{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-11","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Everinbox manages email campaigns, audiences, templates, and automations. Review deliverability and engagement, organize contacts, and prepare or send campaigns. Access follows your role; inbox-impacting or destructive actions require explicit confirmation.","did":"97ecdf77-aa4c-46eb-9b81-cb1b3325b5c7","documentation_url":"https://github.com/everinboxhq/everinbox-ai-plugin","editorial_description":{"extended_description":"Work with regular, A/B, and recurring campaigns, segment previews, frequency caps, push campaigns, and automation flows. Before consequential actions, the connector presents audience, local time, template, and sender details. OAuth access is limited to enterprises and projects where you have a role.","schema_version":1,"summary":"Everinbox manages email campaigns, audiences, templates, and automations.\nReview deliverability and engagement, organize contacts, and prepare or send campaigns.\nAccess follows your role; inbox-impacting or destructive actions require explicit confirmation."},"homepage_url":"","icon":"https://app.everinbox.com.br/logos/logo-icon.svg","id":"97ecdf77-aa4c-46eb-9b81-cb1b3325b5c7","installs":0,"last_scanned":"","license":"","long_description":"Work with regular, A/B, and recurring campaigns, segment previews, frequency caps, push campaigns, and automation flows. Before consequential actions, the connector presents audience, local time, template, and sender details. OAuth access is limited to enterprises and projects where you have a role.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The listing explicitly says campaigns can be scheduled/sent and live automations adjusted.","reasoning":"These actions communicate to real audiences.","risk_type":"messaging_as_user","severity":"high","title":"Sends/schedules email and push campaigns","triggering_tools_or_skills":["create-campaign","create-push-campaign","set-automation-status"]},{"evidence":"Explicit destructive tools remove marketing data/configuration.","reasoning":"They can cause severe customer/campaign loss.","risk_type":"data_deletion","severity":"high","title":"Deletes campaigns, contacts, automations, templates, segments and tags","triggering_tools_or_skills":["delete-campaign","delete-contact","delete-automation","delete-template","delete-segment","delete-tag"]},{"evidence":"These tools change production communication automation/domains.","reasoning":"They alter live delivery infrastructure.","risk_type":"deployment_infrastructure","severity":"high","title":"Activates marketing automations/push infrastructure","triggering_tools_or_skills":["set-automation-status","create-push-app","add-push-domain"]},{"evidence":"These are privileged external integration/domain actions.","reasoning":"They administer delivery/security configuration.","risk_type":"credential_admin","severity":"high","title":"Connects Postmaster and configures domains/apps","triggering_tools_or_skills":["connect-postmaster","map-postmaster-domain","add-push-domain"]}],"assessment_status":"provisional","auth_and_scopes":"OAuth role-scopes enterprises/projects and confirmations guard inbox/destructive actions.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/97ecdf77-aa4c-46eb-9b81-cb1b3325b5c7.json","what_it_proves":"Candidate PR #125 record identity (name \"Everinbox\", publisher, type web_connector) and 80 stored tool names (truncated vs Directory); no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/97ecdf77-aa4c-46eb-9b81-cb1b3325b5c7: complete tool_names inventory (129 tools), remote streamable-http endpoint https://core.mcp.everinbox.com.br/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Everinbox can send campaigns, delete customer/automation data and administer delivery integrations.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:97ecdf77-aa4c-46eb-9b81-cb1b3325b5c7","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 129 stored tools; inventory is truncated, but explicit High actions are sufficient.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"true","deletes_data":"true","deployment_or_infrastructure":"true","dynamic_hidden_actions":"false","filesystem_or_repo_access":"true","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":129,"tools_or_skills_total":129},"name":"Everinbox","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=97ecdf77-aa4c-46eb-9b81-cb1b3325b5c7&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://app.everinbox.com.br/legal/connector-ia","provisional_risk":null,"publication_recommendation":"accept","publisher":"Everinbox","publisher_url":"https://everinbox.com.br/","remote_url":"https://core.mcp.everinbox.com.br/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: These actions communicate to real audiences.","evidence":"Sends/schedules email and push campaigns: The listing explicitly says campaigns can be scheduled/sent and live automations adjusted.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Sends/schedules email and push campaigns","triggering_tools":["create-campaign","create-push-campaign","set-automation-status"]},{"description":"This connector can permanently remove data or resources. Review findings: They can cause severe customer/campaign loss.","evidence":"Deletes campaigns, contacts, automations, templates, segments and tags: Explicit destructive tools remove marketing data/configuration.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Deletes campaigns, contacts, automations, templates, segments and tags","triggering_tools":["delete-campaign","delete-contact","delete-automation","delete-template","delete-segment","delete-tag"]},{"description":"This connector can deploy code or change infrastructure and production environments. Review findings: They alter live delivery infrastructure.","evidence":"Activates marketing automations/push infrastructure: These tools change production communication automation/domains.","manual_risk_type":"deployment_infrastructure","remediation":{"block_tool_categories":["code_execution","state_change"],"steps":["Default to a sandbox or staging environment.","Require code review, human approval, audit logging, and a tested rollback path for production changes."]},"risk_type":"code_deployment","severity":"high","title":"Activates marketing automations/push infrastructure","triggering_tools":["set-automation-status","create-push-app","add-push-domain"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They administer delivery/security configuration.","evidence":"Connects Postmaster and configures domains/apps: These are privileged external integration/domain actions.","manual_risk_type":"credential_admin","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"high","title":"Connects Postmaster and configures domains/apps","triggering_tools":["connect-postmaster","map-postmaster-domain","add-push-domain"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"contato@everinbox.com.br","tags":["code_deployment","deletes_data","modifies_data","network_access","oauth_required","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"add-contacts-to-tag"},{"description":"","name":"add-push-domain","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They administer delivery/security configuration."}},{"description":"","name":"analyze-template-variations"},{"description":"","name":"apply-segment-frequency-cap-preset"},{"description":"","name":"apply-template-variations"},{"description":"","name":"archive-segments"},{"description":"","name":"assign-tags-to-contacts"},{"description":"","name":"cancel-campaign"},{"description":"","name":"connect-postmaster","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They administer delivery/security configuration."}},{"description":"","name":"create-automation"},{"description":"","name":"create-automation-node"},{"description":"","name":"create-automation-nodes-batch"},{"description":"","name":"create-campaign","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: These actions communicate to real audiences."}},{"description":"","name":"create-campaigns-batch"},{"description":"","name":"create-list"},{"description":"","name":"create-push-app","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: They alter live delivery infrastructure."}},{"description":"","name":"create-push-campaign","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: These actions communicate to real audiences."}},{"description":"","name":"create-push-tag"},{"description":"","name":"create-segment"},{"description":"","name":"create-tag"},{"description":"","name":"create-template"},{"description":"","name":"delete-automation","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: They can cause severe customer/campaign loss."}},{"description":"","name":"delete-automation-node"},{"description":"","name":"delete-automation-nodes-batch"},{"description":"","name":"delete-campaign","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: They can cause severe customer/campaign loss."}},{"description":"","name":"delete-campaigns-batch"},{"description":"","name":"delete-contact","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: They can cause severe customer/campaign loss."}},{"description":"","name":"delete-contacts-batch"},{"description":"","name":"delete-gallery-item"},{"description":"","name":"delete-push-campaign"},{"description":"","name":"delete-segment","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: They can cause severe customer/campaign loss."}},{"description":"","name":"delete-segment-frequency-cap"},{"description":"","name":"delete-tag","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: They can cause severe customer/campaign loss."}},{"description":"","name":"delete-template","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: They can cause severe customer/campaign loss."}},{"description":"","name":"duplicate-automation"},{"description":"","name":"duplicate-automations-batch"},{"description":"","name":"duplicate-segment"},{"description":"","name":"duplicate-tag"},{"description":"","name":"duplicate-template"},{"description":"","name":"duplicate-templates-batch"},{"description":"","name":"export-list-contacts"},{"description":"","name":"get-automation"},{"description":"","name":"get-automation-flow"},{"description":"","name":"get-automation-history"},{"description":"","name":"get-automation-step-metrics"},{"description":"","name":"get-automations-metrics"},{"description":"","name":"get-automations-status-metrics"},{"description":"","name":"get-campaign"},{"description":"","name":"get-campaign-ab-test-results"},{"description":"","name":"get-campaign-contact"},{"description":"","name":"get-campaign-executions"},{"description":"","name":"get-campaign-frequency-cap-blocked"},{"description":"","name":"get-campaign-metrics"},{"description":"","name":"get-campaign-timeline"},{"description":"","name":"get-campaigns-status-metrics"},{"description":"","name":"get-contact-tags"},{"description":"","name":"get-gallery-item-usage"},{"description":"","name":"get-import-status"},{"description":"","name":"get-postmaster-metrics-domain"},{"description":"","name":"get-postmaster-metrics-enterprise"},{"description":"","name":"get-postmaster-metrics-project"},{"description":"","name":"get-project-dashboard"},{"description":"","name":"get-push-app"},{"description":"","name":"get-push-audience-options"},{"description":"","name":"get-push-campaign-details"},{"description":"","name":"get-push-dashboard-overview"},{"description":"","name":"get-segment"},{"description":"","name":"get-segment-contacts"},{"description":"","name":"get-segment-frequency-cap"},{"description":"","name":"get-segment-history"},{"description":"","name":"get-segment-status"},{"description":"","name":"get-segment-usage"},{"description":"","name":"get-tag"},{"description":"","name":"get-tag-contacts"},{"description":"","name":"get-template"},{"description":"","name":"get-template-clicks-by-url"},{"description":"","name":"get-template-metrics"},{"description":"","name":"get-template-saturation"},{"description":"","name":"get-template-usage"},{"description":"","name":"get-template-versions-metrics"},{"description":"","name":"get-utm-metrics"},{"description":"","name":"import-contacts"},{"description":"","name":"list-automation-node-types"},{"description":"","name":"list-automations"},{"description":"","name":"list-campaigns"},{"description":"","name":"list-custom-fields"},{"description":"","name":"list-enterprises"},{"description":"","name":"list-frequency-cap-presets"},{"description":"","name":"list-gallery-items"},{"description":"","name":"list-lists"},{"description":"","name":"list-merge-tags"},{"description":"","name":"list-postmaster-alert-configs"},{"description":"","name":"list-postmaster-alert-history"},{"description":"","name":"list-postmaster-connections"},{"description":"","name":"list-postmaster-domains"},{"description":"","name":"list-projects"},{"description":"","name":"list-push-apps"},{"description":"","name":"list-push-campaign-executions"},{"description":"","name":"list-push-campaigns"},{"description":"","name":"list-push-domains"},{"description":"","name":"list-push-tags"},{"description":"","name":"list-segments"},{"description":"","name":"list-tags"},{"description":"","name":"list-template-senders"},{"description":"","name":"list-template-versions"},{"description":"","name":"list-templates"},{"description":"","name":"map-postmaster-domain","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They administer delivery/security configuration."}},{"description":"","name":"move-contacts"},{"description":"","name":"preview-segment"},{"description":"","name":"recalculate-segment"},{"description":"","name":"remove-contacts-from-tag"},{"description":"","name":"remove-tags-from-contacts"},{"description":"","name":"rename-automations-batch"},{"description":"","name":"rename-templates-batch"},{"description":"","name":"save-automation-flow"},{"description":"","name":"set-automation-status","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: They alter live delivery infrastructure."}},{"description":"","name":"set-segment-frequency-cap"},{"description":"","name":"sync-postmaster-domains"},{"description":"","name":"update-automation"},{"description":"","name":"update-automation-node"},{"description":"","name":"update-automation-nodes-batch"},{"description":"","name":"update-campaign"},{"description":"","name":"update-gallery-item"},{"description":"","name":"update-push-campaign"},{"description":"","name":"update-segment"},{"description":"","name":"update-tag"},{"description":"","name":"update-template"},{"description":"","name":"upload-gallery-image"},{"description":"","name":"upsert-postmaster-alert-configs"}],"tools_count":129,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/97ecdf77-aa4c-46eb-9b81-cb1b3325b5c7","uuid":"08170ee6-5004-518e-bb21-644038bf74d8","verification_tier":"community","version":""},"query_key":"everinbox","schema_version":1,"status":"match"}