{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-08","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Interactive Connector","confidence":"medium","description":"Kema Invoice supports invoicing for freelancers and small businesses in France. Create, issue, track, and correct invoices, quotes, retainers, and credit notes. The source describes Factur-X documents and transmission through an accredited platform, with agent activity logged in the app.","did":"4f32d441-50d4-438d-96fe-f0c5025caef3","documentation_url":"https://docs.kema-studio.com/invoice","editorial_description":{"extended_description":"Tools manage customers and billing profiles, invoice line items, payment status, PDF downloads, external invoice imports, and revenue summaries. The platform includes VAT handling, invoice numbering, and VIES validation. Write tools carry confirmation-related annotations; the interface supports French, English, Spanish, Italian, and Portuguese.","schema_version":1,"summary":"Kema Invoice supports invoicing for freelancers and small businesses in France.\nCreate, issue, track, and correct invoices, quotes, retainers, and credit notes.\nThe source describes Factur-X documents and transmission through an accredited platform, with agent activity logged in the app."},"homepage_url":"","icon":"https://mcp.kema-studio.com/icon.svg","id":"4f32d441-50d4-438d-96fe-f0c5025caef3","installs":0,"last_scanned":"","license":"","long_description":"Tools manage customers and billing profiles, invoice line items, payment status, PDF downloads, external invoice imports, and revenue summaries. The platform includes VAT handling, invoice numbering, and VIES validation. Write tools carry confirmation-related annotations; the interface supports French, English, Spanish, Italian, and Portuguese.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"Inventory declares issuance and payment-state operations on invoices/provisions.","reasoning":"These actions materially affect financial records and payment status.","risk_type":"financial_transaction","severity":"high","title":"Can issue and mark financial documents paid","triggering_tools_or_skills":["issue_invoice","mark_invoice_paid","mark_provision_paid","create_credit_note"]},{"evidence":"Names explicitly send external financial documents.","reasoning":"External messages are sent as the user.","risk_type":"messaging_as_user","severity":"high","title":"Can send quotes and provisions","triggering_tools_or_skills":["send_quote","send_provision"]},{"evidence":"Tools explicitly delete meaningful financial/business data.","reasoning":"Deletion is High.","risk_type":"data_deletion","severity":"high","title":"Can delete invoices and related records","triggering_tools_or_skills":["delete_invoice","delete_company","delete_invoice_item","delete_invoice_client_profile"]},{"evidence":"Declared tools persist and alter financial records.","reasoning":"Meaningful financial record mutation is at least Medium.","risk_type":"data_modification","severity":"medium","title":"Can create and alter invoices and quotes","triggering_tools_or_skills":["create_invoice","create_quote","rectify_invoice","update_invoice"]}],"assessment_status":"provisional","auth_and_scopes":"Authenticated invoice/account access is implied; financial and messaging scopes are undocumented.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/4f32d441-50d4-438d-96fe-f0c5025caef3.json","what_it_proves":"Candidate PR #125 record identity (name \"Kema Invoice\", publisher, type interactive_connector) and 41 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/4f32d441-50d4-438d-96fe-f0c5025caef3: complete tool_names inventory (41 tools), remote streamable-http endpoint https://mcp.kema-studio.com/api/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Kema can issue/send financial documents, mark payments, and delete invoice data.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:4f32d441-50d4-438d-96fe-f0c5025caef3","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 41 names; runtime approval and accounting controls should be verified.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"true"},"tools_or_skills_reviewed":41,"tools_or_skills_total":41},"name":"Kema Invoice","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=4f32d441-50d4-438d-96fe-f0c5025caef3&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://docs.kema-studio.com/invoice/aspects-legaux/politique-de-confidentialite","provisional_risk":null,"publication_recommendation":"accept","publisher":"Kema Studio","publisher_url":"https://www.kema-studio.com/","remote_url":"https://mcp.kema-studio.com/api/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: These actions materially affect financial records and payment status.","evidence":"Can issue and mark financial documents paid: Inventory declares issuance and payment-state operations on invoices/provisions.","manual_risk_type":"financial_transaction","remediation":{"block_tool_categories":["financial"],"steps":["Set provider-side spending limits and require approval for every financial action.","Use a dedicated low-balance account and review transaction logs."]},"risk_type":"spends_money","severity":"high","title":"Can issue and mark financial documents paid","triggering_tools":["issue_invoice","mark_invoice_paid","mark_provision_paid","create_credit_note"]},{"description":"This connector can publish or send messages and content using the connected identity. Review findings: External messages are sent as the user.","evidence":"Can send quotes and provisions: Names explicitly send external financial documents.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Can send quotes and provisions","triggering_tools":["send_quote","send_provision"]},{"description":"This connector can permanently remove data or resources. Review findings: Deletion is High.","evidence":"Can delete invoices and related records: Tools explicitly delete meaningful financial/business data.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Can delete invoices and related records","triggering_tools":["delete_invoice","delete_company","delete_invoice_item","delete_invoice_client_profile"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Meaningful financial record mutation is at least Medium.","evidence":"Can create and alter invoices and quotes: Declared tools persist and alter financial records.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Can create and alter invoices and quotes","triggering_tools":["create_invoice","create_quote","rectify_invoice","update_invoice"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"hello@kema-studio.com","tags":["deletes_data","interactive_connector","modifies_data","network_access","oauth_required","sends_messages_as_you","spends_money"],"tools":[{"description":"","name":"accept_quote"},{"description":"","name":"add_invoice_item"},{"description":"","name":"apply_provisions_to_invoice"},{"description":"","name":"cancel_invoice"},{"description":"","name":"check_certification_status"},{"description":"","name":"convert_quote_to_invoice"},{"description":"","name":"create_company"},{"description":"","name":"create_credit_note","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: These actions materially affect financial records and payment status."}},{"description":"","name":"create_invoice","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Meaningful financial record mutation is at least Medium."}},{"description":"","name":"create_provision"},{"description":"","name":"create_quote","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Meaningful financial record mutation is at least Medium."}},{"description":"","name":"delete_company","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion is High."}},{"description":"","name":"delete_invoice","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion is High."}},{"description":"","name":"delete_invoice_client_profile","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion is High."}},{"description":"","name":"delete_invoice_item","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion is High."}},{"description":"","name":"get_company"},{"description":"","name":"get_invoice"},{"description":"","name":"get_invoice_client_profile"},{"description":"","name":"get_invoice_pdf"},{"description":"","name":"get_rectification_links"},{"description":"","name":"get_revenue_summary"},{"description":"","name":"get_settings"},{"description":"","name":"import_external_invoice"},{"description":"","name":"issue_invoice","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: These actions materially affect financial records and payment status."}},{"description":"","name":"list_available_provisions"},{"description":"","name":"list_companies"},{"description":"","name":"list_invoices"},{"description":"","name":"list_mcp_activity"},{"description":"","name":"mark_invoice_paid","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: These actions materially affect financial records and payment status."}},{"description":"","name":"mark_provision_paid","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: These actions materially affect financial records and payment status."}},{"description":"","name":"rectify_invoice","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Meaningful financial record mutation is at least Medium."}},{"description":"","name":"reject_quote"},{"description":"","name":"remove_provision_from_invoice"},{"description":"","name":"reorder_invoice_items"},{"description":"","name":"send_provision","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: External messages are sent as the user."}},{"description":"","name":"send_quote","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: External messages are sent as the user."}},{"description":"","name":"update_company"},{"description":"","name":"update_invoice","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Meaningful financial record mutation is at least Medium."}},{"description":"","name":"update_invoice_item"},{"description":"","name":"update_invoice_matter"},{"description":"","name":"upsert_invoice_client_profile"}],"tools_count":41,"transport":"streamable-http","type":"interactive_connector","url":"https://claude.ai/directory/4f32d441-50d4-438d-96fe-f0c5025caef3","uuid":"26377c95-c64f-52d0-829b-621d7b2c9eab","verification_tier":"community","version":""},"query_key":"kema studio kema invoice","schema_version":1,"status":"match"}