{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-07","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Monitor and maintain agency-managed WordPress sites with Glow. Inspect updates, vulnerabilities, uptime, certificates, backups, reports, and work allowances. A Glow account on any plan is required; each optional write capability needs its own permission.","did":"dee6003c-d3e3-4c7b-a682-0d25db98e0f9","documentation_url":"https://getglow.io/integrations/ai-assistants/","editorial_description":{"extended_description":"Plugin Safe Updates use a backup, screenshots, checks, and rollback when needed; theme and WordPress-core updates are not reversible. Authorized tools also change uptime monitoring and log work or allowances. The connector cannot delete sites, backups, or clients, or deactivate site components. User and per-site restrictions apply.","schema_version":1,"summary":"Monitor and maintain agency-managed WordPress sites with Glow.\nInspect updates, vulnerabilities, uptime, certificates, backups, reports, and work allowances.\nA Glow account on any plan is required; each optional write capability needs its own permission."},"homepage_url":"","icon":"https://getglow.io/images/connector/glow-connector-icon-512.png","id":"dee6003c-d3e3-4c7b-a682-0d25db98e0f9","installs":0,"last_scanned":"","license":"","long_description":"Plugin Safe Updates use a backup, screenshots, checks, and rollback when needed; theme and WordPress-core updates are not reversible. Authorized tools also change uptime monitoring and log work or allowances. The connector cannot delete sites, backups, or clients, or deactivate site components. User and per-site restrictions apply.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The description says plugin updates use backup/check/rollback, while theme and core updates may be irreversible.","reasoning":"This deploys code to production client websites.","risk_type":"deployment_infrastructure","severity":"high","title":"Plugins, themes and WordPress core can be updated on live sites","triggering_tools_or_skills":["run_safe_update","run_update"]},{"evidence":"The tool provides access to a managed website without exposing passwords.","reasoning":"A login link is a sensitive authentication capability.","risk_type":"credential_admin","severity":"high","title":"A privileged site login link can be generated","triggering_tools_or_skills":["site_login_link"]},{"evidence":"These tools persist operational/account changes.","reasoning":"They affect service management and billing records.","risk_type":"data_modification","severity":"medium","title":"Monitoring and client time allowances can be changed","triggering_tools_or_skills":["set_uptime_monitoring","add_custom_work","set_time_allowance"]},{"evidence":"Client/site-generated operational content is returned.","reasoning":"It may contain prompt injection.","risk_type":"prompt_injection_exposure","severity":"low","title":"Support tickets, site timelines and vulnerability data enter model context","triggering_tools_or_skills":["site_timeline","whats_changed","vulnerabilities"]},{"evidence":"The connector runs at https://my.getglow.io/api/mcp without a pinned server implementation in the packet.","reasoning":"The implementation can change independently, so runtime verification and change monitoring remain necessary.","risk_type":"provenance_uncertainty","severity":"low","title":"Glow for WordPress is a mutable hosted service","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"OAuth follows the user's Glow visibility and per-site permissions; update, monitoring and time-management permissions are separately granted.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/dee6003c-d3e3-4c7b-a682-0d25db98e0f9.json","what_it_proves":"Candidate PR #125 record identity (name \"Glow for WordPress\", publisher, type web_connector) and 27 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/dee6003c-d3e3-4c7b-a682-0d25db98e0f9: complete tool_names inventory (27 tools), remote streamable-http endpoint https://my.getglow.io/api/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Glow can deploy updates to live WordPress sites and generate privileged login links.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:dee6003c-d3e3-4c7b-a682-0d25db98e0f9","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 27 tools. The explicit no-delete limits are noted, but core/theme updates remain potentially irreversible.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"true","deletes_data":"false","deployment_or_infrastructure":"true","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":27,"tools_or_skills_total":27},"name":"Glow for WordPress","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=dee6003c-d3e3-4c7b-a682-0d25db98e0f9&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://getglow.io/privacy/","provisional_risk":null,"publication_recommendation":"accept","publisher":"Glow","publisher_url":"https://getglow.io/","remote_url":"https://my.getglow.io/api/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can deploy code or change infrastructure and production environments. Review findings: This deploys code to production client websites.","evidence":"Plugins, themes and WordPress core can be updated on live sites: The description says plugin updates use backup/check/rollback, while theme and core updates may be irreversible.","manual_risk_type":"deployment_infrastructure","remediation":{"block_tool_categories":["code_execution","state_change"],"steps":["Default to a sandbox or staging environment.","Require code review, human approval, audit logging, and a tested rollback path for production changes."]},"risk_type":"code_deployment","severity":"high","title":"Plugins, themes and WordPress core can be updated on live sites","triggering_tools":["run_safe_update","run_update"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: A login link is a sensitive authentication capability.; They affect service management and billing records.","evidence":"A privileged site login link can be generated: The tool provides access to a managed website without exposing passwords. | Monitoring and client time allowances can be changed: These tools persist operational/account changes.","manual_risk_type":"credential_admin,data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"high","title":"Can change connected resources","triggering_tools":["site_login_link","set_uptime_monitoring","add_custom_work","set_time_allowance"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"hello@getglow.io","tags":["code_deployment","modifies_data","network_access","oauth_required","web_connector"],"tools":[{"description":"","name":"add_custom_work","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: A login link is a sensitive authentication capability.; They affect service management and billing records."}},{"description":"","name":"connection_issues"},{"description":"","name":"find_plugin"},{"description":"","name":"find_sites"},{"description":"","name":"fleet_overview"},{"description":"","name":"list_backups"},{"description":"","name":"list_reports"},{"description":"","name":"list_resellers"},{"description":"","name":"list_websites"},{"description":"","name":"pending_today"},{"description":"","name":"pending_updates"},{"description":"","name":"performance"},{"description":"","name":"report_schedule"},{"description":"","name":"run_safe_update","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: This deploys code to production client websites."}},{"description":"","name":"run_update","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: This deploys code to production client websites."}},{"description":"","name":"safe_update_status"},{"description":"","name":"set_time_allowance","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: A login link is a sensitive authentication capability.; They affect service management and billing records."}},{"description":"","name":"set_uptime_monitoring","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: A login link is a sensitive authentication capability.; They affect service management and billing records."}},{"description":"","name":"site_login_link","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: A login link is a sensitive authentication capability.; They affect service management and billing records."}},{"description":"","name":"site_timeline"},{"description":"","name":"site_updates"},{"description":"","name":"ssl_status"},{"description":"","name":"time_allowance"},{"description":"","name":"time_summary"},{"description":"","name":"uptime_history"},{"description":"","name":"vulnerabilities"},{"description":"","name":"whats_changed"}],"tools_count":27,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/dee6003c-d3e3-4c7b-a682-0d25db98e0f9","uuid":"64aeeb2a-6d19-5110-b953-9c8e96758404","verification_tier":"community","version":""},"query_key":"glow for wordpress","schema_version":1,"status":"match"}