{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-24","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","catalog_reconciliation":{"basis":"Documented actions on the identified catalog surface; not an execution test.","confidence":"medium","evidence_completeness":"complete","previous":{"confidence":"low","detail_sha256":"51fa06f68807e1248a52fc131cec540926b0f49318c15cb793f6b4ef348c4cdf","risk":"medium"},"proposal_file":"claude-tail-proposals.json","rationale":"The Medium rests only on 'May persist legislation tracking'. The vendor MCP docs (now readable) define track_legislation as a filtered query of Czech Parliament bills, with parameters status, stage, changed_since_days, term and limit, and no subscription or saved state. All 16 tools are retrieval over public law, regulators and public company registries. convert_file_to_markdown only accepts allow-listed legal-source hosts, and get_entitlements reads the user's own tier. Auth is OAuth 2.1 via WorkOS. The only data flow is the user's query text going to DirectCase, so Low.","review_key":"claudesec:4f3c971f-45d9-48b5-be8f-a84cbcef4530","reviewed_at":"2026-10-12","runtime_verified":false,"sources":["https://www.directcase.ai/gb/en/docs/mcp","https://mcp.directcase.ai/.well-known/oauth-protected-resource","https://api.anthropic.com/api/directory/servers"],"status":"resolved"},"category":"Web Connector","confidence":"low","description":"DirectCase searches legislation, case law, and regulatory material for legal research. Retrieve documents, track legislative changes, and find related decisions with source references. It is aimed at legal professionals researching national and European law.","did":"4f3c971f-45d9-48b5-be8f-a84cbcef4530","documentation_url":"https://www.directcase.ai/gb/en/docs/mcp","editorial_description":{"extended_description":"Tools include parallel law, case-law, and regulatory searches, identifier and keyword lookup, company-document searches, and file-to-Markdown conversion. The source does not specify a complete list of supported national jurisdictions.","schema_version":1,"summary":"DirectCase searches legislation, case law, and regulatory material for legal research.\nRetrieve documents, track legislative changes, and find related decisions with source references.\nIt is aimed at legal professionals researching national and European law."},"homepage_url":"","icon":"","id":"4f3c971f-45d9-48b5-be8f-a84cbcef4530","installs":0,"last_scanned":"","license":"","long_description":"Tools include parallel law, case-law, and regulatory searches, identifier and keyword lookup, company-document searches, and file-to-Markdown conversion. The source does not specify a complete list of supported national jurisdictions.","manual_assessment":"medium","manual_review":{"all_findings":[{"evidence":"Official article describes authenticated legal-source retrieval and original documents.","reasoning":"Read-only legal research is Low.","risk_type":"private_data_read","severity":"low","title":"Reads legal research and company documents","triggering_tools_or_skills":["get_document","search_company_documents","search_caselaw_parallel","search_law_parallel"]},{"evidence":"The tool name says track_legislation, but official public material reviewed does not state whether it saves a subscription/watch record.","reasoning":"A persistent tracking record would be Medium; behavior needs runtime verification.","risk_type":"data_modification","severity":"medium","title":"May persist legislation tracking","triggering_tools_or_skills":["track_legislation"]},{"evidence":"Remote source is unpinned.","reasoning":"Runtime may drift.","risk_type":"provenance_uncertainty","severity":"low","title":"Hosted implementation is mutable","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"OAuth/sign-in to DirectCase; precise scopes and track_legislation persistence are not documented.","blocked_missing_evidence":null,"confidence":"low","displayed_risk":"medium","evidence_completeness":"partial","manual_overall_risk":"medium","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/4f3c971f-45d9-48b5-be8f-a84cbcef4530.json","what_it_proves":"Candidate PR #125 record identity (name \"DirectCase Legal Search\", publisher, type web_connector) and 16 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/4f3c971f-45d9-48b5-be8f-a84cbcef4530: complete tool_names inventory (16 tools), remote streamable-http endpoint https://mcp.directcase.ai/, auth_posture auth_required, directory tier community"},{"accessed_at":"2026-10-10T21:51:32Z","url_or_path":"https://blog.directcase.ai/cs/prvni-v-cesku-pravo-primo-ve-vasem-ai-prostredi-pres-mcp/","what_it_proves":"Official DirectCase article describes OAuth-authenticated access to legislation, case law, regulations, and original legal documents through MCP."}],"primary_reason":"DirectCase is primarily read-only, but track_legislation may create persistent tracking state.","provisional_risk":null,"publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:4f3c971f-45d9-48b5-be8f-a84cbcef4530","reviewed_at":"2026-10-10","reviewer_notes":"Official MCP article confirmed product identity and research access; the supplied docs page was inaccessible. Need track_legislation schema and convert_file_to_markdown persistence semantics.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"unknown","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":16,"tools_or_skills_total":16},"name":"DirectCase Legal Search","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=4f3c971f-45d9-48b5-be8f-a84cbcef4530&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.directcase.ai/gb/en/privacy-policy","provisional_risk":null,"publication_recommendation":"fix","publisher":"DirectCase s.r.o.","publisher_url":"https://www.directcase.ai/","remote_url":"https://mcp.directcase.ai/","repository_url":"","risk":"low","risk_severity":"low","security_risks":[{"description":"Sends research queries to DirectCase and retrieves public law, case law, legislation and company-registry records, including documents from allowed legal-source hosts.","evidence":"Actions: search_caselaw_parallel, search_law_parallel, search_regulatory_parallel, search_keyword, search_similar, search_identifier, get_document, get_law_detail, search_company, search_company_documents. https://www.directcase.ai/gb/en/docs/mcp — Tools (16) list and data sources\nActions: track_legislation, legislation_changes. https://www.directcase.ai/gb/en/docs/mcp — track_legislation params: status, stage, changed_since_days, term, limit\nActions: convert_file_to_markdown. https://www.directcase.ai/gb/en/docs/mcp — accepts only trusted legal-source hosts","risk_type":"reads_public_data","severity":"low","title":"Sends legal queries to retrieve public records"}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://www.directcase.ai/gb/en/support","tags":["reads_public_data"],"tools":[{"description":"","name":"convert_file_to_markdown"},{"description":"","name":"currency_conversion"},{"description":"","name":"get_current_time"},{"description":"","name":"get_document"},{"description":"","name":"get_entitlements"},{"description":"","name":"get_law_detail"},{"description":"","name":"legislation_changes"},{"description":"","name":"search_caselaw_parallel"},{"description":"","name":"search_company"},{"description":"","name":"search_company_documents"},{"description":"","name":"search_identifier"},{"description":"","name":"search_keyword"},{"description":"","name":"search_law_parallel"},{"description":"","name":"search_regulatory_parallel"},{"description":"","name":"search_similar"},{"description":"","name":"track_legislation","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: A persistent tracking record would be Medium; behavior needs runtime verification."}}],"tools_count":16,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/4f3c971f-45d9-48b5-be8f-a84cbcef4530","uuid":"70b52037-fafb-5381-8491-4aead2fa2e83","verification_tier":"community","version":""},"query_key":"directcase s r o directcase legal search","schema_version":1,"status":"match"}