{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-14","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"high","description":"Connects Claude to HitPay sales, transactions, payouts and balances. Create payment links, products, recurring plans and invoices, including invoice emails. Requires an owner or admin connection for one business; it cannot refund, move funds or change settings.","did":"2d134a7d-77a0-4e3f-a0e9-f644a70923d8","documentation_url":"https://docs.hitpayapp.com/apis/guide/mcp-server","editorial_description":{"extended_description":"Review sales by channel, product category or payment method, plus settlement and refund information. HitPay serves businesses in Singapore, Malaysia and the Philippines. Creation tools are limited to the listed business objects; other supported actions are read-only.","schema_version":1,"summary":"Connects Claude to HitPay sales, transactions, payouts and balances.\nCreate payment links, products, recurring plans and invoices, including invoice emails.\nRequires an owner or admin connection for one business; it cannot refund, move funds or change settings."},"homepage_url":"","icon":"https://framerusercontent.com/images/7aaJLPLCUlCkZoTJ6JvDJUn5A.svg","id":"2d134a7d-77a0-4e3f-a0e9-f644a70923d8","installs":0,"last_scanned":"","license":"","long_description":"Review sales by channel, product category or payment method, plus settlement and refund information. HitPay serves businesses in Singapore, Malaysia and the Philippines. Creation tools are limited to the listed business objects; other supported actions are read-only.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"Official current documentation says create_invoice can optionally send the invoice to the customer by email.","reasoning":"This can send an external financial communication as the connected business.","risk_type":"messaging_as_user","severity":"high","title":"Current connector can create and email invoices","triggering_tools_or_skills":["create_invoice"]},{"evidence":"The packet stores 15 read tools, while official docs list 24 HitPay tools plus four BillPay reads and identify four creation tools.","reasoning":"The catalog materially understates current capability and risk.","risk_type":"identity_discrepancy","severity":"high","title":"Stored 15-tool inventory omits current write surface","triggering_tools_or_skills":["create_payment_link","create_invoice","create_product","create_recurring_plan"]}],"assessment_status":"provisional","auth_and_scopes":"HitPay requires dashboard owner or admin authentication and authorizes one business per connection. The stored inventory is read-only but official current docs show four write tools.","blocked_missing_evidence":null,"confidence":"high","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/2d134a7d-77a0-4e3f-a0e9-f644a70923d8.json","what_it_proves":"Candidate PR #125 record identity (name \"HitPay\", publisher, type web_connector) and 15 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/2d134a7d-77a0-4e3f-a0e9-f644a70923d8: complete tool_names inventory (15 tools), remote streamable-http endpoint https://mcp.hit-pay.com/, auth_posture auth_required, directory tier community"},{"accessed_at":"2026-10-10T21:33:21Z","url_or_path":"https://docs.hitpayapp.com/apis/guide/mcp-server","what_it_proves":"Official current documentation lists 24 HitPay tools plus four BillPay reads, including create_payment_link, create_invoice, create_product and create_recurring_plan; invoices may be emailed to customers."}],"primary_reason":"Current HitPay can create payment artifacts and email invoices, but the stored tool inventory contains only 15 read tools.","provisional_risk":null,"publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:2d134a7d-77a0-4e3f-a0e9-f644a70923d8","reviewed_at":"2026-10-10","reviewer_notes":"Official docs explicitly say it cannot refund, cancel transactions, move funds, or change account settings. Refresh the inventory before publication.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":15,"tools_or_skills_total":15},"name":"HitPay","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=2d134a7d-77a0-4e3f-a0e9-f644a70923d8&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://hitpayapp.com/privacy-policy","provisional_risk":null,"publication_recommendation":"fix","publisher":"HitPay","publisher_url":"https://www.hitpayapp.com/","remote_url":"https://mcp.hit-pay.com/","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: This can send an external financial communication as the connected business.","evidence":"Current connector can create and email invoices: Official current documentation says create_invoice can optionally send the invoice to the customer by email.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Current connector can create and email invoices","triggering_tools":["create_invoice"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@hit-pya.com","tags":["accesses_messaging","network_access","oauth_required","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"get_balances"},{"description":"","name":"get_channel_distribution"},{"description":"","name":"get_charge_details"},{"description":"","name":"get_charge_refunds"},{"description":"","name":"get_growth_indicator"},{"description":"","name":"get_payout_schedule"},{"description":"","name":"get_sales_by_category"},{"description":"","name":"get_sales_by_payment_method"},{"description":"","name":"get_sales_summary"},{"description":"","name":"get_top_products"},{"description":"","name":"get_transactions_volume"},{"description":"","name":"list_charges"},{"description":"","name":"list_invoices"},{"description":"","name":"list_orders"},{"description":"","name":"list_payouts"},{"description":"","name":"create_invoice","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: This can send an external financial communication as the connected business."}},{"description":"","name":"create_payment_link"},{"description":"","name":"create_product"},{"description":"","name":"create_recurring_plan"}],"tools_count":19,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/2d134a7d-77a0-4e3f-a0e9-f644a70923d8","uuid":"7da1ad10-a68a-5f45-9787-924f2c4084a8","verification_tier":"community","version":""},"query_key":"hitpay hitpay","schema_version":1,"status":"match"}