{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-13","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"high","description":"Read marketing dashboard metrics and compare reporting periods in DashThis. With write access, add commentary, create dashboards, and attach existing data sources. Dashboard creation and source additions need your approval; dashboards, widgets, and sources cannot be deleted.","did":"6c52fbf2-5503-42ba-b688-05c08c873c6d","documentation_url":"https://help.dashthis.com/what-is-an-mcp-connector","editorial_description":{"extended_description":"Requires a DashThis account and consent for write access. Replacing existing commentary also asks for approval. Reads cover existing widget data, not arbitrary queries against connected platforms. Added sources count against plan limits; new platform connections are not supported. PDF exports use the dashboard's reporting period and expire after one hour.","schema_version":1,"summary":"Read marketing dashboard metrics and compare reporting periods in DashThis.\nWith write access, add commentary, create dashboards, and attach existing data sources.\nDashboard creation and source additions need your approval; dashboards, widgets, and sources cannot be deleted."},"homepage_url":"","icon":"","id":"6c52fbf2-5503-42ba-b688-05c08c873c6d","installs":0,"last_scanned":"","license":"","long_description":"Requires a DashThis account and consent for write access. Replacing existing commentary also asks for approval. Reads cover existing widget data, not arbitrary queries against connected platforms. Added sources count against plan limits; new platform connections are not supported. PDF exports use the dashboard's reporting period and expire after one hour.","manual_assessment":"medium","manual_review":{"all_findings":[{"evidence":"Official docs describe creating a proposed dashboard after approval, adding a data source, and writing or replacing dashboard-period comments.","reasoning":"These are durable shared reporting-workspace changes.","risk_type":"data_modification","severity":"medium","title":"Creates dashboards and writes dashboard commentary","triggering_tools_or_skills":["DashThis MCP: create dashboards","DashThis MCP: write dashboard commentary","DashThis MCP: add a data source"]},{"evidence":"The packet lists only get_dashboard_data, list_dashboards, provide_feedback and whoami, while official docs describe dashboard/comment/data-source writes.","reasoning":"The incomplete inventory materially understates the connector’s write capability.","risk_type":"identity_discrepancy","severity":"medium","title":"Directory inventory omits documented write actions","triggering_tools_or_skills":[]},{"evidence":"Official docs say the connector lists account dashboards and reads current widget values.","reasoning":"Reporting dashboards can contain sensitive business metrics.","risk_type":"private_data_read","severity":"low","title":"Reads private dashboard reporting data","triggering_tools_or_skills":["get_dashboard_data","list_dashboards"]}],"assessment_status":"provisional","auth_and_scopes":"OAuth signs into a DashThis account; write functions require the “Create and change dashboards & data” grant.","blocked_missing_evidence":null,"confidence":"high","displayed_risk":"medium","evidence_completeness":"complete","manual_overall_risk":"medium","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/6c52fbf2-5503-42ba-b688-05c08c873c6d.json","what_it_proves":"Candidate PR #125 record identity (name \"DashThis\", publisher, type web_connector) and 4 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/6c52fbf2-5503-42ba-b688-05c08c873c6d: complete tool_names inventory (4 tools), remote streamable-http endpoint https://mcp.dashthis.com/, auth_posture auth_required, directory tier community"},{"accessed_at":"2026-10-10T21:00:24Z","url_or_path":"https://help.dashthis.com/what-is-an-mcp-connector","what_it_proves":"Official docs say the connector reads dashboards, exports PDF, writes dashboard commentary, creates dashboards and adds data sources; OAuth grants a create/change scope."}],"primary_reason":"DashThis officially supports dashboard and commentary writes that are missing from the packet inventory.","provisional_risk":null,"publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:6c52fbf2-5503-42ba-b688-05c08c873c6d","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all four packet tools plus official current capabilities. provide_feedback is only third-party feedback forwarding; the hidden dashboard/comment actions drive Medium risk.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":4,"tools_or_skills_total":4},"name":"DashThis","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=6c52fbf2-5503-42ba-b688-05c08c873c6d&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://dashthis.com/terms","provisional_risk":null,"publication_recommendation":"fix","publisher":"DashThis","publisher_url":"https://dashthis.com/","remote_url":"https://mcp.dashthis.com/","repository_url":"","risk":"medium","risk_severity":"medium","security_risks":[{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are durable shared reporting-workspace changes.","evidence":"Creates dashboards and writes dashboard commentary: Official docs describe creating a proposed dashboard after approval, adding a data source, and writing or replacing dashboard-period comments.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Creates dashboards and writes dashboard commentary","triggering_tools":["DashThis MCP: create dashboards","DashThis MCP: write dashboard commentary","DashThis MCP: add a data source"]},{"description":"This connector can read information available to the connected account and return it to the AI. Review findings: Reporting dashboards can contain sensitive business metrics.","evidence":"Reads private dashboard reporting data: Official docs say the connector lists account dashboards and reads current widget values.","manual_risk_type":"private_data_read","remediation":{"block_tool_categories":["data_exfiltration"],"steps":["Use a least-privilege account limited to the information required by the workflow.","Restrict folders, projects, tenants, and other data scopes wherever the provider allows it.","Review access logs for unexpected reads or bulk retrieval."]},"risk_type":"reads_private_data","severity":"low","title":"Reads private dashboard reporting data","triggering_tools":["get_dashboard_data","list_dashboards"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://help.dashthis.com/kb-tickets/new","tags":["modifies_data","network_access","oauth_required","reads_private_data","web_connector"],"tools":[{"description":"","name":"get_dashboard_data"},{"description":"","name":"list_dashboards"},{"description":"","name":"provide_feedback"},{"description":"","name":"whoami"},{"description":"","name":"DashThis MCP: create dashboards","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are durable shared reporting-workspace changes."}},{"description":"","name":"DashThis MCP: write dashboard commentary","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are durable shared reporting-workspace changes."}},{"description":"","name":"DashThis MCP: add a data source","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are durable shared reporting-workspace changes."}}],"tools_count":7,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/6c52fbf2-5503-42ba-b688-05c08c873c6d","uuid":"198cbf1d-6911-5ea0-ad83-581524d9a3ed","verification_tier":"community","version":""},"query_key":"dashthis","schema_version":1,"status":"match"}