{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-02","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Interactive Connector","confidence":"medium","description":"Extract construction quantities from blueprints with Kamai AI. Create projects, upload PDF drawings, and inspect takeoff measurements linked to drawing geometry. Current coverage includes interior finishes, plumbing, and electrical divisions.","did":"e23351e2-db28-4499-8b0f-b8fcb0e6c603","documentation_url":"https://kamai.io/developers/mcp","editorial_description":{"extended_description":"View sheets, projects, uploads, and takeoffs interactively. Outputs can include areas, volumes, lengths, counts, and materials for estimating, bid preparation, or scope review, with references to the originating sheet and layer.","schema_version":1,"summary":"Extract construction quantities from blueprints with Kamai AI.\nCreate projects, upload PDF drawings, and inspect takeoff measurements linked to drawing geometry.\nCurrent coverage includes interior finishes, plumbing, and electrical divisions."},"homepage_url":"","icon":"","id":"e23351e2-db28-4499-8b0f-b8fcb0e6c603","installs":0,"last_scanned":"","license":"","long_description":"View sheets, projects, uploads, and takeoffs interactively. Outputs can include areas, volumes, lengths, counts, and materials for estimating, bid preparation, or scope review, with references to the originating sheet and layer.","manual_assessment":"medium","manual_review":{"all_findings":[{"evidence":"The connector persists construction drawings and projects.","reasoning":"This uploads sensitive plans and changes workspace state.","risk_type":"file_write","severity":"medium","title":"Projects and blueprint PDFs can be created/uploaded","triggering_tools_or_skills":["create_project","request_blueprint_upload","finalize_blueprint_upload","ingest_blueprint_from_chat"]},{"evidence":"The product statement explicitly permits URL-based drawing ingestion.","reasoning":"SSRF and download restrictions require runtime verification.","risk_type":"arbitrary_network_access","severity":"low","title":"Blueprints can be ingested from a URL","triggering_tools_or_skills":["request_blueprint_upload"]},{"evidence":"Uploaded project documents are analyzed.","reasoning":"They may contain prompt injection.","risk_type":"prompt_injection_exposure","severity":"low","title":"Blueprint text and annotations enter model context","triggering_tools_or_skills":["get_blueprint","view_takeoff"]},{"evidence":"The connector runs at https://mcp.kamai.io/mcp without a pinned server implementation in the packet.","reasoning":"The implementation can change independently, so runtime verification and change monitoring remain necessary.","risk_type":"provenance_uncertainty","severity":"low","title":"Kamai AI is a mutable hosted service","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"OAuth scopes projects, blueprints and takeoffs to the Kamai account; exact project-sharing roles are not documented.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"medium","evidence_completeness":"partial","manual_overall_risk":"medium","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/e23351e2-db28-4499-8b0f-b8fcb0e6c603.json","what_it_proves":"Candidate PR #125 record identity (name \"Kamai AI\", publisher, type interactive_connector) and 13 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/e23351e2-db28-4499-8b0f-b8fcb0e6c603: complete tool_names inventory (13 tools), remote streamable-http endpoint https://mcp.kamai.io/mcp, auth_posture auth_required, publisher-declared permissions text, declared sensitive data types, directory tier community"}],"primary_reason":"Kamai creates projects and ingests blueprint files/URLs but exposes no destructive or external-send action.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:e23351e2-db28-4499-8b0f-b8fcb0e6c603","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 13 tools.","risk_domains":{"arbitrary_network_access":"true","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"true","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":13,"tools_or_skills_total":13},"name":"Kamai AI","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=e23351e2-db28-4499-8b0f-b8fcb0e6c603&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://kamai.io/privacy-policy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Kamai","publisher_url":"https://kamai.io/","remote_url":"https://mcp.kamai.io/mcp","repository_url":"","risk":"medium","risk_severity":"medium","security_risks":[{"description":"This connector can create, change, export, or otherwise write files. Review findings: This uploads sensitive plans and changes workspace state.","evidence":"Projects and blueprint PDFs can be created/uploaded: The connector persists construction drawings and projects.","manual_risk_type":"file_write","remediation":{"block_tool_categories":["state_change"],"steps":["Limit file access to a dedicated working directory.","Review generated or modified files before they are shared or executed."]},"risk_type":"filesystem_access","severity":"medium","title":"Projects and blueprint PDFs can be created/uploaded","triggering_tools":["create_project","request_blueprint_upload","finalize_blueprint_upload","ingest_blueprint_from_chat"]},{"description":"This connector can send caller-provided data to an external service or publisher. Review findings: SSRF and download restrictions require runtime verification.","evidence":"Blueprints can be ingested from a URL: The product statement explicitly permits URL-based drawing ingestion.","manual_risk_type":"arbitrary_network_access","remediation":{"block_tool_categories":["sends_externally"],"steps":["Do not include secrets, regulated data, or customer information unless the destination is approved.","Review the recipient's retention and deletion policy before enabling the connector."]},"risk_type":"forwards_data_to_third_party","severity":"low","title":"Blueprints can be ingested from a URL","triggering_tools":["request_blueprint_upload"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://kamai.io/contact","tags":["accesses_messaging","filesystem_access","forwards_data_to_third_party","interactive_connector","network_access","oauth_required"],"tools":[{"description":"","name":"create_project","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: This uploads sensitive plans and changes workspace state."}},{"description":"","name":"finalize_blueprint_upload","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: This uploads sensitive plans and changes workspace state."}},{"description":"","name":"get_blueprint"},{"description":"","name":"get_project"},{"description":"","name":"list_projects"},{"description":"","name":"request_blueprint_upload","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: This uploads sensitive plans and changes workspace state."}},{"description":"","name":"update_project"},{"description":"","name":"view_blueprint"},{"description":"","name":"view_projects"},{"description":"","name":"view_takeoff"},{"description":"","name":"ingest_blueprint_from_chat","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: This uploads sensitive plans and changes workspace state."}},{"description":"","name":"open_kamai"},{"description":"","name":"view_upload"}],"tools_count":13,"transport":"streamable-http","type":"interactive_connector","url":"https://claude.ai/directory/e23351e2-db28-4499-8b0f-b8fcb0e6c603","uuid":"257071d3-297d-5bbd-ad39-71bddde45a77","verification_tier":"community","version":""},"query_key":"kamai ai","schema_version":1,"status":"match"}