{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-12","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"LaunchNotes manages product announcements, roadmaps, and customer feedback. Draft, publish, schedule, or archive updates and move roadmap items through stages. Review engagement, organize feedback, and post public or internal roadmap updates.","did":"9a329621-727a-4f90-8649-19482d0df338","documentation_url":"https://help.launchnotes.com/en/articles/16204893-how-do-i-approve-the-launchnotes-mcp-connector-for-my-organization","editorial_description":{"extended_description":"Attach supporting links, notify followers about roadmap progress, and inspect top-performing announcements. Project tools also update visual styling, content, feature settings, and custom code.","schema_version":1,"summary":"LaunchNotes manages product announcements, roadmaps, and customer feedback.\nDraft, publish, schedule, or archive updates and move roadmap items through stages.\nReview engagement, organize feedback, and post public or internal roadmap updates."},"homepage_url":"","icon":"https://cdn.prod.website-files.com/69fbf67f935d4bffd0e160d7/6a394b45979ab88c7ab5570c_launchnotes_webclip-dark.png","id":"9a329621-727a-4f90-8649-19482d0df338","installs":0,"last_scanned":"","license":"","long_description":"Attach supporting links, notify followers about roadmap progress, and inspect top-performing announcements. Project tools also update visual styling, content, feature settings, and custom code.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"These tools notify customers/followers or teams.","reasoning":"They communicate as the organization.","risk_type":"messaging_as_user","severity":"high","title":"Publishes/schedules announcements and roadmap updates","triggering_tools_or_skills":["launchnotes_publish_announcement","launchnotes_schedule_announcement","launchnotes_post_roadmap_update"]},{"evidence":"These tools alter production communication site behavior.","reasoning":"They can affect live customer-facing infrastructure.","risk_type":"deployment_infrastructure","severity":"high","title":"Changes project custom code/features/content","triggering_tools_or_skills":["launchnotes_update_project_custom_code","launchnotes_update_project_features"]},{"evidence":"Custom code is deployed in the project communication surface.","reasoning":"It is production code mutation.","risk_type":"code_execution","severity":"high","title":"Writes project custom code","triggering_tools_or_skills":["launchnotes_update_project_custom_code"]},{"evidence":"Archiving removes a durable announcement from active availability.","reasoning":"It is destructive communication state.","risk_type":"data_deletion","severity":"high","title":"Archives announcements","triggering_tools_or_skills":["launchnotes_archive_announcement"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication is required; project communication/roadmap/feedback actions follow LaunchNotes permissions.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/9a329621-727a-4f90-8649-19482d0df338.json","what_it_proves":"Candidate PR #125 record identity (name \"LaunchNotes\", publisher, type web_connector) and 29 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/9a329621-727a-4f90-8649-19482d0df338: complete tool_names inventory (29 tools), remote streamable-http endpoint https://mcp.launchnotes.com/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"LaunchNotes publishes customer communications and changes custom code/live project content.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:9a329621-727a-4f90-8649-19482d0df338","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 29 tools.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"true","deployment_or_infrastructure":"true","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"true","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":29,"tools_or_skills_total":29},"name":"LaunchNotes","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=9a329621-727a-4f90-8649-19482d0df338&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.launchnotes.com/privacy-policy","provisional_risk":null,"publication_recommendation":"accept","publisher":"LaunchNotes","publisher_url":"https://www.launchnotes.com/","remote_url":"https://mcp.launchnotes.com/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: They communicate as the organization.","evidence":"Publishes/schedules announcements and roadmap updates: These tools notify customers/followers or teams.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Publishes/schedules announcements and roadmap updates","triggering_tools":["launchnotes_publish_announcement","launchnotes_schedule_announcement","launchnotes_post_roadmap_update"]},{"description":"This connector can deploy code or change infrastructure and production environments. Review findings: They can affect live customer-facing infrastructure.","evidence":"Changes project custom code/features/content: These tools alter production communication site behavior.","manual_risk_type":"deployment_infrastructure","remediation":{"block_tool_categories":["code_execution","state_change"],"steps":["Default to a sandbox or staging environment.","Require code review, human approval, audit logging, and a tested rollback path for production changes."]},"risk_type":"code_deployment","severity":"high","title":"Changes project custom code/features/content","triggering_tools":["launchnotes_update_project_custom_code","launchnotes_update_project_features"]},{"description":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: It is production code mutation.","evidence":"Writes project custom code: Custom code is deployed in the project communication surface.","manual_risk_type":"code_execution","remediation":{"block_tool_categories":["code_execution"],"steps":["Run only in a sandbox with least-privilege credentials and strict resource limits.","Disable generic execution gateways unless their reachable action set is fully understood.","Require approval before execution against production systems or sensitive data."]},"risk_type":"runs_code","severity":"high","title":"Writes project custom code","triggering_tools":["launchnotes_update_project_custom_code"]},{"description":"This connector can permanently remove data or resources. Review findings: It is destructive communication state.","evidence":"Archives announcements: Archiving removes a durable announcement from active availability.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Archives announcements","triggering_tools":["launchnotes_archive_announcement"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@launchnotes.io","tags":["code_deployment","deletes_data","network_access","oauth_required","runs_code","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"launchnotes_archive_announcement","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: It is destructive communication state."}},{"description":"","name":"launchnotes_create_announcement"},{"description":"","name":"launchnotes_create_external_content_link"},{"description":"","name":"launchnotes_create_work_item"},{"description":"","name":"launchnotes_get_announcement"},{"description":"","name":"launchnotes_get_feedback"},{"description":"","name":"launchnotes_get_project"},{"description":"","name":"launchnotes_get_project_analytics"},{"description":"","name":"launchnotes_get_top_announcements"},{"description":"","name":"launchnotes_get_work_item"},{"description":"","name":"launchnotes_list_announcements"},{"description":"","name":"launchnotes_list_categories"},{"description":"","name":"launchnotes_list_projects"},{"description":"","name":"launchnotes_list_stages"},{"description":"","name":"launchnotes_list_templates"},{"description":"","name":"launchnotes_list_work_items"},{"description":"","name":"launchnotes_move_work_item"},{"description":"","name":"launchnotes_organize_feedback"},{"description":"","name":"launchnotes_post_roadmap_update","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: They communicate as the organization."}},{"description":"","name":"launchnotes_project_search"},{"description":"","name":"launchnotes_publish_announcement","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: They communicate as the organization."}},{"description":"","name":"launchnotes_schedule_announcement","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: They communicate as the organization."}},{"description":"","name":"launchnotes_search_feedback"},{"description":"","name":"launchnotes_update_announcement"},{"description":"","name":"launchnotes_update_project_colors"},{"description":"","name":"launchnotes_update_project_content"},{"description":"","name":"launchnotes_update_project_custom_code","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: It is production code mutation."}},{"description":"","name":"launchnotes_update_project_features","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: They can affect live customer-facing infrastructure."}},{"description":"","name":"launchnotes_update_work_item"}],"tools_count":29,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/9a329621-727a-4f90-8649-19482d0df338","uuid":"ae101ab1-1b0d-581e-9653-ca69b3a9d19c","verification_tier":"community","version":""},"query_key":"launchnotes launchnotes","schema_version":1,"status":"match"}