{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-06-25","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Analyzes website traffic, campaigns and conversion journeys with Evarist. Explore audience behavior, funnel drops, revenue and traffic from AI assistants. Query site data and configure tracking goals, tags, domains or team access.","did":"b0a74256-a658-46c7-87d2-8251380cd46d","documentation_url":"https://evarist.ai/docs","editorial_description":{"extended_description":"The platform uses a site script and links analysis to session-level evidence. Tools also support Shopify setup, product lists and identity-capture settings. Reports help investigate traffic changes rather than proving visitors' intent or why a change occurred.","schema_version":1,"summary":"Analyzes website traffic, campaigns and conversion journeys with Evarist.\nExplore audience behavior, funnel drops, revenue and traffic from AI assistants.\nQuery site data and configure tracking goals, tags, domains or team access."},"homepage_url":"","icon":"","id":"b0a74256-a658-46c7-87d2-8251380cd46d","installs":0,"last_scanned":"","license":"","long_description":"The platform uses a site script and links analysis to session-level evidence. Tools also support Shopify setup, product lists and identity-capture settings. Reports help investigate traffic changes rather than proving visitors' intent or why a change occurred.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The explicit tool runs queries against live site/customer data.","reasoning":"Flexible query execution is High.","risk_type":"query_execution","severity":"high","title":"Executes analytics queries","triggering_tools_or_skills":["execute_query"]},{"evidence":"These tools alter access/integrations/site identity.","reasoning":"They are privileged administration.","risk_type":"credential_admin","severity":"high","title":"Manages team, Shopify setup and domains","triggering_tools_or_skills":["manage_team","setup_shopify","add_domain","remove_domain"]},{"evidence":"The tools change production analytics collection/instrumentation.","reasoning":"They affect live website data infrastructure.","risk_type":"deployment_infrastructure","severity":"high","title":"Creates sites and confirms event tags/identity capture","triggering_tools_or_skills":["create_site","confirm_event_tag","set_identity_capture"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication scopes analytics sites, teams, Shopify and domains.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/b0a74256-a658-46c7-87d2-8251380cd46d.json","what_it_proves":"Candidate PR #125 record identity (name \"Evarist\", publisher, type web_connector) and 16 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/b0a74256-a658-46c7-87d2-8251380cd46d: complete tool_names inventory (16 tools), remote streamable-http endpoint https://app.evarist.ai/mcp, auth_posture auth_required, publisher-declared permissions text, directory tier community"}],"primary_reason":"Evarist executes analytics queries and administers production tracking/sites.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:b0a74256-a658-46c7-87d2-8251380cd46d","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 16 tools.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"true","deletes_data":"false","deployment_or_infrastructure":"true","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"true","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":16,"tools_or_skills_total":16},"name":"Evarist","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=b0a74256-a658-46c7-87d2-8251380cd46d&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://app.evarist.ai/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Evarist","publisher_url":"https://evarist.ai/","remote_url":"https://app.evarist.ai/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Flexible query execution is High.","evidence":"Executes analytics queries: The explicit tool runs queries against live site/customer data.","manual_risk_type":"query_execution","remediation":{"block_tool_categories":["code_execution"],"steps":["Run only in a sandbox with least-privilege credentials and strict resource limits.","Disable generic execution gateways unless their reachable action set is fully understood.","Require approval before execution against production systems or sensitive data."]},"risk_type":"runs_code","severity":"high","title":"Executes analytics queries","triggering_tools":["execute_query"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They are privileged administration.","evidence":"Manages team, Shopify setup and domains: These tools alter access/integrations/site identity.","manual_risk_type":"credential_admin","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"high","title":"Manages team, Shopify setup and domains","triggering_tools":["manage_team","setup_shopify","add_domain","remove_domain"]},{"description":"This connector can deploy code or change infrastructure and production environments. Review findings: They affect live website data infrastructure.","evidence":"Creates sites and confirms event tags/identity capture: The tools change production analytics collection/instrumentation.","manual_risk_type":"deployment_infrastructure","remediation":{"block_tool_categories":["code_execution","state_change"],"steps":["Default to a sandbox or staging environment.","Require code review, human approval, audit logging, and a tested rollback path for production changes."]},"risk_type":"code_deployment","severity":"high","title":"Creates sites and confirms event tags/identity capture","triggering_tools":["create_site","confirm_event_tag","set_identity_capture"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"clement@evarist.ai","tags":["accesses_calendar","code_deployment","modifies_data","network_access","oauth_required","runs_code","web_connector"],"tools":[{"description":"","name":"create_site","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: They affect live website data infrastructure."}},{"description":"","name":"describe_data"},{"description":"","name":"execute_query","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Flexible query execution is High."}},{"description":"","name":"list_sites"},{"description":"","name":"manage_team","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They are privileged administration."}},{"description":"","name":"campaign_performance"},{"description":"","name":"revenue_summary"},{"description":"","name":"setup_shopify","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They are privileged administration."}},{"description":"","name":"set_event_goal"},{"description":"","name":"list_products"},{"description":"","name":"propose_event_tag"},{"description":"","name":"confirm_event_tag","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: They affect live website data infrastructure."}},{"description":"","name":"list_taggable_events"},{"description":"","name":"set_identity_capture","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: They affect live website data infrastructure."}},{"description":"","name":"add_domain","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They are privileged administration."}},{"description":"","name":"remove_domain","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They are privileged administration."}}],"tools_count":16,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/b0a74256-a658-46c7-87d2-8251380cd46d","uuid":"4b67cd78-4b26-58bc-8189-404f1c9887d1","verification_tier":"community","version":""},"query_key":"evarist evarist","schema_version":1,"status":"match"}