{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-15","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"high","description":"Chartsy brings SaaS billing metrics and website analytics into Claude. Track MRR, revenue, churn, refunds, customer growth, and concentration among large customers. Compare traffic and signup sources using connected Stripe or Paddle Billing data and tracked sites.","did":"5395b368-6600-4f64-8830-97d799b5a503","documentation_url":"https://chartsy.app/help/chartsy/mcp","editorial_description":{"extended_description":"Tools provide daily business snapshots, MRR by plan or country, at-risk customer lists, goal progress, and marketing-source breakdowns. Website reporting can examine channels, campaigns, and landing pages.","schema_version":1,"summary":"Chartsy brings SaaS billing metrics and website analytics into Claude.\nTrack MRR, revenue, churn, refunds, customer growth, and concentration among large customers.\nCompare traffic and signup sources using connected Stripe or Paddle Billing data and tracked sites."},"homepage_url":"","icon":"","id":"5395b368-6600-4f64-8830-97d799b5a503","installs":0,"last_scanned":"","license":"","long_description":"Tools provide daily business snapshots, MRR by plan or country, at-risk customer lists, goal progress, and marketing-source breakdowns. Website reporting can examine channels, campaigns, and landing pages.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"Official reference states each call draws from the same monthly ChartsyAI allowance.","reasoning":"Consuming paid credits/allowance is High.","risk_type":"financial_transaction","severity":"high","title":"Tool calls consume monthly question budget","triggering_tools_or_skills":["get_business_snapshot","get_mrr","get_site_traffic"]},{"evidence":"Official reference documents read-only access to owned billing/site analytics.","reasoning":"Private reads are Low aside from quota spend.","risk_type":"private_data_read","severity":"low","title":"Reads private revenue and customer metrics","triggering_tools_or_skills":["get_mrr","list_top_customers","list_at_risk_customers"]},{"evidence":"Remote hosted implementation is unpinned.","reasoning":"Runtime capabilities can drift.","risk_type":"provenance_uncertainty","severity":"low","title":"Hosted implementation is mutable","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"OAuth/account authorization required; exact scopes are not documented.","blocked_missing_evidence":null,"confidence":"high","displayed_risk":"high","evidence_completeness":"complete","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/5395b368-6600-4f64-8830-97d799b5a503.json","what_it_proves":"Candidate PR #125 record identity (name \"Chartsy\", publisher, type web_connector) and 18 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/5395b368-6600-4f64-8830-97d799b5a503: complete tool_names inventory (18 tools), remote streamable-http endpoint https://mcp.chartsy.app/mcp, auth_posture auth_required, directory tier community"},{"accessed_at":"2026-10-10T21:55:04Z","url_or_path":"https://chartsy.app/help/chartsy/mcp","what_it_proves":"Official MCP reference says every tool is read-only but each call draws down the plan’s monthly ChartsyAI question allowance."}],"primary_reason":"Chartsy tools are read-only but consume a paid-plan monthly allowance.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:5395b368-6600-4f64-8830-97d799b5a503","reviewed_at":"2026-10-10","reviewer_notes":"All declared tool names were reviewed; schemas were not available.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"false","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"true"},"tools_or_skills_reviewed":18,"tools_or_skills_total":18},"name":"Chartsy","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=5395b368-6600-4f64-8830-97d799b5a503&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://chartsy.app/privacy-policy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Chartsy","publisher_url":"https://chartsy.app/","remote_url":"https://mcp.chartsy.app/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Consuming paid credits/allowance is High.","evidence":"Tool calls consume monthly question budget: Official reference states each call draws from the same monthly ChartsyAI allowance.","manual_risk_type":"financial_transaction","remediation":{"block_tool_categories":["financial"],"steps":["Set provider-side spending limits and require approval for every financial action.","Use a dedicated low-balance account and review transaction logs."]},"risk_type":"spends_money","severity":"high","title":"Tool calls consume monthly question budget","triggering_tools":["get_business_snapshot","get_mrr","get_site_traffic"]},{"description":"This connector can read information available to the connected account and return it to the AI. Review findings: Private reads are Low aside from quota spend.","evidence":"Reads private revenue and customer metrics: Official reference documents read-only access to owned billing/site analytics.","manual_risk_type":"private_data_read","remediation":{"block_tool_categories":["data_exfiltration"],"steps":["Use a least-privilege account limited to the information required by the workflow.","Restrict folders, projects, tenants, and other data scopes wherever the provider allows it.","Review access logs for unexpected reads or bulk retrieval."]},"risk_type":"reads_private_data","severity":"low","title":"Reads private revenue and customer metrics","triggering_tools":["get_mrr","list_top_customers","list_at_risk_customers"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@chartsy.app","tags":["accesses_calendar","network_access","oauth_required","reads_private_data","spends_money","web_connector"],"tools":[{"description":"","name":"get_business_snapshot","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Consuming paid credits/allowance is High."}},{"description":"","name":"get_churn_rate"},{"description":"","name":"get_customer_concentration"},{"description":"","name":"get_daily_snapshot"},{"description":"","name":"get_goal_progress"},{"description":"","name":"get_monthly_events_usage"},{"description":"","name":"get_mrr","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Consuming paid credits/allowance is High."}},{"description":"","name":"get_mrr_by_country"},{"description":"","name":"get_mrr_by_plan"},{"description":"","name":"get_new_subscribers"},{"description":"","name":"get_refund_summary"},{"description":"","name":"get_revenue_breakdown"},{"description":"","name":"get_site_traffic","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Consuming paid credits/allowance is High."}},{"description":"","name":"get_traffic_sources"},{"description":"","name":"list_accounts"},{"description":"","name":"list_at_risk_customers"},{"description":"","name":"list_top_customers"},{"description":"","name":"list_tracked_sites"}],"tools_count":18,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/5395b368-6600-4f64-8830-97d799b5a503","uuid":"1f6f5fd5-ad03-54bd-a2f3-7ec958fd9e1e","verification_tier":"community","version":""},"query_key":"chartsy chartsy","schema_version":1,"status":"match"}