{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-16","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","catalog_reconciliation":{"basis":"Documented actions on the identified catalog surface; not an execution test.","confidence":"medium","evidence_completeness":"partial","previous":{"confidence":"low","detail_sha256":"a89e2a43ba86c15427fdd68eae5a2cbb3c964f5734b313f708e55ac4b0598dbf","risk":"high"},"proposal_file":"final-evidence-proposals.json","rationale":"Current same-endpoint administration tools resolve the old uncertainty. High applies to the current documented permitted surface; it is not a claim that every role receives administrative power. Current public Claude-specific documentation rendered in the ordinary browser without signing in; manual-connection section confirms exact endpoint.","remaining_evidence_gaps":["Current role-specific schemas and runtime enforcement were not tested. Stored inventory omits current administration tools."],"review_key":"claudesec:944f2645-0f0e-4347-8054-756fe40f59ee","reviewed_at":"2026-10-12","runtime_verified":false,"sources":["https://citelaw.org/connect/claude"],"status":"resolved"},"category":"Web Connector","confidence":"low","description":"CiteLaw combines U.S. legal research with matter and firm workflows. Search authorities, verify citations, inspect case treatment, and organize client work. It is a research tool, not legal advice or an attorney-client relationship.","did":"944f2645-0f0e-4347-8054-756fe40f59ee","documentation_url":"https://citelaw.org/connect/claude","editorial_description":{"extended_description":"Retrieve full legal texts and search uploaded documents or prior research. Firm tools cover conflict checks, leads, contacts, discovery, clause libraries, tasks, and schedules. Notes, research sessions, and drafted Word documents can be saved to shared matters and workspaces.","schema_version":1,"summary":"CiteLaw combines U.S. legal research with matter and firm workflows.\nSearch authorities, verify citations, inspect case treatment, and organize client work.\nIt is a research tool, not legal advice or an attorney-client relationship."},"homepage_url":"","icon":"https://citelaw.org/assets/CiteLawTabIcon.png","id":"944f2645-0f0e-4347-8054-756fe40f59ee","installs":0,"last_scanned":"","license":"","long_description":"Retrieve full legal texts and search uploaded documents or prior research. Firm tools cover conflict checks, leads, contacts, discovery, clause libraries, tasks, and schedules. Notes, research sessions, and drafted Word documents can be saved to shared matters and workspaces.","manual_assessment":"unassessed","manual_review":{"all_findings":[{"evidence":"These generic tools may create/update/delete or communicate around legal matters, but per-operation schemas are absent.","reasoning":"The fixed inventory does not bound destructive/admin/messaging effects.","risk_type":"generic_gateway","severity":"low","title":"Uses opaque manage_* operations for firm records","triggering_tools_or_skills":["manage_leads","manage_discovery","manage_clauses","manage_tasks","manage_schedule"]},{"evidence":"These tools persist matter files/research.","reasoning":"They materially change shared legal records.","risk_type":"file_write","severity":"medium","title":"Creates legal documents and notes and saves sessions","triggering_tools_or_skills":["create_document","create_note","save_session"]},{"evidence":"These tools change firm-management state.","reasoning":"They alter sensitive operational records.","risk_type":"data_modification","severity":"medium","title":"Creates/links contacts and manages intake/discovery/tasks/schedule","triggering_tools_or_skills":["create_contact","link_contact_to_matter","manage_leads","manage_tasks"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication is required; legal workspaces/matters/documents/intake/tasks/contacts follow firm permissions, which are not detailed.","blocked_missing_evidence":"Exhaustive schemas/action enums for manage_leads, manage_discovery, manage_clauses, manage_tasks and manage_schedule, identifying delete, external-send, deadline/filing and role/access effects.","confidence":"low","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"unassessed","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/944f2645-0f0e-4347-8054-756fe40f59ee.json","what_it_proves":"Candidate PR #125 record identity (name \"CiteLaw\", publisher, type web_connector) and 36 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/944f2645-0f0e-4347-8054-756fe40f59ee: complete tool_names inventory (36 tools), remote streamable-http endpoint https://citelaw.org/api/mcp/protocol, auth_posture auth_required, directory tier community"}],"primary_reason":"CiteLaw exposes opaque manage_* gateways over sensitive firm-management workflows.","provisional_risk":"high","publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:944f2645-0f0e-4347-8054-756fe40f59ee","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 36 tools. Research/search is bounded; unassessed status is driven by five generic management gateways, not legal-data retrieval.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"true","filesystem_or_repo_access":"true","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":36,"tools_or_skills_total":36},"name":"CiteLaw","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=944f2645-0f0e-4347-8054-756fe40f59ee&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://citelaw.org/privacy","provisional_risk":"high","publication_recommendation":"fix","publisher":"CiteLaw","publisher_url":"https://citelaw.org/","remote_url":"https://citelaw.org/api/mcp/protocol","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"The current Claude connector can invite or remove workspace members, change roles and manage who can see a matter, within the connected user’s permissions.","evidence":"https://citelaw.org/connect/claude\nDocumented actions: manage_workspace, manage_matters","risk_type":"modifies_data","severity":"high","title":"Changes workspace members, roles and matter access"},{"description":"Reads accessible documents, notes, contacts, deadlines, tasks and research history from the connected workspace.","evidence":"https://citelaw.org/connect/claude\nDocumented actions: read_document, search_documents, query_notes, query_contacts, query_schedule, query_tasks, query_search_history","risk_type":"reads_private_data","severity":"medium","title":"Reads confidential matter and firm records"},{"description":"Creates documents, notes and discovery records; manages tasks and deadlines. Calendar changes can mirror to connected Outlook. The sign-off queue still requires a human decision.","evidence":"https://citelaw.org/connect/claude\nDocumented actions: create_document, create_note, manage_discovery, manage_tasks, manage_schedule","risk_type":"modifies_data","severity":"medium","title":"Updates shared legal work and calendar entries"}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"solutions@citelaw.org","tags":["modifies_data","reads_private_data"],"tools":[{"description":"","name":"authority_lookup"},{"description":"","name":"authority_search_metadata"},{"description":"","name":"check_case_treatment"},{"description":"","name":"check_corpus_coverage"},{"description":"","name":"create_document","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: They materially change shared legal records."}},{"description":"","name":"create_note","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: They materially change shared legal records."}},{"description":"","name":"extract_citations"},{"description":"","name":"get_active_context"},{"description":"","name":"judge_lookup"},{"description":"","name":"list_matters"},{"description":"","name":"list_workspaces"},{"description":"","name":"query_notes"},{"description":"","name":"query_search_history"},{"description":"","name":"save_session","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: They materially change shared legal records."}},{"description":"","name":"search_authorities"},{"description":"","name":"search_authorities_keyword"},{"description":"","name":"switch_matter"},{"description":"","name":"switch_workspace"},{"description":"","name":"verify_citations"},{"description":"","name":"run_conflict_check"},{"description":"","name":"query_leads"},{"description":"","name":"manage_leads","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They alter sensitive operational records."}},{"description":"","name":"query_discovery"},{"description":"","name":"manage_discovery"},{"description":"","name":"query_clauses"},{"description":"","name":"manage_clauses"},{"description":"","name":"query_tasks"},{"description":"","name":"manage_tasks","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They alter sensitive operational records."}},{"description":"","name":"query_contacts"},{"description":"","name":"create_contact","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They alter sensitive operational records."}},{"description":"","name":"link_contact_to_matter","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They alter sensitive operational records."}},{"description":"","name":"query_schedule"},{"description":"","name":"manage_schedule"},{"description":"","name":"list_documents"},{"description":"","name":"search_documents"},{"description":"","name":"read_document"}],"tools_count":36,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/944f2645-0f0e-4347-8054-756fe40f59ee","uuid":"921e61bc-594b-5e3c-bc4c-ceab88745387","verification_tier":"community","version":""},"query_key":"citelaw citelaw","schema_version":1,"status":"match"}