{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-03","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"high","description":"Analyze email performance and manage your Flodesk audience from Claude. Compare campaigns, engagement trends, segments, signup forms and checkout results. Maintain subscribers and segments, but do not send or schedule emails through this connector.","did":"c7e0a3c8-0f8e-49b3-aa20-23dc5a67a669","documentation_url":"https://help.flodesk.com/en/articles/12573377","editorial_description":{"extended_description":"Inspect subscriber profiles, recipients, segment rules and audience growth. Writes can find or create subscribers, update profile fields, change static-segment membership, unsubscribe people and save filtered segments. Changes or removals marked destructive require confirmation; OAuth limits the connection to your own Flodesk data.","schema_version":1,"summary":"Analyze email performance and manage your Flodesk audience from Claude.\nCompare campaigns, engagement trends, segments, signup forms and checkout results.\nMaintain subscribers and segments, but do not send or schedule emails through this connector."},"homepage_url":"","icon":"","id":"c7e0a3c8-0f8e-49b3-aa20-23dc5a67a669","installs":0,"last_scanned":"","license":"","long_description":"Inspect subscriber profiles, recipients, segment rules and audience growth. Writes can find or create subscribers, update profile fields, change static-segment membership, unsubscribe people and save filtered segments. Changes or removals marked destructive require confirmation; OAuth limits the connection to your own Flodesk data.","manual_assessment":"medium","manual_review":{"all_findings":[{"evidence":"Official Flodesk examples confirm adding/updating subscribers, moving/removing segment membership and unsubscribing, with user confirmation before changes.","reasoning":"These actions alter the user's audience database but do not send campaigns or delete the subscriber record.","risk_type":"data_modification","severity":"medium","title":"Subscriber records and segment membership can be changed","triggering_tools_or_skills":["create_subscriber","update_subscriber","add_subscriber_to_segment","remove_subscriber_from_segment","unsubscribe_subscriber","create_segment"]},{"evidence":"The connector runs at https://mcp.flodesk.com/mcp and no pinned server implementation was available in the review packet.","reasoning":"The hosted implementation and action semantics can change independently of this catalog snapshot, so runtime verification and change monitoring remain necessary.","risk_type":"provenance_uncertainty","severity":"low","title":"Flodesk is a mutable remote service","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"The user signs in to and authorizes a Flodesk account; official docs describe account-scoped audience analytics and management but do not enumerate raw OAuth scopes.","blocked_missing_evidence":null,"confidence":"high","displayed_risk":"medium","evidence_completeness":"partial","manual_overall_risk":"medium","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/c7e0a3c8-0f8e-49b3-aa20-23dc5a67a669.json","what_it_proves":"Candidate PR #125 record identity (name \"Flodesk\", publisher, type web_connector) and 24 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/c7e0a3c8-0f8e-49b3-aa20-23dc5a67a669: complete tool_names inventory (24 tools), remote streamable-http endpoint https://mcp.flodesk.com/mcp, auth_posture auth_required, publisher-declared permissions text, directory tier community"},{"accessed_at":"2026-10-10T21:04:12Z","url_or_path":"https://help.flodesk.com/en/articles/12573377","what_it_proves":"Flodesk documents subscriber creation/update, segment membership changes and unsubscribe actions, with confirmation for changes/removals."}],"primary_reason":"Flodesk can modify subscriber profiles, segments and subscription status, but cannot send a campaign in the declared inventory.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:c7e0a3c8-0f8e-49b3-aa20-23dc5a67a669","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 24 tools and official examples. remove_subscriber_from_segment and unsubscribe_subscriber change membership/status rather than delete the subscriber object, so they remain Medium.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":24,"tools_or_skills_total":24},"name":"Flodesk","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=c7e0a3c8-0f8e-49b3-aa20-23dc5a67a669&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://flodesk.com/legal/privacy-policy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Flodesk Inc.","publisher_url":"https://flodesk.com/","remote_url":"https://mcp.flodesk.com/mcp","repository_url":"","risk":"medium","risk_severity":"medium","security_risks":[{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions alter the user's audience database but do not send campaigns or delete the subscriber record.","evidence":"Subscriber records and segment membership can be changed: Official Flodesk examples confirm adding/updating subscribers, moving/removing segment membership and unsubscribing, with user confirmation before changes.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Subscriber records and segment membership can be changed","triggering_tools":["create_subscriber","update_subscriber","add_subscriber_to_segment","remove_subscriber_from_segment","unsubscribe_subscriber","create_segment"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"mcp@flodesk.com","tags":["modifies_data","network_access","oauth_required","web_connector"],"tools":[{"description":"","name":"add_subscriber_to_segment","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions alter the user's audience database but do not send campaigns or delete the subscriber record."}},{"description":"","name":"create_segment","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions alter the user's audience database but do not send campaigns or delete the subscriber record."}},{"description":"","name":"create_subscriber","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions alter the user's audience database but do not send campaigns or delete the subscriber record."}},{"description":"","name":"flodesk_overview"},{"description":"","name":"get_checkout_totals"},{"description":"","name":"get_email_totals"},{"description":"","name":"get_email_trends"},{"description":"","name":"get_me"},{"description":"","name":"get_send_time_insights"},{"description":"","name":"get_subscriber"},{"description":"","name":"get_subscriber_totals"},{"description":"","name":"get_subscriber_trends"},{"description":"","name":"inspect_segment"},{"description":"","name":"list_email_recipients"},{"description":"","name":"list_segments"},{"description":"","name":"list_subscribers"},{"description":"","name":"preview_segment_count"},{"description":"","name":"rank_emails"},{"description":"","name":"rank_forms"},{"description":"","name":"rank_segments"},{"description":"","name":"rank_workflows"},{"description":"","name":"remove_subscriber_from_segment","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions alter the user's audience database but do not send campaigns or delete the subscriber record."}},{"description":"","name":"unsubscribe_subscriber","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions alter the user's audience database but do not send campaigns or delete the subscriber record."}},{"description":"","name":"update_subscriber","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions alter the user's audience database but do not send campaigns or delete the subscriber record."}}],"tools_count":24,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/c7e0a3c8-0f8e-49b3-aa20-23dc5a67a669","uuid":"0ff82702-1191-5636-a552-d5d7918c5127","verification_tier":"community","version":""},"query_key":"flodesk","schema_version":1,"status":"match"}