{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-14","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Create and manage Hovercode QR codes, short links, pages and forms. Customize designs, change dynamic destinations and review scan or click analytics. Work in your connected workspace within the same plan limits as the dashboard.","did":"c9867785-5919-4b3a-b6d1-9fcecf6addf5","documentation_url":"https://hovercode.com/integrations/mcp/","editorial_description":{"extended_description":"Generate QR codes in bulk and download PNG or SVG files, including codes linked to PDFs. Build block-based landing pages and branded forms, publish them and inspect responses. Organization tools include folders and tags; free accounts have limited active dynamic codes, with higher limits on paid plans.","schema_version":1,"summary":"Create and manage Hovercode QR codes, short links, pages and forms.\nCustomize designs, change dynamic destinations and review scan or click analytics.\nWork in your connected workspace within the same plan limits as the dashboard."},"homepage_url":"","icon":"","id":"c9867785-5919-4b3a-b6d1-9fcecf6addf5","installs":0,"last_scanned":"","license":"","long_description":"Generate QR codes in bulk and download PNG or SVG files, including codes linked to PDFs. Build block-based landing pages and branded forms, publish them and inspect responses. Organization tools include folders and tags; free accounts have limited active dynamic codes, with higher limits on paid plans.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The complete inventory explicitly declares four deletion tools.","reasoning":"Deleting active dynamic links, pages or QR codes removes meaningful marketing resources and can break printed links.","risk_type":"data_deletion","severity":"high","title":"QR, page, folder and short-link resources can be deleted","triggering_tools_or_skills":["delete_folder","delete_page","delete_qr_code","delete_short_link"]},{"evidence":"Declared tool names and the listing describe direct creation and repointing of live resources.","reasoning":"These actions persist externally visible marketing changes.","risk_type":"data_modification","severity":"medium","title":"Pages, forms, QR codes and short links can be created and edited","triggering_tools_or_skills":["build_page","create_form","create_qr_code","create_short_link","update_qr_code","update_short_link"]},{"evidence":"The connector runs at https://hovercode.com/mcp without a pinned server implementation in the packet.","reasoning":"The hosted implementation and tool behavior can change independently of this snapshot, so monitoring and runtime verification remain necessary.","risk_type":"provenance_uncertainty","severity":"low","title":"Hovercode is a mutable remote service","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"Authentication selects a Hovercode workspace; scopes and confirmation requirements are not published.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/c9867785-5919-4b3a-b6d1-9fcecf6addf5.json","what_it_proves":"Candidate PR #125 record identity (name \"Hovercode\", publisher, type web_connector) and 36 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/c9867785-5919-4b3a-b6d1-9fcecf6addf5: complete tool_names inventory (36 tools), remote streamable-http endpoint https://hovercode.com/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Hovercode can rewrite and delete live QR, page and short-link resources.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:c9867785-5919-4b3a-b6d1-9fcecf6addf5","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 36 tools. High deletion is explicit from names; tool schemas and safeguards were not available.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":36,"tools_or_skills_total":36},"name":"Hovercode","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=c9867785-5919-4b3a-b6d1-9fcecf6addf5&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://hovercode.com/privacy/","provisional_risk":null,"publication_recommendation":"accept","publisher":"Hovercode","publisher_url":"https://hovercode.com/","remote_url":"https://hovercode.com/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can permanently remove data or resources. Review findings: Deleting active dynamic links, pages or QR codes removes meaningful marketing resources and can break printed links.","evidence":"QR, page, folder and short-link resources can be deleted: The complete inventory explicitly declares four deletion tools.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"QR, page, folder and short-link resources can be deleted","triggering_tools":["delete_folder","delete_page","delete_qr_code","delete_short_link"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions persist externally visible marketing changes.","evidence":"Pages, forms, QR codes and short links can be created and edited: Declared tool names and the listing describe direct creation and repointing of live resources.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Pages, forms, QR codes and short links can be created and edited","triggering_tools":["build_page","create_form","create_qr_code","create_short_link","update_qr_code","update_short_link"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://hovercode.com/contact/","tags":["deletes_data","modifies_data","network_access","oauth_required","web_connector"],"tools":[{"description":"","name":"build_page","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions persist externally visible marketing changes."}},{"description":"","name":"create_folder"},{"description":"","name":"create_form","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions persist externally visible marketing changes."}},{"description":"","name":"create_page"},{"description":"","name":"create_pdf_qr"},{"description":"","name":"create_qr_code","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions persist externally visible marketing changes."}},{"description":"","name":"create_qr_codes_bulk"},{"description":"","name":"create_short_link","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions persist externally visible marketing changes."}},{"description":"","name":"delete_folder","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deleting active dynamic links, pages or QR codes removes meaningful marketing resources and can break printed links."}},{"description":"","name":"delete_page","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deleting active dynamic links, pages or QR codes removes meaningful marketing resources and can break printed links."}},{"description":"","name":"delete_qr_code","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deleting active dynamic links, pages or QR codes removes meaningful marketing resources and can break printed links."}},{"description":"","name":"delete_short_link","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deleting active dynamic links, pages or QR codes removes meaningful marketing resources and can break printed links."}},{"description":"","name":"download_qr"},{"description":"","name":"get_analytics"},{"description":"","name":"get_form"},{"description":"","name":"get_form_responses"},{"description":"","name":"get_page"},{"description":"","name":"get_qr_activity"},{"description":"","name":"get_qr_code"},{"description":"","name":"get_short_link"},{"description":"","name":"get_short_link_activity"},{"description":"","name":"list_block_types"},{"description":"","name":"list_folders"},{"description":"","name":"list_forms"},{"description":"","name":"list_pages"},{"description":"","name":"list_qr_codes"},{"description":"","name":"list_short_links"},{"description":"","name":"list_tags"},{"description":"","name":"list_templates"},{"description":"","name":"list_workspaces"},{"description":"","name":"set_workspace"},{"description":"","name":"update_folder"},{"description":"","name":"update_form"},{"description":"","name":"update_page"},{"description":"","name":"update_qr_code","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions persist externally visible marketing changes."}},{"description":"","name":"update_short_link","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions persist externally visible marketing changes."}}],"tools_count":36,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/c9867785-5919-4b3a-b6d1-9fcecf6addf5","uuid":"a6be76ee-6469-59a4-8210-fe08a5e2f9a2","verification_tier":"community","version":""},"query_key":"hovercode hovercode","schema_version":1,"status":"match"}