{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-16","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Build and edit fitness programs in your Jimmy coaching workspace. Import existing plans and organize exercises, sets, loads and rest periods. Optionally inspect client progress and payment status without messaging clients or changing their data.","did":"c6534c3f-2451-475b-98e4-2fa257779352","documentation_url":"https://jimmycoach.com/en/features/connected-ai","editorial_description":{"extended_description":"Programs can be supplied from screenshots, PDFs or spreadsheets, with exercise matching against your library and custom exercises for unmatched movements. Unclear loads remain in notes rather than being saved as definite values. You choose the training space and enable each access category in Jimmy; client insights can cover missed sessions, personal records, check-ins and health trends, but not chats.","schema_version":1,"summary":"Build and edit fitness programs in your Jimmy coaching workspace.\nImport existing plans and organize exercises, sets, loads and rest periods.\nOptionally inspect client progress and payment status without messaging clients or changing their data."},"homepage_url":"","icon":"https://app.jimmycoach.com/icon2.png","id":"c6534c3f-2451-475b-98e4-2fa257779352","installs":0,"last_scanned":"","license":"","long_description":"Programs can be supplied from screenshots, PDFs or spreadsheets, with exercise matching against your library and custom exercises for unmatched movements. Unclear loads remain in notes rather than being saved as definite values. You choose the training space and enable each access category in Jimmy; client insights can cover missed sessions, personal records, check-ins and health trends, but not chats.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The complete Directory inventory includes remove_from_workout alongside workout creation and update tools; Jimmy's official page confirms that the connector writes directly to Workout Builder.","reasoning":"Removing an exercise or block from a saved workout destroys meaningful program data and therefore meets the High deletion threshold.","risk_type":"data_deletion","severity":"high","title":"Workout content can be removed","triggering_tools_or_skills":["remove_from_workout"]},{"evidence":"The declared names state create/update actions, and the official connector page says generated programs and edits land directly in Jimmy.","reasoning":"These actions persist changes to coaching content.","risk_type":"data_modification","severity":"medium","title":"Programs, workouts and custom exercises can be written","triggering_tools_or_skills":["add_exercises","create_custom_exercise","create_program","create_workout","update_exercise","update_workout"]},{"evidence":"The connector runs at https://app.jimmycoach.com/mcp and no pinned server implementation was available in the review packet.","reasoning":"The hosted implementation and action semantics can change independently of this catalog snapshot, so runtime verification and change monitoring remain necessary.","risk_type":"provenance_uncertainty","severity":"low","title":"Jimmy is a mutable remote service","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"OAuth-style consent is required; the user selects a Jimmy training space and can separately enable client-data access. Exact scopes are not published.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/c6534c3f-2451-475b-98e4-2fa257779352.json","what_it_proves":"Candidate PR #125 record identity (name \"Jimmy\", publisher, type web_connector) and 21 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/c6534c3f-2451-475b-98e4-2fa257779352: complete tool_names inventory (21 tools), remote streamable-http endpoint https://app.jimmycoach.com/mcp, auth_posture auth_required, directory tier community"},{"accessed_at":"2026-10-10T21:04:12Z","url_or_path":"https://jimmycoach.com/en/features/connected-ai","what_it_proves":"Jimmy documents account-scoped access and direct creation and editing of training programs and workouts."}],"primary_reason":"Jimmy can create and edit training data and remove content from saved workouts.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:c6534c3f-2451-475b-98e4-2fa257779352","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 21 declared tools. Jimmy's official page confirms workspace selection and direct workout/program writes; the High rating is driven by the names-only remove_from_workout action, so runtime schema confirmation remains appropriate.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":21,"tools_or_skills_total":21},"name":"Jimmy","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=c6534c3f-2451-475b-98e4-2fa257779352&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://jimmycoach.com/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Just Jimmy LLC","publisher_url":"https://jimmycoach.com/","remote_url":"https://app.jimmycoach.com/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can permanently remove data or resources. Review findings: Removing an exercise or block from a saved workout destroys meaningful program data and therefore meets the High deletion threshold.","evidence":"Workout content can be removed: The complete Directory inventory includes remove_from_workout alongside workout creation and update tools; Jimmy's official page confirms that the connector writes directly to Workout Builder.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Workout content can be removed","triggering_tools":["remove_from_workout"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions persist changes to coaching content.","evidence":"Programs, workouts and custom exercises can be written: The declared names state create/update actions, and the official connector page says generated programs and edits land directly in Jimmy.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Programs, workouts and custom exercises can be written","triggering_tools":["add_exercises","create_custom_exercise","create_program","create_workout","update_exercise","update_workout"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@jimmycoach.com","tags":["deletes_data","modifies_data","network_access","oauth_required","web_connector"],"tools":[{"description":"","name":"add_exercises","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions persist changes to coaching content."}},{"description":"","name":"compare_clients"},{"description":"","name":"create_custom_exercise","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions persist changes to coaching content."}},{"description":"","name":"create_program","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions persist changes to coaching content."}},{"description":"","name":"create_workout","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions persist changes to coaching content."}},{"description":"","name":"get_client_checkins"},{"description":"","name":"get_client_health"},{"description":"","name":"get_client_overview"},{"description":"","name":"get_client_prs"},{"description":"","name":"get_client_training"},{"description":"","name":"get_clients_digest"},{"description":"","name":"get_payments_overview"},{"description":"","name":"get_program"},{"description":"","name":"get_workout"},{"description":"","name":"list_clients"},{"description":"","name":"list_programs"},{"description":"","name":"remove_from_workout","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Removing an exercise or block from a saved workout destroys meaningful program data and therefore meets the High deletion threshold."}},{"description":"","name":"search_exercise"},{"description":"","name":"update_exercise","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions persist changes to coaching content."}},{"description":"","name":"update_workout","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions persist changes to coaching content."}},{"description":"","name":"whoami"}],"tools_count":21,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/c6534c3f-2451-475b-98e4-2fa257779352","uuid":"eb4b43a1-5e3d-582d-8779-e0b815d1a8f8","verification_tier":"community","version":""},"query_key":"just jimmy llc jimmy","schema_version":1,"status":"match"}