{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-15","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Manages CoverCount reservations and venue-event operations from Claude. Check availability, adjust bookings or tables, and review guests, capacity and check-ins. Staff permissions apply; sensitive actions need CoverCount approval and drafted guest texts require confirmation.","did":"c0e9fc3f-9c2a-4b62-ad27-ee23a8c18de9","documentation_url":"https://www.covercount.io/learn/connected-apps/covercount-staff","editorial_description":{"extended_description":"An authorized staff account connects its venue. Tools provide briefings, prepare and commit management changes, and inspect action status so pending messages are not mistaken for completed delivery. Bookings requiring payment handling remain in the staff app; refund tools use prepare/commit steps.","schema_version":1,"summary":"Manages CoverCount reservations and venue-event operations from Claude.\nCheck availability, adjust bookings or tables, and review guests, capacity and check-ins.\nStaff permissions apply; sensitive actions need CoverCount approval and drafted guest texts require confirmation."},"homepage_url":"","icon":"https://www.covercount.io/img/emblem.svg","id":"c0e9fc3f-9c2a-4b62-ad27-ee23a8c18de9","installs":0,"last_scanned":"","license":"","long_description":"An authorized staff account connects its venue. Tools provide briefings, prepare and commit management changes, and inspect action status so pending messages are not mistaken for completed delivery. Bookings requiring payment handling remain in the staff app; refund tools use prepare/commit steps.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The inventory explicitly includes a two-step refund operation.","reasoning":"A committed refund moves money.","risk_type":"financial_transaction","severity":"high","title":"Commits refunds","triggering_tools_or_skills":["prepare_refund","commit_refund"]},{"evidence":"These tools externally communicate with guests or publish venue events.","reasoning":"They send content as the venue user.","risk_type":"messaging_as_user","severity":"high","title":"Messages guests and publishes events","triggering_tools_or_skills":["send_guest_message","commit_event_publication"]},{"evidence":"Cancellation destroys a meaningful booking resource.","reasoning":"It materially affects a guest reservation.","risk_type":"data_deletion","severity":"high","title":"Cancels reservations","triggering_tools_or_skills":["cancel_reservation"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication covers venue reservations/events; refund, publication and messaging roles are unspecified.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/c0e9fc3f-9c2a-4b62-ad27-ee23a8c18de9.json","what_it_proves":"Candidate PR #125 record identity (name \"CoverCount Staff\", publisher, type web_connector) and 24 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/c0e9fc3f-9c2a-4b62-ad27-ee23a8c18de9: complete tool_names inventory (24 tools), remote streamable-http endpoint https://mcp.covercount.io/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"CoverCount can commit refunds, publish events, cancel reservations and send guest messages.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:c0e9fc3f-9c2a-4b62-ad27-ee23a8c18de9","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 24 names. Official page was inaccessible; prepare/commit pairs suggest confirmation but runtime enforcement must be verified.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"true"},"tools_or_skills_reviewed":24,"tools_or_skills_total":24},"name":"CoverCount Staff","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=c0e9fc3f-9c2a-4b62-ad27-ee23a8c18de9&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.covercount.io/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"CloudScope","publisher_url":"https://www.covercount.io/","remote_url":"https://mcp.covercount.io/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: A committed refund moves money.","evidence":"Commits refunds: The inventory explicitly includes a two-step refund operation.","manual_risk_type":"financial_transaction","remediation":{"block_tool_categories":["financial"],"steps":["Set provider-side spending limits and require approval for every financial action.","Use a dedicated low-balance account and review transaction logs."]},"risk_type":"spends_money","severity":"high","title":"Commits refunds","triggering_tools":["prepare_refund","commit_refund"]},{"description":"This connector can publish or send messages and content using the connected identity. Review findings: They send content as the venue user.","evidence":"Messages guests and publishes events: These tools externally communicate with guests or publish venue events.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Messages guests and publishes events","triggering_tools":["send_guest_message","commit_event_publication"]},{"description":"This connector can permanently remove data or resources. Review findings: It materially affects a guest reservation.","evidence":"Cancels reservations: Cancellation destroys a meaningful booking resource.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Cancels reservations","triggering_tools":["cancel_reservation"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://support.cloudscope.io","tags":["accesses_calendar","accesses_messaging","deletes_data","network_access","oauth_required","sends_messages_as_you","spends_money","web_connector"],"tools":[{"description":"","name":"cancel_reservation","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: It materially affects a guest reservation."}},{"description":"","name":"commit_capacity_change"},{"description":"","name":"commit_event_publication","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: They send content as the venue user."}},{"description":"","name":"commit_refund","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: A committed refund moves money."}},{"description":"","name":"create_reservation"},{"description":"","name":"get_availability"},{"description":"","name":"get_current_user"},{"description":"","name":"get_event"},{"description":"","name":"get_event_status"},{"description":"","name":"get_operation_status"},{"description":"","name":"get_reservation"},{"description":"","name":"get_reservation_table_options"},{"description":"","name":"list_experiences"},{"description":"","name":"list_venues"},{"description":"","name":"modify_reservation"},{"description":"","name":"prepare_capacity_change"},{"description":"","name":"prepare_event_publication"},{"description":"","name":"prepare_refund","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: A committed refund moves money."}},{"description":"","name":"search_events"},{"description":"","name":"search_reservations"},{"description":"","name":"send_guest_message","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: They send content as the venue user."}},{"description":"","name":"summarize_event_activity"},{"description":"","name":"summarize_events"},{"description":"","name":"summarize_reservations"}],"tools_count":24,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/c0e9fc3f-9c2a-4b62-ad27-ee23a8c18de9","uuid":"94922e52-df4f-54f2-b36d-97c1e45a084e","verification_tier":"community","version":""},"query_key":"cloudscope covercount staff","schema_version":1,"status":"match"}