{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-02","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Manages support tickets across your Dispatch Tickets brands from Claude. Search conversations, inspect internal notes and counts, and create or update tickets. Public replies email the customer; private notes stay internal to the ticket.","did":"221f0567-01e1-4e56-9351-4c86ebcb8bab","documentation_url":"https://dispatchtickets.com/docs/","editorial_description":{"extended_description":"A single OAuth connection selects an organization and reaches its brands, with each request scoped to the chosen brand. Tools separately handle customer replies and internal notes so their destinations remain distinct.","schema_version":1,"summary":"Manages support tickets across your Dispatch Tickets brands from Claude.\nSearch conversations, inspect internal notes and counts, and create or update tickets.\nPublic replies email the customer; private notes stay internal to the ticket."},"homepage_url":"","icon":"","id":"221f0567-01e1-4e56-9351-4c86ebcb8bab","installs":0,"last_scanned":"","license":"","long_description":"A single OAuth connection selects an organization and reaches its brands, with each request scoped to the chosen brand. Tools separately handle customer replies and internal notes so their destinations remain distinct.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The tool inventory explicitly includes reply_to_customer and the description states that it posts a public reply which emails the customer.","reasoning":"This sends external content as the connected support organization.","risk_type":"messaging_as_user","severity":"high","title":"Replies to support customers by email","triggering_tools_or_skills":["reply_to_customer"]}],"assessment_status":"provisional","auth_and_scopes":"OAuth grants access to a selected organization across its brands; exact read/write scopes and brand-selection enforcement are not included.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/221f0567-01e1-4e56-9351-4c86ebcb8bab.json","what_it_proves":"Candidate PR #125 record identity (name \"Dispatch Tickets\", publisher, type web_connector) and 10 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/221f0567-01e1-4e56-9351-4c86ebcb8bab: complete tool_names inventory (10 tools), remote streamable-http endpoint https://mcp.dispatchtickets.com/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Dispatch Tickets can email customers through public ticket replies and modify ticket records.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:221f0567-01e1-4e56-9351-4c86ebcb8bab","reviewed_at":"2026-10-10","reviewer_notes":"create_ticket, update_ticket and add_internal_note are Medium writes; reply_to_customer independently establishes High. Verify recipient preview and cross-brand scoping at runtime.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":10,"tools_or_skills_total":10},"name":"Dispatch Tickets","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=221f0567-01e1-4e56-9351-4c86ebcb8bab&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://dispatchtickets.com/privacy/","provisional_risk":null,"publication_recommendation":"accept","publisher":"Dispatch Tickets","publisher_url":"https://dispatchtickets.com/","remote_url":"https://mcp.dispatchtickets.com/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: This sends external content as the connected support organization.","evidence":"Replies to support customers by email: The tool inventory explicitly includes reply_to_customer and the description states that it posts a public reply which emails the customer.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Replies to support customers by email","triggering_tools":["reply_to_customer"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@dispatchtickets.com","tags":["network_access","oauth_required","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"add_internal_note"},{"description":"","name":"create_ticket"},{"description":"","name":"get_ticket"},{"description":"","name":"get_ticket_stats"},{"description":"","name":"list_brands"},{"description":"","name":"list_comments"},{"description":"","name":"list_tickets"},{"description":"","name":"reply_to_customer","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: This sends external content as the connected support organization."}},{"description":"","name":"search_tickets"},{"description":"","name":"update_ticket"}],"tools_count":10,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/221f0567-01e1-4e56-9351-4c86ebcb8bab","uuid":"7a19f63e-cfd0-5d6d-a5fb-0040dba2457b","verification_tier":"community","version":""},"query_key":"dispatch tickets dispatch tickets","schema_version":1,"status":"match"}