{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-24","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Manages property-maintenance work in your Latchel account from Claude. Find work orders, inspect their activity and tasks, and create new orders. Create, resolve or defer tasks and look up properties, residents and company users.","did":"210f8eff-ada3-4cbf-a233-d7a9e72db0c3","documentation_url":"https://help.latchel.com/s/topic/0TO5e000000h9wqGAA/latchel-mcp-ai-assistants","editorial_description":{"extended_description":"Work-order details include open tasks, with separate history and task-detail tools. Company user and group lookups help identify the people associated with maintenance workflows.","schema_version":1,"summary":"Manages property-maintenance work in your Latchel account from Claude.\nFind work orders, inspect their activity and tasks, and create new orders.\nCreate, resolve or defer tasks and look up properties, residents and company users."},"homepage_url":"","icon":"","id":"210f8eff-ada3-4cbf-a233-d7a9e72db0c3","installs":0,"last_scanned":"","license":"","long_description":"Work-order details include open tasks, with separate history and task-detail tools. Company user and group lookups help identify the people associated with maintenance workflows.","manual_assessment":"medium","manual_review":{"all_findings":[{"evidence":"The complete Directory inventory and description explicitly expose creation of work orders and creation, resolution and rescheduling of their tasks.","reasoning":"These operations persistently change property-maintenance workflow state; the evidence does not establish that they message or dispatch an external party.","risk_type":"data_modification","severity":"medium","title":"Creates and changes maintenance workflow records","triggering_tools_or_skills":["create_task","create_work_order","defer_task","resolve_task"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication is required to a Latchel company account; exact scopes and which company users or properties are visible are not documented.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"medium","evidence_completeness":"partial","manual_overall_risk":"medium","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/210f8eff-ada3-4cbf-a233-d7a9e72db0c3.json","what_it_proves":"Candidate PR #125 record identity (name \"Latchel MCP\", publisher, type web_connector) and 14 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/210f8eff-ada3-4cbf-a233-d7a9e72db0c3: complete tool_names inventory (14 tools), remote streamable-http endpoint https://app.latchel.com/mcp/user-tools, auth_posture auth_required, directory tier community"}],"primary_reason":"Latchel can create work orders and create, defer or resolve operational tasks.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:210f8eff-ada3-4cbf-a233-d7a9e72db0c3","reviewed_at":"2026-10-10","reviewer_notes":"The official help URL could not be fetched. Runtime schemas are needed to establish whether create_work_order notifies vendors or residents; identity and endpoint are otherwise coherent.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"unknown","spends_or_moves_money":"false"},"tools_or_skills_reviewed":14,"tools_or_skills_total":14},"name":"Latchel MCP","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=210f8eff-ada3-4cbf-a233-d7a9e72db0c3&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://latchel.com/privacy-policy/","provisional_risk":null,"publication_recommendation":"accept","publisher":"Latchel Inc.","publisher_url":"https://latchel.com/","remote_url":"https://app.latchel.com/mcp/user-tools","repository_url":"","risk":"medium","risk_severity":"medium","security_risks":[{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These operations persistently change property-maintenance workflow state; the evidence does not establish that they message or dispatch an external party.","evidence":"Creates and changes maintenance workflow records: The complete Directory inventory and description explicitly expose creation of work orders and creation, resolution and rescheduling of their tasks.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Creates and changes maintenance workflow records","triggering_tools":["create_task","create_work_order","defer_task","resolve_task"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@latchel.com","tags":["modifies_data","network_access","oauth_required","web_connector"],"tools":[{"description":"","name":"create_task","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These operations persistently change property-maintenance workflow state; the evidence does not establish that they message or dispatch an external party."}},{"description":"","name":"create_work_order","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These operations persistently change property-maintenance workflow state; the evidence does not establish that they message or dispatch an external party."}},{"description":"","name":"defer_task","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These operations persistently change property-maintenance workflow state; the evidence does not establish that they message or dispatch an external party."}},{"description":"","name":"get_company_user_groups"},{"description":"","name":"get_company_users"},{"description":"","name":"get_properties"},{"description":"","name":"get_residents"},{"description":"","name":"get_task_details"},{"description":"","name":"get_tasks"},{"description":"","name":"get_work_order_details"},{"description":"","name":"get_work_order_logs"},{"description":"","name":"get_work_orders"},{"description":"","name":"resolve_task","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These operations persistently change property-maintenance workflow state; the evidence does not establish that they message or dispatch an external party."}},{"description":"","name":"who_am_i"}],"tools_count":14,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/210f8eff-ada3-4cbf-a233-d7a9e72db0c3","uuid":"33192f22-fc4d-5c70-b968-ac82ca97a4c4","verification_tier":"community","version":""},"query_key":"latchel inc latchel mcp","schema_version":1,"status":"match"}