{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-23","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"GC AI brings an in-house legal team's documents and playbooks into Claude. Ask file-grounded questions, run review playbooks, and organize projects or uploads. Access uses your existing GC AI account and is scoped to your organization.","did":"77f61a19-ed56-4537-8b16-9739bf965938","documentation_url":"https://docs.gc.ai/get-started/welcome","editorial_description":{"extended_description":"Tools track upload extraction and indexing, attach or detach project files, and create or update reusable skills and playbooks. Review workflows include contract analysis, redlining, and issue spotting with results returned to chat.","schema_version":1,"summary":"GC AI brings an in-house legal team's documents and playbooks into Claude.\nAsk file-grounded questions, run review playbooks, and organize projects or uploads.\nAccess uses your existing GC AI account and is scoped to your organization."},"homepage_url":"","icon":"","id":"77f61a19-ed56-4537-8b16-9739bf965938","installs":0,"last_scanned":"","license":"","long_description":"Tools track upload extraction and indexing, attach or detach project files, and create or update reusable skills and playbooks. Review workflows include contract analysis, redlining, and issue spotting with results returned to chat.","manual_assessment":"medium","manual_review":{"all_findings":[{"evidence":"The explicit multipart upload flow stores files in the team legal workspace.","reasoning":"It writes potentially confidential documents into the remote service.","risk_type":"file_write","severity":"medium","title":"Uploads legal files into GC AI","triggering_tools_or_skills":["start_file_upload","upload_file","finish_file_upload"]},{"evidence":"These tools persist organization legal-workflow configuration.","reasoning":"They materially change shared workspace state.","risk_type":"data_modification","severity":"medium","title":"Creates and updates projects, playbooks and skills","triggering_tools_or_skills":["create_project","update_project","create_playbook","update_playbook","create_skill","update_skill","attach_to_project","detach_from_project"]},{"evidence":"Official docs identify contract/document review and team knowledge as core product data.","reasoning":"Legal files and answers are highly sensitive private information.","risk_type":"private_data_read","severity":"low","title":"Reads private legal files, projects, vaults and playbooks","triggering_tools_or_skills":["get_files","get_projects","get_vaults","get_playbooks","ask_gcai"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication to a GC AI legal-team organization is required; projects, vaults, files, skills and playbooks follow existing organization permissions.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"medium","evidence_completeness":"partial","manual_overall_risk":"medium","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/77f61a19-ed56-4537-8b16-9739bf965938.json","what_it_proves":"Candidate PR #125 record identity (name \"GC AI\", publisher, type web_connector) and 21 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/77f61a19-ed56-4537-8b16-9739bf965938: complete tool_names inventory (21 tools), remote streamable-http endpoint https://app.gc.ai/api/mcp, auth_posture auth_required, directory tier community"},{"accessed_at":"2026-10-11T01:44:00Z","url_or_path":"https://docs.gc.ai/get-started/welcome","what_it_proves":"Official GC AI docs describe private legal files/projects, playbooks, contract review, research and generated/exported document work."}],"primary_reason":"GC AI writes legal files and persistently manages projects, playbooks and skills.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:77f61a19-ed56-4537-8b16-9739bf965938","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 21 tools. run_playbook invokes a bounded legal-document review workflow; no evidence establishes arbitrary code execution, external messaging, deletion or production deployment.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"true","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":21,"tools_or_skills_total":21},"name":"GC AI","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=77f61a19-ed56-4537-8b16-9739bf965938&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://gc.ai/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"GC AI","publisher_url":"https://gc.ai/","remote_url":"https://app.gc.ai/api/mcp","repository_url":"","risk":"medium","risk_severity":"medium","security_risks":[{"description":"This connector can create, change, export, or otherwise write files. Review findings: It writes potentially confidential documents into the remote service.","evidence":"Uploads legal files into GC AI: The explicit multipart upload flow stores files in the team legal workspace.","manual_risk_type":"file_write","remediation":{"block_tool_categories":["state_change"],"steps":["Limit file access to a dedicated working directory.","Review generated or modified files before they are shared or executed."]},"risk_type":"filesystem_access","severity":"medium","title":"Uploads legal files into GC AI","triggering_tools":["start_file_upload","upload_file","finish_file_upload"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change shared workspace state.","evidence":"Creates and updates projects, playbooks and skills: These tools persist organization legal-workflow configuration.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Creates and updates projects, playbooks and skills","triggering_tools":["create_project","update_project","create_playbook","update_playbook","create_skill","update_skill","attach_to_project","detach_from_project"]},{"description":"This connector can read information available to the connected account and return it to the AI. Review findings: Legal files and answers are highly sensitive private information.","evidence":"Reads private legal files, projects, vaults and playbooks: Official docs identify contract/document review and team knowledge as core product data.","manual_risk_type":"private_data_read","remediation":{"block_tool_categories":["data_exfiltration"],"steps":["Use a least-privilege account limited to the information required by the workflow.","Restrict folders, projects, tenants, and other data scopes wherever the provider allows it.","Review access logs for unexpected reads or bulk retrieval."]},"risk_type":"reads_private_data","severity":"low","title":"Reads private legal files, projects, vaults and playbooks","triggering_tools":["get_files","get_projects","get_vaults","get_playbooks","ask_gcai"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://gc.ai/contact","tags":["accesses_messaging","filesystem_access","modifies_data","network_access","oauth_required","reads_private_data","web_connector"],"tools":[{"description":"","name":"ask_gcai"},{"description":"","name":"ask_gcai_save_chat"},{"description":"","name":"ask_gcai_status"},{"description":"","name":"attach_to_project","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change shared workspace state."}},{"description":"","name":"create_playbook","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change shared workspace state."}},{"description":"","name":"create_project","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change shared workspace state."}},{"description":"","name":"create_skill","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change shared workspace state."}},{"description":"","name":"detach_from_project","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change shared workspace state."}},{"description":"","name":"finish_file_upload","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: It writes potentially confidential documents into the remote service."}},{"description":"","name":"get_files"},{"description":"","name":"get_playbooks"},{"description":"","name":"get_projects"},{"description":"","name":"get_skills"},{"description":"","name":"get_vaults"},{"description":"","name":"run_playbook"},{"description":"","name":"run_playbook_status"},{"description":"","name":"start_file_upload","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: It writes potentially confidential documents into the remote service."}},{"description":"","name":"update_playbook","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change shared workspace state."}},{"description":"","name":"update_project","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change shared workspace state."}},{"description":"","name":"update_skill","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change shared workspace state."}},{"description":"","name":"upload_file","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: It writes potentially confidential documents into the remote service."}}],"tools_count":21,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/77f61a19-ed56-4537-8b16-9739bf965938","uuid":"0dcb0939-f447-5bd9-94b0-60438fcc850d","verification_tier":"community","version":""},"query_key":"gc ai","schema_version":1,"status":"match"}