{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-28","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Keenable SELECT turns web research into tables using read-only SQL in a DuckDB dialect. It searches pages, extracts requested fields, removes duplicates, and can publish an HTML report. Queries may take seconds to minutes, and searching or fetching is billed to your Keenable account.","did":"51b492c2-dc77-4ad7-9d08-20eed239e7e6","documentation_url":"https://docs.keenable.ai/select","editorial_description":{"extended_description":"Result sets are retained for 30 days so follow-up queries can reuse the same gathered material. SQL can filter and aggregate extracted rows, while report tools generate or revoke shareable HTML output with charts. The service is intended for multi-source research rather than quick single-page lookups.","schema_version":1,"summary":"Keenable SELECT turns web research into tables using read-only SQL in a DuckDB dialect.\nIt searches pages, extracts requested fields, removes duplicates, and can publish an HTML report.\nQueries may take seconds to minutes, and searching or fetching is billed to your Keenable account."},"homepage_url":"","icon":"","id":"51b492c2-dc77-4ad7-9d08-20eed239e7e6","installs":0,"last_scanned":"","license":"","long_description":"Result sets are retained for 30 days so follow-up queries can reuse the same gathered material. SQL can filter and aggregate extracted rows, while report tools generate or revoke shareable HTML output with charts. The service is intended for multi-source research rather than quick single-page lookups.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"Description explicitly says the model writes a DuckDB SQL statement and the server runs it over fetched pages.","reasoning":"Arbitrary SQL/query execution is High.","risk_type":"query_execution","severity":"high","title":"Executes user-authored SQL over fetched web pages","triggering_tools_or_skills":["select"]},{"evidence":"Tool explicitly revokes a published report.","reasoning":"Revocation of a shared resource is High.","risk_type":"data_deletion","severity":"high","title":"Revokes hosted HTML reports","triggering_tools_or_skills":["revoke_html_report"]},{"evidence":"Description says one query can fetch more than a thousand pages.","reasoning":"Broad web fetching exposes arbitrary third-party content.","risk_type":"arbitrary_network_access","severity":"low","title":"Fetches many web pages for a query","triggering_tools_or_skills":["select"]},{"evidence":"The remote hosted implementation is not pinned.","reasoning":"Runtime capabilities may change after review.","risk_type":"provenance_uncertainty","severity":"low","title":"Hosted implementation is mutable","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"OAuth/account authorization required; exact scopes are not documented.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/51b492c2-dc77-4ad7-9d08-20eed239e7e6.json","what_it_proves":"Candidate PR #125 record identity (name \"Keenable SELECT\", publisher, type web_connector) and 3 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/51b492c2-dc77-4ad7-9d08-20eed239e7e6: complete tool_names inventory (3 tools), remote streamable-http endpoint https://select.keenable.ai/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Keenable SELECT executes SQL-backed web research and can revoke hosted reports.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:51b492c2-dc77-4ad7-9d08-20eed239e7e6","reviewed_at":"2026-10-10","reviewer_notes":"All three tools reviewed; report hosting and SQL execution are explicit in the description.","risk_domains":{"arbitrary_network_access":"true","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"true","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":3,"tools_or_skills_total":3},"name":"Keenable SELECT","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=51b492c2-dc77-4ad7-9d08-20eed239e7e6&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://keenable.ai/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Keenable","publisher_url":"https://keenable.ai/","remote_url":"https://select.keenable.ai/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Arbitrary SQL/query execution is High.","evidence":"Executes user-authored SQL over fetched web pages: Description explicitly says the model writes a DuckDB SQL statement and the server runs it over fetched pages.","manual_risk_type":"query_execution","remediation":{"block_tool_categories":["code_execution"],"steps":["Run only in a sandbox with least-privilege credentials and strict resource limits.","Disable generic execution gateways unless their reachable action set is fully understood.","Require approval before execution against production systems or sensitive data."]},"risk_type":"runs_code","severity":"high","title":"Executes user-authored SQL over fetched web pages","triggering_tools":["select"]},{"description":"This connector can permanently remove data or resources. Review findings: Revocation of a shared resource is High.","evidence":"Revokes hosted HTML reports: Tool explicitly revokes a published report.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Revokes hosted HTML reports","triggering_tools":["revoke_html_report"]},{"description":"This connector can send caller-provided data to an external service or publisher. Review findings: Broad web fetching exposes arbitrary third-party content.","evidence":"Fetches many web pages for a query: Description says one query can fetch more than a thousand pages.","manual_risk_type":"arbitrary_network_access","remediation":{"block_tool_categories":["sends_externally"],"steps":["Do not include secrets, regulated data, or customer information unless the destination is approved.","Review the recipient's retention and deletion policy before enabling the connector."]},"risk_type":"forwards_data_to_third_party","severity":"low","title":"Fetches many web pages for a query","triggering_tools":["select"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@keenable.ai","tags":["deletes_data","forwards_data_to_third_party","network_access","oauth_required","runs_code","web_connector"],"tools":[{"description":"","name":"generate_html_report"},{"description":"","name":"revoke_html_report","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Revocation of a shared resource is High."}},{"description":"","name":"select","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Arbitrary SQL/query execution is High."}}],"tools_count":3,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/51b492c2-dc77-4ad7-9d08-20eed239e7e6","uuid":"de4501ba-d7ba-537a-8ffa-8f50f420e371","verification_tier":"community","version":""},"query_key":"keenable keenable select","schema_version":1,"status":"match"}