{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-11","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"high","description":"Uptimely connects Claude to uptime monitoring, incidents, alerts, and on-call information. Read project status and history, or manage monitors and incident workflows when allowed. Writes are off by default until a project owner enables them, and some actions contact real URLs or notify people.","did":"5f9edabd-a9fa-4959-a28b-88eda05ca85f","documentation_url":"https://getuptimely.com/docs/api","editorial_description":{"extended_description":"Each call specifies a project and is checked against current membership and granted product scopes. Enabled writes can create monitors or alerts, run probes, declare incidents, change states, and save postmortems. The connector has no deletion tools; public status pages can be affected by incident changes.","schema_version":1,"summary":"Uptimely connects Claude to uptime monitoring, incidents, alerts, and on-call information.\nRead project status and history, or manage monitors and incident workflows when allowed.\nWrites are off by default until a project owner enables them, and some actions contact real URLs or notify people."},"homepage_url":"","icon":"https://app.getuptimely.com/icon-512.png","id":"5f9edabd-a9fa-4959-a28b-88eda05ca85f","installs":0,"last_scanned":"","license":"","long_description":"Each call specifies a project and is checked against current membership and granted product scopes. Enabled writes can create monitors or alerts, run probes, declare incidents, change states, and save postmortems. The connector has no deletion tools; public status pages can be affected by incident changes.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"Official incident documentation says declarations can trigger on-call and subscriber notifications and postmortem publication has its own notification.","reasoning":"Invoking these tools can send external email, SMS or other notifications on the project’s behalf.","risk_type":"messaging_as_user","severity":"high","title":"Incident actions can trigger subscriber and on-call notifications","triggering_tools_or_skills":["uptimely_incident_declare","uptimely_incident_state_change","uptimely_incident_postmortem_save"]},{"evidence":"The MCP inventory and official write-access documentation confirm persistent project changes.","reasoning":"These operations alter operational monitoring and incident-management state.","risk_type":"data_modification","severity":"medium","title":"Creates monitors, alerts and incident records","triggering_tools_or_skills":["uptimely_monitor_create","uptimely_alert_create","uptimely_incident_declare"]},{"evidence":"Uptimely supports Website, API, DNS, IP and other target monitors and exposes a run-probe tool.","reasoning":"Monitoring caller-selected targets gives the service outbound network reach; target validation is not in the packet.","risk_type":"arbitrary_network_access","severity":"low","title":"Creates and probes user-selected monitor targets","triggering_tools_or_skills":["uptimely_monitor_create","uptimely_run_monitor_probe"]}],"assessment_status":"provisional","auth_and_scopes":"OAuth 2.1 is required; read tools are default, while project-level AI writes must be enabled and write access requires the appropriate plan.","blocked_missing_evidence":null,"confidence":"high","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/5f9edabd-a9fa-4959-a28b-88eda05ca85f.json","what_it_proves":"Candidate PR #125 record identity (name \"Uptimely\", publisher, type web_connector) and 20 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/5f9edabd-a9fa-4959-a28b-88eda05ca85f: complete tool_names inventory (20 tools), remote streamable-http endpoint https://app.getuptimely.com/api/mcp, auth_posture auth_required, directory tier community"},{"accessed_at":"2026-10-10T20:45:33Z","url_or_path":"https://getuptimely.com/docs/mcp-and-ai","what_it_proves":"Uptimely documents OAuth, opt-in write access and MCP operation over monitors, incidents and alerts."},{"accessed_at":"2026-10-10T20:45:33Z","url_or_path":"https://getuptimely.com/docs/incidents-and-alerts","what_it_proves":"Uptimely states that incident declaration can trigger on-call policies and subscriber notifications, and postmortems can notify subscribers."}],"primary_reason":"Uptimely incident tools can notify subscribers and on-call responders through external channels.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:5f9edabd-a9fa-4959-a28b-88eda05ca85f","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 20 tools plus official MCP and incident documentation. Custom JavaScript monitors exist in the product, but the monitor_create schema was not available, so arbitrary code creation remains unknown rather than verified.","risk_domains":{"arbitrary_network_access":"true","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"unknown","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":20,"tools_or_skills_total":20},"name":"Uptimely","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=5f9edabd-a9fa-4959-a28b-88eda05ca85f&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://getuptimely.com/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Devino Solutions","publisher_url":"https://devino.ca/","remote_url":"https://app.getuptimely.com/api/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: Invoking these tools can send external email, SMS or other notifications on the project’s behalf.","evidence":"Incident actions can trigger subscriber and on-call notifications: Official incident documentation says declarations can trigger on-call and subscriber notifications and postmortem publication has its own notification.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Incident actions can trigger subscriber and on-call notifications","triggering_tools":["uptimely_incident_declare","uptimely_incident_state_change","uptimely_incident_postmortem_save"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These operations alter operational monitoring and incident-management state.","evidence":"Creates monitors, alerts and incident records: The MCP inventory and official write-access documentation confirm persistent project changes.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Creates monitors, alerts and incident records","triggering_tools":["uptimely_monitor_create","uptimely_alert_create","uptimely_incident_declare"]},{"description":"This connector can send caller-provided data to an external service or publisher. Review findings: Monitoring caller-selected targets gives the service outbound network reach; target validation is not in the packet.","evidence":"Creates and probes user-selected monitor targets: Uptimely supports Website, API, DNS, IP and other target monitors and exposes a run-probe tool.","manual_risk_type":"arbitrary_network_access","remediation":{"block_tool_categories":["sends_externally"],"steps":["Do not include secrets, regulated data, or customer information unless the destination is approved.","Review the recipient's retention and deletion policy before enabling the connector."]},"risk_type":"forwards_data_to_third_party","severity":"low","title":"Creates and probes user-selected monitor targets","triggering_tools":["uptimely_monitor_create","uptimely_run_monitor_probe"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"aladdin@devino.ca","tags":["forwards_data_to_third_party","modifies_data","network_access","oauth_required","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"uptimely_alert_create","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These operations alter operational monitoring and incident-management state."}},{"description":"","name":"uptimely_alert_list"},{"description":"","name":"uptimely_alert_state_change"},{"description":"","name":"uptimely_incident_declare","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Invoking these tools can send external email, SMS or other notifications on the project’s behalf."}},{"description":"","name":"uptimely_incident_get"},{"description":"","name":"uptimely_incident_list"},{"description":"","name":"uptimely_incident_postmortem_save","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Invoking these tools can send external email, SMS or other notifications on the project’s behalf."}},{"description":"","name":"uptimely_incident_state_change","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Invoking these tools can send external email, SMS or other notifications on the project’s behalf."}},{"description":"","name":"uptimely_maintenance_list"},{"description":"","name":"uptimely_monitor_create","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These operations alter operational monitoring and incident-management state."}},{"description":"","name":"uptimely_monitor_get"},{"description":"","name":"uptimely_monitor_list"},{"description":"","name":"uptimely_monitor_status_history"},{"description":"","name":"uptimely_monitor_target_list"},{"description":"","name":"uptimely_on_call_current"},{"description":"","name":"uptimely_project_list"},{"description":"","name":"uptimely_project_overview"},{"description":"","name":"uptimely_run_monitor_probe"},{"description":"","name":"uptimely_status_page_list"},{"description":"","name":"uptimely_telemetry_service_list"}],"tools_count":20,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/5f9edabd-a9fa-4959-a28b-88eda05ca85f","uuid":"ff8fec28-5884-5628-9dfe-074879cbcf28","verification_tier":"community","version":""},"query_key":"devino solutions uptimely","schema_version":1,"status":"match"}