{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-02","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Bring Cora's customer context into Claude across connected business systems. Prepare account briefs, investigate risk, update CRM records and send messages. Build scheduled agents for recurring customer work.","did":"07ef40e3-7ac1-4764-8d25-7de44815f241","documentation_url":"https://help.cora.ai/en","editorial_description":{"extended_description":"Cora's Account Brain keeps customer context across systems and conversations. The connector discovers tools and custom skills and invokes the capabilities available in the connected account. Supported actions can send email or Slack messages, so the integration is not limited to analysis.","schema_version":1,"summary":"Bring Cora's customer context into Claude across connected business systems.\nPrepare account briefs, investigate risk, update CRM records and send messages.\nBuild scheduled agents for recurring customer work."},"homepage_url":"","icon":"","id":"07ef40e3-7ac1-4764-8d25-7de44815f241","installs":0,"last_scanned":"","license":"","long_description":"Cora's Account Brain keeps customer context across systems and conversations. The connector discovers tools and custom skills and invokes the capabilities available in the connected account. Supported actions can send email or Slack messages, so the integration is not limited to analysis.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The Directory description says the hidden action surface can update CRM, send email and Slack, assign tasks, and build scheduled agents.","reasoning":"The visible six-tool inventory is a dispatcher whose runtime-discovered operations include high-impact external communication.","risk_type":"generic_gateway","severity":"high","title":"call_tool and skills hide high-impact actions","triggering_tools_or_skills":["activate_skill","call_tool","load_custom_skill","search_tools"]},{"evidence":"The publisher description explicitly says Cora can send email and Slack from the connected customer-operation environment.","reasoning":"These actions communicate to external recipients under the user's organizational identity.","risk_type":"messaging_as_user","severity":"high","title":"Email and Slack can be sent","triggering_tools_or_skills":["call_tool","activate_skill"]},{"evidence":"The description states Cora updates CRM, assigns tasks, and builds or schedules agents that watch signals and run work.","reasoning":"These operations persistently alter business systems and automation state.","risk_type":"data_modification","severity":"medium","title":"CRM records, tasks, and scheduled agents can change","triggering_tools_or_skills":["call_tool","activate_skill","load_custom_skill"]},{"evidence":"Cora's Account Brain combines CRM, support tickets, product usage, calls, and Slack content.","reasoning":"Customer and collaborator-authored text is untrusted model input.","risk_type":"prompt_injection_exposure","severity":"low","title":"CRM, tickets, calls, and Slack enter context","triggering_tools_or_skills":["call_tool","activate_skill"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication required for Cora customer-operation data and custom skills; effective CRM, email, Slack, task, and automation scopes are hidden behind runtime tool search and skill activation.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/07ef40e3-7ac1-4764-8d25-7de44815f241.json","what_it_proves":"Candidate PR #125 record identity (name \"Cora\", publisher, type web_connector) and 6 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/07ef40e3-7ac1-4764-8d25-7de44815f241: complete tool_names inventory (6 tools), remote streamable-http endpoint https://mcp.cora.ai/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"The generic dispatcher is officially described as able to send email and Slack and modify CRM, tasks, and scheduled agents.","provisional_risk":null,"publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:07ef40e3-7ac1-4764-8d25-7de44815f241","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all six gateway names. Runtime enumeration is mandatory for every call_tool target and custom skill, including delete, spend, admin, network, schedule, and approval behavior.","risk_domains":{"arbitrary_network_access":"unknown","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"unknown","deletes_data":"unknown","deployment_or_infrastructure":"false","dynamic_hidden_actions":"true","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"unknown","sends_messages_as_user":"true","spends_or_moves_money":"unknown"},"tools_or_skills_reviewed":6,"tools_or_skills_total":6},"name":"Cora","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=07ef40e3-7ac1-4764-8d25-7de44815f241&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.cora.ai/privacy-policy","provisional_risk":null,"publication_recommendation":"fix","publisher":"Cora AI, Inc","publisher_url":"https://www.cora.ai/","remote_url":"https://mcp.cora.ai/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: The visible six-tool inventory is a dispatcher whose runtime-discovered operations include high-impact external communication.","evidence":"call_tool and skills hide high-impact actions: The Directory description says the hidden action surface can update CRM, send email and Slack, assign tasks, and build scheduled agents.","manual_risk_type":"generic_gateway","remediation":{"block_tool_categories":["code_execution"],"steps":["Run only in a sandbox with least-privilege credentials and strict resource limits.","Disable generic execution gateways unless their reachable action set is fully understood.","Require approval before execution against production systems or sensitive data."]},"risk_type":"runs_code","severity":"high","title":"call_tool and skills hide high-impact actions","triggering_tools":["activate_skill","call_tool","load_custom_skill","search_tools"]},{"description":"This connector can publish or send messages and content using the connected identity. Review findings: These actions communicate to external recipients under the user's organizational identity.","evidence":"Email and Slack can be sent: The publisher description explicitly says Cora can send email and Slack from the connected customer-operation environment.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Email and Slack can be sent","triggering_tools":["call_tool","activate_skill"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These operations persistently alter business systems and automation state.","evidence":"CRM records, tasks, and scheduled agents can change: The description states Cora updates CRM, assigns tasks, and builds or schedules agents that watch signals and run work.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"CRM records, tasks, and scheduled agents can change","triggering_tools":["call_tool","activate_skill","load_custom_skill"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@cora.ai","tags":["modifies_data","network_access","oauth_required","runs_code","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"activate_skill","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: These actions communicate to external recipients under the user's organizational identity."}},{"description":"","name":"call_tool","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: These actions communicate to external recipients under the user's organizational identity."}},{"description":"","name":"list_custom_skills"},{"description":"","name":"load_custom_skill","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: The visible six-tool inventory is a dispatcher whose runtime-discovered operations include high-impact external communication."}},{"description":"","name":"search_tools","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: The visible six-tool inventory is a dispatcher whose runtime-discovered operations include high-impact external communication."}},{"description":"","name":"whoami"}],"tools_count":6,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/07ef40e3-7ac1-4764-8d25-7de44815f241","uuid":"92786f8d-3f54-5e18-8ca2-d6db331134f3","verification_tier":"community","version":""},"query_key":"cora ai inc cora","schema_version":1,"status":"match"}