{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-27","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Knips prepares email and SMS campaigns for housing projects. Build welcome flows, segment interested contacts or buyers, and inspect campaign performance. Created content stays in draft for your review and sending in Knips.","did":"f18c365b-a7a6-49ba-8fa1-1a399f2b09a2","documentation_url":"https://knips.info/en/articles/15586611-knips-mcp","editorial_description":{"extended_description":"Browse contacts, forms, media, and existing campaigns; edit draft blocks, flow steps, or segments. Media can be uploaded to support campaign preparation.","schema_version":1,"summary":"Knips prepares email and SMS campaigns for housing projects.\nBuild welcome flows, segment interested contacts or buyers, and inspect campaign performance.\nCreated content stays in draft for your review and sending in Knips."},"homepage_url":"","icon":"","id":"f18c365b-a7a6-49ba-8fa1-1a399f2b09a2","installs":0,"last_scanned":"","license":"","long_description":"Browse contacts, forms, media, and existing campaigns; edit draft blocks, flow steps, or segments. Media can be uploaded to support campaign preparation.","manual_assessment":"medium","manual_review":{"all_findings":[{"evidence":"The inventory creates and updates draft campaigns, audience segments, welcome flows, and flow steps.","reasoning":"These changes persist marketing automation configuration but the listing states the user reviews and sends separately.","risk_type":"data_modification","severity":"medium","title":"Draft campaigns, segments, and automation flows can be created or changed","triggering_tools_or_skills":["draft_campaign","update_draft_campaign","create_segment","update_segment","create_flow","add_flow_step","update_flow"]},{"evidence":"The listing covers live interested contacts and buyers, audience segmentation, links, campaigns, and performance of sends.","reasoning":"This is personal lead/customer data and confidential campaign analytics.","risk_type":"private_data_read","severity":"medium","title":"Contacts and campaign performance are exposed","triggering_tools_or_skills":["get_contact","search_contacts","get_campaign_statistics","preview_segment"]},{"evidence":"User-authored forms, campaign copy, media metadata, and contact fields are searchable.","reasoning":"Workspace content is untrusted input.","risk_type":"prompt_injection_exposure","severity":"low","title":"Contact and campaign content enters context","triggering_tools_or_skills":["get_contact","search_forms","search_campaigns","search_media"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication grants Knips access to contacts, campaigns, segments, flows, forms, media, and analytics; the listing says every created item remains a draft.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"medium","evidence_completeness":"partial","manual_overall_risk":"medium","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/f18c365b-a7a6-49ba-8fa1-1a399f2b09a2.json","what_it_proves":"Candidate PR #125 record identity (name \"Knips\", publisher, type web_connector) and 26 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/f18c365b-a7a6-49ba-8fa1-1a399f2b09a2: complete tool_names inventory (26 tools), remote streamable-http endpoint https://mcp.knips.com/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Knips can modify marketing drafts and flows but has no declared send or publish action.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:f18c365b-a7a6-49ba-8fa1-1a399f2b09a2","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 26 tools; the draft-only claim should be checked at runtime, especially flow activation state.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":26,"tools_or_skills_total":26},"name":"Knips","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=f18c365b-a7a6-49ba-8fa1-1a399f2b09a2&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://knips.com/legal/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Knips","publisher_url":"https://knips.com/","remote_url":"https://mcp.knips.com/mcp","repository_url":"","risk":"medium","risk_severity":"medium","security_risks":[{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These changes persist marketing automation configuration but the listing states the user reviews and sends separately.","evidence":"Draft campaigns, segments, and automation flows can be created or changed: The inventory creates and updates draft campaigns, audience segments, welcome flows, and flow steps.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Draft campaigns, segments, and automation flows can be created or changed","triggering_tools":["draft_campaign","update_draft_campaign","create_segment","update_segment","create_flow","add_flow_step","update_flow"]},{"description":"This connector can read information available to the connected account and return it to the AI. Review findings: This is personal lead/customer data and confidential campaign analytics.","evidence":"Contacts and campaign performance are exposed: The listing covers live interested contacts and buyers, audience segmentation, links, campaigns, and performance of sends.","manual_risk_type":"private_data_read","remediation":{"block_tool_categories":["data_exfiltration"],"steps":["Use a least-privilege account limited to the information required by the workflow.","Restrict folders, projects, tenants, and other data scopes wherever the provider allows it.","Review access logs for unexpected reads or bulk retrieval."]},"risk_type":"reads_private_data","severity":"medium","title":"Contacts and campaign performance are exposed","triggering_tools":["get_contact","search_contacts","get_campaign_statistics","preview_segment"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@knips.com","tags":["modifies_data","network_access","oauth_required","reads_private_data","web_connector"],"tools":[{"description":"","name":"add_flow_step","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These changes persist marketing automation configuration but the listing states the user reviews and sends separately."}},{"description":"","name":"create_flow","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These changes persist marketing automation configuration but the listing states the user reviews and sends separately."}},{"description":"","name":"create_segment","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These changes persist marketing automation configuration but the listing states the user reviews and sends separately."}},{"description":"","name":"draft_campaign","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These changes persist marketing automation configuration but the listing states the user reviews and sends separately."}},{"description":"","name":"get_campaign"},{"description":"","name":"get_campaign_statistics","risk":{"category":"data_exfiltration","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can read information available to the connected account and return it to the AI. Review findings: This is personal lead/customer data and confidential campaign analytics."}},{"description":"","name":"get_contact","risk":{"category":"data_exfiltration","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can read information available to the connected account and return it to the AI. Review findings: This is personal lead/customer data and confidential campaign analytics."}},{"description":"","name":"get_flow"},{"description":"","name":"get_flow_blueprints"},{"description":"","name":"get_flows"},{"description":"","name":"get_links"},{"description":"","name":"get_segment"},{"description":"","name":"get_segments"},{"description":"","name":"get_settings"},{"description":"","name":"preview_segment","risk":{"category":"data_exfiltration","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can read information available to the connected account and return it to the AI. Review findings: This is personal lead/customer data and confidential campaign analytics."}},{"description":"","name":"search_campaigns"},{"description":"","name":"search_contacts","risk":{"category":"data_exfiltration","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can read information available to the connected account and return it to the AI. Review findings: This is personal lead/customer data and confidential campaign analytics."}},{"description":"","name":"search_forms"},{"description":"","name":"search_media"},{"description":"","name":"update_draft_campaign","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These changes persist marketing automation configuration but the listing states the user reviews and sends separately."}},{"description":"","name":"update_draft_campaign_blocks"},{"description":"","name":"update_flow","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These changes persist marketing automation configuration but the listing states the user reviews and sends separately."}},{"description":"","name":"update_flow_step"},{"description":"","name":"update_segment","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These changes persist marketing automation configuration but the listing states the user reviews and sends separately."}},{"description":"","name":"upload_media"},{"description":"","name":"whoami"}],"tools_count":26,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/f18c365b-a7a6-49ba-8fa1-1a399f2b09a2","uuid":"9c0c4b57-05d6-56d7-9735-47ff86ca6d25","verification_tier":"community","version":""},"query_key":"knips knips","schema_version":1,"status":"match"}