{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-06-29","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Follow HoneyBook projects, clients, invoices, contracts and conversations in Claude. Review business activity and, when enabled, update projects, notes and contacts. Changes are off by default and access is limited to your connected account.","did":"01ce7a0e-8c9e-46a6-9a4b-ddc62627cdc7","documentation_url":"https://help.honeybook.com/en/articles/15686224-honeybook-claude-how-your-data-is-used","editorial_description":{"extended_description":"Viewing and changing data use separate permissions. Additional access to company settings or professional collaborators is authorized separately. The connector discovers relevant actions and offers distinct read-only and action interfaces for independent-business workflows.","schema_version":1,"summary":"Follow HoneyBook projects, clients, invoices, contracts and conversations in Claude.\nReview business activity and, when enabled, update projects, notes and contacts.\nChanges are off by default and access is limited to your connected account."},"homepage_url":"","icon":"","id":"01ce7a0e-8c9e-46a6-9a4b-ddc62627cdc7","installs":0,"last_scanned":"","license":"","long_description":"Viewing and changing data use separate permissions. Additional access to company settings or professional collaborators is authorized separately. The connector discovers relevant actions and offers distinct read-only and action interfaces for independent-business workflows.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"Directory tool_names are only find_action, get_guidance, take_action, take_action_read_only; declared_permissions describe create/update of projects, contacts, organisations and profile.","reasoning":"Actions are discovered at runtime; the declared inventory does not bound what take_action can do.","risk_type":"generic_gateway","severity":"high","title":"Generic find_action/take_action gateway hides the reachable action set","triggering_tools_or_skills":["find_action","take_action","take_action_read_only","get_guidance"]},{"evidence":"HoneyBook MCP blog: agents can 'build a proposal, invoice or contract' from templates and 'publish it' for a client to open.","reasoning":"Issues client-facing documents under the business's name.","risk_type":"messaging_as_user","severity":"high","title":"Can publish proposals, invoices and contracts to clients","triggering_tools_or_skills":["take_action"]},{"evidence":"HoneyBook MCP blog: agents can 'raise a standalone payment request'.","reasoning":"Requesting/charging client money is a High financial action.","risk_type":"financial_transaction","severity":"high","title":"Can raise standalone payment requests to clients","triggering_tools_or_skills":["take_action"]},{"evidence":"Description: 'The bigger stuff, like company settings or letting a pro or bookkeeper in, is always asked for on its own'.","reasoning":"Suggests admin/access-granting actions may be reachable; not confirmed in docs (credential_or_admin_actions unknown).","risk_type":"credential_admin","severity":"medium","title":"Description references grants for company settings and adding a pro or bookkeeper","triggering_tools_or_skills":["take_action"]},{"evidence":"sensitive_data_types include client contact information, communications, financial records, contracts.","reasoning":"Client messages are third-party text (prompt-injection exposure).","risk_type":"private_data_read","severity":"low","title":"Reads client contacts, messages, invoices, contracts and revenue","triggering_tools_or_skills":["take_action_read_only","find_action"]},{"evidence":"Directory remote.url is mcp.api.honeybook.com/mcp; no pinned source or version is available for the server.","reasoning":"Tool behaviour can change server-side after review; ratings rest on the 2026-09-22 snapshot.","risk_type":"provenance_uncertainty","severity":"low","title":"Closed hosted MCP server for HoneyBook can change without notice","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"auth_required OAuth; per-resource grants with separate view/change switches (writes off by default); larger grants (company settings, adding a pro/bookkeeper) requested separately per description; exact scopes unknown.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/01ce7a0e-8c9e-46a6-9a4b-ddc62627cdc7.json","what_it_proves":"Candidate PR #125 record identity (name \"HoneyBook\", publisher, type web_connector) and 4 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/01ce7a0e-8c9e-46a6-9a4b-ddc62627cdc7: complete tool_names inventory (4 tools), remote streamable-http endpoint https://mcp.api.honeybook.com/mcp, auth_posture auth_required, publisher-declared permissions text, declared sensitive data types, directory tier community"},{"accessed_at":"2026-10-10T20:28:28Z","url_or_path":"https://help.honeybook.com/en/articles/15686224-honeybook-claude-how-your-data-is-used","what_it_proves":"HoneyBook help article: read access to projects, invoices, contracts, client messages; write access creates projects and edits project details; no undo for changes."},{"accessed_at":"2026-10-10T20:29:25Z","url_or_path":"https://www.honeybook.com/blog/introducing-the-honeybook-mcp-ask-claude-about-your-pipeline-invoices-and-contracts","what_it_proves":"Official HoneyBook MCP blog: agents can create/update projects and client records, build a proposal, invoice or contract and publish it for a client, and raise a standalone payment request; permission granted resource by resource."}],"primary_reason":"A generic take_action gateway reaches actions that official HoneyBook docs say include publishing invoices/contracts to clients and raising payment requests.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:01ce7a0e-8c9e-46a6-9a4b-ddc62627cdc7","reviewed_at":"2026-10-10","reviewer_notes":"Identity consistent (HoneyBook; publisher string 'Honeybook' capitalisation only). Reviewed all 4 tool names. The help article mentions only project create/edit, while the official blog adds publishing documents and payment requests; rating follows the broader official statement. Deletion and admin actions unknown. 'About the HoneyBook connector' article not found via WebSearch (search not cited).","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"unknown","deletes_data":"unknown","deployment_or_infrastructure":"false","dynamic_hidden_actions":"true","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"true"},"tools_or_skills_reviewed":4,"tools_or_skills_total":4},"name":"HoneyBook","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=01ce7a0e-8c9e-46a6-9a4b-ddc62627cdc7&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.honeybook.com/legal/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Honeybook","publisher_url":"https://www.honeybook.com/","remote_url":"https://mcp.api.honeybook.com/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Actions are discovered at runtime; the declared inventory does not bound what take_action can do.","evidence":"Generic find_action/take_action gateway hides the reachable action set: Directory tool_names are only find_action, get_guidance, take_action, take_action_read_only; declared_permissions describe create/update of projects, contacts, organisations and profile.","manual_risk_type":"generic_gateway","remediation":{"block_tool_categories":["code_execution"],"steps":["Run only in a sandbox with least-privilege credentials and strict resource limits.","Disable generic execution gateways unless their reachable action set is fully understood.","Require approval before execution against production systems or sensitive data."]},"risk_type":"runs_code","severity":"high","title":"Generic find_action/take_action gateway hides the reachable action set","triggering_tools":["find_action","take_action","take_action_read_only","get_guidance"]},{"description":"This connector can publish or send messages and content using the connected identity. Review findings: Issues client-facing documents under the business's name.","evidence":"Can publish proposals, invoices and contracts to clients: HoneyBook MCP blog: agents can 'build a proposal, invoice or contract' from templates and 'publish it' for a client to open.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Can publish proposals, invoices and contracts to clients","triggering_tools":["take_action"]},{"description":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Requesting/charging client money is a High financial action.","evidence":"Can raise standalone payment requests to clients: HoneyBook MCP blog: agents can 'raise a standalone payment request'.","manual_risk_type":"financial_transaction","remediation":{"block_tool_categories":["financial"],"steps":["Set provider-side spending limits and require approval for every financial action.","Use a dedicated low-balance account and review transaction logs."]},"risk_type":"spends_money","severity":"high","title":"Can raise standalone payment requests to clients","triggering_tools":["take_action"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Suggests admin/access-granting actions may be reachable; not confirmed in docs (credential_or_admin_actions unknown).","evidence":"Description references grants for company settings and adding a pro or bookkeeper: Description: 'The bigger stuff, like company settings or letting a pro or bookkeeper in, is always asked for on its own'.","manual_risk_type":"credential_admin","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Description references grants for company settings and adding a pro or bookkeeper","triggering_tools":["take_action"]},{"description":"This connector can read information available to the connected account and return it to the AI. Review findings: Client messages are third-party text (prompt-injection exposure).","evidence":"Reads client contacts, messages, invoices, contracts and revenue: sensitive_data_types include client contact information, communications, financial records, contracts.","manual_risk_type":"private_data_read","remediation":{"block_tool_categories":["data_exfiltration"],"steps":["Use a least-privilege account limited to the information required by the workflow.","Restrict folders, projects, tenants, and other data scopes wherever the provider allows it.","Review access logs for unexpected reads or bulk retrieval."]},"risk_type":"reads_private_data","severity":"low","title":"Reads client contacts, messages, invoices, contracts and revenue","triggering_tools":["take_action_read_only","find_action"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"concierge@honeybook.com ","tags":["modifies_data","network_access","oauth_required","reads_private_data","runs_code","sends_messages_as_you","spends_money","web_connector"],"tools":[{"description":"","name":"find_action","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Actions are discovered at runtime; the declared inventory does not bound what take_action can do."}},{"description":"","name":"get_guidance","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Actions are discovered at runtime; the declared inventory does not bound what take_action can do."}},{"description":"","name":"take_action","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Requesting/charging client money is a High financial action."}},{"description":"","name":"take_action_read_only","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Actions are discovered at runtime; the declared inventory does not bound what take_action can do."}}],"tools_count":4,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/01ce7a0e-8c9e-46a6-9a4b-ddc62627cdc7","uuid":"ae56f72c-d033-5d14-b04b-dd9fa13c1115","verification_tier":"community","version":""},"query_key":"honeybook honeybook","schema_version":1,"status":"match"}