{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-12","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Explore survey research stored in Episto. List studies, inspect questions and progress, and retrieve responses or aggregates. Use collected findings to support your research team's analysis.","did":"03a776fc-f9f9-445b-865b-6b98303708f7","documentation_url":"https://episto.slite.page/p/Qf6Eb9rNlUEfop/Connect-Episto-to-Claude","editorial_description":{"extended_description":"Available tools include completion filters, result maps and retrieval of individual survey completions. Episto's broader platform supports respondent recruitment and research collection, but this connector's listed operations focus on accessing studies and results.","schema_version":1,"summary":"Explore survey research stored in Episto.\nList studies, inspect questions and progress, and retrieve responses or aggregates.\nUse collected findings to support your research team's analysis."},"homepage_url":"","icon":"https://episto.fr/favicon.ico?favicon.0f4773rael.6x.ico","id":"03a776fc-f9f9-445b-865b-6b98303708f7","installs":0,"last_scanned":"","license":"","long_description":"Available tools include completion filters, result maps and retrieval of individual survey completions. Episto's broader platform supports respondent recruitment and research collection, but this connector's listed operations focus on accessing studies and results.","manual_assessment":"low","manual_review":{"all_findings":[{"evidence":"The complete inventory includes retrieval of individual response data, completion details, progress, and mapped survey results.","reasoning":"Survey answers can contain personal, employee, or customer-sensitive information.","risk_type":"private_data_read","severity":"low","title":"Individual survey responses are readable","triggering_tools_or_skills":["get_individual_data","get_survey_completion","get_survey_progress","get_results_map"]},{"evidence":"The Directory marks the hosted connector authentication-required for ongoing access to private survey data.","reasoning":"A reusable authorization session is needed, though exact token mechanics were not documented.","risk_type":"persistent_credentials","severity":"low","title":"Remote survey access requires retained authorization","triggering_tools_or_skills":[]},{"evidence":"The read tools return free-form questions and respondent-authored answers into the model context.","reasoning":"Respondent content can carry malicious instructions and must be treated as data.","risk_type":"prompt_injection_exposure","severity":"low","title":"Survey questions and answers are untrusted text","triggering_tools_or_skills":["get_individual_data","list_survey_questions"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication required for Episto survey access; exact OAuth scopes and credential duration were not available from an informative official page.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"low","evidence_completeness":"partial","manual_overall_risk":"low","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/03a776fc-f9f9-445b-865b-6b98303708f7.json","what_it_proves":"Candidate PR #125 record identity (name \"Episto\", publisher, type web_connector) and 9 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/03a776fc-f9f9-445b-865b-6b98303708f7: complete tool_names inventory (9 tools), remote streamable-http endpoint https://mcp.episto.fr/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"All nine complete-inventory actions are get or list operations over survey data, with no declared mutation or high-impact capability.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:03a776fc-f9f9-445b-865b-6b98303708f7","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all nine names. The linked official page was not retrievable informatively, so scopes and response schemas require runtime verification despite the bounded read-only inventory.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"false","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":9,"tools_or_skills_total":9},"name":"Episto","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=03a776fc-f9f9-445b-865b-6b98303708f7&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://episto.fr/","provisional_risk":null,"publication_recommendation":"accept","publisher":"Episto","publisher_url":"https://episto.fr/","remote_url":"https://mcp.episto.fr/mcp","repository_url":"","risk":"low","risk_severity":"low","security_risks":[{"description":"This connector can read information available to the connected account and return it to the AI. Review findings: Survey answers can contain personal, employee, or customer-sensitive information.","evidence":"Individual survey responses are readable: The complete inventory includes retrieval of individual response data, completion details, progress, and mapped survey results.","manual_risk_type":"private_data_read","remediation":{"block_tool_categories":["data_exfiltration"],"steps":["Use a least-privilege account limited to the information required by the workflow.","Restrict folders, projects, tenants, and other data scopes wherever the provider allows it.","Review access logs for unexpected reads or bulk retrieval."]},"risk_type":"reads_private_data","severity":"low","title":"Individual survey responses are readable","triggering_tools":["get_individual_data","get_survey_completion","get_survey_progress","get_results_map"]},{"description":"This connector may rely on credentials or tokens that remain valid beyond one request. Review findings: A reusable authorization session is needed, though exact token mechanics were not documented.","evidence":"Remote survey access requires retained authorization: The Directory marks the hosted connector authentication-required for ongoing access to private survey data.","manual_risk_type":"persistent_credentials","remediation":{"block_tool_categories":["privilege"],"steps":["Use short-lived, narrowly scoped credentials where supported.","Store secrets in an approved secret manager and rotate them regularly."]},"risk_type":"requires_persistent_credentials","severity":"low","title":"Remote survey access requires retained authorization","triggering_tools":[]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"hello@episto.fr","tags":["network_access","oauth_required","reads_private_data","requires_persistent_credentials","web_connector"],"tools":[{"description":"","name":"get_aggregated_data"},{"description":"","name":"get_completion_filters"},{"description":"","name":"get_individual_data"},{"description":"","name":"get_results_map"},{"description":"","name":"get_survey"},{"description":"","name":"get_survey_completion"},{"description":"","name":"get_survey_progress"},{"description":"","name":"list_survey_questions"},{"description":"","name":"list_surveys"}],"tools_count":9,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/03a776fc-f9f9-445b-865b-6b98303708f7","uuid":"ba72732d-ce0e-58f9-87be-1fc15bcd2ff1","verification_tier":"community","version":""},"query_key":"episto episto","schema_version":1,"status":"match"}