{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-14","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Kasvu reviews training, recovery, sessions, and your active program. Save coaching notes or propose programs, daily changes, progress measures, and watchlists. Proposals remain pending until you accept in the iPhone app; Pro connector access is required.","did":"9fefab4d-13c4-412e-a8d1-0c384d542cff","documentation_url":"https://kasvu.fit/connect","editorial_description":{"extended_description":"The connector cannot activate plans or log completed workouts. Preview training weeks and use Kasvu's planning-engine prescriptions; Claude plan requirements apply separately. Kasvu provides training information, not medical diagnosis or treatment.","schema_version":1,"summary":"Kasvu reviews training, recovery, sessions, and your active program.\nSave coaching notes or propose programs, daily changes, progress measures, and watchlists.\nProposals remain pending until you accept in the iPhone app; Pro connector access is required."},"homepage_url":"","icon":"https://kasvu.fit/kasvu-icon.png","id":"9fefab4d-13c4-412e-a8d1-0c384d542cff","installs":0,"last_scanned":"","license":"","long_description":"The connector cannot activate plans or log completed workouts. Preview training weeks and use Kasvu's planning-engine prescriptions; Claude plan requirements apply separately. Kasvu provides training information, not medical diagnosis or treatment.","manual_assessment":"medium","manual_review":{"all_findings":[{"evidence":"These tools persist private coaching content awaiting user acceptance.","reasoning":"They cannot activate plans or log completed workouts.","risk_type":"data_modification","severity":"medium","title":"Saves coaching notes and pending plan proposals","triggering_tools_or_skills":["post_note","propose_day","propose_program","propose_watchlist","propose_progress_measures"]},{"evidence":"The tools expose sensitive athlete data.","reasoning":"They are account-scoped retrieval.","risk_type":"private_data_read","severity":"low","title":"Reads private health/training/recovery records","triggering_tools_or_skills":["get_recovery","get_sessions","get_strain","get_program"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication scopes private athlete data; proposals require acceptance in the iPhone app.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"medium","evidence_completeness":"partial","manual_overall_risk":"medium","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/9fefab4d-13c4-412e-a8d1-0c384d542cff.json","what_it_proves":"Candidate PR #125 record identity (name \"Kasvu\", publisher, type web_connector) and 17 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/9fefab4d-13c4-412e-a8d1-0c384d542cff: complete tool_names inventory (17 tools), remote streamable-http endpoint https://mcp.kasvu.fit/mcp, auth_posture auth_required, publisher-declared permissions text, declared sensitive data types, directory tier community"}],"primary_reason":"Kasvu persists coaching notes and pending proposals but cannot activate them.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:9fefab4d-13c4-412e-a8d1-0c384d542cff","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 17 tools.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":17,"tools_or_skills_total":17},"name":"Kasvu","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=9fefab4d-13c4-412e-a8d1-0c384d542cff&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://kasvu.fit/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Create Business Solutions, LLC","publisher_url":"https://kasvu.fit/","remote_url":"https://mcp.kasvu.fit/mcp","repository_url":"","risk":"medium","risk_severity":"medium","security_risks":[{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They cannot activate plans or log completed workouts.","evidence":"Saves coaching notes and pending plan proposals: These tools persist private coaching content awaiting user acceptance.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Saves coaching notes and pending plan proposals","triggering_tools":["post_note","propose_day","propose_program","propose_watchlist","propose_progress_measures"]},{"description":"This connector can read information available to the connected account and return it to the AI. Review findings: They are account-scoped retrieval.","evidence":"Reads private health/training/recovery records: The tools expose sensitive athlete data.","manual_risk_type":"private_data_read","remediation":{"block_tool_categories":["data_exfiltration"],"steps":["Use a least-privilege account limited to the information required by the workflow.","Restrict folders, projects, tenants, and other data scopes wherever the provider allows it.","Review access logs for unexpected reads or bulk retrieval."]},"risk_type":"reads_private_data","severity":"low","title":"Reads private health/training/recovery records","triggering_tools":["get_recovery","get_sessions","get_strain","get_program"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"nicknowlin@createbusinesssolutions.com","tags":["modifies_data","network_access","oauth_required","reads_private_data","web_connector"],"tools":[{"description":"","name":"answer_question"},{"description":"","name":"get_bests"},{"description":"","name":"get_coaching_context"},{"description":"","name":"get_lift_log"},{"description":"","name":"get_morning_status"},{"description":"","name":"get_open_questions"},{"description":"","name":"get_program"},{"description":"","name":"get_recovery"},{"description":"","name":"get_sessions"},{"description":"","name":"get_strain"},{"description":"","name":"post_note","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They cannot activate plans or log completed workouts."}},{"description":"","name":"propose_day","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They cannot activate plans or log completed workouts."}},{"description":"","name":"propose_program","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They cannot activate plans or log completed workouts."}},{"description":"","name":"propose_watchlist","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They cannot activate plans or log completed workouts."}},{"description":"","name":"get_program_format"},{"description":"","name":"preview_training_week"},{"description":"","name":"propose_progress_measures","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They cannot activate plans or log completed workouts."}}],"tools_count":17,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/9fefab4d-13c4-412e-a8d1-0c384d542cff","uuid":"d405d970-f774-581b-8646-c862257f1d64","verification_tier":"community","version":""},"query_key":"create business solutions llc kasvu","schema_version":1,"status":"match"}