{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-12","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Contour connects project planning and delivery context to Claude. Create and update projects, requirements, tasks, milestones, stakeholders, and living documents. Explore related meeting, email, and Slack context alongside your work.","did":"9535e2a4-e764-43c6-aa92-139e0fe2f45a","documentation_url":"https://handsome-meeting-6c7.notion.site/contour-claude-connector-documentation-f3a7b28402f983788cd08120280fd4a1?source=copy_link","editorial_description":{"extended_description":"Organize work through phases, streams, roles, tags, dependencies, and success criteria. Task controls include completion and approval settings. Read document versions, meeting transcripts, templates, and playbooks, or query relationships across project entities.","schema_version":1,"summary":"Contour connects project planning and delivery context to Claude.\nCreate and update projects, requirements, tasks, milestones, stakeholders, and living documents.\nExplore related meeting, email, and Slack context alongside your work."},"homepage_url":"","icon":"","id":"9535e2a4-e764-43c6-aa92-139e0fe2f45a","installs":0,"last_scanned":"","license":"","long_description":"Organize work through phases, streams, roles, tags, dependencies, and success criteria. Task controls include completion and approval settings. Read document versions, meeting transcripts, templates, and playbooks, or query relationships across project entities.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"These tools define and assign organizational project roles.","reasoning":"They are privileged authorization/responsibility administration.","risk_type":"credential_admin","severity":"high","title":"Creates/updates roles and assigns work-stream roles","triggering_tools_or_skills":["create_role","update_role","set_work_stream_roles"]},{"evidence":"These tools broadly persist shared project state.","reasoning":"They materially alter team workflows.","risk_type":"data_modification","severity":"medium","title":"Creates/updates projects, tasks, requirements and living documents","triggering_tools_or_skills":["create_project","create_task","create_requirement","write_living_document_content"]},{"evidence":"The connector exposes sensitive communication/context.","reasoning":"Reads are scoped but broad.","risk_type":"private_data_read","severity":"low","title":"Reads private email, Slack, meetings and documents","triggering_tools_or_skills":["get_email","search_emails","search_slack_history","get_meeting_transcript"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication is required; project, document, email, Slack and role visibility follows Contour organization permissions.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/9535e2a4-e764-43c6-aa92-139e0fe2f45a.json","what_it_proves":"Candidate PR #125 record identity (name \"Contour\", publisher, type web_connector) and 80 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/9535e2a4-e764-43c6-aa92-139e0fe2f45a: complete tool_names inventory (80 tools), remote streamable-http endpoint https://api.contour-prod-api.prod.i.usecontour.ai/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Contour administers project roles and broadly writes shared project/doc state.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:9535e2a4-e764-43c6-aa92-139e0fe2f45a","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 80 tools. set_task_approval/completion are Medium workflow transitions; no deletion or external send tool appears.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"true","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":80,"tools_or_skills_total":80},"name":"Contour","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=9535e2a4-e764-43c6-aa92-139e0fe2f45a&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://usecontour.ai/privacy-policy/","provisional_risk":null,"publication_recommendation":"accept","publisher":"Contour AI","publisher_url":"https://usecontour.ai/","remote_url":"https://api.contour-prod-api.prod.i.usecontour.ai/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They are privileged authorization/responsibility administration.; They materially alter team workflows.","evidence":"Creates/updates roles and assigns work-stream roles: These tools define and assign organizational project roles. | Creates/updates projects, tasks, requirements and living documents: These tools broadly persist shared project state.","manual_risk_type":"credential_admin,data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"high","title":"Can change connected resources","triggering_tools":["create_role","update_role","set_work_stream_roles","create_project","create_task","create_requirement","write_living_document_content"]},{"description":"This connector can read information available to the connected account and return it to the AI. Review findings: Reads are scoped but broad.","evidence":"Reads private email, Slack, meetings and documents: The connector exposes sensitive communication/context.","manual_risk_type":"private_data_read","remediation":{"block_tool_categories":["data_exfiltration"],"steps":["Use a least-privilege account limited to the information required by the workflow.","Restrict folders, projects, tenants, and other data scopes wherever the provider allows it.","Review access logs for unexpected reads or bulk retrieval."]},"risk_type":"reads_private_data","severity":"low","title":"Reads private email, Slack, meetings and documents","triggering_tools":["get_email","search_emails","search_slack_history","get_meeting_transcript"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"customers@usecontour.ai","tags":["accesses_calendar","modifies_data","network_access","oauth_required","reads_private_data","web_connector"],"tools":[{"description":"","name":"create_entity"},{"description":"","name":"create_living_document"},{"description":"","name":"create_milestone"},{"description":"","name":"create_project","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They are privileged authorization/responsibility administration.; They materially alter team workflows."}},{"description":"","name":"create_requirement","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They are privileged authorization/responsibility administration.; They materially alter team workflows."}},{"description":"","name":"create_role","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They are privileged authorization/responsibility administration.; They materially alter team workflows."}},{"description":"","name":"create_stakeholder"},{"description":"","name":"create_success_criterion"},{"description":"","name":"create_tag"},{"description":"","name":"create_task","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They are privileged authorization/responsibility administration.; They materially alter team workflows."}},{"description":"","name":"create_task_dependency"},{"description":"","name":"create_work_phase"},{"description":"","name":"create_work_stream"},{"description":"","name":"find_organization_members"},{"description":"","name":"get_current_user"},{"description":"","name":"get_document_content"},{"description":"","name":"get_email"},{"description":"","name":"get_email_thread"},{"description":"","name":"get_entity"},{"description":"","name":"get_living_document"},{"description":"","name":"get_meeting"},{"description":"","name":"get_meeting_transcript"},{"description":"","name":"get_milestone"},{"description":"","name":"get_organization_settings"},{"description":"","name":"get_playbook"},{"description":"","name":"get_project"},{"description":"","name":"get_requirement"},{"description":"","name":"get_role"},{"description":"","name":"get_stakeholder"},{"description":"","name":"get_success_criterion"},{"description":"","name":"get_task"},{"description":"","name":"get_template"},{"description":"","name":"get_work_phase"},{"description":"","name":"get_work_stream"},{"description":"","name":"list_document_versions"},{"description":"","name":"list_documents"},{"description":"","name":"list_email_mailboxes"},{"description":"","name":"list_entities"},{"description":"","name":"list_entity_fields"},{"description":"","name":"list_entity_types"},{"description":"","name":"list_living_documents"},{"description":"","name":"list_meetings"},{"description":"","name":"list_milestones"},{"description":"","name":"list_playbooks"},{"description":"","name":"list_project_members"},{"description":"","name":"list_projects"},{"description":"","name":"list_requirements"},{"description":"","name":"list_roles"},{"description":"","name":"list_slack_channels"},{"description":"","name":"list_stakeholder_fields"},{"description":"","name":"list_stakeholders"},{"description":"","name":"list_success_criteria"},{"description":"","name":"list_tags"},{"description":"","name":"list_tasks"},{"description":"","name":"list_templates"},{"description":"","name":"list_work_phases"},{"description":"","name":"list_work_streams"},{"description":"","name":"query_graph"},{"description":"","name":"search_email_threads"},{"description":"","name":"search_emails"},{"description":"","name":"search_slack_history"},{"description":"","name":"set_milestone_work_phase"},{"description":"","name":"set_milestone_work_stream"},{"description":"","name":"set_task_approval"},{"description":"","name":"set_task_completion"},{"description":"","name":"set_task_milestone"},{"description":"","name":"set_task_tags"},{"description":"","name":"set_work_stream_roles","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They are privileged authorization/responsibility administration.; They materially alter team workflows."}},{"description":"","name":"update_entity"},{"description":"","name":"update_milestone"},{"description":"","name":"update_project"},{"description":"","name":"update_requirement"},{"description":"","name":"update_role","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They are privileged authorization/responsibility administration.; They materially alter team workflows."}},{"description":"","name":"update_stakeholder"},{"description":"","name":"update_success_criterion"},{"description":"","name":"update_tag"},{"description":"","name":"update_task"},{"description":"","name":"update_work_phase"},{"description":"","name":"update_work_stream"},{"description":"","name":"write_living_document_content","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They are privileged authorization/responsibility administration.; They materially alter team workflows."}}],"tools_count":80,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/9535e2a4-e764-43c6-aa92-139e0fe2f45a","uuid":"b13df627-78a4-5e97-8c49-42fd9b2e266c","verification_tier":"community","version":""},"query_key":"contour","schema_version":1,"status":"match"}