{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-20","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Create campaign links, QR codes, UTM templates and pages with Whooshly. Publish assets, inspect analytics and update their destinations after launch. Keep existing public links or printed QR codes connected to current content.","did":"0cecb1e0-03ad-4f25-9554-5f6bd2be0736","documentation_url":"https://whooshly.co/docs/agents/mcp-quickstart","editorial_description":{"extended_description":"QR codes are generated as scannable PNG assets. The connector supports search, account-usage checks and page updates. Custom domains, smart routing and expiry depend on the plan. Sign in with Whooshly; broader platform features such as ticketing and check-in are not listed connector actions.","schema_version":1,"summary":"Create campaign links, QR codes, UTM templates and pages with Whooshly.\nPublish assets, inspect analytics and update their destinations after launch.\nKeep existing public links or printed QR codes connected to current content."},"homepage_url":"","icon":"","id":"0cecb1e0-03ad-4f25-9554-5f6bd2be0736","installs":0,"last_scanned":"","license":"","long_description":"QR codes are generated as scannable PNG assets. The connector supports search, account-usage checks and page updates. Custom domains, smart routing and expiry depend on the plan. Sign in with Whooshly; broader platform features such as ticketing and check-in are not listed connector actions.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The tools create and update audience-facing destinations and identity cards reachable outside the account.","reasoning":"Publishing external content represents the connected user to visitors.","risk_type":"messaging_as_user","severity":"high","title":"Public pages, links, QR codes, and vCards can be published","triggering_tools_or_skills":["create_link","create_page","create_qr","create_utm","create_vcard","update_link","update_page"]},{"evidence":"The same explicit tools persist new or changed resources in the account.","reasoning":"They alter shared marketing state.","risk_type":"data_modification","severity":"medium","title":"Persistent marketing resources can be created and updated","triggering_tools_or_skills":["create_link","create_page","create_qr","create_utm","create_vcard","update_link","update_page"]},{"evidence":"The connector can retrieve or store caller-supplied web destinations.","reasoning":"URL restrictions are needed to prevent arbitrary or internal host access.","risk_type":"arbitrary_network_access","severity":"low","title":"Fetch and link creation accept external URLs","triggering_tools_or_skills":["fetch","create_link","update_link"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication to Whooshly public links, pages, QR codes, UTMs, vCards, statistics, and billing state; exact publication scopes are undocumented.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/0cecb1e0-03ad-4f25-9554-5f6bd2be0736.json","what_it_proves":"Candidate PR #125 record identity (name \"Whooshly\", publisher, type web_connector) and 16 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/0cecb1e0-03ad-4f25-9554-5f6bd2be0736: complete tool_names inventory (16 tools), remote streamable-http endpoint https://app.whooshly.co/api/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Creation and update of public web resources establish external publishing capability.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:0cecb1e0-03ad-4f25-9554-5f6bd2be0736","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 16 names. Official docs lookup was uninformative; runtime checks should verify publication defaults, URL allowlists, vCard privacy, billing effects, and page update rollback.","risk_domains":{"arbitrary_network_access":"true","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":16,"tools_or_skills_total":16},"name":"Whooshly","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=0cecb1e0-03ad-4f25-9554-5f6bd2be0736&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://whooshly.co/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"KMF Ventures","publisher_url":"https://whooshly.co/","remote_url":"https://app.whooshly.co/api/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: Publishing external content represents the connected user to visitors.","evidence":"Public pages, links, QR codes, and vCards can be published: The tools create and update audience-facing destinations and identity cards reachable outside the account.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Public pages, links, QR codes, and vCards can be published","triggering_tools":["create_link","create_page","create_qr","create_utm","create_vcard","update_link","update_page"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They alter shared marketing state.","evidence":"Persistent marketing resources can be created and updated: The same explicit tools persist new or changed resources in the account.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Persistent marketing resources can be created and updated","triggering_tools":["create_link","create_page","create_qr","create_utm","create_vcard","update_link","update_page"]},{"description":"This connector can send caller-provided data to an external service or publisher. Review findings: URL restrictions are needed to prevent arbitrary or internal host access.","evidence":"Fetch and link creation accept external URLs: The connector can retrieve or store caller-supplied web destinations.","manual_risk_type":"arbitrary_network_access","remediation":{"block_tool_categories":["sends_externally"],"steps":["Do not include secrets, regulated data, or customer information unless the destination is approved.","Review the recipient's retention and deletion policy before enabling the connector."]},"risk_type":"forwards_data_to_third_party","severity":"low","title":"Fetch and link creation accept external URLs","triggering_tools":["fetch","create_link","update_link"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"contact@whooshly.co","tags":["forwards_data_to_third_party","modifies_data","network_access","oauth_required","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"create_link","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Publishing external content represents the connected user to visitors."}},{"description":"","name":"create_page","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Publishing external content represents the connected user to visitors."}},{"description":"","name":"create_qr","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Publishing external content represents the connected user to visitors."}},{"description":"","name":"create_utm","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Publishing external content represents the connected user to visitors."}},{"description":"","name":"create_vcard","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Publishing external content represents the connected user to visitors."}},{"description":"","name":"fetch"},{"description":"","name":"get_billing_status"},{"description":"","name":"get_link_stats"},{"description":"","name":"get_page"},{"description":"","name":"get_qr"},{"description":"","name":"list_links"},{"description":"","name":"list_pages"},{"description":"","name":"list_utm"},{"description":"","name":"search"},{"description":"","name":"update_link","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Publishing external content represents the connected user to visitors."}},{"description":"","name":"update_page","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Publishing external content represents the connected user to visitors."}}],"tools_count":16,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/0cecb1e0-03ad-4f25-9554-5f6bd2be0736","uuid":"5ad6c972-495a-5742-b3e6-c327e7bb5334","verification_tier":"community","version":""},"query_key":"kmf ventures whooshly","schema_version":1,"status":"match"}