{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-19","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Foundry IMS manages product catalogs and assemblies from Claude. Update products, variants, bundles, images, custom fields, and bills of materials. Access is scoped to the selected organization and your existing Foundry permissions.","did":"70d294ce-25da-4088-afa0-565af7cc3cc1","documentation_url":"https://foundryims.com/integrations/ai/claude/","editorial_description":{"extended_description":"Assembly tools check buildable quantities from stock, trace where components are used, and flatten subassemblies. Catalog operations include pricing, identifiers, brands, categories, product deletion, and restoration.","schema_version":1,"summary":"Foundry IMS manages product catalogs and assemblies from Claude.\nUpdate products, variants, bundles, images, custom fields, and bills of materials.\nAccess is scoped to the selected organization and your existing Foundry permissions."},"homepage_url":"","icon":"","id":"70d294ce-25da-4088-afa0-565af7cc3cc1","installs":0,"last_scanned":"","license":"","long_description":"Assembly tools check buildable quantities from stock, trace where components are used, and flatten subassemblies. Catalog operations include pricing, identifiers, brands, categories, product deletion, and restoration.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"Declared permissions note product deletes are soft/restorable, while these tools still remove active catalogue/BOM state.","reasoning":"Meaningful deletion is High even when a restore path exists.","risk_type":"data_deletion","severity":"high","title":"Deletes products and bills of materials","triggering_tools_or_skills":["delete_product","delete_bom"]},{"evidence":"These tools persist broad product, price, cost and assembly changes.","reasoning":"They materially change shared inventory/catalogue state.","risk_type":"data_modification","severity":"medium","title":"Creates and updates catalogue, bundles and BOMs","triggering_tools_or_skills":["create_product","add_bundle_component","create_brand","create_category","set_bom","update_product","update_variant"]},{"evidence":"These actions change hosted product image assets.","reasoning":"They write/delete catalogue media relationships.","risk_type":"file_write","severity":"medium","title":"Adds, removes and reorders variant images","triggering_tools_or_skills":["add_variant_image","remove_variant_image","reorder_variant_images"]}],"assessment_status":"provisional","auth_and_scopes":"Account/API-key authentication inherits Foundry permissions; read-only keys remain read-only, while write-capable keys can change the catalogue.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/70d294ce-25da-4088-afa0-565af7cc3cc1.json","what_it_proves":"Candidate PR #125 record identity (name \"Foundry IMS\", publisher, type web_connector) and 32 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/70d294ce-25da-4088-afa0-565af7cc3cc1: complete tool_names inventory (32 tools), remote streamable-http endpoint https://mcp.foundryims.com/mcp, auth_posture auth_required, publisher-declared permissions text, declared sensitive data types, directory tier community"}],"primary_reason":"Foundry IMS can delete products/BOMs and broadly alter catalogue and assembly data.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:70d294ce-25da-4088-afa0-565af7cc3cc1","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 32 tools and declared scope boundaries; orders, billing, users and stock adjustments are explicitly out of reach.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"true","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":32,"tools_or_skills_total":32},"name":"Foundry IMS","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=70d294ce-25da-4088-afa0-565af7cc3cc1&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://foundryims.com/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Foundry IMS","publisher_url":"https://foundryims.com/","remote_url":"https://mcp.foundryims.com/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can permanently remove data or resources. Review findings: Meaningful deletion is High even when a restore path exists.","evidence":"Deletes products and bills of materials: Declared permissions note product deletes are soft/restorable, while these tools still remove active catalogue/BOM state.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Deletes products and bills of materials","triggering_tools":["delete_product","delete_bom"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change shared inventory/catalogue state.","evidence":"Creates and updates catalogue, bundles and BOMs: These tools persist broad product, price, cost and assembly changes.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Creates and updates catalogue, bundles and BOMs","triggering_tools":["create_product","add_bundle_component","create_brand","create_category","set_bom","update_product","update_variant"]},{"description":"This connector can create, change, export, or otherwise write files. Review findings: They write/delete catalogue media relationships.","evidence":"Adds, removes and reorders variant images: These actions change hosted product image assets.","manual_risk_type":"file_write","remediation":{"block_tool_categories":["state_change"],"steps":["Limit file access to a dedicated working directory.","Review generated or modified files before they are shared or executed."]},"risk_type":"filesystem_access","severity":"medium","title":"Adds, removes and reorders variant images","triggering_tools":["add_variant_image","remove_variant_image","reorder_variant_images"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@foundryims.com","tags":["deletes_data","filesystem_access","modifies_data","network_access","oauth_required","web_connector"],"tools":[{"description":"","name":"add_bundle_component","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change shared inventory/catalogue state."}},{"description":"","name":"add_variant_image","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: They write/delete catalogue media relationships."}},{"description":"","name":"bom_can_build"},{"description":"","name":"create_brand","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change shared inventory/catalogue state."}},{"description":"","name":"create_category","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change shared inventory/catalogue state."}},{"description":"","name":"create_product","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change shared inventory/catalogue state."}},{"description":"","name":"delete_bom","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Meaningful deletion is High even when a restore path exists."}},{"description":"","name":"delete_product","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Meaningful deletion is High even when a restore path exists."}},{"description":"","name":"find_where_used"},{"description":"","name":"flatten_bom"},{"description":"","name":"get_bom"},{"description":"","name":"get_bundle_components"},{"description":"","name":"get_custom_values"},{"description":"","name":"get_product"},{"description":"","name":"get_variant"},{"description":"","name":"list_brands"},{"description":"","name":"list_categories"},{"description":"","name":"list_custom_fields"},{"description":"","name":"list_orgs"},{"description":"","name":"remove_bundle_component"},{"description":"","name":"remove_variant_image","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: They write/delete catalogue media relationships."}},{"description":"","name":"reorder_variant_images","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: They write/delete catalogue media relationships."}},{"description":"","name":"replace_bom_component"},{"description":"","name":"restore_product"},{"description":"","name":"search_products"},{"description":"","name":"search_variants"},{"description":"","name":"set_bom","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change shared inventory/catalogue state."}},{"description":"","name":"set_custom_values"},{"description":"","name":"set_org"},{"description":"","name":"update_bundle_component"},{"description":"","name":"update_product","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change shared inventory/catalogue state."}},{"description":"","name":"update_variant","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change shared inventory/catalogue state."}}],"tools_count":32,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/70d294ce-25da-4088-afa0-565af7cc3cc1","uuid":"5ea45104-ac84-5590-8960-db19aa2f9b67","verification_tier":"community","version":""},"query_key":"foundry ims foundry ims","schema_version":1,"status":"match"}