{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-03","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"no_auth","category":"Web Connector","confidence":"medium","description":"Manage Gumlet video and image infrastructure from Claude. Upload and organize assets, configure encoding profiles and inspect delivery analytics. Operate playlists, live streams and supported workspace resources.","did":"cad05a7d-585d-4ad2-ac5a-4fa64a6e0bc2","documentation_url":"https://docs.gumlet.com/","editorial_description":{"extended_description":"Tools cover subtitles, thumbnails, chapters, image sources, webhooks and viewer invitations. You can start or complete live streams, purge image caches and update or delete assets, profiles, folders and workspaces. Analytics include aggregate results, breakdowns and asset-level performance.","schema_version":1,"summary":"Manage Gumlet video and image infrastructure from Claude.\nUpload and organize assets, configure encoding profiles and inspect delivery analytics.\nOperate playlists, live streams and supported workspace resources."},"homepage_url":"","icon":"https://www.gumlet.com/favicon.ico","id":"cad05a7d-585d-4ad2-ac5a-4fa64a6e0bc2","installs":0,"last_scanned":"","license":"","long_description":"Tools cover subtitles, thumbnails, chapters, image sources, webhooks and viewer invitations. You can start or complete live streams, purge image caches and update or delete assets, profiles, folders and workspaces. Analytics include aggregate results, breakdowns and asset-level performance.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The inventory explicitly exposes deletion of media and account/infrastructure resources.","reasoning":"These are destructive actions over production media delivery.","risk_type":"data_deletion","severity":"high","title":"Assets, workspaces, sources, profiles and webhooks can be deleted","triggering_tools_or_skills":["delete_asset","delete_workspace","delete_source","delete_profile","delete_webhook"]},{"evidence":"The tool names operate media-delivery infrastructure and live streams.","reasoning":"Starting live delivery and changing webhooks/workspaces is production infrastructure action.","risk_type":"deployment_infrastructure","severity":"high","title":"Live streams, workspaces, sources and webhooks can be provisioned or started","triggering_tools_or_skills":["start_live","create_workspace","create_image_source","create_webhook","create_live_asset"]},{"evidence":"The inventory includes viewer invitation and removal tools.","reasoning":"Granting or revoking audience access is administrative and invitations may contact external recipients.","risk_type":"credential_admin","severity":"high","title":"Channel viewers can be invited or removed","triggering_tools_or_skills":["invite_channel_viewers","invite_channel_viewers_csv","remove_channel_viewers"]},{"evidence":"The Directory says no_auth while tools fetch users/orgs and mutate workspaces, assets and viewers.","reasoning":"Without an explained tenant/auth boundary, it is unclear whose resources these actions affect.","risk_type":"authz_ambiguity","severity":"low","title":"No-auth posture conflicts with account management actions","triggering_tools_or_skills":[]},{"evidence":"The connector runs at https://mcp.gumlet.com/mcp/v1 without a pinned server implementation in the packet.","reasoning":"The hosted implementation and tool behavior can change independently of this snapshot, so monitoring and runtime verification remain necessary.","risk_type":"provenance_uncertainty","severity":"low","title":"Gumlet is a mutable remote service","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"The Directory marks this remote service no-auth despite extensive account and infrastructure actions; no authorization explanation is supplied.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/cad05a7d-585d-4ad2-ac5a-4fa64a6e0bc2.json","what_it_proves":"Candidate PR #125 record identity (name \"Gumlet\", publisher, type web_connector) and 71 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/cad05a7d-585d-4ad2-ac5a-4fa64a6e0bc2: complete tool_names inventory (71 tools), remote streamable-http endpoint https://mcp.gumlet.com/mcp/v1, auth_posture no_auth, directory tier community"}],"primary_reason":"Gumlet exposes destructive media infrastructure and access-management actions while the listing claims no authentication.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:cad05a7d-585d-4ad2-ac5a-4fa64a6e0bc2","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 71 tools. Publication should not imply a safe auth posture; runtime verification must establish the actual tenant authorization boundary.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"true","deletes_data":"true","deployment_or_infrastructure":"true","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"unknown","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"unknown","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":71,"tools_or_skills_total":71},"name":"Gumlet","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=cad05a7d-585d-4ad2-ac5a-4fa64a6e0bc2&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://gumlet.com/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Gumlet","publisher_url":"https://gumlet.com/","remote_url":"https://mcp.gumlet.com/mcp/v1","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can permanently remove data or resources. Review findings: These are destructive actions over production media delivery.","evidence":"Assets, workspaces, sources, profiles and webhooks can be deleted: The inventory explicitly exposes deletion of media and account/infrastructure resources.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Assets, workspaces, sources, profiles and webhooks can be deleted","triggering_tools":["delete_asset","delete_workspace","delete_source","delete_profile","delete_webhook"]},{"description":"This connector can deploy code or change infrastructure and production environments. Review findings: Starting live delivery and changing webhooks/workspaces is production infrastructure action.","evidence":"Live streams, workspaces, sources and webhooks can be provisioned or started: The tool names operate media-delivery infrastructure and live streams.","manual_risk_type":"deployment_infrastructure","remediation":{"block_tool_categories":["code_execution","state_change"],"steps":["Default to a sandbox or staging environment.","Require code review, human approval, audit logging, and a tested rollback path for production changes."]},"risk_type":"code_deployment","severity":"high","title":"Live streams, workspaces, sources and webhooks can be provisioned or started","triggering_tools":["start_live","create_workspace","create_image_source","create_webhook","create_live_asset"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Granting or revoking audience access is administrative and invitations may contact external recipients.","evidence":"Channel viewers can be invited or removed: The inventory includes viewer invitation and removal tools.","manual_risk_type":"credential_admin","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"high","title":"Channel viewers can be invited or removed","triggering_tools":["invite_channel_viewers","invite_channel_viewers_csv","remove_channel_viewers"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@gumlet.com","tags":["accesses_messaging","code_deployment","deletes_data","modifies_data","network_access","web_connector"],"tools":[{"description":"","name":"add_asset_playlist"},{"description":"","name":"asset_audio_upload"},{"description":"","name":"asset_status_history"},{"description":"","name":"complete_audio_upload"},{"description":"","name":"complete_live_stream"},{"description":"","name":"complete_multipart_upload"},{"description":"","name":"complete_subtitle_upload"},{"description":"","name":"create_asset"},{"description":"","name":"create_asset_direct_upload"},{"description":"","name":"create_folder"},{"description":"","name":"create_image_source","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: Starting live delivery and changing webhooks/workspaces is production infrastructure action."}},{"description":"","name":"create_live_asset","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: Starting live delivery and changing webhooks/workspaces is production infrastructure action."}},{"description":"","name":"create_live_asset_copy"},{"description":"","name":"create_playlist"},{"description":"","name":"create_profile"},{"description":"","name":"create_update_chapter"},{"description":"","name":"create_webhook","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: Starting live delivery and changing webhooks/workspaces is production infrastructure action."}},{"description":"","name":"create_workspace","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: Starting live delivery and changing webhooks/workspaces is production infrastructure action."}},{"description":"","name":"delete_asset","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These are destructive actions over production media delivery."}},{"description":"","name":"delete_folder"},{"description":"","name":"delete_live_asset"},{"description":"","name":"delete_playlist"},{"description":"","name":"delete_profile","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These are destructive actions over production media delivery."}},{"description":"","name":"delete_source","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These are destructive actions over production media delivery."}},{"description":"","name":"delete_webhook","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These are destructive actions over production media delivery."}},{"description":"","name":"delete_workspace","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These are destructive actions over production media delivery."}},{"description":"","name":"fetch_audit_logs"},{"description":"","name":"fetch_org"},{"description":"","name":"fetch_user"},{"description":"","name":"filter_live_assets"},{"description":"","name":"get_all_playlists"},{"description":"","name":"get_asset_details"},{"description":"","name":"get_folder"},{"description":"","name":"get_image_sources_source_id"},{"description":"","name":"get_live_asset_status"},{"description":"","name":"get_playlist_assets"},{"description":"","name":"get_profile"},{"description":"","name":"get_workspace"},{"description":"","name":"image_purge"},{"description":"","name":"insights_aggregated_data"},{"description":"","name":"insights_breakdown_data"},{"description":"","name":"insights_chart_data"},{"description":"","name":"invite_channel_viewers","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Granting or revoking audience access is administrative and invitations may contact external recipients."}},{"description":"","name":"invite_channel_viewers_csv","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Granting or revoking audience access is administrative and invitations may contact external recipients."}},{"description":"","name":"list_assets"},{"description":"","name":"list_folders"},{"description":"","name":"list_profiles"},{"description":"","name":"list_sources"},{"description":"","name":"list_workspaces"},{"description":"","name":"purge_image_cache"},{"description":"","name":"recover"},{"description":"","name":"remove_asset_playlist"},{"description":"","name":"remove_assets_folder"},{"description":"","name":"remove_channel_viewers","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Granting or revoking audience access is administrative and invitations may contact external recipients."}},{"description":"","name":"reorder_asset_playlist"},{"description":"","name":"retrieve_analytics"},{"description":"","name":"retrieve_image_analytics"},{"description":"","name":"retrieve_part_url"},{"description":"","name":"start_live","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: Starting live delivery and changing webhooks/workspaces is production infrastructure action."}},{"description":"","name":"thumbnail_select"},{"description":"","name":"thumbnail_upload"},{"description":"","name":"thumbnail_upload_live"},{"description":"","name":"top_assets"},{"description":"","name":"update_asset"},{"description":"","name":"update_folder"},{"description":"","name":"update_image_source"},{"description":"","name":"update_playlist"},{"description":"","name":"update_profile"},{"description":"","name":"update_webhook"},{"description":"","name":"update_workspace"},{"description":"","name":"upload_subtitles"}],"tools_count":71,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/cad05a7d-585d-4ad2-ac5a-4fa64a6e0bc2","uuid":"63ed63d7-b0bc-57e9-a23c-b8d80e4d8e7c","verification_tier":"community","version":""},"query_key":"gumlet","schema_version":1,"status":"match"}