{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-20","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"high","description":"Pepys transcribes audio, video, supported public media links, and podcast feeds. Retrieve timestamped speaker segments, search recordings, ask transcript questions, and export text or subtitles. OAuth uses your Pepys account, and transcription consumes that account's credits.","did":"5631f155-c2fb-4a54-b452-1ad6d0eacdb0","documentation_url":"https://pepys.co/mcp","editorial_description":{"extended_description":"Batch transcription supports RSS and Apple Podcasts feeds. Outputs include SRT, VTT, TXT, Markdown, and JSON, with citation-linked transcript Q&A and summaries. Tools list jobs and check credit balance before larger workloads.","schema_version":1,"summary":"Pepys transcribes audio, video, supported public media links, and podcast feeds.\nRetrieve timestamped speaker segments, search recordings, ask transcript questions, and export text or subtitles.\nOAuth uses your Pepys account, and transcription consumes that account's credits."},"homepage_url":"","icon":"","id":"5631f155-c2fb-4a54-b452-1ad6d0eacdb0","installs":0,"last_scanned":"","license":"","long_description":"Batch transcription supports RSS and Apple Podcasts feeds. Outputs include SRT, VTT, TXT, Markdown, and JSON, with citation-linked transcript Q&A and summaries. Tools list jobs and check credit balance before larger workloads.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"Official MCP page says hosted connector transcription bills to credits.","reasoning":"Consumption of paid credits is High.","risk_type":"financial_transaction","severity":"high","title":"Transcriptions consume credits","triggering_tools_or_skills":["transcribe","transcribe_podcast_feed"]},{"evidence":"Tools upload media and generate transcript exports.","reasoning":"Remote file/artifact operations are Medium.","risk_type":"file_write","severity":"medium","title":"Uploads and exports transcript artifacts","triggering_tools_or_skills":["upload_file","export_transcript"]},{"evidence":"Remote hosted implementation is unpinned.","reasoning":"Runtime capability may drift.","risk_type":"provenance_uncertainty","severity":"low","title":"Hosted implementation is mutable","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"OAuth/account authorization required; exact scopes are not documented.","blocked_missing_evidence":null,"confidence":"high","displayed_risk":"high","evidence_completeness":"complete","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/5631f155-c2fb-4a54-b452-1ad6d0eacdb0.json","what_it_proves":"Candidate PR #125 record identity (name \"Pepys – Transcribe Anything\", publisher, type web_connector) and 10 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/5631f155-c2fb-4a54-b452-1ad6d0eacdb0: complete tool_names inventory (10 tools), remote streamable-http endpoint https://pepys.co/api/mcp, auth_posture auth_required, directory tier community"},{"accessed_at":"2026-10-10T21:56:08Z","url_or_path":"https://pepys.co/mcp","what_it_proves":"Official MCP page lists the same transcription tools and states that transcription is billed to account credits at one credit per minute."}],"primary_reason":"Pepys starts transcription jobs that spend prepaid credits.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:5631f155-c2fb-4a54-b452-1ad6d0eacdb0","reviewed_at":"2026-10-10","reviewer_notes":"All declared tool names were reviewed; schemas were unavailable.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"true"},"tools_or_skills_reviewed":10,"tools_or_skills_total":10},"name":"Pepys – Transcribe Anything","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=5631f155-c2fb-4a54-b452-1ad6d0eacdb0&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://pepys.co/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"KMF Ventures LLC","publisher_url":"https://pepys.co/","remote_url":"https://pepys.co/api/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Consumption of paid credits is High.","evidence":"Transcriptions consume credits: Official MCP page says hosted connector transcription bills to credits.","manual_risk_type":"financial_transaction","remediation":{"block_tool_categories":["financial"],"steps":["Set provider-side spending limits and require approval for every financial action.","Use a dedicated low-balance account and review transaction logs."]},"risk_type":"spends_money","severity":"high","title":"Transcriptions consume credits","triggering_tools":["transcribe","transcribe_podcast_feed"]},{"description":"This connector can create, change, export, or otherwise write files. Review findings: Remote file/artifact operations are Medium.","evidence":"Uploads and exports transcript artifacts: Tools upload media and generate transcript exports.","manual_risk_type":"file_write","remediation":{"block_tool_categories":["state_change"],"steps":["Limit file access to a dedicated working directory.","Review generated or modified files before they are shared or executed."]},"risk_type":"filesystem_access","severity":"medium","title":"Uploads and exports transcript artifacts","triggering_tools":["upload_file","export_transcript"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@pepys.co","tags":["filesystem_access","network_access","oauth_required","spends_money","web_connector"],"tools":[{"description":"","name":"ask_transcription"},{"description":"","name":"export_transcript","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: Remote file/artifact operations are Medium."}},{"description":"","name":"get_credit_balance"},{"description":"","name":"get_transcription"},{"description":"","name":"list_podcast_episodes"},{"description":"","name":"list_transcriptions"},{"description":"","name":"search_transcript"},{"description":"","name":"transcribe","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Consumption of paid credits is High."}},{"description":"","name":"transcribe_podcast_feed","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Consumption of paid credits is High."}},{"description":"","name":"upload_file","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: Remote file/artifact operations are Medium."}}],"tools_count":10,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/5631f155-c2fb-4a54-b452-1ad6d0eacdb0","uuid":"9edaa2a9-c094-56da-8d53-03c0c8c2db84","verification_tier":"community","version":""},"query_key":"kmf ventures llc pepys transcribe anything","schema_version":1,"status":"match"}