{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-12","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"high","description":"Exchange Server by Postgate AI connects Claude to on-premises or hybrid Microsoft Exchange. Read and send mail, manage calendars, contacts, tasks, folders, and attachments. Each user authenticates individually and acts under existing Exchange permissions.","did":"88a9d97f-b5cc-4db3-a6fd-8093b6890521","documentation_url":"https://postgate-ai.com/mcp-server-exchange","editorial_description":{"extended_description":"Supported servers include SE, 2019, and 2016 via EWS. Tools handle meeting responses, inbox rules, out-of-office settings, mailbox statistics, and briefings, including deletion or folder-emptying actions.","schema_version":1,"summary":"Exchange Server by Postgate AI connects Claude to on-premises or hybrid Microsoft Exchange.\nRead and send mail, manage calendars, contacts, tasks, folders, and attachments.\nEach user authenticates individually and acts under existing Exchange permissions."},"homepage_url":"","icon":"","id":"88a9d97f-b5cc-4db3-a6fd-8093b6890521","installs":0,"last_scanned":"","license":"","long_description":"Supported servers include SE, 2019, and 2016 via EWS. Tools handle meeting responses, inbox rules, out-of-office settings, mailbox statistics, and briefings, including deletion or folder-emptying actions.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"These tools communicate externally from the user’s Exchange identity.","reasoning":"They can send authoritative business messages and meeting decisions.","risk_type":"messaging_as_user","severity":"high","title":"Sends, replies to and forwards email and meeting responses","triggering_tools_or_skills":["send_email","send_draft","reply_email","forward_email","respond_to_meeting"]},{"evidence":"The inventory contains numerous explicit destructive mailbox tools.","reasoning":"Deletion can irreversibly remove business records or automation.","risk_type":"data_deletion","severity":"high","title":"Deletes mail, appointments, calendars, contacts, tasks, attachments and inbox rules","triggering_tools_or_skills":["delete_email","delete_appointment","delete_calendar","delete_contact","delete_task","delete_attachment","inbox_rule_delete","empty_folder"]},{"evidence":"These actions control automated mailbox behavior and account-level communication settings.","reasoning":"Malicious rules can redirect, suppress or manipulate future mail handling.","risk_type":"credential_admin","severity":"high","title":"Creates and changes server-side inbox rules and mailbox settings","triggering_tools_or_skills":["inbox_rule_create","inbox_rule_update","update_mailbox_settings","oof_settings"]},{"evidence":"The connector transfers mailbox files into and out of Exchange workflows.","reasoning":"Attachments can contain sensitive data and writes modify outgoing drafts.","risk_type":"file_write","severity":"medium","title":"Adds/downloads/reads attachments","triggering_tools_or_skills":["add_attachment","attach_email_to_draft","download_attachment"]}],"assessment_status":"provisional","auth_and_scopes":"OAuth 2.0/PKCE uses each user’s existing Exchange permissions; credentials are stored in a per-user encrypted vault.","blocked_missing_evidence":null,"confidence":"high","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/88a9d97f-b5cc-4db3-a6fd-8093b6890521.json","what_it_proves":"Candidate PR #125 record identity (name \"Exchange Server by Postgate AI\", publisher, type web_connector) and 70 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/88a9d97f-b5cc-4db3-a6fd-8093b6890521: complete tool_names inventory (70 tools), remote streamable-http endpoint https://mcp.postgate-ai.com/, auth_posture auth_required, publisher-declared permissions text, declared sensitive data types, directory tier community"},{"accessed_at":"2026-10-10T21:17:31Z","url_or_path":"https://postgate-ai.com/mcp-server-exchange","what_it_proves":"Official product documentation confirms delegated per-user access to Exchange mail, calendar, contacts, tasks and folders."},{"accessed_at":"2026-10-10T21:17:31Z","url_or_path":"https://postgate-ai.com/features","what_it_proves":"Official feature list confirms server-side inbox rule creation/list/deletion and a broad mailbox action surface."}],"primary_reason":"Postgate Exchange can send mail, delete mailbox resources and administer server-side rules/settings.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:88a9d97f-b5cc-4db3-a6fd-8093b6890521","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 70 listed tools. The official site now says 90+ tools, so the Directory inventory is stale/incomplete even though listed tools already establish High risk.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"true","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"true","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":70,"tools_or_skills_total":70},"name":"Exchange Server by Postgate AI","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=88a9d97f-b5cc-4db3-a6fd-8093b6890521&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://postgate-ai.com/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Postgate AI","publisher_url":"https://postgate-ai.com/","remote_url":"https://mcp.postgate-ai.com/","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: They can send authoritative business messages and meeting decisions.","evidence":"Sends, replies to and forwards email and meeting responses: These tools communicate externally from the user’s Exchange identity.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Sends, replies to and forwards email and meeting responses","triggering_tools":["send_email","send_draft","reply_email","forward_email","respond_to_meeting"]},{"description":"This connector can permanently remove data or resources. Review findings: Deletion can irreversibly remove business records or automation.","evidence":"Deletes mail, appointments, calendars, contacts, tasks, attachments and inbox rules: The inventory contains numerous explicit destructive mailbox tools.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Deletes mail, appointments, calendars, contacts, tasks, attachments and inbox rules","triggering_tools":["delete_email","delete_appointment","delete_calendar","delete_contact","delete_task","delete_attachment","inbox_rule_delete","empty_folder"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Malicious rules can redirect, suppress or manipulate future mail handling.","evidence":"Creates and changes server-side inbox rules and mailbox settings: These actions control automated mailbox behavior and account-level communication settings.","manual_risk_type":"credential_admin","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"high","title":"Creates and changes server-side inbox rules and mailbox settings","triggering_tools":["inbox_rule_create","inbox_rule_update","update_mailbox_settings","oof_settings"]},{"description":"This connector can create, change, export, or otherwise write files. Review findings: Attachments can contain sensitive data and writes modify outgoing drafts.","evidence":"Adds/downloads/reads attachments: The connector transfers mailbox files into and out of Exchange workflows.","manual_risk_type":"file_write","remediation":{"block_tool_categories":["state_change"],"steps":["Limit file access to a dedicated working directory.","Review generated or modified files before they are shared or executed."]},"risk_type":"filesystem_access","severity":"medium","title":"Adds/downloads/reads attachments","triggering_tools":["add_attachment","attach_email_to_draft","download_attachment"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@postgate-ai.com","tags":["accesses_calendar","accesses_messaging","deletes_data","filesystem_access","modifies_data","network_access","oauth_required","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"add_attachment","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: Attachments can contain sensitive data and writes modify outgoing drafts."}},{"description":"","name":"analyze_contacts"},{"description":"","name":"attach_email_to_draft","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: Attachments can contain sensitive data and writes modify outgoing drafts."}},{"description":"","name":"bulk_email_operation"},{"description":"","name":"check_availability"},{"description":"","name":"complete_task"},{"description":"","name":"copy_email"},{"description":"","name":"create_appointment"},{"description":"","name":"create_calendar"},{"description":"","name":"create_contact"},{"description":"","name":"create_draft"},{"description":"","name":"create_forward_draft"},{"description":"","name":"create_reply_draft"},{"description":"","name":"create_task"},{"description":"","name":"delete_appointment","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion can irreversibly remove business records or automation."}},{"description":"","name":"delete_attachment","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion can irreversibly remove business records or automation."}},{"description":"","name":"delete_calendar","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion can irreversibly remove business records or automation."}},{"description":"","name":"delete_contact","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion can irreversibly remove business records or automation."}},{"description":"","name":"delete_email","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion can irreversibly remove business records or automation."}},{"description":"","name":"delete_task","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion can irreversibly remove business records or automation."}},{"description":"","name":"download_attachment","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: Attachments can contain sensitive data and writes modify outgoing drafts."}},{"description":"","name":"expand_distribution_list"},{"description":"","name":"find_folder"},{"description":"","name":"find_meeting_times"},{"description":"","name":"find_person"},{"description":"","name":"forward_email","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: They can send authoritative business messages and meeting decisions."}},{"description":"","name":"get_calendar"},{"description":"","name":"get_email_details"},{"description":"","name":"get_email_mime"},{"description":"","name":"get_emails_bulk"},{"description":"","name":"get_mailbox_settings"},{"description":"","name":"get_tasks"},{"description":"","name":"list_attachments"},{"description":"","name":"list_calendars"},{"description":"","name":"list_folders"},{"description":"","name":"list_room_lists"},{"description":"","name":"list_rooms"},{"description":"","name":"manage_folder"},{"description":"","name":"move_email"},{"description":"","name":"oof_settings","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Malicious rules can redirect, suppress or manipulate future mail handling."}},{"description":"","name":"read_attachment"},{"description":"","name":"read_emails"},{"description":"","name":"reply_email","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: They can send authoritative business messages and meeting decisions."}},{"description":"","name":"respond_to_meeting","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: They can send authoritative business messages and meeting decisions."}},{"description":"","name":"search_by_conversation"},{"description":"","name":"search_emails"},{"description":"","name":"send_draft","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: They can send authoritative business messages and meeting decisions."}},{"description":"","name":"send_email","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: They can send authoritative business messages and meeting decisions."}},{"description":"","name":"update_appointment"},{"description":"","name":"update_contact"},{"description":"","name":"update_email"},{"description":"","name":"update_mailbox_settings","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Malicious rules can redirect, suppress or manipulate future mail handling."}},{"description":"","name":"update_task"},{"description":"","name":"archive_email"},{"description":"","name":"empty_folder","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion can irreversibly remove business records or automation."}},{"description":"","name":"generate_briefing"},{"description":"","name":"get_mail_tips"},{"description":"","name":"get_mailbox_statistics"},{"description":"","name":"inbox_rule_create","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Malicious rules can redirect, suppress or manipulate future mail handling."}},{"description":"","name":"inbox_rule_list"},{"description":"","name":"inbox_rule_update","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Malicious rules can redirect, suppress or manipulate future mail handling."}},{"description":"","name":"move_to_trash"},{"description":"","name":"prepare_meeting"},{"description":"","name":"report_junk"},{"description":"","name":"resolve_names"},{"description":"","name":"set_flag"},{"description":"","name":"set_reminder"},{"description":"","name":"sync_folders"},{"description":"","name":"sync_items"},{"description":"","name":"inbox_rule_delete","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion can irreversibly remove business records or automation."}}],"tools_count":70,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/88a9d97f-b5cc-4db3-a6fd-8093b6890521","uuid":"b04d04cd-78cd-5d61-bd48-b6f4b1e026ff","verification_tier":"community","version":""},"query_key":"exchange server by postgate ai","schema_version":1,"status":"match"}