{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-16","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Groundbook reviews construction drawings against specifications, checklists, and code sources. Inspect cited issues, manage review projects, and update findings or assignments. Existing project permissions apply, and changes require confirmation.","did":"901f7774-f7ad-45c3-8369-df11a7edc77f","documentation_url":"https://app.groundbook.ai/developers","editorial_description":{"extended_description":"Checks can use public, uploaded, or licensed code material. Tools add saved files, start reviews, share projects, and export PDF reports, marked drawings, Bluebeam FDF, or CSV, with downloads prepared on the website.","schema_version":1,"summary":"Groundbook reviews construction drawings against specifications, checklists, and code sources.\nInspect cited issues, manage review projects, and update findings or assignments.\nExisting project permissions apply, and changes require confirmation."},"homepage_url":"","icon":"","id":"901f7774-f7ad-45c3-8369-df11a7edc77f","installs":0,"last_scanned":"","license":"","long_description":"Checks can use public, uploaded, or licensed code material. Tools add saved files, start reviews, share projects, and export PDF reports, marked drawings, Bluebeam FDF, or CSV, with downloads prepared on the website.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"These tools destroy construction-review projects/resources or revoke sharing.","reasoning":"They can cause severe project/data/access loss.","risk_type":"data_deletion","severity":"high","title":"Deletes projects and removes files/code sources/shares","triggering_tools_or_skills":["delete_project","remove_file","remove_code_source","remove_project_share"]},{"evidence":"This posts collaborator-visible issue discussion.","reasoning":"It communicates as the authenticated reviewer.","risk_type":"messaging_as_user","severity":"high","title":"Comments on construction issues","triggering_tools_or_skills":["comment_on_issue"]},{"evidence":"These operations change access/control semantics for projects and source materials.","reasoning":"They are privileged sharing/authorization administration.","risk_type":"credential_admin","severity":"high","title":"Shares projects and changes file roles/review instructions","triggering_tools_or_skills":["share_project","remove_project_share","set_file_role","set_review_instructions"]},{"evidence":"The tool runs review checks against drawings and uploaded/licensed building codes.","reasoning":"This is remote analytical execution over project files, though not arbitrary shell code.","risk_type":"code_execution","severity":"high","title":"Starts automated drawing/code checks","triggering_tools_or_skills":["start_check"]},{"evidence":"These tools persist or generate project artifacts.","reasoning":"They transfer sensitive drawings/reports.","risk_type":"file_write","severity":"medium","title":"Adds saved files and exports reports/marked drawings","triggering_tools_or_skills":["add_saved_files_to_project","export_issues"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication is required; project/code/drawing/issue/share access follows the user’s Groundbook permissions.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/901f7774-f7ad-45c3-8369-df11a7edc77f.json","what_it_proves":"Candidate PR #125 record identity (name \"Groundbook\", publisher, type web_connector) and 26 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/901f7774-f7ad-45c3-8369-df11a7edc77f: complete tool_names inventory (26 tools), remote streamable-http endpoint https://app.groundbook.ai/api/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Groundbook can delete projects, post comments and administer sharing/file roles.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:901f7774-f7ad-45c3-8369-df11a7edc77f","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 26 tools. Confirmation annotations are safeguards; start_check is bounded analysis, while deletion/sharing independently establish High risk.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"true","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"true","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"true","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":26,"tools_or_skills_total":26},"name":"Groundbook","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=901f7774-f7ad-45c3-8369-df11a7edc77f&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://app.groundbook.ai/legal/privacy-policy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Groundbook AI","publisher_url":"https://groundbook.ai/","remote_url":"https://app.groundbook.ai/api/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can permanently remove data or resources. Review findings: They can cause severe project/data/access loss.","evidence":"Deletes projects and removes files/code sources/shares: These tools destroy construction-review projects/resources or revoke sharing.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Deletes projects and removes files/code sources/shares","triggering_tools":["delete_project","remove_file","remove_code_source","remove_project_share"]},{"description":"This connector can publish or send messages and content using the connected identity. Review findings: It communicates as the authenticated reviewer.","evidence":"Comments on construction issues: This posts collaborator-visible issue discussion.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Comments on construction issues","triggering_tools":["comment_on_issue"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They are privileged sharing/authorization administration.","evidence":"Shares projects and changes file roles/review instructions: These operations change access/control semantics for projects and source materials.","manual_risk_type":"credential_admin","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"high","title":"Shares projects and changes file roles/review instructions","triggering_tools":["share_project","remove_project_share","set_file_role","set_review_instructions"]},{"description":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: This is remote analytical execution over project files, though not arbitrary shell code.","evidence":"Starts automated drawing/code checks: The tool runs review checks against drawings and uploaded/licensed building codes.","manual_risk_type":"code_execution","remediation":{"block_tool_categories":["code_execution"],"steps":["Run only in a sandbox with least-privilege credentials and strict resource limits.","Disable generic execution gateways unless their reachable action set is fully understood.","Require approval before execution against production systems or sensitive data."]},"risk_type":"runs_code","severity":"high","title":"Starts automated drawing/code checks","triggering_tools":["start_check"]},{"description":"This connector can create, change, export, or otherwise write files. Review findings: They transfer sensitive drawings/reports.","evidence":"Adds saved files and exports reports/marked drawings: These tools persist or generate project artifacts.","manual_risk_type":"file_write","remediation":{"block_tool_categories":["state_change"],"steps":["Limit file access to a dedicated working directory.","Review generated or modified files before they are shared or executed."]},"risk_type":"filesystem_access","severity":"medium","title":"Adds saved files and exports reports/marked drawings","triggering_tools":["add_saved_files_to_project","export_issues"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@groundbook.ai","tags":["deletes_data","filesystem_access","modifies_data","network_access","oauth_required","runs_code","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"add_code_source"},{"description":"","name":"add_saved_files_to_project","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: They transfer sensitive drawings/reports."}},{"description":"","name":"ask"},{"description":"","name":"assign_issue"},{"description":"","name":"comment_on_issue","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: It communicates as the authenticated reviewer."}},{"description":"","name":"create_project"},{"description":"","name":"delete_project","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: They can cause severe project/data/access loss."}},{"description":"","name":"export_issues","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: They transfer sensitive drawings/reports."}},{"description":"","name":"get_export"},{"description":"","name":"get_issue"},{"description":"","name":"get_me"},{"description":"","name":"get_project"},{"description":"","name":"give_issue_feedback"},{"description":"","name":"list_issues"},{"description":"","name":"list_projects"},{"description":"","name":"list_saved_files"},{"description":"","name":"remove_code_source","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: They can cause severe project/data/access loss."}},{"description":"","name":"remove_file","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: They can cause severe project/data/access loss."}},{"description":"","name":"remove_project_share","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They are privileged sharing/authorization administration."}},{"description":"","name":"set_file_role","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They are privileged sharing/authorization administration."}},{"description":"","name":"set_review_instructions","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They are privileged sharing/authorization administration."}},{"description":"","name":"share_project","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They are privileged sharing/authorization administration."}},{"description":"","name":"start_check","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: This is remote analytical execution over project files, though not arbitrary shell code."}},{"description":"","name":"unassign_issue"},{"description":"","name":"update_issue"},{"description":"","name":"update_project"}],"tools_count":26,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/901f7774-f7ad-45c3-8369-df11a7edc77f","uuid":"00bb2524-c79f-5d8a-92eb-760e8dce5b31","verification_tier":"community","version":""},"query_key":"groundbook ai groundbook","schema_version":1,"status":"match"}