{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-15","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","catalog_reconciliation":{"basis":"Documented actions on the identified catalog surface; not an execution test.","confidence":"high","evidence_completeness":"complete","previous":{"confidence":"low","detail_sha256":"004f658857ac4c6ca8b6b3289d380c75ac372619e9652792388ef67eae3d0e77","risk":"high"},"proposal_file":"claude-tail-proposals.json","rationale":"Low-confidence entry; High is confirmed. The official remote-MCP doc lists server create/delete/start/stop/force-stop/reboot/resize, volume create/update/delete/attach, SSH keypair create/delete and security-group/rule CRUD, and notes VPS creation incurs normal charges. The OSS tool map ties deletions to conoha_delete_by_param. Destructive infrastructure deletion and network-exposure changes => High, and the deletes_data and code_deployment High cards are right. Presentation fixes: the High runs_code card mislabels a generic ConoHa API dispatcher as code execution. The High forwards_data_to_third_party card for fetch_url overstates a helper documented for retrieving startup-script content; Low/Medium fits.","review_key":"claudesec:9dbcf509-31d0-4398-af95-ccaa9eefaede","reviewed_at":"2026-10-12","runtime_verified":false,"sources":["https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community","https://doc.conoha.jp/reference/mcp-server/remote-mcp/conoha-vps-mcp-server-remote/","https://github.com/gmo-internet/conoha_vps_mcp/blob/4d2d96a7a5f2d0fc6c9368c1a00a1023e10431c1/docs/tool.md"],"status":"resolved"},"category":"Web Connector","confidence":"low","description":"ConoHa VPS operates your ConoHa virtual servers through Japanese-language chat. Create, resize, start, stop, or delete servers and manage volumes or console access. Manage SSH keys and security groups, with Japanese tool descriptions and errors.","did":"9dbcf509-31d0-4398-af95-ccaa9eefaede","documentation_url":"https://doc.conoha.jp/reference/mcp-server/remote-mcp/conoha-vps-mcp-server-remote/","editorial_description":{"extended_description":"Browse available OS images and create, update, or delete supported storage and security rules.","schema_version":1,"summary":"ConoHa VPS operates your ConoHa virtual servers through Japanese-language chat.\nCreate, resize, start, stop, or delete servers and manage volumes or console access.\nManage SSH keys and security groups, with Japanese tool descriptions and errors."},"homepage_url":"","icon":"","id":"9dbcf509-31d0-4398-af95-ccaa9eefaede","installs":0,"last_scanned":"","license":"","long_description":"Browse available OS images and create, update, or delete supported storage and security rules.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"Generic HTTP-style tools accept runtime resource/action parameters.","reasoning":"They hide the complete infrastructure action surface.","risk_type":"generic_gateway","severity":"high","title":"Executes generic ConoHa GET/POST/PUT/delete operations","triggering_tools_or_skills":["conoha_delete_by_param","conoha_get_by_param","conoha_post","conoha_post_put_by_param"]},{"evidence":"The description explicitly includes server, volume, SSH-key and security-group operations.","reasoning":"These actions change live cloud infrastructure.","risk_type":"deployment_infrastructure","severity":"high","title":"Creates, starts, stops and resizes servers/volumes/network rules","triggering_tools_or_skills":["conoha_post","conoha_post_put_by_param"]},{"evidence":"The generic delete tool covers infrastructure resources described in the listing.","reasoning":"Deletion may irreversibly destroy servers/data/access configuration.","risk_type":"data_deletion","severity":"high","title":"Deletes servers, volumes, keys and security rules","triggering_tools_or_skills":["conoha_delete_by_param"]},{"evidence":"The tool name exposes URL fetching without a documented allowlist.","reasoning":"Caller-controlled outbound access can reach unintended endpoints.","risk_type":"arbitrary_network_access","severity":"high","title":"Fetches caller-selected URLs","triggering_tools_or_skills":["fetch_url"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication grants access to the user’s ConoHa VPS account and infrastructure.","blocked_missing_evidence":null,"confidence":"low","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/9dbcf509-31d0-4398-af95-ccaa9eefaede.json","what_it_proves":"Candidate PR #125 record identity (name \"ConoHa VPS\", publisher, type web_connector) and 7 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/9dbcf509-31d0-4398-af95-ccaa9eefaede: complete tool_names inventory (7 tools), remote streamable-http endpoint https://api.conoha.jp/vps/claude, auth_posture auth_required, directory tier community"}],"primary_reason":"ConoHa exposes generic destructive cloud-infrastructure and URL-fetch operations.","provisional_risk":null,"publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:9dbcf509-31d0-4398-af95-ccaa9eefaede","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all seven wrapper tools; exact runtime resource/action schemas are missing.","risk_domains":{"arbitrary_network_access":"true","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"true","deletes_data":"true","deployment_or_infrastructure":"true","dynamic_hidden_actions":"true","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"true","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":7,"tools_or_skills_total":7},"name":"ConoHa VPS","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=9dbcf509-31d0-4398-af95-ccaa9eefaede&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://internet.gmo/terms/privacy/","provisional_risk":null,"publication_recommendation":"fix","publisher":"ConoHa byGMO","publisher_url":"https://vps.conoha.jp/","remote_url":"https://api.conoha.jp/vps/claude","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"Deletes servers, storage volumes, SSH key pairs, security groups and network rules in your ConoHa account.","evidence":"Actions: conoha_delete_by_param. https://doc.conoha.jp/reference/mcp-server/remote-mcp/conoha-vps-mcp-server-remote/ — 対応機能 table: サーバー 削除, SSH キーペア 削除, ボリューム 削除, セキュリティグループ...削除; https://github.com/gmo-internet/conoha_vps_mcp/blob/4d2d96a7a5f2d0fc6c9368c1a00a1023e10431c1/docs/tool.md — conoha_delete_by_param section","risk_type":"deletes_data","severity":"high","title":"Deletes servers and infrastructure resources"},{"description":"Creates or resizes servers and volumes, performs power operations, and changes security groups or network ports.","evidence":"Actions: conoha_post, conoha_post_put_by_param. https://doc.conoha.jp/reference/mcp-server/remote-mcp/conoha-vps-mcp-server-remote/ — メモ: 'VPS の作成等の操作により通常の ConoHa VPS 料金が発生します'; https://github.com/gmo-internet/conoha_vps_mcp/blob/4d2d96a7a5f2d0fc6c9368c1a00a1023e10431c1/docs/tool.md — conoha_post / conoha_post_put_by_param sections","risk_type":"code_deployment","severity":"high","title":"Changes live servers and network exposure"},{"description":"Creating or resizing VPS servers and volumes can incur normal ConoHa charges.","evidence":"Actions: conoha_post, conoha_post_put_by_param. https://doc.conoha.jp/reference/mcp-server/remote-mcp/conoha-vps-mcp-server-remote/ — メモ: 'VPS の作成等の操作により通常の ConoHa VPS 料金が発生します'; https://github.com/gmo-internet/conoha_vps_mcp/blob/4d2d96a7a5f2d0fc6c9368c1a00a1023e10431c1/docs/tool.md — conoha_post / conoha_post_put_by_param sections","risk_type":"spends_money","severity":"high","title":"Creates billable cloud resources"},{"description":"Retrieves server inventory, IP addresses and usage information from your account.","evidence":"Actions: conoha_get, conoha_get_by_param. https://github.com/gmo-internet/conoha_vps_mcp/blob/4d2d96a7a5f2d0fc6c9368c1a00a1023e10431c1/docs/tool.md — conoha_get / conoha_get_by_param sections","risk_type":"reads_private_data","severity":"medium","title":"Reads private infrastructure information"},{"description":"Retrieves text from supplied URLs, including startup-script content.","evidence":"Actions: fetch_url, encode_base64. https://github.com/gmo-internet/conoha_vps_mcp/blob/4d2d96a7a5f2d0fc6c9368c1a00a1023e10431c1/docs/tool.md — fetch_url: 'URLからテキストコンテンツを取得 - スタートアップスクリプトの取得などに利用'","risk_type":"reads_public_data","severity":"low","title":"Fetches content from supplied URLs"}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://help.conoha.jp/contact/","tags":["deletes_data","code_deployment","spends_money","reads_private_data","reads_public_data"],"tools":[{"description":"","name":"conoha_delete_by_param","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion may irreversibly destroy servers/data/access configuration."}},{"description":"","name":"conoha_get"},{"description":"","name":"conoha_get_by_param","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: They hide the complete infrastructure action surface."}},{"description":"","name":"conoha_post","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: These actions change live cloud infrastructure."}},{"description":"","name":"conoha_post_put_by_param","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: These actions change live cloud infrastructure."}},{"description":"","name":"encode_base64"},{"description":"","name":"fetch_url"}],"tools_count":7,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/9dbcf509-31d0-4398-af95-ccaa9eefaede","uuid":"84a7850d-1605-55c6-aa73-c26f9c651771","verification_tier":"community","version":""},"query_key":"conoha vps","schema_version":1,"status":"match"}