{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-21","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Find real estate transactions and related records in your Flatre workspace. Review contacts, properties, tasks, approvals, document metadata and safe message previews. Prepare internal tasks, notes, record-change proposals and supported email drafts under workspace controls.","did":"c2ed336c-d810-45f1-a17d-01591efdb547","documentation_url":"https://app.flatre.ai/docs#integrations","editorial_description":{"extended_description":"Available context includes commission summaries, integration status and recent activity. Access follows workspace permissions, OAuth scopes, safety checks and approval requirements. The connector does not expose document contents, attachments, raw email bodies or credentials, and does not provide direct approval or deletion actions.","schema_version":1,"summary":"Find real estate transactions and related records in your Flatre workspace.\nReview contacts, properties, tasks, approvals, document metadata and safe message previews.\nPrepare internal tasks, notes, record-change proposals and supported email drafts under workspace controls."},"homepage_url":"","icon":"","id":"c2ed336c-d810-45f1-a17d-01591efdb547","installs":0,"last_scanned":"","license":"","long_description":"Available context includes commission summaries, integration status and recent activity. Access follows workspace permissions, OAuth scopes, safety checks and approval requirements. The connector does not expose document contents, attachments, raw email bodies or credentials, and does not provide direct approval or deletion actions.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The declared tool sends email from the connected real-estate workflow.","reasoning":"It communicates externally as the user.","risk_type":"messaging_as_user","severity":"high","title":"Sends external email","triggering_tools_or_skills":["send_external_email"]},{"evidence":"The tools persist task/note records.","reasoning":"They change workspace data.","risk_type":"data_modification","severity":"medium","title":"Creates internal tasks and notes","triggering_tools_or_skills":["create_internal_task","record_internal_note"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication covers one Flatre workspace; transaction/contact/email scopes are undocumented.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/c2ed336c-d810-45f1-a17d-01591efdb547.json","what_it_proves":"Candidate PR #125 record identity (name \"Flatre\", publisher, type web_connector) and 19 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/c2ed336c-d810-45f1-a17d-01591efdb547: complete tool_names inventory (19 tools), remote streamable-http endpoint https://api.flatre.ai/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Flatre sends external email and writes tasks, notes and proposed real-estate record updates.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:c2ed336c-d810-45f1-a17d-01591efdb547","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 19 names; proposed updates may require approval, but send_external_email is directly High.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":19,"tools_or_skills_total":19},"name":"Flatre","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=c2ed336c-d810-45f1-a17d-01591efdb547&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://app.flatre.ai/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Flatre","publisher_url":"https://app.flatre.ai/","remote_url":"https://api.flatre.ai/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: It communicates externally as the user.","evidence":"Sends external email: The declared tool sends email from the connected real-estate workflow.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Sends external email","triggering_tools":["send_external_email"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They change workspace data.","evidence":"Creates internal tasks and notes: The tools persist task/note records.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Creates internal tasks and notes","triggering_tools":["create_internal_task","record_internal_note"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://app.flatre.ai/support","tags":["accesses_messaging","modifies_data","network_access","oauth_required","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"create_internal_task","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They change workspace data."}},{"description":"","name":"get_contact"},{"description":"","name":"get_integration_status"},{"description":"","name":"get_transaction"},{"description":"","name":"get_transaction_financial_summary"},{"description":"","name":"list_document_details"},{"description":"","name":"list_pending_approvals"},{"description":"","name":"list_tasks"},{"description":"","name":"propose_contact_update"},{"description":"","name":"propose_property_update"},{"description":"","name":"propose_transaction_update"},{"description":"","name":"record_internal_note","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They change workspace data."}},{"description":"","name":"search_contacts"},{"description":"","name":"search_flatre_workspace"},{"description":"","name":"search_message_previews"},{"description":"","name":"search_properties"},{"description":"","name":"search_transactions"},{"description":"","name":"search_workspace_activity"},{"description":"","name":"send_external_email","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: It communicates externally as the user."}}],"tools_count":19,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/c2ed336c-d810-45f1-a17d-01591efdb547","uuid":"11018f33-1fdb-57e0-b1e1-1088641fb188","verification_tier":"community","version":""},"query_key":"flatre","schema_version":1,"status":"match"}