{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-09","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Dalea connects Claude to a BioPharma research workspace. Search and author lab documents, query data, record measurements, and manage samples, reagents, and containers. OAuth access is scoped by user and workspace, with separate annotated read and write operations.","did":"504a0fb3-25c7-4110-90f8-d752adda4c65","documentation_url":"https://dalea.wiki/ai/connect-claude-web","editorial_description":{"extended_description":"Documents can contain tables, charts, plates, and executable analysis blocks. The connector also designs data environments, imports and exports structured spreadsheets, manages document versions, and builds in-platform addon web apps. Destructive and schema-committing actions are flagged.","schema_version":1,"summary":"Dalea connects Claude to a BioPharma research workspace.\nSearch and author lab documents, query data, record measurements, and manage samples, reagents, and containers.\nOAuth access is scoped by user and workspace, with separate annotated read and write operations."},"homepage_url":"","icon":"","id":"504a0fb3-25c7-4110-90f8-d752adda4c65","installs":0,"last_scanned":"","license":"","long_description":"Documents can contain tables, charts, plates, and executable analysis blocks. The connector also designs data environments, imports and exports structured spreadsheets, manages document versions, and builds in-platform addon web apps. Destructive and schema-committing actions are flagged.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"dalea_bash unambiguously exposes shell execution.","reasoning":"Arbitrary shell execution is High.","risk_type":"code_execution","severity":"high","title":"Executes Dalea shell commands","triggering_tools_or_skills":["dalea_bash"]},{"evidence":"Many declared write tools persist scientific workspace state.","reasoning":"Meaningful workspace mutations are Medium.","risk_type":"data_modification","severity":"medium","title":"Writes lab documents, data, inventory, and projects","triggering_tools_or_skills":["document_markdown_write","data_objects_write","inventory_items_write","manage_projects_write"]},{"evidence":"Tools write/import/export workspace files or data artifacts.","reasoning":"File/data writes are Medium.","risk_type":"file_write","severity":"medium","title":"Imports and exports structured data","triggering_tools_or_skills":["import_data_write","export_data"]},{"evidence":"The remote hosted implementation is not pinned.","reasoning":"Runtime capabilities may change after review.","risk_type":"provenance_uncertainty","severity":"low","title":"Hosted implementation is mutable","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"OAuth/account authorization required; exact scopes are not documented.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/504a0fb3-25c7-4110-90f8-d752adda4c65.json","what_it_proves":"Candidate PR #125 record identity (name \"Dalea - Research Orchestration Platform\", publisher, type web_connector) and 37 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/504a0fb3-25c7-4110-90f8-d752adda4c65: complete tool_names inventory (37 tools), remote streamable-http endpoint https://dalea.app/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Dalea can execute shell commands and broadly write laboratory data, code, documents, and inventory.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:504a0fb3-25c7-4110-90f8-d752adda4c65","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 37 names; directory description confirms executable analysis blocks and addon webapps.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"true","dynamic_hidden_actions":"false","filesystem_or_repo_access":"true","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"true","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":37,"tools_or_skills_total":37},"name":"Dalea - Research Orchestration Platform","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=504a0fb3-25c7-4110-90f8-d752adda4c65&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://dalea.app/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Dalea ApS","publisher_url":"https://dalea.tech/","remote_url":"https://dalea.app/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Arbitrary shell execution is High.","evidence":"Executes Dalea shell commands: dalea_bash unambiguously exposes shell execution.","manual_risk_type":"code_execution","remediation":{"block_tool_categories":["code_execution"],"steps":["Run only in a sandbox with least-privilege credentials and strict resource limits.","Disable generic execution gateways unless their reachable action set is fully understood.","Require approval before execution against production systems or sensitive data."]},"risk_type":"runs_code","severity":"high","title":"Executes Dalea shell commands","triggering_tools":["dalea_bash"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Meaningful workspace mutations are Medium.","evidence":"Writes lab documents, data, inventory, and projects: Many declared write tools persist scientific workspace state.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Writes lab documents, data, inventory, and projects","triggering_tools":["document_markdown_write","data_objects_write","inventory_items_write","manage_projects_write"]},{"description":"This connector can create, change, export, or otherwise write files. Review findings: File/data writes are Medium.","evidence":"Imports and exports structured data: Tools write/import/export workspace files or data artifacts.","manual_risk_type":"file_write","remediation":{"block_tool_categories":["state_change"],"steps":["Limit file access to a dedicated working directory.","Review generated or modified files before they are shared or executed."]},"risk_type":"filesystem_access","severity":"medium","title":"Imports and exports structured data","triggering_tools":["import_data_write","export_data"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@dalea.tech","tags":["filesystem_access","modifies_data","network_access","oauth_required","runs_code","web_connector"],"tools":[{"description":"","name":"addons_read"},{"description":"","name":"addons_write"},{"description":"","name":"create"},{"description":"","name":"dalea_bash","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Arbitrary shell execution is High."}},{"description":"","name":"data_columns_read"},{"description":"","name":"data_columns_write"},{"description":"","name":"data_environments_read"},{"description":"","name":"data_environments_write"},{"description":"","name":"data_objects_read"},{"description":"","name":"data_objects_write","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Meaningful workspace mutations are Medium."}},{"description":"","name":"data_queries_read"},{"description":"","name":"data_queries_write"},{"description":"","name":"data_tables_read"},{"description":"","name":"data_tables_write"},{"description":"","name":"document_markdown_read"},{"description":"","name":"document_markdown_write","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Meaningful workspace mutations are Medium."}},{"description":"","name":"document_versions_read"},{"description":"","name":"document_versions_write"},{"description":"","name":"export_data","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: File/data writes are Medium."}},{"description":"","name":"get_tool_examples"},{"description":"","name":"import_data_read"},{"description":"","name":"import_data_write","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: File/data writes are Medium."}},{"description":"","name":"inventory_containers_read"},{"description":"","name":"inventory_containers_write"},{"description":"","name":"inventory_items_read"},{"description":"","name":"inventory_items_write","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Meaningful workspace mutations are Medium."}},{"description":"","name":"inventory_types"},{"description":"","name":"list_skills"},{"description":"","name":"load_skill"},{"description":"","name":"manage_projects_read"},{"description":"","name":"manage_projects_write","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Meaningful workspace mutations are Medium."}},{"description":"","name":"marketplace_packages"},{"description":"","name":"related_entities"},{"description":"","name":"result_data_read"},{"description":"","name":"result_data_write"},{"description":"","name":"search_all"},{"description":"","name":"workspace_info"}],"tools_count":37,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/504a0fb3-25c7-4110-90f8-d752adda4c65","uuid":"ce793a54-c847-5979-a56d-4687189ccb39","verification_tier":"community","version":""},"query_key":"dalea aps dalea research orchestration platform","schema_version":1,"status":"match"}