{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-08","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Connect The Dots finds introduction paths through your relationship network. Research people and companies, identify possible connectors, and monitor job changes. Draft, share for approval, and send introduction emails from the connected workflow.","did":"500d1b36-3247-4e78-aaa5-0945520d3e09","documentation_url":"https://ctd.ai/guide/category/mcp-and-ai","editorial_description":{"extended_description":"Tools explore paths to people or companies, organize relationship stages, manage email participants, and retrieve activity and job-change notifications. LinkedIn connection and message imports can add network context.","schema_version":1,"summary":"Connect The Dots finds introduction paths through your relationship network.\nResearch people and companies, identify possible connectors, and monitor job changes.\nDraft, share for approval, and send introduction emails from the connected workflow."},"homepage_url":"","icon":"https://iconify.production.ctd.tools/ctd/logo.svg","id":"500d1b36-3247-4e78-aaa5-0945520d3e09","installs":0,"last_scanned":"","license":"","long_description":"Tools explore paths to people or companies, organize relationship stages, manage email participants, and retrieve activity and job-change notifications. LinkedIn connection and message imports can add network context.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"Names explicitly send emails and share email drafts.","reasoning":"They communicate externally as the user.","risk_type":"messaging_as_user","severity":"high","title":"Can send and share ghost emails","triggering_tools_or_skills":["send_ghost_email","share_ghost_email_draft","share_ghost_email_for_approval"]},{"evidence":"Declared tools persist imported messages/connections and CRM stage changes.","reasoning":"These are meaningful account-data modifications.","risk_type":"data_modification","severity":"medium","title":"Can import LinkedIn data and update relationship stages","triggering_tools_or_skills":["import_linkedin_connections","import_linkedin_messages","bulk_update_company_stage","update_path_stage"]},{"evidence":"Remote source is unpinned.","reasoning":"Runtime may drift.","risk_type":"provenance_uncertainty","severity":"low","title":"Hosted implementation is mutable","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"Authenticated Connect The Dots account access is implied; email recipient/approval scopes are undocumented.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/500d1b36-3247-4e78-aaa5-0945520d3e09.json","what_it_proves":"Candidate PR #125 record identity (name \"Connect The Dots\", publisher, type web_connector) and 38 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/500d1b36-3247-4e78-aaa5-0945520d3e09: complete tool_names inventory (38 tools), remote streamable-http endpoint https://app.ctd.ai/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Connect The Dots can send emails and materially change relationship/CRM data.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:500d1b36-3247-4e78-aaa5-0945520d3e09","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 38 names; approval and recipient constraints should be verified.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":38,"tools_or_skills_total":38},"name":"Connect The Dots","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=500d1b36-3247-4e78-aaa5-0945520d3e09&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://ctd.ai/privacy-policy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Connect The Dots","publisher_url":"https://ctd.ai/","remote_url":"https://app.ctd.ai/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: They communicate externally as the user.","evidence":"Can send and share ghost emails: Names explicitly send emails and share email drafts.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Can send and share ghost emails","triggering_tools":["send_ghost_email","share_ghost_email_draft","share_ghost_email_for_approval"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are meaningful account-data modifications.","evidence":"Can import LinkedIn data and update relationship stages: Declared tools persist imported messages/connections and CRM stage changes.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Can import LinkedIn data and update relationship stages","triggering_tools":["import_linkedin_connections","import_linkedin_messages","bulk_update_company_stage","update_path_stage"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@ctd.ai","tags":["accesses_messaging","modifies_data","network_access","oauth_required","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"add_ghost_email_participant"},{"description":"","name":"bulk_update_company_stage","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are meaningful account-data modifications."}},{"description":"","name":"create_ghost_email_draft"},{"description":"","name":"decline_ghost_email_approval"},{"description":"","name":"get_approvers_for_connector"},{"description":"","name":"get_company_details"},{"description":"","name":"get_company_info"},{"description":"","name":"get_job_changes"},{"description":"","name":"get_paths_by_connector"},{"description":"","name":"get_paths_by_stage"},{"description":"","name":"get_paths_to_company"},{"description":"","name":"get_paths_to_contact"},{"description":"","name":"get_paths_to_person"},{"description":"","name":"get_people_in_company"},{"description":"","name":"get_person_details"},{"description":"","name":"get_reachable_person"},{"description":"","name":"import_linkedin_connections","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are meaningful account-data modifications."}},{"description":"","name":"import_linkedin_messages","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are meaningful account-data modifications."}},{"description":"","name":"list_activities"},{"description":"","name":"list_all_contacts"},{"description":"","name":"list_company_current_contacts"},{"description":"","name":"list_company_current_potential_contacts"},{"description":"","name":"list_company_former_contacts"},{"description":"","name":"list_company_former_potential_contacts"},{"description":"","name":"list_ghost_emails"},{"description":"","name":"list_global_paths"},{"description":"","name":"list_global_paths_by_connector"},{"description":"","name":"list_job_change_notifications"},{"description":"","name":"list_reachable_companies"},{"description":"","name":"list_reachable_people"},{"description":"","name":"remove_ghost_email_participant"},{"description":"","name":"search_paths"},{"description":"","name":"send_ghost_email","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: They communicate externally as the user."}},{"description":"","name":"share_ghost_email_draft","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: They communicate externally as the user."}},{"description":"","name":"share_ghost_email_for_approval","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: They communicate externally as the user."}},{"description":"","name":"update_company_stage"},{"description":"","name":"update_ghost_email"},{"description":"","name":"update_path_stage","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are meaningful account-data modifications."}}],"tools_count":38,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/500d1b36-3247-4e78-aaa5-0945520d3e09","uuid":"2b99e28f-c4bb-50ea-b4d3-74604fbe88aa","verification_tier":"community","version":""},"query_key":"connect the dots connect the dots","schema_version":1,"status":"match"}