{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-08","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Filevine connects project, contact, document, note, and task workflows to Claude. Retrieve records, create or update supported resources, and manage task progress or deadlines. Operations follow the connected user's Filevine permissions.","did":"f2949ce2-7f86-4821-9610-40989cb703f3","documentation_url":"https://developer.filevine.io/docs/v2","editorial_description":{"extended_description":"Tools organize folders and documents, manage project forms or collections, schedule appointments, and configure custom fields. Task actions include assignments, completion, snoozing, and deletion.","schema_version":1,"summary":"Filevine connects project, contact, document, note, and task workflows to Claude.\nRetrieve records, create or update supported resources, and manage task progress or deadlines.\nOperations follow the connected user's Filevine permissions."},"homepage_url":"","icon":"https://us-shard-b.filevineapp.com/public/img/logos/fv-logo-64x64.png","id":"f2949ce2-7f86-4821-9610-40989cb703f3","installs":0,"last_scanned":"","license":"","long_description":"Tools organize folders and documents, manage project forms or collections, schedule appointments, and configure custom fields. Task actions include assignments, completion, snoozing, and deletion.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The 112-tool inventory explicitly deletes Filevine tasks and collection/form taskflow-button resources.","reasoning":"These destructive actions can remove assigned legal work or workflow controls from active matters.","risk_type":"data_deletion","severity":"high","title":"Tasks and taskflow buttons can be deleted","triggering_tools_or_skills":["delete_fv_app_tasks","delete_Collections_TaskflowButtons","delete_Projects_Forms_TaskflowButtons"]},{"evidence":"The connector exposes POST, PATCH, and PUT operations across projects, contacts, documents, notes, folders, appointments, tasks, deadlines, custom fields, and bulk project data.","reasoning":"These writes alter shared legal case records and work assignments.","risk_type":"data_modification","severity":"medium","title":"Legal matters, contacts, documents, notes, tasks, and deadlines can be changed","triggering_tools_or_skills":["patch_fv_app_Projects","patch_fv_app_Contacts","patch_fv_app_Documents","post_fv_app_Notes","post_fv_app_tasks","patch_fv_app_projects_deadlines"]},{"evidence":"The listing and tools provide projects, contacts, documents, notes, emails, tasks, appointments, deadlines, and user access.","reasoning":"Legal case files and client communications can contain highly confidential and privileged information.","risk_type":"private_data_read","severity":"medium","title":"Sensitive legal matter and client data is exposed","triggering_tools_or_skills":["get_fv_app_Projects","get_fv_app_Contacts","get_fv_app_Documents","get_fv_app_projects_emails","get_fv_app_Notes"]},{"evidence":"Search and retrieval tools return client-authored documents, email content, and internal notes.","reasoning":"Matter content is untrusted model input and may contain adversarial instructions.","risk_type":"prompt_injection_exposure","severity":"low","title":"Client documents, emails, and notes enter context","triggering_tools_or_skills":["get_fv_app_DocumentSearch","get_fv_app_projects_emails","get_fv_app_Notes"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication grants the connected user's Filevine API permissions across legal projects, contacts, documents, notes, appointments, tasks, deadlines, and schemas.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/f2949ce2-7f86-4821-9610-40989cb703f3.json","what_it_proves":"Candidate PR #125 record identity (name \"Filevine\", publisher, type web_connector) and 80 stored tool names (truncated vs Directory); no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/f2949ce2-7f86-4821-9610-40989cb703f3: complete tool_names inventory (112 tools), remote streamable-http endpoint https://api.filevineapp.com/mcp/api-v2, auth_posture auth_required, directory tier partner"}],"primary_reason":"Filevine can delete workflow resources and broadly modify highly sensitive legal matter records.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:f2949ce2-7f86-4821-9610-40989cb703f3","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 112 names; exact Filevine role enforcement and document gateway/lock semantics need runtime verification.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":112,"tools_or_skills_total":112},"name":"Filevine","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=f2949ce2-7f86-4821-9610-40989cb703f3&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.filevine.com/legal/privacy-policy/","provisional_risk":null,"publication_recommendation":"accept","publisher":"Filevine","publisher_url":"https://www.filevine.com/","remote_url":"https://api.filevineapp.com/mcp/api-v2","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can permanently remove data or resources. Review findings: These destructive actions can remove assigned legal work or workflow controls from active matters.","evidence":"Tasks and taskflow buttons can be deleted: The 112-tool inventory explicitly deletes Filevine tasks and collection/form taskflow-button resources.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Tasks and taskflow buttons can be deleted","triggering_tools":["delete_fv_app_tasks","delete_Collections_TaskflowButtons","delete_Projects_Forms_TaskflowButtons"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These writes alter shared legal case records and work assignments.","evidence":"Legal matters, contacts, documents, notes, tasks, and deadlines can be changed: The connector exposes POST, PATCH, and PUT operations across projects, contacts, documents, notes, folders, appointments, tasks, deadlines, custom fields, and bulk project data.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Legal matters, contacts, documents, notes, tasks, and deadlines can be changed","triggering_tools":["patch_fv_app_Projects","patch_fv_app_Contacts","patch_fv_app_Documents","post_fv_app_Notes","post_fv_app_tasks","patch_fv_app_projects_deadlines"]},{"description":"This connector can read information available to the connected account and return it to the AI. Review findings: Legal case files and client communications can contain highly confidential and privileged information.","evidence":"Sensitive legal matter and client data is exposed: The listing and tools provide projects, contacts, documents, notes, emails, tasks, appointments, deadlines, and user access.","manual_risk_type":"private_data_read","remediation":{"block_tool_categories":["data_exfiltration"],"steps":["Use a least-privilege account limited to the information required by the workflow.","Restrict folders, projects, tenants, and other data scopes wherever the provider allows it.","Review access logs for unexpected reads or bulk retrieval."]},"risk_type":"reads_private_data","severity":"medium","title":"Sensitive legal matter and client data is exposed","triggering_tools":["get_fv_app_Projects","get_fv_app_Contacts","get_fv_app_Documents","get_fv_app_projects_emails","get_fv_app_Notes"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@filevine.com","tags":["deletes_data","modifies_data","network_access","oauth_required","reads_private_data","web_connector"],"tools":[{"description":"","name":"delete_Collections_TaskflowButtons","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These destructive actions can remove assigned legal work or workflow controls from active matters."}},{"description":"","name":"delete_Projects_Forms_TaskflowButtons","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These destructive actions can remove assigned legal work or workflow controls from active matters."}},{"description":"","name":"delete_fv_app_tasks","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These destructive actions can remove assigned legal work or workflow controls from active matters."}},{"description":"","name":"get_Projects_Collections_TaskflowButtons"},{"description":"","name":"get_Projects_Forms_TaskflowButtons"},{"description":"","name":"get_deadlines_timely_calculations"},{"description":"","name":"get_fv_app_Appointments"},{"description":"","name":"get_fv_app_Contacts","risk":{"category":"data_exfiltration","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can read information available to the connected account and return it to the AI. Review findings: Legal case files and client communications can contain highly confidential and privileged information."}},{"description":"","name":"get_fv_app_Contacts_2"},{"description":"","name":"get_fv_app_Contacts_Countries"},{"description":"","name":"get_fv_app_Contacts_PrimaryLanguages"},{"description":"","name":"get_fv_app_Contacts_addresses"},{"description":"","name":"get_fv_app_Contacts_emailaddresses"},{"description":"","name":"get_fv_app_Contacts_phones"},{"description":"","name":"get_fv_app_Contacts_projects"},{"description":"","name":"get_fv_app_DocumentSearch"},{"description":"","name":"get_fv_app_DocumentSeries"},{"description":"","name":"get_fv_app_Documents","risk":{"category":"data_exfiltration","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can read information available to the connected account and return it to the AI. Review findings: Legal case files and client communications can contain highly confidential and privileged information."}},{"description":"","name":"get_fv_app_Documents_2"},{"description":"","name":"get_fv_app_Folders"},{"description":"","name":"get_fv_app_Folders_2"},{"description":"","name":"get_fv_app_Folders_children"},{"description":"","name":"get_fv_app_Folders_list"},{"description":"","name":"get_fv_app_Notes","risk":{"category":"data_exfiltration","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can read information available to the connected account and return it to the AI. Review findings: Legal case files and client communications can contain highly confidential and privileged information."}},{"description":"","name":"get_fv_app_Notes_2"},{"description":"","name":"get_fv_app_ProjectTypes"},{"description":"","name":"get_fv_app_ProjectTypes_2"},{"description":"","name":"get_fv_app_ProjectTypes_Sections_2"},{"description":"","name":"get_fv_app_ProjectTypes_phases"},{"description":"","name":"get_fv_app_ProjectTypes_sections"},{"description":"","name":"get_fv_app_ProjectTypes_taskflows"},{"description":"","name":"get_fv_app_Projects","risk":{"category":"data_exfiltration","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can read information available to the connected account and return it to the AI. Review findings: Legal case files and client communications can contain highly confidential and privileged information."}},{"description":"","name":"get_fv_app_Projects_2"},{"description":"","name":"get_fv_app_Projects_Appointments"},{"description":"","name":"get_fv_app_Projects_Collections"},{"description":"","name":"get_fv_app_Projects_Collections_2"},{"description":"","name":"get_fv_app_Projects_Forms"},{"description":"","name":"get_fv_app_Projects_Notes"},{"description":"","name":"get_fv_app_Projects_Vitals"},{"description":"","name":"get_fv_app_Projects_contacts"},{"description":"","name":"get_fv_app_RecentlyOpenedDocuments"},{"description":"","name":"get_fv_app_Users"},{"description":"","name":"get_fv_app_Users_Me"},{"description":"","name":"get_fv_app_chaintypes"},{"description":"","name":"get_fv_app_projects_deadlinechains"},{"description":"","name":"get_fv_app_projects_deadlinechains_2"},{"description":"","name":"get_fv_app_projects_deadlines"},{"description":"","name":"get_fv_app_projects_deadlines_2"},{"description":"","name":"get_fv_app_projects_emails","risk":{"category":"data_exfiltration","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can read information available to the connected account and return it to the AI. Review findings: Legal case files and client communications can contain highly confidential and privileged information."}},{"description":"","name":"get_fv_app_projects_tasks"},{"description":"","name":"get_fv_app_tasks"},{"description":"","name":"get_fv_app_users_2"},{"description":"","name":"get_fv_app_users_appointments"},{"description":"","name":"get_fv_app_users_projects_access"},{"description":"","name":"get_fv_app_users_recentprojects"},{"description":"","name":"get_fv_app_users_tasks"},{"description":"","name":"get_fv_app_users_teams"},{"description":"","name":"patch_fv_app_Contacts","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These writes alter shared legal case records and work assignments."}},{"description":"","name":"patch_fv_app_Documents","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These writes alter shared legal case records and work assignments."}},{"description":"","name":"patch_fv_app_Folders"},{"description":"","name":"patch_fv_app_Notes"},{"description":"","name":"patch_fv_app_Projects","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These writes alter shared legal case records and work assignments."}},{"description":"","name":"patch_fv_app_Projects_Collections"},{"description":"","name":"patch_fv_app_Projects_Forms"},{"description":"","name":"patch_fv_app_Projects_contacts"},{"description":"","name":"patch_fv_app_projects_chaindates_update"},{"description":"","name":"patch_fv_app_projects_deadlinechains"},{"description":"","name":"patch_fv_app_projects_deadlines","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These writes alter shared legal case records and work assignments."}},{"description":"","name":"patch_fv_app_tasks"},{"description":"","name":"patch_fv_app_tasks_assign"},{"description":"","name":"post_fv_app_Contacts"},{"description":"","name":"post_fv_app_CustomSections_CustomFields"},{"description":"","name":"post_fv_app_Documents_copy"},{"description":"","name":"post_fv_app_Documents_gateway_claim"},{"description":"","name":"post_fv_app_Documents_lock"},{"description":"","name":"post_fv_app_Documents_move"},{"description":"","name":"post_fv_app_Documents_unlock"},{"description":"","name":"post_fv_app_Folders"},{"description":"","name":"post_fv_app_Notes","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These writes alter shared legal case records and work assignments."}},{"description":"","name":"post_fv_app_Notes_move"},{"description":"","name":"post_fv_app_Notes_pin"},{"description":"","name":"post_fv_app_Notes_unpin"},{"description":"","name":"post_fv_app_ProjectTypes"},{"description":"","name":"post_fv_app_ProjectTypes_sections"},{"description":"","name":"post_fv_app_Projects"},{"description":"","name":"post_fv_app_Projects_Appointments"},{"description":"","name":"post_fv_app_Projects_Collections"},{"description":"","name":"post_fv_app_Projects_DeadlineChains"},{"description":"","name":"post_fv_app_Projects_Documents"},{"description":"","name":"post_fv_app_Projects_contacts"},{"description":"","name":"post_fv_app_Utils_conflictcheck_projects"},{"description":"","name":"post_fv_app_hashtags"},{"description":"","name":"post_fv_app_projects_deadlines"},{"description":"","name":"post_fv_app_projects_notes_pin"},{"description":"","name":"post_fv_app_projects_notes_unpin"},{"description":"","name":"post_fv_app_projects_sectionvisibility"},{"description":"","name":"post_fv_app_projects_tasks_pin"},{"description":"","name":"post_fv_app_projects_tasks_unpin"},{"description":"","name":"post_fv_app_tasks","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These writes alter shared legal case records and work assignments."}},{"description":"","name":"post_fv_app_tasks_complete"},{"description":"","name":"post_fv_app_tasks_pin"},{"description":"","name":"post_fv_app_tasks_uncomplete"},{"description":"","name":"post_fv_app_tasks_unpin"},{"description":"","name":"post_fv_app_utils_GetUserOrgsWithToken"},{"description":"","name":"post_timely_calculations_deadlines"},{"description":"","name":"put_Projects_Collections_TaskflowButtons"},{"description":"","name":"put_Projects_Forms_TaskflowButtons"},{"description":"","name":"put_fv_app_CustomFields"},{"description":"","name":"put_fv_app_CustomSections"},{"description":"","name":"put_fv_app_ProjectTypes"},{"description":"","name":"put_fv_app_projects_bulk"},{"description":"","name":"put_fv_app_tasks_snooze"}],"tools_count":112,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/f2949ce2-7f86-4821-9610-40989cb703f3","uuid":"825c896f-0c77-5ddb-85a9-dd342a5222c5","verification_tier":"partner","version":""},"query_key":"filevine filevine","schema_version":1,"status":"match"}