{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-18","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Manage product notifications and messaging content in Knock. Inspect or update workflows, broadcasts, guides, layouts and translations. Available operations depend on the capabilities granted when connecting.","did":"06e115af-4f0e-4746-8df8-0f951c4ed86c","documentation_url":"https://docs.knock.app/","editorial_description":{"extended_description":"The connector exposes API search and separate read and write execution tools. Depending on enabled access, it can inspect environments, messages, users, tenants and objects. Authentication uses Knock OAuth with selectable capabilities.","schema_version":1,"summary":"Manage product notifications and messaging content in Knock.\nInspect or update workflows, broadcasts, guides, layouts and translations.\nAvailable operations depend on the capabilities granted when connecting."},"homepage_url":"","icon":"https://knock.app/favicon/favicon.svg","id":"06e115af-4f0e-4746-8df8-0f951c4ed86c","installs":0,"last_scanned":"","license":"","long_description":"The connector exposes API search and separate read and write execution tools. Depending on enabled access, it can inspect environments, messages, users, tenants and objects. Authentication uses Knock OAuth with selectable capabilities.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The Directory description states Code Mode tools explore and call Knock's Management API for arbitrary read and write operations.","reasoning":"A generic API execution interface has broader impact than narrow typed tools and may include destructive sub-operations.","risk_type":"query_execution","severity":"high","title":"Generic Management API operations execute","triggering_tools_or_skills":["execute_mapi_read","execute_mapi_write"]},{"evidence":"The publisher description says the hosted agent creates and updates notification workflows, broadcasts, guides, email layouts, partials, and translations.","reasoning":"Broadcast and workflow actions can cause external customer messages under the connected account.","risk_type":"messaging_as_user","severity":"high","title":"Notification broadcasts and workflows can be managed","triggering_tools_or_skills":["get_knock_agent","start_knock_agent","execute_mapi_write"]},{"evidence":"The visible tools route to searched Management API methods or a hosted agent rather than enumerating each operation.","reasoning":"Available actions depend on selected capabilities and runtime schemas, making static review incomplete.","risk_type":"generic_gateway","severity":"low","title":"Five tools hide a variable action surface","triggering_tools_or_skills":["search_mapi","execute_mapi_read","execute_mapi_write","get_knock_agent","start_knock_agent"]},{"evidence":"Enabled reads can inspect messages, users, tenants, objects, workflows, and templates containing third-party text.","reasoning":"Customer and template content is untrusted model input.","risk_type":"prompt_injection_exposure","severity":"low","title":"Message and customer content enters context","triggering_tools_or_skills":["execute_mapi_read","start_knock_agent"]}],"assessment_status":"provisional","auth_and_scopes":"OAuth to a Knock account with user-selected capabilities; the exact Management API operations available through generic read/write and agent tools vary by granted scope.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/06e115af-4f0e-4746-8df8-0f951c4ed86c.json","what_it_proves":"Candidate PR #125 record identity (name \"Knock\", publisher, type web_connector) and 5 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/06e115af-4f0e-4746-8df8-0f951c4ed86c: complete tool_names inventory (5 tools), remote streamable-http endpoint https://mcp.knock.app/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Generic Management API execution and a hosted agent expose high-impact notification sending with dynamic hidden actions.","provisional_risk":null,"publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:06e115af-4f0e-4746-8df8-0f951c4ed86c","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all five gateway tools. Runtime enumeration must record every enabled Management API operation, delete/publish/deploy paths, scope selection, and confirmation behavior.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"unknown","deletes_data":"unknown","deployment_or_infrastructure":"unknown","dynamic_hidden_actions":"true","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"true","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":5,"tools_or_skills_total":5},"name":"Knock","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=06e115af-4f0e-4746-8df8-0f951c4ed86c&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://knock.app/legal/privacy-policy","provisional_risk":null,"publication_recommendation":"fix","publisher":"Knock","publisher_url":"https://knock.app/","remote_url":"https://mcp.knock.app/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: A generic API execution interface has broader impact than narrow typed tools and may include destructive sub-operations.; Available actions depend on selected capabilities and runtime schemas, making static review incomplete.","evidence":"Generic Management API operations execute: The Directory description states Code Mode tools explore and call Knock's Management API for arbitrary read and write operations. | Five tools hide a variable action surface: The visible tools route to searched Management API methods or a hosted agent rather than enumerating each operation.","manual_risk_type":"query_execution,generic_gateway","remediation":{"block_tool_categories":["code_execution"],"steps":["Run only in a sandbox with least-privilege credentials and strict resource limits.","Disable generic execution gateways unless their reachable action set is fully understood.","Require approval before execution against production systems or sensitive data."]},"risk_type":"runs_code","severity":"high","title":"Can execute code, queries, or dynamic actions","triggering_tools":["execute_mapi_read","execute_mapi_write","search_mapi","get_knock_agent","start_knock_agent"]},{"description":"This connector can publish or send messages and content using the connected identity. Review findings: Broadcast and workflow actions can cause external customer messages under the connected account.","evidence":"Notification broadcasts and workflows can be managed: The publisher description says the hosted agent creates and updates notification workflows, broadcasts, guides, email layouts, partials, and translations.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Notification broadcasts and workflows can be managed","triggering_tools":["get_knock_agent","start_knock_agent","execute_mapi_write"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@knock.app","tags":["network_access","oauth_required","runs_code","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"execute_mapi_read","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: A generic API execution interface has broader impact than narrow typed tools and may include destructive sub-operations.; Available actions depend on selected capabilities and runtime schemas, making static review incomplete."}},{"description":"","name":"execute_mapi_write","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Broadcast and workflow actions can cause external customer messages under the connected account."}},{"description":"","name":"get_knock_agent","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Broadcast and workflow actions can cause external customer messages under the connected account."}},{"description":"","name":"search_mapi","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: A generic API execution interface has broader impact than narrow typed tools and may include destructive sub-operations.; Available actions depend on selected capabilities and runtime schemas, making static review incomplete."}},{"description":"","name":"start_knock_agent","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Broadcast and workflow actions can cause external customer messages under the connected account."}}],"tools_count":5,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/06e115af-4f0e-4746-8df8-0f951c4ed86c","uuid":"0ef05dd1-588f-5bb8-90cc-957be0147b97","verification_tier":"community","version":""},"query_key":"knock","schema_version":1,"status":"match"}