{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-30","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Validates and runs SAS programs in your Jenner Analytics workspace. Execute code against workspace datasets and retrieve the results and execution audit. Designed for clinical and regulated analytics requiring traceable program runs.","did":"2264430c-44b3-4ff4-9aba-919e979611f6","documentation_url":"https://docs.jenneranalytics.com/","editorial_description":{"extended_description":"Each execution produces an audit ID linking to the program text, full SAS log and a hash of the inputs. Jenner is a SAS-compatible engine; audit records support inspection and reproducibility rather than establishing regulatory approval.","schema_version":1,"summary":"Validates and runs SAS programs in your Jenner Analytics workspace.\nExecute code against workspace datasets and retrieve the results and execution audit.\nDesigned for clinical and regulated analytics requiring traceable program runs."},"homepage_url":"","icon":"","id":"2264430c-44b3-4ff4-9aba-919e979611f6","installs":0,"last_scanned":"","license":"","long_description":"Each execution produces an audit ID linking to the program text, full SAS log and a hash of the inputs. Jenner is a SAS-compatible engine; audit records support inspection and reproducibility rather than establishing regulatory approval.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The complete inventory explicitly includes execute_sas_program and the description says it runs SAS programs against workspace datasets and stores a durable audit record.","reasoning":"Executing a general analytics language is arbitrary code/query execution under the review taxonomy.","risk_type":"code_execution","severity":"high","title":"Executes user-supplied SAS programs","triggering_tools_or_skills":["execute_sas_program"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication is required for datasets in the user's Jenner workspace; dataset permissions, SAS language restrictions and execution resource limits are not stated.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/2264430c-44b3-4ff4-9aba-919e979611f6.json","what_it_proves":"Candidate PR #125 record identity (name \"Jenner Analytics\", publisher, type web_connector) and 4 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/2264430c-44b3-4ff4-9aba-919e979611f6: complete tool_names inventory (4 tools), remote streamable-http endpoint https://workspace.jenneranalytics.com/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Jenner executes SAS programs against private workspace datasets.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:2264430c-44b3-4ff4-9aba-919e979611f6","reviewed_at":"2026-10-10","reviewer_notes":"Runtime schemas and official engine restrictions are required to establish filesystem/network access, write-capable SAS statements and resource limits; durable audit creation also constitutes a workspace write.","risk_domains":{"arbitrary_network_access":"unknown","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"unknown","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"true","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":4,"tools_or_skills_total":4},"name":"Jenner Analytics","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=2264430c-44b3-4ff4-9aba-919e979611f6&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://jenneranalytics.com/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Jenner Analytics","publisher_url":"https://jenneranalytics.com/","remote_url":"https://workspace.jenneranalytics.com/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Executing a general analytics language is arbitrary code/query execution under the review taxonomy.","evidence":"Executes user-supplied SAS programs: The complete inventory explicitly includes execute_sas_program and the description says it runs SAS programs against workspace datasets and stores a durable audit record.","manual_risk_type":"code_execution","remediation":{"block_tool_categories":["code_execution"],"steps":["Run only in a sandbox with least-privilege credentials and strict resource limits.","Disable generic execution gateways unless their reachable action set is fully understood.","Require approval before execution against production systems or sensitive data."]},"risk_type":"runs_code","severity":"high","title":"Executes user-supplied SAS programs","triggering_tools":["execute_sas_program"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://jenneranalytics.com#contact","tags":["network_access","oauth_required","runs_code","web_connector"],"tools":[{"description":"","name":"execute_sas_program","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Executing a general analytics language is arbitrary code/query execution under the review taxonomy."}},{"description":"","name":"get_execution_audit"},{"description":"","name":"ping"},{"description":"","name":"validate_sas_program"}],"tools_count":4,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/2264430c-44b3-4ff4-9aba-919e979611f6","uuid":"a2b1d127-0a82-550c-8250-2fc5eec95f89","verification_tier":"community","version":""},"query_key":"jenner analytics jenner analytics","schema_version":1,"status":"match"}