{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-04","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Interactive Connector","confidence":"medium","description":"Organize notes, lists, plans, and projects as nested tiles in Everythings. Search saved information, create or rearrange items, and maintain shared workspaces. Comment and react with family or teammates across web and mobile apps.","did":"d4a47eed-46a3-478f-921b-4575a7d17edf","documentation_url":"https://www.everythings.app/docs","editorial_description":{"extended_description":"Inspect recent changes, copy or move items, reorder tiles, and manage workspaces. Deleted items can be found in trash and restored; comments and marks support collaboration.","schema_version":1,"summary":"Organize notes, lists, plans, and projects as nested tiles in Everythings.\nSearch saved information, create or rearrange items, and maintain shared workspaces.\nComment and react with family or teammates across web and mobile apps."},"homepage_url":"","icon":"https://wtjyswuabjgietulgedb.supabase.co/storage/v1/object/public/public-assets/general/icon_96.png","id":"d4a47eed-46a3-478f-921b-4575a7d17edf","installs":0,"last_scanned":"","license":"","long_description":"Inspect recent changes, copy or move items, reorder tiles, and manage workspaces. Deleted items can be found in trash and restored; comments and marks support collaboration.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The complete inventory explicitly declares delete_thing and trash/restore operations.","reasoning":"Removing shared workspace content is destructive.","risk_type":"data_deletion","severity":"high","title":"Workspace items can be deleted","triggering_tools_or_skills":["delete_thing"]},{"evidence":"The description says family/team members share the space and can comment on content.","reasoning":"Posting a comment communicates externally as the user.","risk_type":"messaging_as_user","severity":"high","title":"Comments can be posted to shared workspaces","triggering_tools_or_skills":["add_comment"]},{"evidence":"Declared tools persist and organize shared information.","reasoning":"These materially change workspace data.","risk_type":"data_modification","severity":"medium","title":"Workspaces and tiles can be created, updated, moved and reordered","triggering_tools_or_skills":["create_workspace","create_thing","update_thing","move_thing","reorder_things"]},{"evidence":"The connector returns family/team-authored workspace content.","reasoning":"Shared content should be treated as untrusted.","risk_type":"prompt_injection_exposure","severity":"low","title":"Shared tiles and comments enter model context","triggering_tools_or_skills":["fetch","get_thing","list_comments","search"]},{"evidence":"The connector runs at https://www.everythings.app/api/mcp without a pinned server implementation in the packet.","reasoning":"The implementation can change independently of this review, so runtime verification and change monitoring remain necessary.","risk_type":"provenance_uncertainty","severity":"low","title":"Everythings is a mutable hosted service","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"Authentication connects the user's personal/family/team workspaces; exact member roles and delete permissions are not published.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/d4a47eed-46a3-478f-921b-4575a7d17edf.json","what_it_proves":"Candidate PR #125 record identity (name \"Everythings\", publisher, type interactive_connector) and 26 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/d4a47eed-46a3-478f-921b-4575a7d17edf: complete tool_names inventory (26 tools), remote streamable-http endpoint https://www.everythings.app/api/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Everythings can delete shared items, post comments and broadly modify collaborative workspaces.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:d4a47eed-46a3-478f-921b-4575a7d17edf","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 26 tools. fetch appears to retrieve an item rather than an arbitrary URL based on the surrounding complete inventory; its schema should still be verified at runtime.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":26,"tools_or_skills_total":26},"name":"Everythings","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=d4a47eed-46a3-478f-921b-4575a7d17edf&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.everythings.app/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Vis Media","publisher_url":"https://www.vis.works/","remote_url":"https://www.everythings.app/api/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can permanently remove data or resources. Review findings: Removing shared workspace content is destructive.","evidence":"Workspace items can be deleted: The complete inventory explicitly declares delete_thing and trash/restore operations.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Workspace items can be deleted","triggering_tools":["delete_thing"]},{"description":"This connector can publish or send messages and content using the connected identity. Review findings: Posting a comment communicates externally as the user.","evidence":"Comments can be posted to shared workspaces: The description says family/team members share the space and can comment on content.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Comments can be posted to shared workspaces","triggering_tools":["add_comment"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These materially change workspace data.","evidence":"Workspaces and tiles can be created, updated, moved and reordered: Declared tools persist and organize shared information.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Workspaces and tiles can be created, updated, moved and reordered","triggering_tools":["create_workspace","create_thing","update_thing","move_thing","reorder_things"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@everythings.app","tags":["deletes_data","interactive_connector","modifies_data","network_access","oauth_required","sends_messages_as_you"],"tools":[{"description":"","name":"add_comment","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Posting a comment communicates externally as the user."}},{"description":"","name":"add_mark"},{"description":"","name":"copy_thing"},{"description":"","name":"create_thing","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These materially change workspace data."}},{"description":"","name":"create_workspace","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These materially change workspace data."}},{"description":"","name":"delete_thing","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Removing shared workspace content is destructive."}},{"description":"","name":"fetch"},{"description":"","name":"get_thing"},{"description":"","name":"get_thing_view"},{"description":"","name":"get_workspace"},{"description":"","name":"get_workspace_view"},{"description":"","name":"list_child_things"},{"description":"","name":"list_comments"},{"description":"","name":"list_marks"},{"description":"","name":"list_things"},{"description":"","name":"list_trash"},{"description":"","name":"list_workspaces"},{"description":"","name":"move_thing","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These materially change workspace data."}},{"description":"","name":"recent_things"},{"description":"","name":"remove_mark"},{"description":"","name":"rename_workspace"},{"description":"","name":"reorder_things","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These materially change workspace data."}},{"description":"","name":"restore_thing"},{"description":"","name":"search"},{"description":"","name":"search_things"},{"description":"","name":"update_thing","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These materially change workspace data."}}],"tools_count":26,"transport":"streamable-http","type":"interactive_connector","url":"https://claude.ai/directory/d4a47eed-46a3-478f-921b-4575a7d17edf","uuid":"06842bc1-a6b8-59bf-99bc-e81ee0e6c06d","verification_tier":"community","version":""},"query_key":"everythings","schema_version":1,"status":"match"}