{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-13","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Interactive Connector","confidence":"medium","description":"Create presentations and documents with EM+x and your own templates. Approve a storyline, generate PowerPoint or Word outputs and inspect previews. Refine deliverables and compare project versions.","did":"0c530e28-a2e2-4c41-9d8c-362096109531","documentation_url":"https://emplusx.com/mcp","editorial_description":{"extended_description":"The connector manages project briefs, generation jobs, refinements, downloads and template uploads. Template styles can be cloned, and an interactive panel shows pages, versions and projects. Generation follows storyline approval according to the source; an account is required.","schema_version":1,"summary":"Create presentations and documents with EM+x and your own templates.\nApprove a storyline, generate PowerPoint or Word outputs and inspect previews.\nRefine deliverables and compare project versions."},"homepage_url":"","icon":"https://emplusx.com/logo-1024.png","id":"0c530e28-a2e2-4c41-9d8c-362096109531","installs":0,"last_scanned":"","license":"","long_description":"The connector manages project briefs, generation jobs, refinements, downloads and template uploads. Template styles can be cloned, and an interactive panel shows pages, versions and projects. Generation follows storyline approval according to the source; an account is required.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The tool inventory includes a confirmation-and-generation action and iterative refinement of generated deliverables on publisher infrastructure.","reasoning":"The actions execute generative production workflows whose cost and processing scope are not documented in the packet.","risk_type":"query_execution","severity":"high","title":"Generation jobs execute after confirmation","triggering_tools_or_skills":["confirm_and_generate","refine_deliverable"]},{"evidence":"Explicit tools create, approve, clone, refine, and update persistent project content.","reasoning":"They alter shared deliverable state.","risk_type":"data_modification","severity":"medium","title":"Deliverables, styles, and briefs can change","triggering_tools_or_skills":["approve_deliverable","clone_style","create_deliverable","refine_deliverable","update_brief"]},{"evidence":"The inventory returns upload and download links for template inputs and generated outputs.","reasoning":"Files cross the client-service boundary, though no arbitrary local path is exposed.","risk_type":"file_write","severity":"low","title":"Templates upload and deliverables download as files","triggering_tools_or_skills":["get_template_upload_link","get_download_link"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication to EM+x projects, templates, versions, generation jobs, deliverables, downloads, and billing links; exact generation quota and approval scopes are not documented here.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/0c530e28-a2e2-4c41-9d8c-362096109531.json","what_it_proves":"Candidate PR #125 record identity (name \"EM+x\", publisher, type interactive_connector) and 19 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/0c530e28-a2e2-4c41-9d8c-362096109531: complete tool_names inventory (19 tools), remote streamable-http endpoint https://emplusx.com/api/mcp, auth_posture auth_required, publisher-declared permissions text, directory tier community"}],"primary_reason":"Confirmed generation executes an external production workflow, but its credit or billing effect and processing limits are undocumented.","provisional_risk":null,"publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:0c530e28-a2e2-4c41-9d8c-362096109531","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 19 names. Official docs lookup was uninformative; runtime checks must determine generation pricing, approval semantics, upload limits, model-provider forwarding, and output retention.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"true","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"true","sends_messages_as_user":"false","spends_or_moves_money":"unknown"},"tools_or_skills_reviewed":19,"tools_or_skills_total":19},"name":"EM+x","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=0c530e28-a2e2-4c41-9d8c-362096109531&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://emplusx.com/privacy","provisional_risk":null,"publication_recommendation":"fix","publisher":"Cubed Studios","publisher_url":"https://cubed-ventures.com/","remote_url":"https://emplusx.com/api/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: The actions execute generative production workflows whose cost and processing scope are not documented in the packet.","evidence":"Generation jobs execute after confirmation: The tool inventory includes a confirmation-and-generation action and iterative refinement of generated deliverables on publisher infrastructure.","manual_risk_type":"query_execution","remediation":{"block_tool_categories":["code_execution"],"steps":["Run only in a sandbox with least-privilege credentials and strict resource limits.","Disable generic execution gateways unless their reachable action set is fully understood.","Require approval before execution against production systems or sensitive data."]},"risk_type":"runs_code","severity":"high","title":"Generation jobs execute after confirmation","triggering_tools":["confirm_and_generate","refine_deliverable"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They alter shared deliverable state.","evidence":"Deliverables, styles, and briefs can change: Explicit tools create, approve, clone, refine, and update persistent project content.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Deliverables, styles, and briefs can change","triggering_tools":["approve_deliverable","clone_style","create_deliverable","refine_deliverable","update_brief"]},{"description":"This connector can create, change, export, or otherwise write files. Review findings: Files cross the client-service boundary, though no arbitrary local path is exposed.","evidence":"Templates upload and deliverables download as files: The inventory returns upload and download links for template inputs and generated outputs.","manual_risk_type":"file_write","remediation":{"block_tool_categories":["state_change"],"steps":["Limit file access to a dedicated working directory.","Review generated or modified files before they are shared or executed."]},"risk_type":"filesystem_access","severity":"low","title":"Templates upload and deliverables download as files","triggering_tools":["get_template_upload_link","get_download_link"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"hello@emplusx.com","tags":["filesystem_access","interactive_connector","modifies_data","network_access","oauth_required","runs_code"],"tools":[{"description":"","name":"approve_deliverable","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They alter shared deliverable state."}},{"description":"","name":"clone_style","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They alter shared deliverable state."}},{"description":"","name":"confirm_and_generate","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: The actions execute generative production workflows whose cost and processing scope are not documented in the packet."}},{"description":"","name":"create_deliverable","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They alter shared deliverable state."}},{"description":"","name":"get_billing_portal_link"},{"description":"","name":"get_download_link"},{"description":"","name":"get_job_status"},{"description":"","name":"get_template_upload_link"},{"description":"","name":"get_upgrade_link"},{"description":"","name":"list_projects"},{"description":"","name":"list_templates"},{"description":"","name":"list_versions"},{"description":"","name":"refine_deliverable","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: The actions execute generative production workflows whose cost and processing scope are not documented in the packet."}},{"description":"","name":"show_deliverable_panel"},{"description":"","name":"show_hello_panel"},{"description":"","name":"show_portfolio_panel"},{"description":"","name":"show_template_panel"},{"description":"","name":"update_brief","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They alter shared deliverable state."}},{"description":"","name":"whoami"}],"tools_count":19,"transport":"streamable-http","type":"interactive_connector","url":"https://claude.ai/directory/0c530e28-a2e2-4c41-9d8c-362096109531","uuid":"d90fc970-bf85-5049-9281-f78e2542d194","verification_tier":"community","version":""},"query_key":"cubed studios em x","schema_version":1,"status":"match"}