{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-20","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Explore advertising attribution and revenue data in HYROS. Compare spend, ROAS, lead journeys and customer-value trends. An active HYROS account provides its permitted data and supported record-management actions.","did":"cdab712c-de28-44f1-8c35-1590c2a46f83","documentation_url":"https://api-docs.hyros.com/#description/introduction","editorial_description":{"extended_description":"Reporting covers campaigns, ads, keywords, sales, calls, bookings and subscriptions. The toolset also creates or updates tracked leads, orders, products, costs and conversion definitions, with deletion available for several record types. Tracking-parameter and script checks support attribution troubleshooting.","schema_version":1,"summary":"Explore advertising attribution and revenue data in HYROS.\nCompare spend, ROAS, lead journeys and customer-value trends.\nAn active HYROS account provides its permitted data and supported record-management actions."},"homepage_url":"","icon":"https://markethero-cdn-prod.s3.us-east-1.amazonaws.com/hyros_logo.png","id":"cdab712c-de28-44f1-8c35-1590c2a46f83","installs":0,"last_scanned":"","license":"","long_description":"Reporting covers campaigns, ads, keywords, sales, calls, bookings and subscriptions. The toolset also creates or updates tracked leads, orders, products, costs and conversion definitions, with deletion available for several record types. Tracking-parameter and script checks support attribution troubleshooting.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The complete inventory explicitly includes hyros_refund_order.","reasoning":"Refunding an order moves money and is High impact.","risk_type":"financial_transaction","severity":"high","title":"Orders can be refunded","triggering_tools_or_skills":["hyros_refund_order"]},{"evidence":"Multiple declared tools explicitly delete core attribution records.","reasoning":"These actions destructively alter business records.","risk_type":"data_deletion","severity":"high","title":"Sales, leads, products, costs and definitions can be deleted","triggering_tools_or_skills":["hyros_delete_sale","hyros_delete_lead","hyros_delete_product","hyros_delete_custom_cost","hyros_delete_conversion_definition"]},{"evidence":"The inventory includes extensive record writes.","reasoning":"These persist material attribution and revenue state.","risk_type":"data_modification","severity":"medium","title":"Orders, subscriptions, leads, costs and tracking records can be created/updated","triggering_tools_or_skills":["hyros_create_order","hyros_create_subscription","hyros_create_lead","hyros_create_custom_cost","hyros_update_sale"]},{"evidence":"The connector runs at https://mcp.hyros.com/mcp without a pinned server implementation in the packet.","reasoning":"The hosted implementation can change independently of this catalog snapshot, requiring runtime verification and change monitoring.","risk_type":"provenance_uncertainty","severity":"low","title":"HYROS is a mutable remote service","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"Authentication is required for the user's HYROS attribution account; exact scopes are not published.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/cdab712c-de28-44f1-8c35-1590c2a46f83.json","what_it_proves":"Candidate PR #125 record identity (name \"HYROS\", publisher, type web_connector) and 60 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/cdab712c-de28-44f1-8c35-1590c2a46f83: complete tool_names inventory (60 tools), remote streamable-http endpoint https://mcp.hyros.com/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"HYROS can refund orders and delete attribution/revenue records.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:cdab712c-de28-44f1-8c35-1590c2a46f83","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 60 tools. High actions are explicit from names; tool schemas and confirmation behavior are unavailable.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"true"},"tools_or_skills_reviewed":60,"tools_or_skills_total":60},"name":"HYROS","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=cdab712c-de28-44f1-8c35-1590c2a46f83&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://hyros.com/privacy-policy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Hyros","publisher_url":"https://hyros.com/","remote_url":"https://mcp.hyros.com/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Refunding an order moves money and is High impact.","evidence":"Orders can be refunded: The complete inventory explicitly includes hyros_refund_order.","manual_risk_type":"financial_transaction","remediation":{"block_tool_categories":["financial"],"steps":["Set provider-side spending limits and require approval for every financial action.","Use a dedicated low-balance account and review transaction logs."]},"risk_type":"spends_money","severity":"high","title":"Orders can be refunded","triggering_tools":["hyros_refund_order"]},{"description":"This connector can permanently remove data or resources. Review findings: These actions destructively alter business records.","evidence":"Sales, leads, products, costs and definitions can be deleted: Multiple declared tools explicitly delete core attribution records.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Sales, leads, products, costs and definitions can be deleted","triggering_tools":["hyros_delete_sale","hyros_delete_lead","hyros_delete_product","hyros_delete_custom_cost","hyros_delete_conversion_definition"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These persist material attribution and revenue state.","evidence":"Orders, subscriptions, leads, costs and tracking records can be created/updated: The inventory includes extensive record writes.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Orders, subscriptions, leads, costs and tracking records can be created/updated","triggering_tools":["hyros_create_order","hyros_create_subscription","hyros_create_lead","hyros_create_custom_cost","hyros_update_sale"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@hyros.com","tags":["deletes_data","modifies_data","network_access","oauth_required","spends_money","web_connector"],"tools":[{"description":"","name":"hyros_assert_script_presence_on_domain"},{"description":"","name":"hyros_check_tracking_parameters_for_integrations"},{"description":"","name":"hyros_create_call"},{"description":"","name":"hyros_create_cart"},{"description":"","name":"hyros_create_click"},{"description":"","name":"hyros_create_conversion_definition"},{"description":"","name":"hyros_create_custom_conversion"},{"description":"","name":"hyros_create_custom_cost","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These persist material attribution and revenue state."}},{"description":"","name":"hyros_create_lead","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These persist material attribution and revenue state."}},{"description":"","name":"hyros_create_order","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These persist material attribution and revenue state."}},{"description":"","name":"hyros_create_product"},{"description":"","name":"hyros_create_source"},{"description":"","name":"hyros_create_subscription","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These persist material attribution and revenue state."}},{"description":"","name":"hyros_delete_call"},{"description":"","name":"hyros_delete_conversion_definition","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions destructively alter business records."}},{"description":"","name":"hyros_delete_custom_cost","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions destructively alter business records."}},{"description":"","name":"hyros_delete_lead","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions destructively alter business records."}},{"description":"","name":"hyros_delete_product","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions destructively alter business records."}},{"description":"","name":"hyros_delete_sale","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions destructively alter business records."}},{"description":"","name":"hyros_delete_source"},{"description":"","name":"hyros_get_account_tracking_script"},{"description":"","name":"hyros_get_active_external_integrations"},{"description":"","name":"hyros_get_ad_account_report"},{"description":"","name":"hyros_get_ad_accounts"},{"description":"","name":"hyros_get_ads"},{"description":"","name":"hyros_get_attribution_report"},{"description":"","name":"hyros_get_calls"},{"description":"","name":"hyros_get_carts"},{"description":"","name":"hyros_get_conversion_definitions"},{"description":"","name":"hyros_get_custom_costs"},{"description":"","name":"hyros_get_domains"},{"description":"","name":"hyros_get_integrations_types"},{"description":"","name":"hyros_get_keywords"},{"description":"","name":"hyros_get_lead_clicks"},{"description":"","name":"hyros_get_lead_journey"},{"description":"","name":"hyros_get_leads"},{"description":"","name":"hyros_get_marginal_cac_curve"},{"description":"","name":"hyros_get_products"},{"description":"","name":"hyros_get_roas_report"},{"description":"","name":"hyros_get_sales"},{"description":"","name":"hyros_get_sources"},{"description":"","name":"hyros_get_stages"},{"description":"","name":"hyros_get_subscriptions"},{"description":"","name":"hyros_get_tags"},{"description":"","name":"hyros_get_tags_count"},{"description":"","name":"hyros_get_tracking_script"},{"description":"","name":"hyros_get_tracking_script_with_custom_domain"},{"description":"","name":"hyros_get_user_info"},{"description":"","name":"hyros_refund_order","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Refunding an order moves money and is High impact."}},{"description":"","name":"hyros_search_hyros_docs"},{"description":"","name":"hyros_update_call"},{"description":"","name":"hyros_update_cart"},{"description":"","name":"hyros_update_conversion_definition"},{"description":"","name":"hyros_update_custom_cost"},{"description":"","name":"hyros_update_lead"},{"description":"","name":"hyros_update_order"},{"description":"","name":"hyros_update_product"},{"description":"","name":"hyros_update_sale","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These persist material attribution and revenue state."}},{"description":"","name":"hyros_update_source"},{"description":"","name":"hyros_update_subscription"}],"tools_count":60,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/cdab712c-de28-44f1-8c35-1590c2a46f83","uuid":"93d74d52-90bd-5095-a325-09faaa9b6e4c","verification_tier":"community","version":""},"query_key":"hyros hyros","schema_version":1,"status":"match"}