{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-06","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","catalog_reconciliation":{"basis":"Documented actions on the identified catalog surface; not an execution test.","confidence":"medium","evidence_completeness":"partial","previous":{"confidence":"low","detail_sha256":"612d328063b244af2d5641ff765fbd6c493cd8762d7652bbb3dda63883d27554","risk":"high"},"proposal_file":"final-evidence-proposals.json","rationale":"The publication destination is now documented, resolving the previous rating blocker. High is supported by public publication; do not label apply_comment as an edit or the hosted connector as local filesystem access. Current official hosted MCP reference at the exact stored endpoint; no MCP requests or account access.","remaining_evidence_gaps":["No authenticated runtime verification or deployment version pin. Stored six-tool inventory omits two currently documented session tools."],"review_key":"claudesec:01d3635f-57e5-400e-867e-d8402f392344","reviewed_at":"2026-10-12","runtime_verified":false,"sources":["https://docs.inlace.co/reference/mcp"],"status":"resolved"},"category":"Web Connector","confidence":"low","description":"Bring knowledge captured from your team's work into Claude with Lace Labs. Search discussions and comments and browse project reviews. Apply comments or publish reviews to preserve decisions and their context.","did":"01d3635f-57e5-400e-867e-d8402f392344","documentation_url":"https://docs.inlace.co/","editorial_description":{"extended_description":"Lace describes its purpose as capturing what a team sees, decides and why. The connector's listed operations focus on project reviews, comments and discussion search and require an authenticated account.","schema_version":1,"summary":"Bring knowledge captured from your team's work into Claude with Lace Labs.\nSearch discussions and comments and browse project reviews.\nApply comments or publish reviews to preserve decisions and their context."},"homepage_url":"","icon":"","id":"01d3635f-57e5-400e-867e-d8402f392344","installs":0,"last_scanned":"","license":"","long_description":"Lace describes its purpose as capturing what a team sees, decides and why. The connector's listed operations focus on project reviews, comments and discussion search and require an authenticated account.","manual_assessment":"unassessed","manual_review":{"all_findings":[{"evidence":"Directory tool_names include publish_review and apply_comment; description only says Lace captures team knowledge and hands it to agents.","reasoning":"publish_review may post reviews to an external system (High if so) and apply_comment may modify content/repos; behaviour unresolved because documentation was unreachable.","risk_type":"evidence_gap","severity":"medium","title":"publish_review and apply_comment targets are undocumented","triggering_tools_or_skills":["publish_review","apply_comment"]},{"evidence":"Tool names; description: 'capturing what they see, what they decide, and why'.","reasoning":"Internal team discussion text enters context (prompt-injection exposure).","risk_type":"private_data_read","severity":"low","title":"Searches team comments, discussions and reviews","triggering_tools_or_skills":["search_comments","search_discussion","list_reviews","list_projects"]},{"evidence":"Directory remote.url is mcp.inlace.co/; no pinned source or version is available for the server.","reasoning":"Tool behaviour can change server-side after review; ratings rest on the 2026-09-22 snapshot.","risk_type":"provenance_uncertainty","severity":"low","title":"Closed hosted MCP server for Lace Labs can change without notice","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"auth_required; scopes and connected systems (e.g. code hosts) unknown.","blocked_missing_evidence":"Tool descriptions/input schemas for publish_review and apply_comment (from https://docs.inlace.co/ or a tools/list capture), including where reviews are published and whether apply_comment edits code or documents.","confidence":"low","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"unassessed","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/01d3635f-57e5-400e-867e-d8402f392344.json","what_it_proves":"Candidate PR #125 record identity (name \"Lace Labs\", publisher, type web_connector) and 6 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/01d3635f-57e5-400e-867e-d8402f392344: complete tool_names inventory (6 tools), remote streamable-http endpoint https://mcp.inlace.co/, auth_posture auth_required, directory tier community"}],"primary_reason":"publish_review and apply_comment imply publishing and applying changes, but their targets cannot be established from the vague description and unreachable docs.","provisional_risk":"high","publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:01d3635f-57e5-400e-867e-d8402f392344","reviewed_at":"2026-10-10","reviewer_notes":"Identity consistent (inlace.co / mcp.inlace.co). Reviewed all 6 tool names. https://docs.inlace.co/ (twice), https://docs.inlace.co/mcp and https://inlace.co/ all failed with 'Socket is closed'/no output; a WebSearch on inlace.co/github.com found nothing on these tools. Provisional high because publish_* to an external channel would be High.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"unknown","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"unknown","forwards_data_to_third_party":"true","modifies_data":"unknown","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"unknown","spends_or_moves_money":"false"},"tools_or_skills_reviewed":6,"tools_or_skills_total":6},"name":"Lace Labs","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=01d3635f-57e5-400e-867e-d8402f392344&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://inlace.co/privacy-policy","provisional_risk":"high","publication_recommendation":"fix","publisher":"Lace Labs","publisher_url":"https://inlace.co/","remote_url":"https://mcp.inlace.co/","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"publish_review uploads source or assets, builds supported projects in a sandbox, and returns a shareable live page anyone can open. Publishing confidential content therefore exposes it beyond the account.","evidence":"https://docs.inlace.co/reference/mcp\nDocumented actions: publish_review","risk_type":"forwards_data_to_third_party","severity":"high","title":"Publishes work as a publicly accessible review page"},{"description":"The hosted connector retrieves account comments, screenshots, decisions and permitted discussions or sessions. apply_comment returns contextual material; it is not itself a code-edit operation.","evidence":"https://docs.inlace.co/reference/mcp\nDocumented actions: search_comments, search_discussion, list_reviews, list_projects, apply_comment, search_sessions, get_session_flow","risk_type":"reads_private_data","severity":"medium","title":"Reads team decisions and recorded screen context"}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@inlace.co","tags":["forwards_data_to_third_party","reads_private_data"],"tools":[{"description":"","name":"apply_comment"},{"description":"","name":"list_projects"},{"description":"","name":"list_reviews"},{"description":"","name":"publish_review"},{"description":"","name":"search_comments"},{"description":"","name":"search_discussion"}],"tools_count":6,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/01d3635f-57e5-400e-867e-d8402f392344","uuid":"6119b778-ad7f-5552-8ee0-179bbf2fdd64","verification_tier":"community","version":""},"query_key":"lace labs lace labs","schema_version":1,"status":"match"}