{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-07","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Manage office work for trade businesses in Germany, Austria and Switzerland. Use das Programm to search customers, projects, orders, quotations and invoices. Prepare business documents and review financial or project reports.","did":"02295274-0c7d-42cf-adef-56d54ab729fd","documentation_url":"https://das-programm.io/support/artikel/mcp-schnittstelle-einrichtung-claude-chatgpt/","editorial_description":{"extended_description":"The authenticated connector also exposes suppliers, payments, work reports, product and service lookup, quotation updates and scheduling changes. Its inventory includes creating and sending payment reminders. Operations use the connected das-programm account rather than a separate copy of the business data.","schema_version":1,"summary":"Manage office work for trade businesses in Germany, Austria and Switzerland.\nUse das Programm to search customers, projects, orders, quotations and invoices.\nPrepare business documents and review financial or project reports."},"homepage_url":"","icon":"","id":"02295274-0c7d-42cf-adef-56d54ab729fd","installs":0,"last_scanned":"","license":"","long_description":"The authenticated connector also exposes suppliers, payments, work reports, product and service lookup, quotation updates and scheduling changes. Its inventory includes creating and sending payment reminders. Operations use the connected das-programm account rather than a separate copy of the business data.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"Directory tool_names include dunning__create_dunning_letter_and_send.","reasoning":"Sends payment-reminder correspondence to the business's customers in its name.","risk_type":"messaging_as_user","severity":"high","title":"Creates and sends dunning letters to customers","triggering_tools_or_skills":["dunning__create_dunning_letter_and_send"]},{"evidence":"Directory tool_names include quotation_delete_quotation_item and quotation_delete_quotation_group.","reasoning":"Removes parts of customer quotations.","risk_type":"data_deletion","severity":"high","title":"Deletes quotation items and groups","triggering_tools_or_skills":["quotation_delete_quotation_item","quotation_delete_quotation_group"]},{"evidence":"Tool names; description: 'Angebote und Rechnungen erstellen'.","reasoning":"Creates legally relevant financial documents (invoices).","risk_type":"data_modification","severity":"medium","title":"Creates invoices, quotations, customers, products and changes schedules","triggering_tools_or_skills":["invoice__create_invoice_from_sales_order","invoice__create_invoice_from_work_report","quotation_create_quotation","quotation_update_quotation","quotation_create_or_update_quotation_item","quotation_update_quotation_group","quotation_update_quotation_group_position","quotation_update_quotation_item_position","customer_create_or_update_customer","customer_create_or_update_customer_address","product_create_or_update_product","schedule__change_activity_time"]},{"evidence":"Directory tool_names include customer__query_customer, supplier__query_supplier, invoice__query_invoices, payment__query_payments and debtor/creditor analytics; description: 'Kundendaten nachschlagen und Auswertungen erstellen'.","reasoning":"Returns business financial records and customer PII into the model context.","risk_type":"private_data_read","severity":"low","title":"Reads customers, suppliers, invoices, payments and analytics","triggering_tools_or_skills":["customer__query_customer","supplier__query_supplier","invoice__query_invoices","invoice__query_incomin_invoices","payment__query_payments","analytics__get_debtor_summary","analytics__get_creditor_summary"]},{"evidence":"Directory remote.url is app.das-programm.io/mcp; no pinned source or version is available for the server.","reasoning":"Tool behaviour can change server-side after review; ratings rest on the 2026-09-22 snapshot.","risk_type":"provenance_uncertainty","severity":"low","title":"Closed hosted MCP server for das Programm can change without notice","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"auth_required OAuth to the user's das-programm account; description says the user controls which data is released; scopes unknown.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/02295274-0c7d-42cf-adef-56d54ab729fd.json","what_it_proves":"Candidate PR #125 record identity (name \"das Programm\", publisher, type web_connector) and 41 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/02295274-0c7d-42cf-adef-56d54ab729fd: complete tool_names inventory (41 tools), remote streamable-http endpoint https://app.das-programm.io/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Declared dunning__create_dunning_letter_and_send sends reminders to customers, and quotation delete tools remove data.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:02295274-0c7d-42cf-adef-56d54ab729fd","reviewed_at":"2026-10-10","reviewer_notes":"Identity consistent (synatos GmbH, das-programm.io). Reviewed all 41 tool names. Pinned High by the send and delete tools; no doc lookup made. Typos in tool names (invoice__query_incomin_invoices, quotation_get_quoatation_by_id) are cosmetic.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"false","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":41,"tools_or_skills_total":41},"name":"das Programm","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=02295274-0c7d-42cf-adef-56d54ab729fd&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://das-programm.io/datenschutz/","provisional_risk":null,"publication_recommendation":"accept","publisher":"synatos GmbH","publisher_url":"https://das-programm.io/","remote_url":"https://app.das-programm.io/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: Sends payment-reminder correspondence to the business's customers in its name.","evidence":"Creates and sends dunning letters to customers: Directory tool_names include dunning__create_dunning_letter_and_send.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Creates and sends dunning letters to customers","triggering_tools":["dunning__create_dunning_letter_and_send"]},{"description":"This connector can permanently remove data or resources. Review findings: Removes parts of customer quotations.","evidence":"Deletes quotation items and groups: Directory tool_names include quotation_delete_quotation_item and quotation_delete_quotation_group.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Deletes quotation items and groups","triggering_tools":["quotation_delete_quotation_item","quotation_delete_quotation_group"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Creates legally relevant financial documents (invoices).","evidence":"Creates invoices, quotations, customers, products and changes schedules: Tool names; description: 'Angebote und Rechnungen erstellen'.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Creates invoices, quotations, customers, products and changes schedules","triggering_tools":["invoice__create_invoice_from_sales_order","invoice__create_invoice_from_work_report","quotation_create_quotation","quotation_update_quotation","quotation_create_or_update_quotation_item","quotation_update_quotation_group","quotation_update_quotation_group_position","quotation_update_quotation_item_position","customer_create_or_update_customer","customer_create_or_update_customer_address","product_create_or_update_product","schedule__change_activity_time"]},{"description":"This connector can read information available to the connected account and return it to the AI. Review findings: Returns business financial records and customer PII into the model context.","evidence":"Reads customers, suppliers, invoices, payments and analytics: Directory tool_names include customer__query_customer, supplier__query_supplier, invoice__query_invoices, payment__query_payments and debtor/creditor analytics; description: 'Kundendaten nachschlagen und Auswertungen erstellen'.","manual_risk_type":"private_data_read","remediation":{"block_tool_categories":["data_exfiltration"],"steps":["Use a least-privilege account limited to the information required by the workflow.","Restrict folders, projects, tenants, and other data scopes wherever the provider allows it.","Review access logs for unexpected reads or bulk retrieval."]},"risk_type":"reads_private_data","severity":"low","title":"Reads customers, suppliers, invoices, payments and analytics","triggering_tools":["customer__query_customer","supplier__query_supplier","invoice__query_invoices","invoice__query_incomin_invoices","payment__query_payments","analytics__get_debtor_summary","analytics__get_creditor_summary"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@das-programm.io","tags":["deletes_data","modifies_data","network_access","oauth_required","reads_private_data","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"analytics__get_creditor_summary"},{"description":"","name":"analytics__get_debtor_summary"},{"description":"","name":"analytics__get_missing_invoices"},{"description":"","name":"analytics__get_missing_sales_order"},{"description":"","name":"analytics__get_year_summary_by_month"},{"description":"","name":"company_get_info"},{"description":"","name":"customer__query_customer"},{"description":"","name":"customer_create_or_update_customer","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Creates legally relevant financial documents (invoices)."}},{"description":"","name":"customer_create_or_update_customer_address","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Creates legally relevant financial documents (invoices)."}},{"description":"","name":"dunning__create_dunning_letter_and_send","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Sends payment-reminder correspondence to the business's customers in its name."}},{"description":"","name":"dunning_letter__query_dunning_letter"},{"description":"","name":"invoice__create_invoice_from_sales_order","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Creates legally relevant financial documents (invoices)."}},{"description":"","name":"invoice__create_invoice_from_work_report","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Creates legally relevant financial documents (invoices)."}},{"description":"","name":"invoice__get_invoice_by_id"},{"description":"","name":"invoice__query_incomin_invoices"},{"description":"","name":"invoice__query_invoices"},{"description":"","name":"payment__query_payments"},{"description":"","name":"product_create_or_update_product","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Creates legally relevant financial documents (invoices)."}},{"description":"","name":"product_get_unit_list"},{"description":"","name":"product_material_search"},{"description":"","name":"product_service_search"},{"description":"","name":"project__query_project_status"},{"description":"","name":"project__query_projects"},{"description":"","name":"quotation__query_quotation"},{"description":"","name":"quotation_create_or_update_quotation_item","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Creates legally relevant financial documents (invoices)."}},{"description":"","name":"quotation_create_quotation","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Creates legally relevant financial documents (invoices)."}},{"description":"","name":"quotation_delete_quotation_group","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Removes parts of customer quotations."}},{"description":"","name":"quotation_delete_quotation_item","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Removes parts of customer quotations."}},{"description":"","name":"quotation_get_quoatation_by_id"},{"description":"","name":"quotation_update_quotation","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Creates legally relevant financial documents (invoices)."}},{"description":"","name":"quotation_update_quotation_group","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Creates legally relevant financial documents (invoices)."}},{"description":"","name":"quotation_update_quotation_group_position","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Creates legally relevant financial documents (invoices)."}},{"description":"","name":"quotation_update_quotation_item_position","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Creates legally relevant financial documents (invoices)."}},{"description":"","name":"sales_order__get_controlling"},{"description":"","name":"sales_order__get_sales_order_by_id"},{"description":"","name":"sales_order__query_sales_order"},{"description":"","name":"schedule__change_activity_time","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Creates legally relevant financial documents (invoices)."}},{"description":"","name":"schedule__find_activity_in_time_range"},{"description":"","name":"supplier__query_supplier"},{"description":"","name":"work_report__get_work_report_by_id"},{"description":"","name":"work_report__query_work_report"}],"tools_count":41,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/02295274-0c7d-42cf-adef-56d54ab729fd","uuid":"e5bf7996-d7ef-5fa6-afb8-528da8fdef88","verification_tier":"community","version":""},"query_key":"das programm","schema_version":1,"status":"match"}