{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-16","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"no_auth","catalog_reconciliation":{"basis":"Documented actions on the identified catalog surface; not an execution test.","confidence":"medium","evidence_completeness":"partial","previous":{"confidence":"low","detail_sha256":"6e7145dd8797e98152a8e3c63c0fb87d4348171810db98e82ada1bb599aa21f8","risk":"high"},"proposal_file":"parent-proposals.json","rationale":"High without High; the prior review could not open the official doc. The doc (v1.2) is now read: ask_aura forwards natural-language requests to IHCL's AURA agent, which discovers restaurants, checks availability, and makes reservations at participating IHCL restaurants using guest name and mobile number; examples suggest lookup of reservations by mobile number; rooms/spa not supported; no authentication; connector does not store PII. A restaurant reservation is a bounded, reversible real-world action with PII forwarding = Medium. The no-auth lookup is an authz concern for a separate risk card, not High operational impact.","review_key":"claudesec:522b619f-a62f-49b1-817f-74599021be62","reviewed_at":"2026-10-12","runtime_verified":false,"sources":["https://aura.ihcltata.com/documentation/claude.html","https://api.anthropic.com/api/directory/servers (snapshot claude-directory-all-tiers-2026-09-22.json)"],"status":"resolved"},"category":"Web Connector","confidence":"low","description":"AURA assists with restaurant reservations across IHCL hotels. Use the connector to ask the reservation assistant about your dining plans.","did":"522b619f-a62f-49b1-817f-74599021be62","documentation_url":"https://aura.ihcltata.com/documentation/claude.html","editorial_description":{"extended_description":"","schema_version":1,"summary":"AURA assists with restaurant reservations across IHCL hotels.\nUse the connector to ask the reservation assistant about your dining plans."},"homepage_url":"","icon":"https://aura.ihcltata.com/ihcl_logo.jpg","id":"522b619f-a62f-49b1-817f-74599021be62","installs":0,"last_scanned":"","license":"","long_description":"","manual_assessment":"unassessed","manual_review":{"all_findings":[{"evidence":"Single generic tool hides all reachable reservation-agent actions; description says it helps with restaurant reservations.","reasoning":"It may create/cancel bookings or send confirmations, but this cannot be verified.","risk_type":"generic_gateway","severity":"low","title":"Opaque AURA reservation agent gateway","triggering_tools_or_skills":["ask_aura"]},{"evidence":"Directory marks the server no_auth while the tool may act on reservations.","reasoning":"User identity and authorization boundaries are unclear.","risk_type":"authz_ambiguity","severity":"low","title":"No-auth gateway has unknown booking identity","triggering_tools_or_skills":["ask_aura"]},{"evidence":"The remote hosted implementation is not pinned.","reasoning":"Runtime capabilities may change after review.","risk_type":"provenance_uncertainty","severity":"low","title":"Hosted implementation is mutable","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"No authentication according to Directory; reservation ownership and authorization are unknown.","blocked_missing_evidence":"Official ask_aura tool description/schema listing whether it creates, changes, cancels, or communicates restaurant reservations.","confidence":"low","displayed_risk":"high","evidence_completeness":"insufficient","manual_overall_risk":"unassessed","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/522b619f-a62f-49b1-817f-74599021be62.json","what_it_proves":"Candidate PR #125 record identity (name \"IHCL Restaurant Reservations via AURA\", publisher, type web_connector) and 1 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/522b619f-a62f-49b1-817f-74599021be62: complete tool_names inventory (1 tools), remote streamable-http endpoint https://aura.ihcltata.com/mcp, auth_posture no_auth, directory tier community"}],"primary_reason":"ask_aura is an opaque conversational gateway and the product description suggests reservation actions, but no action schema is available.","provisional_risk":"high","publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:522b619f-a62f-49b1-817f-74599021be62","reviewed_at":"2026-10-10","reviewer_notes":"Official documentation URL was inaccessible. Need ask_aura tool schema and supported intents/actions.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"unknown","deployment_or_infrastructure":"false","dynamic_hidden_actions":"true","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"unknown","persistent_credentials":"false","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"unknown","runs_code_or_queries":"false","sends_messages_as_user":"unknown","spends_or_moves_money":"false"},"tools_or_skills_reviewed":1,"tools_or_skills_total":1},"name":"IHCL Restaurant Reservations via AURA","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=522b619f-a62f-49b1-817f-74599021be62&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.ihcltata.com/privacy-policy","provisional_risk":"high","publication_recommendation":"fix","publisher":"IHCL","publisher_url":"https://www.ihcltata.com/","remote_url":"https://aura.ihcltata.com/mcp","repository_url":"","risk":"medium","risk_severity":"medium","security_risks":[{"description":"AURA can create restaurant reservations at participating IHCL properties using the guest details you provide.","evidence":"https://aura.ihcltata.com/documentation/claude.html\ncapabilities: make reservations at participating IHCL restaurants; property confirms","risk_type":"modifies_data","severity":"medium","title":"Makes restaurant reservations"},{"description":"Reservation requests include a guest name and mobile number and are forwarded to IHCL’s AURA service.","evidence":"https://aura.ihcltata.com/documentation/claude.html\npersonal data: guest name, mobile number sent to AURA/property reservation system","risk_type":"forwards_data_to_third_party","severity":"medium","title":"Sends guest details to the reservation service"}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://www.ihcltata.com/contact-us","tags":["modifies_data","forwards_data_to_third_party"],"tools":[{"description":"","name":"ask_aura"}],"tools_count":1,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/522b619f-a62f-49b1-817f-74599021be62","uuid":"45e19690-26d1-5393-9d9b-0f1250e9c520","verification_tier":"community","version":""},"query_key":"ihcl ihcl restaurant reservations via aura","schema_version":1,"status":"match"}