{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-27","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Hitsteps connects Claude to website analytics, visitor activity, uptime, and live chat. Inspect traffic sources, paths, goals, heatmaps, conversions, and site performance. Manage monitoring and analytics settings or respond to visitors through chat tools.","did":"5950f795-aca7-433e-8b9c-48de99d080ff","documentation_url":"https://www.hitsteps.com/plugin/?type=mcp","editorial_description":{"extended_description":"The inventory includes campaigns, labels, alerts, uptime monitors and contacts, recovery actions, chat tickets, and site setup. Visitor details include browser, device, referral source, and location estimated from IP data; these are not precise location measurements.","schema_version":1,"summary":"Hitsteps connects Claude to website analytics, visitor activity, uptime, and live chat.\nInspect traffic sources, paths, goals, heatmaps, conversions, and site performance.\nManage monitoring and analytics settings or respond to visitors through chat tools."},"homepage_url":"","icon":"","id":"5950f795-aca7-433e-8b9c-48de99d080ff","installs":0,"last_scanned":"","license":"","long_description":"The inventory includes campaigns, labels, alerts, uptime monitors and contacts, recovery actions, chat tickets, and site setup. Visitor details include browser, device, referral source, and location estimated from IP data; these are not precise location measurements.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"Tool sends an external live-chat reply.","reasoning":"Messaging as user is High.","risk_type":"messaging_as_user","severity":"high","title":"Replies to website visitors","triggering_tools_or_skills":["reply_chat"]},{"evidence":"Tools explicitly delete meaningful analytics/monitoring data.","reasoning":"Deletion is High.","risk_type":"data_deletion","severity":"high","title":"Deletes campaigns, tickets, monitors and contacts","triggering_tools_or_skills":["delete_campaign","delete_chat_ticket","delete_uptime_monitor","delete_uptime_contact"]},{"evidence":"These alter live monitoring/recovery infrastructure.","reasoning":"Infrastructure changes are High.","risk_type":"deployment_infrastructure","severity":"high","title":"Creates/updates recovery and uptime monitoring","triggering_tools_or_skills":["create_recovery_action","create_uptime_monitor","update_recovery_action"]},{"evidence":"Remote hosted implementation is unpinned.","reasoning":"Runtime capability can drift.","risk_type":"provenance_uncertainty","severity":"low","title":"Hosted implementation is mutable","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"OAuth/account authorization required; exact scopes are not documented.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/5950f795-aca7-433e-8b9c-48de99d080ff.json","what_it_proves":"Candidate PR #125 record identity (name \"Hitsteps Web Analytics\", publisher, type web_connector) and 80 stored tool names (truncated vs Directory); no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/5950f795-aca7-433e-8b9c-48de99d080ff: complete tool_names inventory (87 tools), remote streamable-http endpoint https://www.hitsteps.com/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Hitsteps deletes monitoring/chat/configuration records, replies to visitors, and its candidate inventory is truncated.","provisional_risk":null,"publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:5950f795-aca7-433e-8b9c-48de99d080ff","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed 87 Directory tools; candidate_tools_truncated=true requires regenerating full stored inventory.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"true","deployment_or_infrastructure":"true","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":87,"tools_or_skills_total":87},"name":"Hitsteps Web Analytics","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=5950f795-aca7-433e-8b9c-48de99d080ff&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.hitsteps.com/privacy.php","provisional_risk":null,"publication_recommendation":"fix","publisher":"Hitsteps Analytics","publisher_url":"https://www.hitsteps.com/","remote_url":"https://www.hitsteps.com/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: Messaging as user is High.","evidence":"Replies to website visitors: Tool sends an external live-chat reply.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Replies to website visitors","triggering_tools":["reply_chat"]},{"description":"This connector can permanently remove data or resources. Review findings: Deletion is High.","evidence":"Deletes campaigns, tickets, monitors and contacts: Tools explicitly delete meaningful analytics/monitoring data.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Deletes campaigns, tickets, monitors and contacts","triggering_tools":["delete_campaign","delete_chat_ticket","delete_uptime_monitor","delete_uptime_contact"]},{"description":"This connector can deploy code or change infrastructure and production environments. Review findings: Infrastructure changes are High.","evidence":"Creates/updates recovery and uptime monitoring: These alter live monitoring/recovery infrastructure.","manual_risk_type":"deployment_infrastructure","remediation":{"block_tool_categories":["code_execution","state_change"],"steps":["Default to a sandbox or staging environment.","Require code review, human approval, audit logging, and a tested rollback path for production changes."]},"risk_type":"code_deployment","severity":"high","title":"Creates/updates recovery and uptime monitoring","triggering_tools":["create_recovery_action","create_uptime_monitor","update_recovery_action"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://www.hitsteps.com/contact.php","tags":["accesses_calendar","accesses_messaging","code_deployment","deletes_data","network_access","oauth_required","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"clear_alerts"},{"description":"","name":"compare_traffic_periods"},{"description":"","name":"create_campaign"},{"description":"","name":"create_chat_ticket"},{"description":"","name":"create_goal"},{"description":"","name":"create_label"},{"description":"","name":"create_recovery_action","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: Infrastructure changes are High."}},{"description":"","name":"create_uptime_contact"},{"description":"","name":"create_uptime_monitor","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: Infrastructure changes are High."}},{"description":"","name":"create_uptime_schedule"},{"description":"","name":"create_website"},{"description":"","name":"delete_campaign","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion is High."}},{"description":"","name":"delete_chat_ticket","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion is High."}},{"description":"","name":"delete_goal"},{"description":"","name":"delete_label"},{"description":"","name":"delete_recovery_action"},{"description":"","name":"delete_uptime_contact","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion is High."}},{"description":"","name":"delete_uptime_monitor","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion is High."}},{"description":"","name":"delete_uptime_schedule"},{"description":"","name":"explain_traffic_change"},{"description":"","name":"get_account_status"},{"description":"","name":"get_ai_referrals"},{"description":"","name":"get_anomalies"},{"description":"","name":"get_audience_technology"},{"description":"","name":"get_bot_traffic"},{"description":"","name":"get_breakdown"},{"description":"","name":"get_campaign_performance"},{"description":"","name":"get_chat"},{"description":"","name":"get_chat_summary"},{"description":"","name":"get_connection_info"},{"description":"","name":"get_digest"},{"description":"","name":"get_downloads"},{"description":"","name":"get_entry_exit_pages"},{"description":"","name":"get_funnel_performance"},{"description":"","name":"get_goal_conversions"},{"description":"","name":"get_goals"},{"description":"","name":"get_heatmap_summary"},{"description":"","name":"get_interaction_events"},{"description":"","name":"get_labels"},{"description":"","name":"get_mcp_usage"},{"description":"","name":"get_outbound_links"},{"description":"","name":"get_overview"},{"description":"","name":"get_page_detail"},{"description":"","name":"get_page_speed"},{"description":"","name":"get_paths"},{"description":"","name":"get_realtime_visitors"},{"description":"","name":"get_retention"},{"description":"","name":"get_search_engines"},{"description":"","name":"get_search_keywords"},{"description":"","name":"get_site_context"},{"description":"","name":"get_site_settings"},{"description":"","name":"get_social_referrals"},{"description":"","name":"get_timeseries"},{"description":"","name":"get_top_countries"},{"description":"","name":"get_top_pages"},{"description":"","name":"get_top_referrers"},{"description":"","name":"get_tracking_code"},{"description":"","name":"get_tracking_health"},{"description":"","name":"get_traffic_by_hour"},{"description":"","name":"get_traffic_sources"},{"description":"","name":"get_traffic_summary"},{"description":"","name":"get_uptime_history"},{"description":"","name":"get_uptime_status"},{"description":"","name":"get_video_analytics"},{"description":"","name":"list_alerts"},{"description":"","name":"list_chats"},{"description":"","name":"list_goal_configuration"},{"description":"","name":"list_label_configuration"},{"description":"","name":"list_metrics_dimensions"},{"description":"","name":"list_sites"},{"description":"","name":"list_uptime_configuration"},{"description":"","name":"mark_alerts_read"},{"description":"","name":"mark_chat_read"},{"description":"","name":"reply_chat","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Messaging as user is High."}},{"description":"","name":"search_chats"},{"description":"","name":"set_chat_ticket_status"},{"description":"","name":"set_chat_visitor_name"},{"description":"","name":"update_campaign"},{"description":"","name":"update_chat_internal_notes"},{"description":"","name":"update_goal"},{"description":"","name":"update_label"},{"description":"","name":"update_recovery_action","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: Infrastructure changes are High."}},{"description":"","name":"update_site_settings"},{"description":"","name":"update_uptime_contact"},{"description":"","name":"update_uptime_monitor"},{"description":"","name":"update_uptime_schedule"},{"description":"","name":"verify_uptime_contact"}],"tools_count":87,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/5950f795-aca7-433e-8b9c-48de99d080ff","uuid":"1db90649-ad7d-5870-984a-147a9b770f3a","verification_tier":"community","version":""},"query_key":"hitsteps web analytics","schema_version":1,"status":"match"}