{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-24","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Connects Claude to sales and customer operations in SmartHome real-estate CRM. Review prospects, clients, confirmed sales and scheduled or overdue payment records. Add follow-up notes and events, update prospects, and change their stage or assigned advisor.","did":"2d72aa88-815c-499a-ab9e-e4aaa25572f5","documentation_url":"https://mcp.smart-home.com.co/docs.html","editorial_description":{"extended_description":"Filter prospects by project, date, stage, probability, advisor or source. Access project and bank summaries, units, custom fields and customer history. OAuth access follows the records your SmartHome account can see; payment tools retrieve records rather than transfer funds.","schema_version":1,"summary":"Connects Claude to sales and customer operations in SmartHome real-estate CRM.\nReview prospects, clients, confirmed sales and scheduled or overdue payment records.\nAdd follow-up notes and events, update prospects, and change their stage or assigned advisor."},"homepage_url":"","icon":"https://mcp.smart-home.com.co/favicon.ico","id":"2d72aa88-815c-499a-ab9e-e4aaa25572f5","installs":0,"last_scanned":"","license":"","long_description":"Filter prospects by project, date, stage, probability, advisor or source. Access project and bank summaries, units, custom fields and customer history. OAuth access follows the records your SmartHome account can see; payment tools retrieve records rather than transfer funds.","manual_assessment":"medium","manual_review":{"all_findings":[{"evidence":"The full 28-tool inventory contains explicit CRM creation, assignment, stage, calendar and update operations.","reasoning":"These tools change persistent customer and sales-workflow state.","risk_type":"data_modification","severity":"medium","title":"Creates prospects and events and changes CRM records","triggering_tools_or_skills":["add_prospect","change_customer_module","change_prospect_stage","change_prospect_user","post_calendar_event","post_event","set_prospect_custom_field","update_prospect"]}],"assessment_status":"provisional","auth_and_scopes":"OAuth 2.1 with PKCE authenticates the connected SmartHome account and respects that account's permissions; granular scopes are not listed.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"medium","evidence_completeness":"partial","manual_overall_risk":"medium","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/2d72aa88-815c-499a-ab9e-e4aaa25572f5.json","what_it_proves":"Candidate PR #125 record identity (name \"SmartHome CRM\", publisher, type web_connector) and 28 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/2d72aa88-815c-499a-ab9e-e4aaa25572f5: complete tool_names inventory (28 tools), remote streamable-http endpoint https://mcp.smart-home.com.co/mcp/smarthome, auth_posture auth_required, directory tier community"}],"primary_reason":"SmartHome modifies CRM prospects and creates events, but no deletion or proven external send is exposed.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:2d72aa88-815c-499a-ab9e-e4aaa25572f5","reviewed_at":"2026-10-10","reviewer_notes":"Verify whether post_calendar_event sends invitations or only writes an internal calendar record; messaging is unknown pending that evidence.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"unknown","spends_or_moves_money":"false"},"tools_or_skills_reviewed":28,"tools_or_skills_total":28},"name":"SmartHome CRM","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=2d72aa88-815c-499a-ab9e-e4aaa25572f5&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://mcp.smart-home.com.co/privacy.html","provisional_risk":null,"publication_recommendation":"accept","publisher":"Gaia Telcom Sucursal Colombia","publisher_url":"https://smart-home.com.co/","remote_url":"https://mcp.smart-home.com.co/mcp/smarthome","repository_url":"","risk":"medium","risk_severity":"medium","security_risks":[{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These tools change persistent customer and sales-workflow state.","evidence":"Creates prospects and events and changes CRM records: The full 28-tool inventory contains explicit CRM creation, assignment, stage, calendar and update operations.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Creates prospects and events and changes CRM records","triggering_tools":["add_prospect","change_customer_module","change_prospect_stage","change_prospect_user","post_calendar_event","post_event","set_prospect_custom_field","update_prospect"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"soporte@gaiatelcom.com","tags":["accesses_calendar","accesses_messaging","modifies_data","network_access","oauth_required","web_connector"],"tools":[{"description":"","name":"add_prospect","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These tools change persistent customer and sales-workflow state."}},{"description":"","name":"change_customer_module","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These tools change persistent customer and sales-workflow state."}},{"description":"","name":"change_prospect_stage","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These tools change persistent customer and sales-workflow state."}},{"description":"","name":"change_prospect_user","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These tools change persistent customer and sales-workflow state."}},{"description":"","name":"get_actions"},{"description":"","name":"get_bank_summary"},{"description":"","name":"get_custom_fields"},{"description":"","name":"get_customer_by_criteria"},{"description":"","name":"get_customer_detail"},{"description":"","name":"get_customer_overdue_payments"},{"description":"","name":"get_customer_payments"},{"description":"","name":"get_customer_scheduled_payments"},{"description":"","name":"get_digitalProfile"},{"description":"","name":"get_message_insight"},{"description":"","name":"get_project_summary"},{"description":"","name":"get_projects"},{"description":"","name":"get_prospect_events"},{"description":"","name":"get_prospect_history"},{"description":"","name":"get_prospect_history_paged"},{"description":"","name":"get_prospects"},{"description":"","name":"get_sale_cycle"},{"description":"","name":"get_sales"},{"description":"","name":"get_units"},{"description":"","name":"get_users"},{"description":"","name":"post_calendar_event","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These tools change persistent customer and sales-workflow state."}},{"description":"","name":"post_event","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These tools change persistent customer and sales-workflow state."}},{"description":"","name":"set_prospect_custom_field","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These tools change persistent customer and sales-workflow state."}},{"description":"","name":"update_prospect","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These tools change persistent customer and sales-workflow state."}}],"tools_count":28,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/2d72aa88-815c-499a-ab9e-e4aaa25572f5","uuid":"2cbea2ee-6565-5740-8ed9-c0b8544242c8","verification_tier":"community","version":""},"query_key":"gaia telcom sucursal colombia smarthome crm","schema_version":1,"status":"match"}