{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-18","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Joinways connects Claude to an event venue's CRM and booking workflow. Manage inquiries, availability, quotes, events, contacts, tasks, and function sheets. It can send event emails through connected Gmail or Outlook accounts, using the signed-in user's workspace permissions.","did":"4986c80e-ebf4-4481-8fff-e322f21bcb50","documentation_url":"https://joinways.app/docs/claude-mcp","editorial_description":{"extended_description":"Availability tools check conflicts, manage blocked dates, and import holidays. Quote tools handle priced line items, VAT, discounts, status, and PDF downloads. Event tools maintain schedules, setup, staff, and day-of contacts; analytics cover conversion, revenue, and event volume.","schema_version":1,"summary":"Joinways connects Claude to an event venue's CRM and booking workflow.\nManage inquiries, availability, quotes, events, contacts, tasks, and function sheets.\nIt can send event emails through connected Gmail or Outlook accounts, using the signed-in user's workspace permissions."},"homepage_url":"","icon":"","id":"4986c80e-ebf4-4481-8fff-e322f21bcb50","installs":0,"last_scanned":"","license":"","long_description":"Availability tools check conflicts, manage blocked dates, and import holidays. Quote tools handle priced line items, VAT, discounts, status, and PDF downloads. Event tools maintain schedules, setup, staff, and day-of contacts; analytics cover conversion, revenue, and event volume.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The description and inventory explicitly allow drafting and sending event emails.","reasoning":"It communicates with venue customers under the user's mailbox identity.","risk_type":"messaging_as_user","severity":"high","title":"Sends event email through connected Gmail/Outlook","triggering_tools_or_skills":["send_event_email"]},{"evidence":"The complete tool inventory contains broad explicit CRM/event deletions.","reasoning":"These actions can remove booked-event planning, commercial and contact records.","risk_type":"data_deletion","severity":"high","title":"Deletes events, quotes, people, tasks and catalog items","triggering_tools_or_skills":["delete_event","delete_quote","delete_quote_item","delete_person","delete_task","delete_catalog_item"]}],"assessment_status":"provisional","auth_and_scopes":"OAuth applies the signed-in venue user's permissions to inquiries, contacts, events, quotes, availability, files, Gmail/Outlook email and analytics.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"complete","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/4986c80e-ebf4-4481-8fff-e322f21bcb50.json","what_it_proves":"Candidate PR #125 record identity (name \"Joinways\", publisher, type web_connector) and 79 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/4986c80e-ebf4-4481-8fff-e322f21bcb50: complete tool_names inventory (79 tools), remote streamable-http endpoint https://mcp.joinways.app/, auth_posture auth_required, directory tier community"}],"primary_reason":"Joinways sends customer email and deletes venue CRM, quote and event data.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:4986c80e-ebf4-4481-8fff-e322f21bcb50","reviewed_at":"2026-10-10","reviewer_notes":"Quote/invoice creation does not itself collect payment; require recipient/content confirmation for email.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"true","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":79,"tools_or_skills_total":79},"name":"Joinways","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=4986c80e-ebf4-4481-8fff-e322f21bcb50&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://joinways.app/en/privacy-policy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Joinways","publisher_url":"https://joinways.app/","remote_url":"https://mcp.joinways.app/","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: It communicates with venue customers under the user's mailbox identity.","evidence":"Sends event email through connected Gmail/Outlook: The description and inventory explicitly allow drafting and sending event emails.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Sends event email through connected Gmail/Outlook","triggering_tools":["send_event_email"]},{"description":"This connector can permanently remove data or resources. Review findings: These actions can remove booked-event planning, commercial and contact records.","evidence":"Deletes events, quotes, people, tasks and catalog items: The complete tool inventory contains broad explicit CRM/event deletions.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Deletes events, quotes, people, tasks and catalog items","triggering_tools":["delete_event","delete_quote","delete_quote_item","delete_person","delete_task","delete_catalog_item"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@joinways.app","tags":["accesses_calendar","deletes_data","network_access","oauth_required","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"add_event_note"},{"description":"","name":"add_quote_items"},{"description":"","name":"block_venue_dates"},{"description":"","name":"check_venue_availability"},{"description":"","name":"convert_lead_to_event"},{"description":"","name":"count_companies"},{"description":"","name":"count_events"},{"description":"","name":"count_leads"},{"description":"","name":"count_people"},{"description":"","name":"count_quotes"},{"description":"","name":"count_tasks"},{"description":"","name":"create_catalog_item"},{"description":"","name":"create_company"},{"description":"","name":"create_event"},{"description":"","name":"create_person"},{"description":"","name":"create_quote"},{"description":"","name":"create_task"},{"description":"","name":"delete_catalog_item","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions can remove booked-event planning, commercial and contact records."}},{"description":"","name":"delete_event","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions can remove booked-event planning, commercial and contact records."}},{"description":"","name":"delete_person","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions can remove booked-event planning, commercial and contact records."}},{"description":"","name":"delete_quote","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions can remove booked-event planning, commercial and contact records."}},{"description":"","name":"delete_quote_item","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions can remove booked-event planning, commercial and contact records."}},{"description":"","name":"delete_task","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions can remove booked-event planning, commercial and contact records."}},{"description":"","name":"download_quote"},{"description":"","name":"duplicate_quote"},{"description":"","name":"generate_email_draft"},{"description":"","name":"get_accounting_analytics"},{"description":"","name":"get_beo"},{"description":"","name":"get_commercial_analytics"},{"description":"","name":"get_event"},{"description":"","name":"get_events_analytics"},{"description":"","name":"get_lead"},{"description":"","name":"get_quote_details"},{"description":"","name":"get_task"},{"description":"","name":"get_venue"},{"description":"","name":"get_venue_availability"},{"description":"","name":"global_search"},{"description":"","name":"import_signed_quote"},{"description":"","name":"import_venue_holidays"},{"description":"","name":"link_lead_to_event"},{"description":"","name":"list_catalog_items"},{"description":"","name":"list_companies"},{"description":"","name":"list_email_connections"},{"description":"","name":"list_email_templates"},{"description":"","name":"list_event_contacts"},{"description":"","name":"list_event_days"},{"description":"","name":"list_event_emails"},{"description":"","name":"list_event_files"},{"description":"","name":"list_event_notes"},{"description":"","name":"list_event_staff"},{"description":"","name":"list_events"},{"description":"","name":"list_leads"},{"description":"","name":"list_notifications"},{"description":"","name":"list_people"},{"description":"","name":"list_quotes"},{"description":"","name":"list_tasks"},{"description":"","name":"list_team_members"},{"description":"","name":"list_venue_closures"},{"description":"","name":"list_venue_conflicts"},{"description":"","name":"list_venue_spaces"},{"description":"","name":"list_venues"},{"description":"","name":"reorder_quote_items"},{"description":"","name":"search_companies"},{"description":"","name":"send_event_email","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: It communicates with venue customers under the user's mailbox identity."}},{"description":"","name":"unblock_venue_dates"},{"description":"","name":"update_beo"},{"description":"","name":"update_catalog_item"},{"description":"","name":"update_company"},{"description":"","name":"update_event"},{"description":"","name":"update_event_status"},{"description":"","name":"update_lead_status"},{"description":"","name":"update_person"},{"description":"","name":"update_quote"},{"description":"","name":"update_quote_item"},{"description":"","name":"update_quote_status"},{"description":"","name":"update_task"},{"description":"","name":"upsert_event_contacts"},{"description":"","name":"upsert_event_days"},{"description":"","name":"upsert_event_staff"}],"tools_count":79,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/4986c80e-ebf4-4481-8fff-e322f21bcb50","uuid":"675c65fa-0aa7-564b-a677-d0e391ba1aec","verification_tier":"community","version":""},"query_key":"joinways joinways","schema_version":1,"status":"match"}