{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-21","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"FormEdge creates and manages forms and landing pages from Claude. Edit drafts, preview pages, inspect submissions, and export responses to CSV. Creation stays private until a separate publish action; workspace OAuth authorization and a FormEdge account are required.","did":"5d0bce52-090a-4aa6-8d36-b1d473836407","documentation_url":"https://formedge.app/developers","editorial_description":{"extended_description":"Tools manage email, Slack, LINE, and webhook notifications, image assets, custom domains, page versions, and IP rules. Preview links expire, and some features are restricted by plan. Published forms and pages can be unpublished or revised through their draft workflows.","schema_version":1,"summary":"FormEdge creates and manages forms and landing pages from Claude.\nEdit drafts, preview pages, inspect submissions, and export responses to CSV.\nCreation stays private until a separate publish action; workspace OAuth authorization and a FormEdge account are required."},"homepage_url":"","icon":"https://formedge.app/apple-touch-icon.png","id":"5d0bce52-090a-4aa6-8d36-b1d473836407","installs":0,"last_scanned":"","license":"","long_description":"Tools manage email, Slack, LINE, and webhook notifications, image assets, custom domains, page versions, and IP rules. Preview links expire, and some features are restricted by plan. Published forms and pages can be unpublished or revised through their draft workflows.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The inventory contains explicit publish and unpublish operations for web forms and pages.","reasoning":"Changing whether a public form or landing page is live is a production publication/deployment action.","risk_type":"deployment_infrastructure","severity":"high","title":"Publishes forms and landing pages","triggering_tools_or_skills":["publish_form","publish_page","unpublish_form","unpublish_page"]},{"evidence":"The connector can register, synchronize and delete custom domains and alter page IP access rules.","reasoning":"Domain attachment and access-rule changes materially alter security and production routing controls.","risk_type":"credential_admin","severity":"high","title":"Manages custom domains and page IP rules","triggering_tools_or_skills":["register_custom_domain","delete_custom_domain","sync_custom_domain","update_page_ip_rules"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication is required; tenant boundaries and custom-domain authorization scopes are not documented in the packet.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/5d0bce52-090a-4aa6-8d36-b1d473836407.json","what_it_proves":"Candidate PR #125 record identity (name \"FormEdge\", publisher, type web_connector) and 39 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/5d0bce52-090a-4aa6-8d36-b1d473836407: complete tool_names inventory (39 tools), remote streamable-http endpoint https://mcp.formedge.app/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"FormEdge can publish public pages and alter custom-domain and IP access controls.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:5d0bce52-090a-4aa6-8d36-b1d473836407","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 39 tools, including submission export, asset upload, version restore and notification settings. Names establish publication and domain administration, but input schemas and approval behavior are absent.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"true","deletes_data":"true","deployment_or_infrastructure":"true","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":39,"tools_or_skills_total":39},"name":"FormEdge","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=5d0bce52-090a-4aa6-8d36-b1d473836407&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://formedge.app/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Value Inc.","publisher_url":"https://formedge.app/","remote_url":"https://mcp.formedge.app/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can deploy code or change infrastructure and production environments. Review findings: Changing whether a public form or landing page is live is a production publication/deployment action.","evidence":"Publishes forms and landing pages: The inventory contains explicit publish and unpublish operations for web forms and pages.","manual_risk_type":"deployment_infrastructure","remediation":{"block_tool_categories":["code_execution","state_change"],"steps":["Default to a sandbox or staging environment.","Require code review, human approval, audit logging, and a tested rollback path for production changes."]},"risk_type":"code_deployment","severity":"high","title":"Publishes forms and landing pages","triggering_tools":["publish_form","publish_page","unpublish_form","unpublish_page"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Domain attachment and access-rule changes materially alter security and production routing controls.","evidence":"Manages custom domains and page IP rules: The connector can register, synchronize and delete custom domains and alter page IP access rules.","manual_risk_type":"credential_admin","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"high","title":"Manages custom domains and page IP rules","triggering_tools":["register_custom_domain","delete_custom_domain","sync_custom_domain","update_page_ip_rules"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://pub.formedge.app/forms/3be5ca53-9cf9-474d-bbca-30036d45131c","tags":["code_deployment","modifies_data","network_access","oauth_required","web_connector"],"tools":[{"description":"","name":"confirm_asset_upload"},{"description":"","name":"create_asset_upload_url"},{"description":"","name":"create_form"},{"description":"","name":"create_page"},{"description":"","name":"delete_custom_domain","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Domain attachment and access-rule changes materially alter security and production routing controls."}},{"description":"","name":"export_submissions_csv"},{"description":"","name":"get_form"},{"description":"","name":"get_form_field_types"},{"description":"","name":"get_notification_settings"},{"description":"","name":"get_notification_types"},{"description":"","name":"get_page"},{"description":"","name":"get_page_ip_rules"},{"description":"","name":"get_page_templates"},{"description":"","name":"get_submission"},{"description":"","name":"get_usage"},{"description":"","name":"issue_page_preview_url"},{"description":"","name":"list_assets"},{"description":"","name":"list_attachments"},{"description":"","name":"list_custom_domains"},{"description":"","name":"list_forms"},{"description":"","name":"list_page_versions"},{"description":"","name":"list_pages"},{"description":"","name":"list_submissions"},{"description":"","name":"patch_page_draft"},{"description":"","name":"publish_form","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: Changing whether a public form or landing page is live is a production publication/deployment action."}},{"description":"","name":"publish_page","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: Changing whether a public form or landing page is live is a production publication/deployment action."}},{"description":"","name":"register_custom_domain","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Domain attachment and access-rule changes materially alter security and production routing controls."}},{"description":"","name":"replace_form_fields"},{"description":"","name":"restore_page_version"},{"description":"","name":"revert_page_draft_to_published"},{"description":"","name":"save_page_version"},{"description":"","name":"sync_custom_domain","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Domain attachment and access-rule changes materially alter security and production routing controls."}},{"description":"","name":"unpublish_form","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: Changing whether a public form or landing page is live is a production publication/deployment action."}},{"description":"","name":"unpublish_page","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: Changing whether a public form or landing page is live is a production publication/deployment action."}},{"description":"","name":"update_form"},{"description":"","name":"update_notification_settings"},{"description":"","name":"update_page_draft"},{"description":"","name":"update_page_ip_rules","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Domain attachment and access-rule changes materially alter security and production routing controls."}},{"description":"","name":"update_page_version"}],"tools_count":39,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/5d0bce52-090a-4aa6-8d36-b1d473836407","uuid":"25299106-1a64-5c4f-b6af-335e38fe5ce4","verification_tier":"community","version":""},"query_key":"formedge","schema_version":1,"status":"match"}