{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-21","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Work with Hiver shared inboxes in Gmail through Claude. Find conversations, draft shared replies, add notes or tags, and inspect support metrics. Access is limited to your inbox membership and role permissions.","did":"10548821-1584-40a2-be24-bcf097ba9844","documentation_url":"https://help.hiverhq.com/","editorial_description":{"extended_description":"Administrator reporting covers volume, workload, response times, SLA performance and customer satisfaction. The listed tools create drafts rather than send replies. CRM updates and external task creation mentioned in the broader prose are not established by this inventory.","schema_version":1,"summary":"Work with Hiver shared inboxes in Gmail through Claude.\nFind conversations, draft shared replies, add notes or tags, and inspect support metrics.\nAccess is limited to your inbox membership and role permissions."},"homepage_url":"","icon":"","id":"10548821-1584-40a2-be24-bcf097ba9844","installs":0,"last_scanned":"","license":"","long_description":"Administrator reporting covers volume, workload, response times, SLA performance and customer satisfaction. The listed tools create drafts rather than send replies. CRM updates and external task creation mentioned in the broader prose are not established by this inventory.","manual_assessment":"medium","manual_review":{"all_findings":[{"evidence":"The declared inventory explicitly adds an internal conversation note, creates a shared draft and updates tags.","reasoning":"These tools persist meaningful support-workspace changes, although no tool sends the draft externally.","risk_type":"data_modification","severity":"medium","title":"Creates notes and drafts and changes conversation tags","triggering_tools_or_skills":["add_conversation_note","create_shared_draft","update_conversation_tags"]},{"evidence":"The description says the connector can update CRM records and create project-management tasks, but no corresponding CRM-update or task-creation tool appears in the complete 20-tool Directory inventory.","reasoning":"The action description and exposed inventory are inconsistent and could misstate the current capability surface.","risk_type":"identity_discrepancy","severity":"low","title":"Listing promises actions absent from the tool inventory","triggering_tools_or_skills":[]},{"evidence":"The connector retrieves customer messages from shared support inboxes.","reasoning":"External senders can place instructions in message bodies.","risk_type":"prompt_injection_exposure","severity":"low","title":"Customer email conversations are untrusted input","triggering_tools_or_skills":["find_conversation_by_thread","get_conversation","list_messages","search_conversations"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication uses the user's Hiver role and is limited to shared inboxes the user belongs to; precise connector scopes are not documented.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"medium","evidence_completeness":"partial","manual_overall_risk":"medium","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/10548821-1584-40a2-be24-bcf097ba9844.json","what_it_proves":"Candidate PR #125 record identity (name \"Hiver in Gmail\", publisher, type web_connector) and 20 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/10548821-1584-40a2-be24-bcf097ba9844: complete tool_names inventory (20 tools), remote streamable-http endpoint https://mcp-hig.hiverhq.com/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"The inventory confirms persistent support-data writes, while the listing additionally promises CRM and task actions not present in that inventory.","provisional_risk":null,"publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:10548821-1584-40a2-be24-bcf097ba9844","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 20 tool names. The official help center required JavaScript and yielded no MCP action documentation, so it is not cited; reconcile the listing with the current tool list and verify report_unmet_need and hidden CRM/task integrations.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"unknown","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":20,"tools_or_skills_total":20},"name":"Hiver in Gmail","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=10548821-1584-40a2-be24-bcf097ba9844&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://hiverhq.com/privacy#hiver-mcp","provisional_risk":null,"publication_recommendation":"fix","publisher":"GREXIT, INC.","publisher_url":"https://hiverhq.com/","remote_url":"https://mcp-hig.hiverhq.com/mcp","repository_url":"","risk":"medium","risk_severity":"medium","security_risks":[{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These tools persist meaningful support-workspace changes, although no tool sends the draft externally.","evidence":"Creates notes and drafts and changes conversation tags: The declared inventory explicitly adds an internal conversation note, creates a shared draft and updates tags.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Creates notes and drafts and changes conversation tags","triggering_tools":["add_conversation_note","create_shared_draft","update_conversation_tags"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@hiverhq.com","tags":["accesses_messaging","modifies_data","network_access","oauth_required","web_connector"],"tools":[{"description":"","name":"add_conversation_note","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These tools persist meaningful support-workspace changes, although no tool sends the draft externally."}},{"description":"","name":"create_shared_draft","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These tools persist meaningful support-workspace changes, although no tool sends the draft externally."}},{"description":"","name":"find_conversation_by_thread"},{"description":"","name":"get_agent_workload"},{"description":"","name":"get_company_support_report"},{"description":"","name":"get_conversation"},{"description":"","name":"get_conversation_volume"},{"description":"","name":"get_csat_report"},{"description":"","name":"get_response_performance"},{"description":"","name":"get_sentiment_summary"},{"description":"","name":"get_sla_report"},{"description":"","name":"list_inbox_users"},{"description":"","name":"list_inboxes"},{"description":"","name":"list_messages"},{"description":"","name":"list_sla_policies"},{"description":"","name":"list_tags"},{"description":"","name":"report_unmet_need"},{"description":"","name":"search_conversations"},{"description":"","name":"update_conversation_tags","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These tools persist meaningful support-workspace changes, although no tool sends the draft externally."}},{"description":"","name":"whoami"}],"tools_count":20,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/10548821-1584-40a2-be24-bcf097ba9844","uuid":"5816165b-97a1-570e-b4c0-460d8d2b8331","verification_tier":"community","version":""},"query_key":"hiver in gmail","schema_version":1,"status":"match"}