{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-30","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Flowera builds customer-chat assistants through its AgentFlow editor. Create or revise nodes, connect models, validate flows, and run test messages. A Flowera account is required, with separate permissions for reading, editing, running, and history access.","did":"7c4d4910-6a9f-4432-8bb8-0156c4b4653c","documentation_url":"https://portal.flowera.ai/docs/agentflow/advanced/build-via-mcp","editorial_description":{"extended_description":"Tools also manage flow variables and webhooks, inspect execution records, and retrieve collected leads or messages. Access is tied to the workspace selected at sign-in; credential listing has its own permission.","schema_version":1,"summary":"Flowera builds customer-chat assistants through its AgentFlow editor.\nCreate or revise nodes, connect models, validate flows, and run test messages.\nA Flowera account is required, with separate permissions for reading, editing, running, and history access."},"homepage_url":"","icon":"","id":"7c4d4910-6a9f-4432-8bb8-0156c4b4653c","installs":0,"last_scanned":"","license":"","long_description":"Tools also manage flow variables and webhooks, inspect execution records, and retrieve collected leads or messages. Access is tied to the workspace selected at sign-in; credential listing has its own permission.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"Official docs say AgentFlows talk to customers and support WhatsApp/Instagram/batch campaign triggers.","reasoning":"Running such a configured flow can send external communications as the business.","risk_type":"messaging_as_user","severity":"high","title":"Runs/triggers flows that can message WhatsApp, Instagram and bulk recipients","triggering_tools_or_skills":["run_agentflow","trigger_webhook"]},{"evidence":"The MCP performs the same create/update/run operations as the production visual automation builder.","reasoning":"It materially configures deployable customer-facing automation.","risk_type":"deployment_infrastructure","severity":"high","title":"Builds and changes live automation flows/webhooks","triggering_tools_or_skills":["create_agentflow","generate_agentflow","set_webhook","update_agentflow","set_node_model"]},{"evidence":"The inventory explicitly removes durable automation/configuration resources.","reasoning":"These destructive actions can break live automations.","risk_type":"data_deletion","severity":"high","title":"Deletes flows, nodes, webhooks and state variables","triggering_tools_or_skills":["delete_agentflow","delete_node","delete_webhook","delete_flow_state_variable"]},{"evidence":"Official docs say MCP chooses existing provider credentials and nodes may invoke arbitrary remote MCP actions with authorization headers.","reasoning":"Binding credentials/integrations is privileged security configuration.","risk_type":"credential_admin","severity":"high","title":"Binds existing credentials/models and outbound integration endpoints","triggering_tools_or_skills":["set_node_model","set_webhook","update_node"]},{"evidence":"Official Custom MCP node docs allow configured remote servers and selected actions.","reasoning":"The 36 builder tools cannot enumerate the downstream effects of each user-defined flow.","risk_type":"generic_gateway","severity":"low","title":"Node configuration can invoke arbitrary enabled external actions","triggering_tools_or_skills":["add_node","update_node","run_agentflow"]}],"assessment_status":"provisional","auth_and_scopes":"A Flowera API key authenticates the workspace; MCP may select existing connected accounts/credentials but cannot create new channel credentials itself.","blocked_missing_evidence":"Resolved node/action/credential manifest per flow, spend/code/network scopes, recipient confirmation and safeguards for run_agentflow/trigger_webhook.","confidence":"medium","displayed_risk":"high","evidence_completeness":"insufficient","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/7c4d4910-6a9f-4432-8bb8-0156c4b4653c.json","what_it_proves":"Candidate PR #125 record identity (name \"Flowera\", publisher, type web_connector) and 36 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/7c4d4910-6a9f-4432-8bb8-0156c4b4653c: complete tool_names inventory (36 tools), remote streamable-http endpoint https://portal.flowera.ai/api/v1/mcp, auth_posture auth_required, directory tier community"},{"accessed_at":"2026-10-11T02:17:00Z","url_or_path":"https://portal.flowera.ai/docs/tr/agentflow/advanced/build-via-mcp/","what_it_proves":"Official MCP guide says clients can create/update/delete/import flows, choose credentials/models, run test messages and trigger webhooks just like the visual builder."},{"accessed_at":"2026-10-11T02:17:00Z","url_or_path":"https://portal.flowera.ai/docs/agentflow/nodes/start-triggers/","what_it_proves":"Official trigger guide documents WhatsApp/Instagram replies, scheduled runs and bulk per-recipient campaigns."},{"accessed_at":"2026-10-11T02:17:00Z","url_or_path":"https://portal.flowera.ai/docs/agentflow/nodes/tools/mcp/","what_it_proves":"Official node docs say a flow can load enabled actions from arbitrary remote MCP servers using stored authorization headers."}],"primary_reason":"Flowera builds/runs/deletes customer-facing automations and can invoke arbitrary configured integration actions, so each flow has a hidden action surface.","provisional_risk":null,"publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:7c4d4910-6a9f-4432-8bb8-0156c4b4653c","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 36 builder tools and official flow/trigger docs. Explicit High messaging/deployment/deletion is established; possible code/spend effects remain unknown.","risk_domains":{"arbitrary_network_access":"true","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"true","deletes_data":"true","deployment_or_infrastructure":"true","dynamic_hidden_actions":"true","filesystem_or_repo_access":"true","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"unknown","sends_messages_as_user":"true","spends_or_moves_money":"unknown"},"tools_or_skills_reviewed":36,"tools_or_skills_total":36},"name":"Flowera","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=7c4d4910-6a9f-4432-8bb8-0156c4b4653c&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://flowera.ai/privacy-policy","provisional_risk":null,"publication_recommendation":"fix","publisher":"Flowera","publisher_url":"https://flowera.ai/","remote_url":"https://portal.flowera.ai/api/v1/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: Running such a configured flow can send external communications as the business.","evidence":"Runs/triggers flows that can message WhatsApp, Instagram and bulk recipients: Official docs say AgentFlows talk to customers and support WhatsApp/Instagram/batch campaign triggers.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Runs/triggers flows that can message WhatsApp, Instagram and bulk recipients","triggering_tools":["run_agentflow","trigger_webhook"]},{"description":"This connector can deploy code or change infrastructure and production environments. Review findings: It materially configures deployable customer-facing automation.","evidence":"Builds and changes live automation flows/webhooks: The MCP performs the same create/update/run operations as the production visual automation builder.","manual_risk_type":"deployment_infrastructure","remediation":{"block_tool_categories":["code_execution","state_change"],"steps":["Default to a sandbox or staging environment.","Require code review, human approval, audit logging, and a tested rollback path for production changes."]},"risk_type":"code_deployment","severity":"high","title":"Builds and changes live automation flows/webhooks","triggering_tools":["create_agentflow","generate_agentflow","set_webhook","update_agentflow","set_node_model"]},{"description":"This connector can permanently remove data or resources. Review findings: These destructive actions can break live automations.","evidence":"Deletes flows, nodes, webhooks and state variables: The inventory explicitly removes durable automation/configuration resources.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Deletes flows, nodes, webhooks and state variables","triggering_tools":["delete_agentflow","delete_node","delete_webhook","delete_flow_state_variable"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Binding credentials/integrations is privileged security configuration.","evidence":"Binds existing credentials/models and outbound integration endpoints: Official docs say MCP chooses existing provider credentials and nodes may invoke arbitrary remote MCP actions with authorization headers.","manual_risk_type":"credential_admin","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"high","title":"Binds existing credentials/models and outbound integration endpoints","triggering_tools":["set_node_model","set_webhook","update_node"]},{"description":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: The 36 builder tools cannot enumerate the downstream effects of each user-defined flow.","evidence":"Node configuration can invoke arbitrary enabled external actions: Official Custom MCP node docs allow configured remote servers and selected actions.","manual_risk_type":"generic_gateway","remediation":{"block_tool_categories":["code_execution"],"steps":["Run only in a sandbox with least-privilege credentials and strict resource limits.","Disable generic execution gateways unless their reachable action set is fully understood.","Require approval before execution against production systems or sensitive data."]},"risk_type":"runs_code","severity":"low","title":"Node configuration can invoke arbitrary enabled external actions","triggering_tools":["add_node","update_node","run_agentflow"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"hello@flowera.ai","tags":["accesses_messaging","code_deployment","deletes_data","modifies_data","network_access","oauth_required","runs_code","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"add_node"},{"description":"","name":"connect_nodes"},{"description":"","name":"create_agentflow","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: It materially configures deployable customer-facing automation."}},{"description":"","name":"delete_agentflow","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These destructive actions can break live automations."}},{"description":"","name":"delete_flow_state_variable","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These destructive actions can break live automations."}},{"description":"","name":"delete_node","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These destructive actions can break live automations."}},{"description":"","name":"delete_webhook","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These destructive actions can break live automations."}},{"description":"","name":"disconnect_nodes"},{"description":"","name":"export_agentflow"},{"description":"","name":"generate_agentflow","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: It materially configures deployable customer-facing automation."}},{"description":"","name":"get_agentflow"},{"description":"","name":"get_connections"},{"description":"","name":"get_execution"},{"description":"","name":"get_flow_state"},{"description":"","name":"get_node"},{"description":"","name":"get_node_schema"},{"description":"","name":"get_webhooks"},{"description":"","name":"import_agentflow"},{"description":"","name":"list_agentflows"},{"description":"","name":"list_credentials"},{"description":"","name":"list_executions"},{"description":"","name":"list_leads"},{"description":"","name":"list_llm_models"},{"description":"","name":"list_messages"},{"description":"","name":"list_nodes"},{"description":"","name":"rename_node"},{"description":"","name":"resolve_node_options"},{"description":"","name":"run_agentflow","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Running such a configured flow can send external communications as the business."}},{"description":"","name":"set_flow_state_variable"},{"description":"","name":"set_node_model","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Binding credentials/integrations is privileged security configuration."}},{"description":"","name":"set_node_state_updates"},{"description":"","name":"set_webhook","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Binding credentials/integrations is privileged security configuration."}},{"description":"","name":"trigger_webhook","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Running such a configured flow can send external communications as the business."}},{"description":"","name":"update_agentflow","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: It materially configures deployable customer-facing automation."}},{"description":"","name":"update_node","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Binding credentials/integrations is privileged security configuration."}},{"description":"","name":"validate_agentflow"}],"tools_count":36,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/7c4d4910-6a9f-4432-8bb8-0156c4b4653c","uuid":"31f7eb20-758f-5f17-adf0-b85a79f96a19","verification_tier":"community","version":""},"query_key":"flowera flowera","schema_version":1,"status":"match"}