{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-06-26","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"no_auth","category":"Web Connector","confidence":"medium","description":"Credits.fm looks up music credits and identifiers without an account. Resolve recordings, works, artists, and rightsholders using IDs such as ISRC, ISWC, IPI, ISNI, and UPC. Use individual or batch lookups to enrich music metadata and match related records.","did":"4a0ad705-4c3b-42af-a9b3-05aa295ee88e","documentation_url":"https://credits.fm/mcp/docs","editorial_description":{"extended_description":"Additional tools resolve music URLs, find publishers for songwriters, report coverage, and accept contributions. Identifier normalization supports matching recordings with compositions and credit information.","schema_version":1,"summary":"Credits.fm looks up music credits and identifiers without an account.\nResolve recordings, works, artists, and rightsholders using IDs such as ISRC, ISWC, IPI, ISNI, and UPC.\nUse individual or batch lookups to enrich music metadata and match related records."},"homepage_url":"","icon":"https://credits.fm/apple-icon.png","id":"4a0ad705-4c3b-42af-a9b3-05aa295ee88e","installs":0,"last_scanned":"","license":"","long_description":"Additional tools resolve music URLs, find publishers for songwriters, report coverage, and accept contributions. Identifier normalization supports matching recordings with compositions and credit information.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The otherwise read-only public identifier surface contains a contribution tool for music credit data.","reasoning":"A contribution publishes or submits an attribution claim that can affect named creators/rightsholders.","risk_type":"messaging_as_user","severity":"high","title":"Contributes public music-credit assertions","triggering_tools_or_skills":["credits_contribute"]}],"assessment_status":"provisional","auth_and_scopes":"The service is unauthenticated; 13 tools read public music identifiers while credits_contribute submits a public-data contribution with no stated identity/moderation controls.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/4a0ad705-4c3b-42af-a9b3-05aa295ee88e.json","what_it_proves":"Candidate PR #125 record identity (name \"Credits.fm\", publisher, type web_connector) and 14 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/4a0ad705-4c3b-42af-a9b3-05aa295ee88e: complete tool_names inventory (14 tools), remote streamable-http endpoint https://credits.fm/mcp, auth_posture no_auth, directory tier community"}],"primary_reason":"Credits.fm permits unauthenticated music-credit contributions without documented moderation or attribution controls.","provisional_risk":null,"publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:4a0ad705-4c3b-42af-a9b3-05aa295ee88e","reviewed_at":"2026-10-10","reviewer_notes":"Document contribution review, rate limiting, provenance and correction/retraction before publication.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"false","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"false","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":14,"tools_or_skills_total":14},"name":"Credits.fm","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=4a0ad705-4c3b-42af-a9b3-05aa295ee88e&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://credits.fm/privacy","provisional_risk":null,"publication_recommendation":"fix","publisher":"Credits.fm","publisher_url":"https://credits.fm/","remote_url":"https://credits.fm/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: A contribution publishes or submits an attribution claim that can affect named creators/rightsholders.","evidence":"Contributes public music-credit assertions: The otherwise read-only public identifier surface contains a contribution tool for music credit data.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Contributes public music-credit assertions","triggering_tools":["credits_contribute"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"credits@notes.fm","tags":["network_access","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"credits_search"},{"description":"","name":"credits_resolve_track"},{"description":"","name":"credits_resolve_url"},{"description":"","name":"credits_lookup_isrc"},{"description":"","name":"credits_lookup_iswc"},{"description":"","name":"credits_lookup_ipi"},{"description":"","name":"credits_lookup_isni"},{"description":"","name":"credits_lookup_upc"},{"description":"","name":"credits_lookup_artist"},{"description":"","name":"credits_lookup_musician"},{"description":"","name":"credits_batch_lookup"},{"description":"","name":"credits_publishers_for_songwriter"},{"description":"","name":"credits_contribute","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: A contribution publishes or submits an attribution claim that can affect named creators/rightsholders."}},{"description":"","name":"credits_coverage"}],"tools_count":14,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/4a0ad705-4c3b-42af-a9b3-05aa295ee88e","uuid":"1a10309b-e253-5b73-9714-6beded19c410","verification_tier":"community","version":""},"query_key":"credits fm","schema_version":1,"status":"match"}