{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-25","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"FlowyTeam connects Claude to tasks, projects, OKRs, employees, and attendance. Create or update work records, track performance cycles, and clock in or out. Operations use your live workspace and existing role permissions.","did":"46ecb069-ba8e-4d09-996f-a361d648d2e9","documentation_url":"https://flowyteam.com/mcp-docs","editorial_description":{"extended_description":"Tools also delete supported tasks, projects, and objectives. Connection uses OAuth.","schema_version":1,"summary":"FlowyTeam connects Claude to tasks, projects, OKRs, employees, and attendance.\nCreate or update work records, track performance cycles, and clock in or out.\nOperations use your live workspace and existing role permissions."},"homepage_url":"","icon":"","id":"46ecb069-ba8e-4d09-996f-a361d648d2e9","installs":0,"last_scanned":"","license":"","long_description":"Tools also delete supported tasks, projects, and objectives. Connection uses OAuth.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The complete inventory contains explicit deletion of core workspace records.","reasoning":"These deletions can remove shared organizational goals and operational work.","risk_type":"data_deletion","severity":"high","title":"Deletes live objectives, projects and tasks","triggering_tools_or_skills":["flowyteam_delete_objective","flowyteam_delete_project","flowyteam_delete_task"]},{"evidence":"The connector manages employee records under existing workspace roles.","reasoning":"Employee administration is a privileged organization action involving personal/workforce data.","risk_type":"credential_admin","severity":"high","title":"Creates and updates employee records under privileged roles","triggering_tools_or_skills":["flowyteam_create_employee","flowyteam_update_employee"]}],"assessment_status":"provisional","auth_and_scopes":"OAuth applies existing FlowyTeam roles and permissions to live tasks, projects, OKRs, employees, performance cycles and attendance.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"complete","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/46ecb069-ba8e-4d09-996f-a361d648d2e9.json","what_it_proves":"Candidate PR #125 record identity (name \"FlowyTeam\", publisher, type web_connector) and 31 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/46ecb069-ba8e-4d09-996f-a361d648d2e9: complete tool_names inventory (31 tools), remote streamable-http endpoint https://flowyteam.com/api/mcp/cloud/rpc, auth_posture auth_required, directory tier community"}],"primary_reason":"FlowyTeam can delete shared work/OKR records and administer employee data.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:46ecb069-ba8e-4d09-996f-a361d648d2e9","reviewed_at":"2026-10-10","reviewer_notes":"Preserve confirmations for deletes, employee changes and attendance edits.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"true","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":31,"tools_or_skills_total":31},"name":"FlowyTeam","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=46ecb069-ba8e-4d09-996f-a361d648d2e9&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://flowyteam.com/page/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"FlowyTeam","publisher_url":"https://flowyteam.com/","remote_url":"https://flowyteam.com/api/mcp/cloud/rpc","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can permanently remove data or resources. Review findings: These deletions can remove shared organizational goals and operational work.","evidence":"Deletes live objectives, projects and tasks: The complete inventory contains explicit deletion of core workspace records.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Deletes live objectives, projects and tasks","triggering_tools":["flowyteam_delete_objective","flowyteam_delete_project","flowyteam_delete_task"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Employee administration is a privileged organization action involving personal/workforce data.","evidence":"Creates and updates employee records under privileged roles: The connector manages employee records under existing workspace roles.","manual_risk_type":"credential_admin","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"high","title":"Creates and updates employee records under privileged roles","triggering_tools":["flowyteam_create_employee","flowyteam_update_employee"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"heloo@flowyteam.com","tags":["deletes_data","modifies_data","network_access","oauth_required","web_connector"],"tools":[{"description":"","name":"flowyteam_clock_in"},{"description":"","name":"flowyteam_clock_out"},{"description":"","name":"flowyteam_create_employee","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Employee administration is a privileged organization action involving personal/workforce data."}},{"description":"","name":"flowyteam_create_key_result"},{"description":"","name":"flowyteam_create_objective"},{"description":"","name":"flowyteam_create_performance_cycle"},{"description":"","name":"flowyteam_create_project"},{"description":"","name":"flowyteam_create_task"},{"description":"","name":"flowyteam_delete_objective","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These deletions can remove shared organizational goals and operational work."}},{"description":"","name":"flowyteam_delete_project","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These deletions can remove shared organizational goals and operational work."}},{"description":"","name":"flowyteam_delete_task","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These deletions can remove shared organizational goals and operational work."}},{"description":"","name":"flowyteam_get_attendance"},{"description":"","name":"flowyteam_get_employee"},{"description":"","name":"flowyteam_get_key_result"},{"description":"","name":"flowyteam_get_objective"},{"description":"","name":"flowyteam_get_performance_cycle"},{"description":"","name":"flowyteam_get_project"},{"description":"","name":"flowyteam_get_task"},{"description":"","name":"flowyteam_list_attendance"},{"description":"","name":"flowyteam_list_employees"},{"description":"","name":"flowyteam_list_key_results"},{"description":"","name":"flowyteam_list_objectives"},{"description":"","name":"flowyteam_list_performance_cycles"},{"description":"","name":"flowyteam_list_projects"},{"description":"","name":"flowyteam_list_tasks"},{"description":"","name":"flowyteam_update_employee","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Employee administration is a privileged organization action involving personal/workforce data."}},{"description":"","name":"flowyteam_update_key_result"},{"description":"","name":"flowyteam_update_objective"},{"description":"","name":"flowyteam_update_performance_cycle"},{"description":"","name":"flowyteam_update_project"},{"description":"","name":"flowyteam_update_task"}],"tools_count":31,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/46ecb069-ba8e-4d09-996f-a361d648d2e9","uuid":"d1b3b90e-951c-5e31-9ab0-48edac5621f8","verification_tier":"community","version":""},"query_key":"flowyteam","schema_version":1,"status":"match"}