{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-18","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Eclincher connects Claude to social publishing, inboxes, and analytics. Schedule or edit posts, handle audience messages, and compare performance. An account is required, with access limited to your brands and profiles.","did":"3952f662-5d2c-41c7-ac14-2afa41222035","documentation_url":"https://www.eclincher.com/mcp","editorial_description":{"extended_description":"Reports cover performance, profile comparisons, competitors, custom reports, and cross-channel totals. The inventory also supports brands, inbox tags, replies, and workflow integrations.","schema_version":1,"summary":"Eclincher connects Claude to social publishing, inboxes, and analytics.\nSchedule or edit posts, handle audience messages, and compare performance.\nAn account is required, with access limited to your brands and profiles."},"homepage_url":"","icon":"","id":"3952f662-5d2c-41c7-ac14-2afa41222035","installs":0,"last_scanned":"","license":"","long_description":"Reports cover performance, profile comparisons, competitors, custom reports, and cross-channel totals. The inventory also supports brands, inbox tags, replies, and workflow integrations.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The inventory and description expose immediate/scheduled posting plus comments/direct-message inbox replies across connected networks.","reasoning":"These communicate externally as the user's social profiles.","risk_type":"messaging_as_user","severity":"high","title":"Publishes social posts and replies to inbox events","triggering_tools_or_skills":["create_post","edit_post","like_inbox_event","reply_to_inbox_event","twitter_inbox_actions"]},{"evidence":"The connector persists brand and unified-inbox workflow changes.","reasoning":"These alter internal account state even without an outbound message.","risk_type":"data_modification","severity":"medium","title":"Creates brands and changes inbox workflow state","triggering_tools_or_skills":["complete_inbox_event","create_brand","set_inbox_events"]}],"assessment_status":"provisional","auth_and_scopes":"OAuth limits access to brands and social profiles already permitted to the Eclincher user; exact platform scopes and helpdesk-inbox side effects are not documented.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"complete","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/3952f662-5d2c-41c7-ac14-2afa41222035.json","what_it_proves":"Candidate PR #125 record identity (name \"Eclincher\", publisher, type web_connector) and 26 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/3952f662-5d2c-41c7-ac14-2afa41222035: complete tool_names inventory (26 tools), remote streamable-http endpoint https://app.eclincher.com/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Eclincher can publish social content and reply through connected inboxes.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:3952f662-5d2c-41c7-ac14-2afa41222035","reviewed_at":"2026-10-10","reviewer_notes":"Verify whether Salesforce/ServiceNow/Zendesk inbox request tools create external tickets or only retrieve handoff data.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":26,"tools_or_skills_total":26},"name":"Eclincher","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=3952f662-5d2c-41c7-ac14-2afa41222035&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.eclincher.com/privacy-policy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Eclincher inc.","publisher_url":"https://www.eclincher.com/","remote_url":"https://app.eclincher.com/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: These communicate externally as the user's social profiles.","evidence":"Publishes social posts and replies to inbox events: The inventory and description expose immediate/scheduled posting plus comments/direct-message inbox replies across connected networks.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Publishes social posts and replies to inbox events","triggering_tools":["create_post","edit_post","like_inbox_event","reply_to_inbox_event","twitter_inbox_actions"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These alter internal account state even without an outbound message.","evidence":"Creates brands and changes inbox workflow state: The connector persists brand and unified-inbox workflow changes.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Creates brands and changes inbox workflow state","triggering_tools":["complete_inbox_event","create_brand","set_inbox_events"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@eclincher.com","tags":["accesses_calendar","accesses_messaging","modifies_data","network_access","oauth_required","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"complete_inbox_event","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These alter internal account state even without an outbound message."}},{"description":"","name":"create_brand","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These alter internal account state even without an outbound message."}},{"description":"","name":"create_post","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: These communicate externally as the user's social profiles."}},{"description":"","name":"edit_post","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: These communicate externally as the user's social profiles."}},{"description":"","name":"get_analytics_job_status"},{"description":"","name":"get_builtin_report"},{"description":"","name":"get_comparison_report"},{"description":"","name":"get_competitor_report"},{"description":"","name":"get_cross_channel_report"},{"description":"","name":"get_custom_report"},{"description":"","name":"get_post_status"},{"description":"","name":"get_scheduled_posts"},{"description":"","name":"like_inbox_event","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: These communicate externally as the user's social profiles."}},{"description":"","name":"list_accounts"},{"description":"","name":"list_brands"},{"description":"","name":"list_competitor_reports"},{"description":"","name":"list_custom_reports"},{"description":"","name":"list_inbox"},{"description":"","name":"list_inbox_roles"},{"description":"","name":"list_inbox_tags"},{"description":"","name":"reply_to_inbox_event","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: These communicate externally as the user's social profiles."}},{"description":"","name":"salesforce_inbox_request"},{"description":"","name":"servicenow_inbox_request"},{"description":"","name":"set_inbox_events","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These alter internal account state even without an outbound message."}},{"description":"","name":"twitter_inbox_actions","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: These communicate externally as the user's social profiles."}},{"description":"","name":"zendesk_inbox_request"}],"tools_count":26,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/3952f662-5d2c-41c7-ac14-2afa41222035","uuid":"ea11913b-1dff-5a8a-9d3f-a3d5feb63e8e","verification_tier":"community","version":""},"query_key":"eclincher","schema_version":1,"status":"match"}