{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-27","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"reviewed","auth_posture":"auth_required","category":"Web Connector","confidence":"high","description":"Ask Claude about Fluix tasks, document status and completed-form data. Investigate overdue work, outstanding signatures and process progress. Access is read-only and requires a plan with the MCP Server feature enabled.","did":"00ba5af4-4c29-4466-802c-c403d2153706","documentation_url":"https://fluix.io/help/connecting-fluix-to-claude","editorial_description":{"extended_description":"The connector provides task-report rows and schemas, document datasets, and document-status information. Dataset access needs Fluix data extraction; document-status access needs the corresponding role permission. It returns information permitted by the connected user's account and does not create, edit, sign or delete documents. Fluix support must enable the MCP Server feature if it is unavailable.","schema_version":1,"summary":"Ask Claude about Fluix tasks, document status and completed-form data.\nInvestigate overdue work, outstanding signatures and process progress.\nAccess is read-only and requires a plan with the MCP Server feature enabled."},"homepage_url":"","icon":"","id":"00ba5af4-4c29-4466-802c-c403d2153706","installs":0,"last_scanned":"","license":"","long_description":"The connector provides task-report rows and schemas, document datasets, and document-status information. Dataset access needs Fluix data extraction; document-status access needs the corresponding role permission. It returns information permitted by the connected user's account and does not create, edit, sign or delete documents. Fluix support must enable the MCP Server feature if it is unavailable.","manual_assessment":"low","manual_review":{"all_findings":[{"evidence":"Help page: read-only access to task reports, form-submission datasets, and document statuses.","reasoning":"Confirmed read-only; form submissions may contain operational/personal data and free text (prompt-injection exposure).","risk_type":"private_data_read","severity":"low","title":"Reads field inspection forms, task reports and document status","triggering_tools_or_skills":["docs_dataset_rows","docs_dataset_schema","docs_list_datasets","docs_status_rows","docs_status_schema","tasks_list_reports","tasks_report_rows","tasks_report_schema"]},{"evidence":"Directory remote.url is mcp.fluix.io/mcp; no pinned source or version is available for the server.","reasoning":"Tool behaviour can change server-side after review; ratings rest on the 2026-09-22 snapshot.","risk_type":"provenance_uncertainty","severity":"low","title":"Closed hosted MCP server for Fluix can change without notice","triggering_tools_or_skills":[]}],"assessment_status":"reviewed","auth_and_scopes":"OAuth 2.1 sign-in (2FA if enabled), company selection, consent areas Tasks/Documents/Datasets (read); limited to the user's Fluix permissions; 30-day inactivity expiry; admin can revoke.","blocked_missing_evidence":null,"confidence":"high","displayed_risk":"low","evidence_completeness":"complete","manual_overall_risk":"low","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/00ba5af4-4c29-4466-802c-c403d2153706.json","what_it_proves":"Candidate PR #125 record identity (name \"Fluix\", publisher, type web_connector) and 8 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/00ba5af4-4c29-4466-802c-c403d2153706: complete tool_names inventory (8 tools), remote streamable-http endpoint https://mcp.fluix.io/mcp, auth_posture auth_required, directory tier community"},{"accessed_at":"2026-10-10T20:27:45Z","url_or_path":"https://fluix.io/help/connecting-fluix-to-claude","what_it_proves":"Fluix help page describes 8 read-only capabilities matching the inventory (3 task-report, 3 dataset, 2 document-status), states Claude 'cannot create, modify, or delete anything', OAuth 2.1 with read-only consent areas, admin revocation."}],"primary_reason":"Official docs confirm all eight tools read task, dataset and document-status data with no write capability.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":false,"review_key":"claude:00ba5af4-4c29-4466-802c-c403d2153706","reviewed_at":"2026-10-10","reviewer_notes":"Identity consistent (fluix.io). All 8 tool names map to the doc's 8 capabilities.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"false","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":8,"tools_or_skills_total":8},"name":"Fluix","needs_runtime_verification":false,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=00ba5af4-4c29-4466-802c-c403d2153706&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://fluix.io/privacy-notice-for-fluix-service","provisional_risk":null,"publication_recommendation":"accept","publisher":"Fluix","publisher_url":"https://fluix.io/","remote_url":"https://mcp.fluix.io/mcp","repository_url":"","risk":"low","risk_severity":"low","security_risks":[{"description":"This connector can read information available to the connected account and return it to the AI. Review findings: Confirmed read-only; form submissions may contain operational/personal data and free text (prompt-injection exposure).","evidence":"Reads field inspection forms, task reports and document status: Help page: read-only access to task reports, form-submission datasets, and document statuses.","manual_risk_type":"private_data_read","remediation":{"block_tool_categories":["data_exfiltration"],"steps":["Use a least-privilege account limited to the information required by the workflow.","Restrict folders, projects, tenants, and other data scopes wherever the provider allows it.","Review access logs for unexpected reads or bulk retrieval."]},"risk_type":"reads_private_data","severity":"low","title":"Reads field inspection forms, task reports and document status","triggering_tools":["docs_dataset_rows","docs_dataset_schema","docs_list_datasets","docs_status_rows","docs_status_schema","tasks_list_reports","tasks_report_rows","tasks_report_schema"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://fluix.io/contact-us","tags":["network_access","oauth_required","reads_private_data","web_connector"],"tools":[{"description":"","name":"docs_dataset_rows"},{"description":"","name":"docs_dataset_schema"},{"description":"","name":"docs_list_datasets"},{"description":"","name":"docs_status_rows"},{"description":"","name":"docs_status_schema"},{"description":"","name":"tasks_list_reports"},{"description":"","name":"tasks_report_rows"},{"description":"","name":"tasks_report_schema"}],"tools_count":8,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/00ba5af4-4c29-4466-802c-c403d2153706","uuid":"d5595585-fb9c-5328-9743-2a8032913d17","verification_tier":"community","version":""},"query_key":"fluix fluix","schema_version":1,"status":"match"}