name":"search_crm"},{"description":"","name":"search_knowledge_base"},{"description":"","name":"search_mail"},{"description":"","name":"send_email","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: They are user-representative actions."}},{"description":"","name":"send_gmail","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: They are user-representative actions."}},{"description":"","name":"send_mail_reply","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: They are user-representative actions."}},{"description":"","name":"send_outlook_mail","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: They are user-representative actions."}},{"description":"","name":"share_calendar","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They administer credentials/authorization."}},{"description":"","name":"share_onedrive_item","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They administer credentials/authorization."}},{"description":"","name":"test_workflow"},{"description":"","name":"trash_mail_message","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: They can cause broad data loss."}},{"description":"","name":"unlabel_mail_message"},{"description":"","name":"unsubscribe_from_sender"},{"description":"","name":"update_availability_poll"},{"description":"","name":"update_booking_page_tool"},{"description":"","name":"update_calendar"},{"description":"","name":"update_contact"},{"description":"","name":"update_crm"},{"description":"","name":"update_data_rows"},{"description":"","name":"update_event"},{"description":"","name":"update_participant_availability"},{"description":"","name":"update_scheduled_task"},{"description":"","name":"update_skill"},{"description":"","name":"update_user_preferences"},{"description":"","name":"update_workflow"},{"description":"","name":"update_workflow_step"},{"description":"","name":"upload_to_onedrive"},{"description":"","name":"upsert_data_rows"},{"description":"","name":"upsert_rows"}],"tools_count":122,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/a7d3d29e-9c97-4f34-91c3-f77d87b8ce4f","uuid":"574ccac3-14e6-5cc2-8605-5f228ce3fa94","verification_tier":"community","version":""},"query_key":"carly","schema_version":1,"status":"match"}