{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-06-16","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Research Canadian federal politics, legislation, spending, and lobbying with FedMCP. Analyze bills, votes, officials, contracts, grants, economic indicators, and public records. Results link to CanadaGPT sources; knowledge-graph Cypher queries are read-only.","did":"db78c42c-8703-4de2-adc6-cd780b3b0f46","documentation_url":"https://canadagpt.ca/fedmcp","editorial_description":{"extended_description":"Search committee testimony, ATIP requests, consultations, charities, and government organizations. Compare parliamentarian activity, explore money flows or potential conflicts, generate briefings, and maintain bookmarks, collections, or user preferences.","schema_version":1,"summary":"Research Canadian federal politics, legislation, spending, and lobbying with FedMCP.\nAnalyze bills, votes, officials, contracts, grants, economic indicators, and public records.\nResults link to CanadaGPT sources; knowledge-graph Cypher queries are read-only."},"homepage_url":"","icon":"","id":"db78c42c-8703-4de2-adc6-cd780b3b0f46","installs":0,"last_scanned":"","license":"","long_description":"Search committee testimony, ATIP requests, consultations, charities, and government organizations. Compare parliamentarian activity, explore money flows or potential conflicts, generate briefings, and maintain bookmarks, collections, or user preferences.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The description explicitly exposes MATCH/RETURN Cypher over the embedded knowledge graph.","reasoning":"Even read-only arbitrary query execution is a High query capability.","risk_type":"query_execution","severity":"high","title":"User-supplied read-only Cypher can execute against a knowledge graph","triggering_tools_or_skills":["execute_read_cypher"]},{"evidence":"An explicit destructive tool removes personal saved resources.","reasoning":"This is user-data deletion.","risk_type":"data_deletion","severity":"high","title":"Saved bookmarks can be deleted","triggering_tools_or_skills":["delete_bookmark"]},{"evidence":"The inventory includes persistent personal/account writes.","reasoning":"These modify account state.","risk_type":"data_modification","severity":"medium","title":"Bookmarks, collections and preferences can be changed","triggering_tools_or_skills":["create_bookmark","create_collection","update_bookmark","update_user_preferences","submit_feedback"]},{"evidence":"Externally authored public records are returned.","reasoning":"They should remain untrusted.","risk_type":"prompt_injection_exposure","severity":"low","title":"Open-government records and testimony enter model context","triggering_tools_or_skills":["fetch_open_data_resource","search_committee_testimony","search_hansard_semantic"]},{"evidence":"The connector runs at https://fedmcp.canadagpt.ca/mcp without a pinned server implementation in the packet.","reasoning":"The implementation can change independently, so runtime verification and change monitoring remain necessary.","risk_type":"provenance_uncertainty","severity":"low","title":"FedMCP is a mutable hosted service","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"Authentication grants access to personal bookmarks, collections, preferences and feedback; public government datasets remain broadly readable.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/db78c42c-8703-4de2-adc6-cd780b3b0f46.json","what_it_proves":"Candidate PR #125 record identity (name \"FedMCP\", publisher, type web_connector) and 80 stored tool names (truncated vs Directory); no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/db78c42c-8703-4de2-adc6-cd780b3b0f46: complete tool_names inventory (94 tools), remote streamable-http endpoint https://fedmcp.canadagpt.ca/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"FedMCP executes user-supplied Cypher and can delete saved account data.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:db78c42c-8703-4de2-adc6-cd780b3b0f46","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 94 tools. The declared Cypher restriction lowers mutation risk but does not remove arbitrary query execution.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"true","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":94,"tools_or_skills_total":94},"name":"FedMCP","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=db78c42c-8703-4de2-adc6-cd780b3b0f46&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://canadagpt.ca/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Connexxia","publisher_url":"https://connexxia.ai/","remote_url":"https://fedmcp.canadagpt.ca/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Even read-only arbitrary query execution is a High query capability.","evidence":"User-supplied read-only Cypher can execute against a knowledge graph: The description explicitly exposes MATCH/RETURN Cypher over the embedded knowledge graph.","manual_risk_type":"query_execution","remediation":{"block_tool_categories":["code_execution"],"steps":["Run only in a sandbox with least-privilege credentials and strict resource limits.","Disable generic execution gateways unless their reachable action set is fully understood.","Require approval before execution against production systems or sensitive data."]},"risk_type":"runs_code","severity":"high","title":"User-supplied read-only Cypher can execute against a knowledge graph","triggering_tools":["execute_read_cypher"]},{"description":"This connector can permanently remove data or resources. Review findings: This is user-data deletion.","evidence":"Saved bookmarks can be deleted: An explicit destructive tool removes personal saved resources.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Saved bookmarks can be deleted","triggering_tools":["delete_bookmark"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These modify account state.","evidence":"Bookmarks, collections and preferences can be changed: The inventory includes persistent personal/account writes.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Bookmarks, collections and preferences can be changed","triggering_tools":["create_bookmark","create_collection","update_bookmark","update_user_preferences","submit_feedback"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@connexxia.ca","tags":["accesses_calendar","deletes_data","modifies_data","network_access","oauth_required","runs_code","web_connector"],"tools":[{"description":"","name":"analyze_bill_lobbying"},{"description":"","name":"analyze_bill_progress"},{"description":"","name":"analyze_industry_influence"},{"description":"","name":"analyze_mp_bills"},{"description":"","name":"analyze_mp_finances"},{"description":"","name":"analyze_mp_voting_participation"},{"description":"","name":"analyze_party_discipline"},{"description":"","name":"check_mp_lobbying_exposure"},{"description":"","name":"compare_mp_performance"},{"description":"","name":"compare_party_bills"},{"description":"","name":"compare_plan_vs_actual"},{"description":"","name":"conflict_of_interest_check"},{"description":"","name":"create_bookmark","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These modify account state."}},{"description":"","name":"create_collection","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These modify account state."}},{"description":"","name":"delete_bookmark","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: This is user-data deletion."}},{"description":"","name":"detect_conflicts_of_interest"},{"description":"","name":"execute_read_cypher","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Even read-only arbitrary query execution is a High query capability."}},{"description":"","name":"fact_check_claim"},{"description":"","name":"fetch_open_data_resource"},{"description":"","name":"find_cross_references"},{"description":"","name":"find_duplicative_funding"},{"description":"","name":"generate_official_briefing"},{"description":"","name":"get_activity_feed"},{"description":"","name":"get_atip_organization_stats"},{"description":"","name":"get_atip_request"},{"description":"","name":"get_atip_responses"},{"description":"","name":"get_atip_trends"},{"description":"","name":"get_bill_lobbying_analysis"},{"description":"","name":"get_candidate_history"},{"description":"","name":"get_cer_savings"},{"description":"","name":"get_charity_director_network"},{"description":"","name":"get_charity_directors"},{"description":"","name":"get_charity_profile"},{"description":"","name":"get_committee_activity"},{"description":"","name":"get_consultation_stats"},{"description":"","name":"get_debate_with_statements"},{"description":"","name":"get_department_estimates"},{"description":"","name":"get_department_org_chart"},{"description":"","name":"get_department_results"},{"description":"","name":"get_department_spending"},{"description":"","name":"get_economic_indicators"},{"description":"","name":"get_economic_snapshot"},{"description":"","name":"get_economic_time_series"},{"description":"","name":"get_election_summary"},{"description":"","name":"get_enriched_bill"},{"description":"","name":"get_enriched_mp"},{"description":"","name":"get_immigration_snapshot"},{"description":"","name":"get_mp_activity_scorecard"},{"description":"","name":"get_mp_lobbying_contacts"},{"description":"","name":"get_mp_scorecard"},{"description":"","name":"get_open_consultations"},{"description":"","name":"get_open_dataset"},{"description":"","name":"get_parliamentary_calendar"},{"description":"","name":"get_party_standings"},{"description":"","name":"get_province_charity_summary"},{"description":"","name":"get_province_economic_comparison"},{"description":"","name":"get_provincial_transfer_payments"},{"description":"","name":"get_statement_mentions"},{"description":"","name":"get_statutory_forecasts"},{"description":"","name":"get_todays_house_business"},{"description":"","name":"get_top_lobbying_clients"},{"description":"","name":"get_top_spending_departments"},{"description":"","name":"get_trade_by_commodity"},{"description":"","name":"get_trade_summary"},{"description":"","name":"get_user_preferences"},{"description":"","name":"get_user_profile"},{"description":"","name":"government_spending_analysis"},{"description":"","name":"list_bookmarks"},{"description":"","name":"list_collections"},{"description":"","name":"list_my_feedback"},{"description":"","name":"lookup_official_contacts"},{"description":"","name":"prepare_dpoh_meeting_brief"},{"description":"","name":"report_mcp_issue"},{"description":"","name":"search_atip_requests"},{"description":"","name":"search_charities"},{"description":"","name":"search_committee_testimony"},{"description":"","name":"search_consultations"},{"description":"","name":"search_economic_data"},{"description":"","name":"search_election_results"},{"description":"","name":"search_federal_organizations"},{"description":"","name":"search_gc_infobase"},{"description":"","name":"search_hansard_semantic"},{"description":"","name":"search_lobbying_communications"},{"description":"","name":"search_lobbying_registrations"},{"description":"","name":"search_open_data"},{"description":"","name":"search_senior_officials"},{"description":"","name":"search_topic_across_sources"},{"description":"","name":"search_transfer_payment_recipients"},{"description":"","name":"submit_feedback","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These modify account state."}},{"description":"","name":"top_transfer_payment_recipients"},{"description":"","name":"trace_money_flow"},{"description":"","name":"track_committee_activity"},{"description":"","name":"update_bookmark","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These modify account state."}},{"description":"","name":"update_user_preferences","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These modify account state."}}],"tools_count":94,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/db78c42c-8703-4de2-adc6-cd780b3b0f46","uuid":"bbac74ef-cc63-5260-a670-63466dd18f9a","verification_tier":"community","version":""},"query_key":"fedmcp","schema_version":1,"status":"match"}