{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-17","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Draft and manage agreements in your fynk account. Create contracts from templates or documents, inspect terms, and move agreements through review and signing. Access follows your permissions; nothing is sent without your confirmation.","did":"d54a8078-81ed-4b57-87ea-7f950e42c70b","documentation_url":"https://help.fynk.com/en/articles/759041-connect-fynk-to-your-ai-assistant-with-mcp","editorial_description":{"extended_description":"Manage document parties, signatories, metadata, tags, and teams, or inspect signed agreements and renewal details. Tools also maintain template fields and signature blocks, archive or restore documents, and retrieve document PDFs.","schema_version":1,"summary":"Draft and manage agreements in your fynk account.\nCreate contracts from templates or documents, inspect terms, and move agreements through review and signing.\nAccess follows your permissions; nothing is sent without your confirmation."},"homepage_url":"","icon":"","id":"d54a8078-81ed-4b57-87ea-7f950e42c70b","installs":0,"last_scanned":"","license":"","long_description":"Manage document parties, signatories, metadata, tags, and teams, or inspect signed agreements and renewal details. Tools also maintain template fields and signature blocks, archive or restore documents, and retrieve document PDFs.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The Directory description says Claude drafts agreements and sends them for legally binding signature, with confirmation.","reasoning":"Issuing a contract for signature is high-impact external communication.","risk_type":"messaging_as_user","severity":"high","title":"Contracts can be moved into legally binding signature workflow","triggering_tools_or_skills":["move-document-to-signing-stage","create-document-signatory","create-document-party"]},{"evidence":"The complete inventory declares deletion/archive of account and contract resources.","reasoning":"These actions destructively alter contract-management data.","risk_type":"data_deletion","severity":"high","title":"Teams, tags, signatories and template fields can be deleted","triggering_tools_or_skills":["delete-account-team","delete-account-tag","delete-document-signatory","delete-template-dynamic-field","archive-document"]},{"evidence":"The connector changes account team access organization.","reasoning":"Membership administration affects authorization.","risk_type":"credential_admin","severity":"high","title":"Account team membership can be attached or detached","triggering_tools_or_skills":["attach-account-users-to-team","detach-account-users-from-team","create-account-team"]},{"evidence":"The actions create durable legal documents.","reasoning":"This writes sensitive contract files.","risk_type":"file_write","severity":"medium","title":"Contracts can be created from uploads/templates/scratch","triggering_tools_or_skills":["create-document-from-pdf-upload","create-document-from-template","create-document-from-scratch"]},{"evidence":"The connector reads user and counterparty-authored legal content.","reasoning":"Legal documents are untrusted input.","risk_type":"prompt_injection_exposure","severity":"low","title":"Contract documents and external-party text enter model context","triggering_tools_or_skills":["get-latest-document-pdf","get-document-info","find-external-parties"]},{"evidence":"The connector runs at https://app.fynk.com/mcp without a pinned server implementation in the packet.","reasoning":"The implementation can change independently of this review, so runtime verification and change monitoring remain necessary.","risk_type":"provenance_uncertainty","severity":"low","title":"fynk is a mutable hosted service","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"The connector inherits the user's fynk permissions and claims confirmation before anything is sent; exact role and confirmation enforcement are not documented.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/d54a8078-81ed-4b57-87ea-7f950e42c70b.json","what_it_proves":"Candidate PR #125 record identity (name \"fynk\", publisher, type web_connector) and 56 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/d54a8078-81ed-4b57-87ea-7f950e42c70b: complete tool_names inventory (56 tools), remote streamable-http endpoint https://app.fynk.com/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"fynk can send contracts for signature, delete contract/account resources and administer teams.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:d54a8078-81ed-4b57-87ea-7f950e42c70b","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 56 tools. Confirmation is an important safeguard but does not lower inherent High capability.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"true","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"true","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":56,"tools_or_skills_total":56},"name":"fynk","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=d54a8078-81ed-4b57-87ea-7f950e42c70b&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://fynk.com/en/privacy-policy/","provisional_risk":null,"publication_recommendation":"accept","publisher":"fynk","publisher_url":"https://fynk.com/","remote_url":"https://app.fynk.com/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: Issuing a contract for signature is high-impact external communication.","evidence":"Contracts can be moved into legally binding signature workflow: The Directory description says Claude drafts agreements and sends them for legally binding signature, with confirmation.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Contracts can be moved into legally binding signature workflow","triggering_tools":["move-document-to-signing-stage","create-document-signatory","create-document-party"]},{"description":"This connector can permanently remove data or resources. Review findings: These actions destructively alter contract-management data.","evidence":"Teams, tags, signatories and template fields can be deleted: The complete inventory declares deletion/archive of account and contract resources.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Teams, tags, signatories and template fields can be deleted","triggering_tools":["delete-account-team","delete-account-tag","delete-document-signatory","delete-template-dynamic-field","archive-document"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Membership administration affects authorization.","evidence":"Account team membership can be attached or detached: The connector changes account team access organization.","manual_risk_type":"credential_admin","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"high","title":"Account team membership can be attached or detached","triggering_tools":["attach-account-users-to-team","detach-account-users-from-team","create-account-team"]},{"description":"This connector can create, change, export, or otherwise write files. Review findings: This writes sensitive contract files.","evidence":"Contracts can be created from uploads/templates/scratch: The actions create durable legal documents.","manual_risk_type":"file_write","remediation":{"block_tool_categories":["state_change"],"steps":["Limit file access to a dedicated working directory.","Review generated or modified files before they are shared or executed."]},"risk_type":"filesystem_access","severity":"medium","title":"Contracts can be created from uploads/templates/scratch","triggering_tools":["create-document-from-pdf-upload","create-document-from-template","create-document-from-scratch"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@fynk.com","tags":["deletes_data","filesystem_access","modifies_data","network_access","oauth_required","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"archive-document","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions destructively alter contract-management data."}},{"description":"","name":"attach-account-users-to-team","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Membership administration affects authorization."}},{"description":"","name":"create-account-tag"},{"description":"","name":"create-account-team","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Membership administration affects authorization."}},{"description":"","name":"create-document-from-pdf-upload","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: This writes sensitive contract files."}},{"description":"","name":"create-document-from-scratch","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: This writes sensitive contract files."}},{"description":"","name":"create-document-from-template","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: This writes sensitive contract files."}},{"description":"","name":"create-document-party","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Issuing a contract for signature is high-impact external communication."}},{"description":"","name":"create-document-pdf-upload-url"},{"description":"","name":"create-document-signatory","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Issuing a contract for signature is high-impact external communication."}},{"description":"","name":"create-template-dynamic-field"},{"description":"","name":"create-template-party"},{"description":"","name":"create-template-signature-block"},{"description":"","name":"delete-account-tag","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions destructively alter contract-management data."}},{"description":"","name":"delete-account-team","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions destructively alter contract-management data."}},{"description":"","name":"delete-document-signatory","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions destructively alter contract-management data."}},{"description":"","name":"delete-template-dynamic-field","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions destructively alter contract-management data."}},{"description":"","name":"delete-template-party"},{"description":"","name":"delete-template-signature-block"},{"description":"","name":"detach-account-users-from-team","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Membership administration affects authorization."}},{"description":"","name":"find-automations"},{"description":"","name":"find-document-users"},{"description":"","name":"find-external-parties"},{"description":"","name":"find-imports"},{"description":"","name":"get-account-info"},{"description":"","name":"get-document-info"},{"description":"","name":"get-latest-document-pdf"},{"description":"","name":"get-template-info"},{"description":"","name":"get-user-info"},{"description":"","name":"join-document"},{"description":"","name":"list-account-document-types"},{"description":"","name":"list-account-metadata"},{"description":"","name":"list-account-parties"},{"description":"","name":"list-account-playbooks"},{"description":"","name":"list-account-tags"},{"description":"","name":"list-account-team-members"},{"description":"","name":"list-account-teams"},{"description":"","name":"list-account-users"},{"description":"","name":"list-documents"},{"description":"","name":"list-templates"},{"description":"","name":"move-document-to-done-stage"},{"description":"","name":"move-document-to-review-stage"},{"description":"","name":"move-document-to-signing-stage","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Issuing a contract for signature is high-impact external communication."}},{"description":"","name":"restore-document"},{"description":"","name":"update-account-tag"},{"description":"","name":"update-account-team"},{"description":"","name":"update-document"},{"description":"","name":"update-document-dynamic-fields"},{"description":"","name":"update-document-metadata-values"},{"description":"","name":"update-document-party"},{"description":"","name":"update-document-signatory"},{"description":"","name":"update-document-tags"},{"description":"","name":"update-document-teams"},{"description":"","name":"update-template-dynamic-field"},{"description":"","name":"update-template-party"},{"description":"","name":"update-template-signature-block"}],"tools_count":56,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/d54a8078-81ed-4b57-87ea-7f950e42c70b","uuid":"054fe835-0c9f-590c-823a-eaa2dc1e8e22","verification_tier":"community","version":""},"query_key":"fynk fynk","schema_version":1,"status":"match"}