{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-03","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Explore customer health, churn risk and revenue trends in Customerscore. Inspect account histories, renewals and lost revenue, then create segments or alerts. The connector cannot edit or delete existing customer data.","did":"01879ce1-1067-43d1-8bac-a33f523ddfeb","documentation_url":"https://docs.customerscore.io/mcp/claude/","editorial_description":{"extended_description":"Customer searches can use names, emails, owners, tags, risk levels and custom properties. Reports include health distributions, churn breakdowns and revenue trends by health status. The only described write actions add segments and Smart Alerts. Sign in with Customerscore; the connector uses the access of the account holder who authorizes it.","schema_version":1,"summary":"Explore customer health, churn risk and revenue trends in Customerscore.\nInspect account histories, renewals and lost revenue, then create segments or alerts.\nThe connector cannot edit or delete existing customer data."},"homepage_url":"","icon":"","id":"01879ce1-1067-43d1-8bac-a33f523ddfeb","installs":0,"last_scanned":"","license":"","long_description":"Customer searches can use names, emails, owners, tags, risk levels and custom properties. Reports include health distributions, churn breakdowns and revenue trends by health status. The only described write actions add segments and Smart Alerts. Sign in with Customerscore; the connector uses the access of the account holder who authorizes it.","manual_assessment":"medium","manual_review":{"all_findings":[{"evidence":"Docs: create_segment and create_alert are the only write tools and are additive.","reasoning":"Persistent configuration changes; nothing edited or deleted.","risk_type":"data_modification","severity":"medium","title":"Creates segments and smart alerts in the account","triggering_tools_or_skills":["create_segment","create_alert"]},{"evidence":"Smart Alerts guide: alerts notify recipients via email (including any typed address) and/or Slack.","reasoning":"If create_alert accepts recipient addresses, it creates a standing rule that sends customer data outward; whether the tool exposes recipients is unverified, so not rated High.","risk_type":"messaging_as_user","severity":"medium","title":"Created alerts may email or Slack recipients when they fire","triggering_tools_or_skills":["create_alert"]},{"evidence":"Tool names and description.","reasoning":"Customer revenue and contact data; notes are user-generated text.","risk_type":"private_data_read","severity":"low","title":"Reads customer health, MRR, churn and notes","triggering_tools_or_skills":["list_customers","get_customer_detail","get_customer_notes","get_customer_ai_summary","get_churn_analytics","get_lost_mrr","get_mrr_trend_by_health","get_scoring_history","get_statistics_overview","get_insights","get_customer_main_stats","get_property_values","list_properties","list_segments","list_tags","list_alerts"]},{"evidence":"Directory remote.url is api.customerscore.io/api/mcp; no pinned source or version is available for the server.","reasoning":"Tool behaviour can change server-side after review; ratings rest on the 2026-09-22 snapshot.","risk_type":"provenance_uncertainty","severity":"low","title":"Closed hosted MCP server for Customerscore can change without notice","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"OAuth 2.1 with PKCE; short-lived tokens scoped to one Customerscore account; acts with the approving user's permissions; scope names not documented.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"medium","evidence_completeness":"partial","manual_overall_risk":"medium","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/01879ce1-1067-43d1-8bac-a33f523ddfeb.json","what_it_proves":"Candidate PR #125 record identity (name \"Customerscore\", publisher, type web_connector) and 18 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/01879ce1-1067-43d1-8bac-a33f523ddfeb: complete tool_names inventory (18 tools), remote streamable-http endpoint https://api.customerscore.io/api/mcp, auth_posture auth_required, directory tier community"},{"accessed_at":"2026-10-10T20:27:55Z","url_or_path":"https://docs.customerscore.io/mcp/claude/","what_it_proves":"Claude setup page: OAuth 2.1 + PKCE, short-lived tokens scoped to a single account, Claude acts with the approving user's access."},{"accessed_at":"2026-10-10T20:28:05Z","url_or_path":"https://docs.customerscore.io/mcp/","what_it_proves":"MCP overview lists tools by category; only create_segment and create_alert write, additive only; example create_alert prompt asks for an email when churn risk >= 4; also lists contact tools not in the Directory inventory."},{"accessed_at":"2026-10-10T20:28:08Z","url_or_path":"https://docs.customerscore.io/guides/smart-alerts/","what_it_proves":"Smart Alerts notify recipients by email (teammates or any typed address) and/or Slack when they fire."}],"primary_reason":"Two additive write tools create segments and smart alerts; no edit, delete or direct send tool is declared.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:01879ce1-1067-43d1-8bac-a33f523ddfeb","reviewed_at":"2026-10-10","reviewer_notes":"Identity consistent (customerscore.io). Reviewed all 18 tool names. Ambiguous for High: create_alert -- verify via tool schema whether recipients (email addresses/Slack) can be set; if so, it is a standing outbound-notification rule and should be rated high. Docs also list list_contacts/get_contact_detail/get_contact_main_stats not in the Directory snapshot (read-only drift).","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"unknown","spends_or_moves_money":"false"},"tools_or_skills_reviewed":18,"tools_or_skills_total":18},"name":"Customerscore","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=01879ce1-1067-43d1-8bac-a33f523ddfeb&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://customerscore.io/privacy-policy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Customerscore.io","publisher_url":"https://customerscore.io/","remote_url":"https://api.customerscore.io/api/mcp","repository_url":"","risk":"medium","risk_severity":"medium","security_risks":[{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Persistent configuration changes; nothing edited or deleted.","evidence":"Creates segments and smart alerts in the account: Docs: create_segment and create_alert are the only write tools and are additive.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Creates segments and smart alerts in the account","triggering_tools":["create_segment","create_alert"]},{"description":"This connector can publish or send messages and content using the connected identity. Review findings: If create_alert accepts recipient addresses, it creates a standing rule that sends customer data outward; whether the tool exposes recipients is unverified, so not rated High.","evidence":"Created alerts may email or Slack recipients when they fire: Smart Alerts guide: alerts notify recipients via email (including any typed address) and/or Slack.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"medium","title":"Created alerts may email or Slack recipients when they fire","triggering_tools":["create_alert"]},{"description":"This connector can read information available to the connected account and return it to the AI. Review findings: Customer revenue and contact data; notes are user-generated text.","evidence":"Reads customer health, MRR, churn and notes: Tool names and description.","manual_risk_type":"private_data_read","remediation":{"block_tool_categories":["data_exfiltration"],"steps":["Use a least-privilege account limited to the information required by the workflow.","Restrict folders, projects, tenants, and other data scopes wherever the provider allows it.","Review access logs for unexpected reads or bulk retrieval."]},"risk_type":"reads_private_data","severity":"low","title":"Reads customer health, MRR, churn and notes","triggering_tools":["list_customers","get_customer_detail","get_customer_notes","get_customer_ai_summary","get_churn_analytics","get_lost_mrr","get_mrr_trend_by_health","get_scoring_history","get_statistics_overview","get_insights","get_customer_main_stats","get_property_values","list_properties","list_segments","list_tags","list_alerts"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@customerscore.io","tags":["modifies_data","network_access","oauth_required","reads_private_data","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"create_alert","risk":{"category":"sends_externally","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: If create_alert accepts recipient addresses, it creates a standing rule that sends customer data outward; whether the tool exposes recipients is unverified, so not rated High."}},{"description":"","name":"create_segment","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Persistent configuration changes; nothing edited or deleted."}},{"description":"","name":"get_churn_analytics"},{"description":"","name":"get_customer_ai_summary"},{"description":"","name":"get_customer_detail"},{"description":"","name":"get_customer_main_stats"},{"description":"","name":"get_customer_notes"},{"description":"","name":"get_insights"},{"description":"","name":"get_lost_mrr"},{"description":"","name":"get_mrr_trend_by_health"},{"description":"","name":"get_property_values"},{"description":"","name":"get_scoring_history"},{"description":"","name":"get_statistics_overview"},{"description":"","name":"list_alerts"},{"description":"","name":"list_customers"},{"description":"","name":"list_properties"},{"description":"","name":"list_segments"},{"description":"","name":"list_tags"}],"tools_count":18,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/01879ce1-1067-43d1-8bac-a33f523ddfeb","uuid":"16ea1cc9-4520-54b0-9d44-7d2d2d261a1c","verification_tier":"community","version":""},"query_key":"customerscore io customerscore","schema_version":1,"status":"match"}