{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-15","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Build, publish, and operate online forms in Formasty. Configure multi-step forms, conditional logic, quizzes, workflows, and branded designs. Actions follow workspace roles, OAuth scopes, plan limits, validation, and tool approvals; payment fields are unsupported.","did":"d36b9132-b4a9-444b-af23-0fcbf8cfd1a9","documentation_url":"https://formasty.com/documentation/overview","editorial_description":{"extended_description":"Import supported public Google Forms or Typeform forms, validate drafts, and diagnose publishing readiness. After publication, inspect or manage authorized submissions, export responses, and configure webhooks, tracking, custom domains, and workspace branding.","schema_version":1,"summary":"Build, publish, and operate online forms in Formasty.\nConfigure multi-step forms, conditional logic, quizzes, workflows, and branded designs.\nActions follow workspace roles, OAuth scopes, plan limits, validation, and tool approvals; payment fields are unsupported."},"homepage_url":"","icon":"","id":"d36b9132-b4a9-444b-af23-0fcbf8cfd1a9","installs":0,"last_scanned":"","license":"","long_description":"Import supported public Google Forms or Typeform forms, validate drafts, and diagnose publishing readiness. After publication, inspect or manage authorized submissions, export responses, and configure webhooks, tracking, custom domains, and workspace branding.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The complete inventory explicitly declares destructive deletion of primary forms, responses and integration resources.","reasoning":"These actions permanently remove meaningful customer/workspace data.","risk_type":"data_deletion","severity":"high","title":"Forms, workspaces, submissions and integrations can be deleted","triggering_tools_or_skills":["formasty_delete_form","formasty_delete_workspace","formasty_delete_submission","formasty_delete_webhook_integration","formasty_delete_field","formasty_delete_step"]},{"evidence":"The declared publish action launches a form, and the description says the connector operates forms after launch.","reasoning":"Publishing externally visible content is communication as the workspace owner.","risk_type":"messaging_as_user","severity":"high","title":"Forms can be published for external respondents","triggering_tools_or_skills":["formasty_publish_form"]},{"evidence":"The inventory includes domain and outbound integration configuration actions.","reasoning":"Changing production routing/integration endpoints materially alters deployed form infrastructure.","risk_type":"deployment_infrastructure","severity":"high","title":"Custom domains, webhooks and tracking integrations can be configured","triggering_tools_or_skills":["formasty_set_custom_domain","formasty_set_webhook_integration","formasty_set_google_tag_manager_integration","formasty_set_facebook_pixel_integration"]},{"evidence":"The connector reads externally authored form responses.","reasoning":"Respondent content is untrusted and can influence the model.","risk_type":"prompt_injection_exposure","severity":"low","title":"Respondent submissions enter model context","triggering_tools_or_skills":["formasty_list_submissions","formasty_get_submission"]},{"evidence":"The connector runs at https://app.formasty.com/api/mcp without a pinned server implementation in the review packet.","reasoning":"The hosted implementation can change independently of this snapshot, so runtime verification and change monitoring remain necessary.","risk_type":"provenance_uncertainty","severity":"low","title":"Formasty is a mutable hosted service","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"OAuth actions are constrained by the connected Formasty workspace role, granted scopes, plan gates and validation rules; exact scopes are not enumerated.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/d36b9132-b4a9-444b-af23-0fcbf8cfd1a9.json","what_it_proves":"Candidate PR #125 record identity (name \"Formasty\", publisher, type web_connector) and 75 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/d36b9132-b4a9-444b-af23-0fcbf8cfd1a9: complete tool_names inventory (75 tools), remote streamable-http endpoint https://app.formasty.com/api/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Formasty can delete core forms/responses, publish external forms and configure production integrations.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:d36b9132-b4a9-444b-af23-0fcbf8cfd1a9","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 75 tools. The official documentation page failed to fetch; the rating is established by unambiguous names but remains medium-confidence.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"true","deployment_or_infrastructure":"true","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":75,"tools_or_skills_total":75},"name":"Formasty","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=d36b9132-b4a9-444b-af23-0fcbf8cfd1a9&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://formasty.com/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Formasty","publisher_url":"https://formasty.com/","remote_url":"https://app.formasty.com/api/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can permanently remove data or resources. Review findings: These actions permanently remove meaningful customer/workspace data.","evidence":"Forms, workspaces, submissions and integrations can be deleted: The complete inventory explicitly declares destructive deletion of primary forms, responses and integration resources.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Forms, workspaces, submissions and integrations can be deleted","triggering_tools":["formasty_delete_form","formasty_delete_workspace","formasty_delete_submission","formasty_delete_webhook_integration","formasty_delete_field","formasty_delete_step"]},{"description":"This connector can publish or send messages and content using the connected identity. Review findings: Publishing externally visible content is communication as the workspace owner.","evidence":"Forms can be published for external respondents: The declared publish action launches a form, and the description says the connector operates forms after launch.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Forms can be published for external respondents","triggering_tools":["formasty_publish_form"]},{"description":"This connector can deploy code or change infrastructure and production environments. Review findings: Changing production routing/integration endpoints materially alters deployed form infrastructure.","evidence":"Custom domains, webhooks and tracking integrations can be configured: The inventory includes domain and outbound integration configuration actions.","manual_risk_type":"deployment_infrastructure","remediation":{"block_tool_categories":["code_execution","state_change"],"steps":["Default to a sandbox or staging environment.","Require code review, human approval, audit logging, and a tested rollback path for production changes."]},"risk_type":"code_deployment","severity":"high","title":"Custom domains, webhooks and tracking integrations can be configured","triggering_tools":["formasty_set_custom_domain","formasty_set_webhook_integration","formasty_set_google_tag_manager_integration","formasty_set_facebook_pixel_integration"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://formasty.com/contact","tags":["code_deployment","deletes_data","network_access","oauth_required","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"formasty_add_field"},{"description":"","name":"formasty_add_step"},{"description":"","name":"formasty_apply_unsplash_image"},{"description":"","name":"formasty_audit_form"},{"description":"","name":"formasty_clone_form"},{"description":"","name":"formasty_configure_matching_rules"},{"description":"","name":"formasty_configure_quiz"},{"description":"","name":"formasty_configure_scheduler_provider"},{"description":"","name":"formasty_configure_score_calculation"},{"description":"","name":"formasty_configure_workflow_variables"},{"description":"","name":"formasty_create_ending_screen"},{"description":"","name":"formasty_create_form"},{"description":"","name":"formasty_create_form_from_starter_template"},{"description":"","name":"formasty_create_submission_export"},{"description":"","name":"formasty_create_workspace"},{"description":"","name":"formasty_delete_ending_screen"},{"description":"","name":"formasty_delete_facebook_pixel_integration"},{"description":"","name":"formasty_delete_field","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions permanently remove meaningful customer/workspace data."}},{"description":"","name":"formasty_delete_form","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions permanently remove meaningful customer/workspace data."}},{"description":"","name":"formasty_delete_google_tag_manager_integration"},{"description":"","name":"formasty_delete_step","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions permanently remove meaningful customer/workspace data."}},{"description":"","name":"formasty_delete_submission","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions permanently remove meaningful customer/workspace data."}},{"description":"","name":"formasty_delete_webhook_integration","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions permanently remove meaningful customer/workspace data."}},{"description":"","name":"formasty_delete_workspace","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions permanently remove meaningful customer/workspace data."}},{"description":"","name":"formasty_disconnect_custom_domain"},{"description":"","name":"formasty_get_capabilities"},{"description":"","name":"formasty_get_connect_assets"},{"description":"","name":"formasty_get_create_form_status"},{"description":"","name":"formasty_get_custom_domain"},{"description":"","name":"formasty_get_dashboard_analytics"},{"description":"","name":"formasty_get_facebook_pixel_integration"},{"description":"","name":"formasty_get_form"},{"description":"","name":"formasty_get_form_settings"},{"description":"","name":"formasty_get_google_tag_manager_integration"},{"description":"","name":"formasty_get_mcp_audit_matrix"},{"description":"","name":"formasty_get_published_fields"},{"description":"","name":"formasty_get_responses_bootstrap"},{"description":"","name":"formasty_get_submission"},{"description":"","name":"formasty_get_submission_export"},{"description":"","name":"formasty_get_webhook_integration"},{"description":"","name":"formasty_get_workflow_capabilities"},{"description":"","name":"formasty_get_workspace"},{"description":"","name":"formasty_get_workspace_branding"},{"description":"","name":"formasty_import_google_form"},{"description":"","name":"formasty_import_typeform"},{"description":"","name":"formasty_list_starter_templates"},{"description":"","name":"formasty_list_submissions"},{"description":"","name":"formasty_list_workspace_forms"},{"description":"","name":"formasty_list_workspaces"},{"description":"","name":"formasty_move_field"},{"description":"","name":"formasty_move_step"},{"description":"","name":"formasty_patch_design"},{"description":"","name":"formasty_publish_form","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Publishing externally visible content is communication as the workspace owner."}},{"description":"","name":"formasty_reorder_fields"},{"description":"","name":"formasty_reorder_steps"},{"description":"","name":"formasty_save_draft"},{"description":"","name":"formasty_search_unsplash_images"},{"description":"","name":"formasty_set_custom_domain","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: Changing production routing/integration endpoints materially alters deployed form infrastructure."}},{"description":"","name":"formasty_set_facebook_pixel_integration","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: Changing production routing/integration endpoints materially alters deployed form infrastructure."}},{"description":"","name":"formasty_set_google_tag_manager_integration","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: Changing production routing/integration endpoints materially alters deployed form infrastructure."}},{"description":"","name":"formasty_set_webhook_integration","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: Changing production routing/integration endpoints materially alters deployed form infrastructure."}},{"description":"","name":"formasty_set_workflow_step_actions"},{"description":"","name":"formasty_update_field"},{"description":"","name":"formasty_update_form_settings"},{"description":"","name":"formasty_update_step"},{"description":"","name":"formasty_update_step_logic"},{"description":"","name":"formasty_update_submission"},{"description":"","name":"formasty_update_thank_you"},{"description":"","name":"formasty_update_workspace"},{"description":"","name":"formasty_update_workspace_branding"},{"description":"","name":"formasty_upload_form_link_asset"},{"description":"","name":"formasty_upload_generated_image"},{"description":"","name":"formasty_upsert_workflow_rule"},{"description":"","name":"formasty_validate_draft"},{"description":"","name":"formasty_verify_custom_domain"}],"tools_count":75,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/d36b9132-b4a9-444b-af23-0fcbf8cfd1a9","uuid":"121d2fdd-1e68-5e1e-b3da-c3d6b4697a68","verification_tier":"community","version":""},"query_key":"formasty","schema_version":1,"status":"match"}