{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-08","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Layers connects Claude to Shopify search and merchandising configuration. Inspect catalog behavior and manage search rules, attributes, ranking, product sequences, and related settings. Collaborative edit sessions support reviewing and testing proposed changes before publication.","did":"5402a27d-f274-4a98-a2d1-20a165e5f543","documentation_url":"https://docs.uselayers.com/","editorial_description":{"extended_description":"The platform describes merchandising campaigns, collection sorting, recommendations, filters, redirects, and synonyms. Tools also provide semantic search, autocomplete, operational status, store configuration, and documentation lookup.","schema_version":1,"summary":"Layers connects Claude to Shopify search and merchandising configuration.\nInspect catalog behavior and manage search rules, attributes, ranking, product sequences, and related settings.\nCollaborative edit sessions support reviewing and testing proposed changes before publication."},"homepage_url":"","icon":"https://cdn.uselayers.com/Layers%20Square%20Logo%20Mark.png","id":"5402a27d-f274-4a98-a2d1-20a165e5f543","installs":0,"last_scanned":"","license":"","long_description":"The platform describes merchandising campaigns, collection sorting, recommendations, filters, redirects, and synonyms. Tools also provide semantic search, autocomplete, operational status, store configuration, and documentation lookup.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"Directory description says changes happen in the live Shopify environment.","reasoning":"Material live production configuration changes are High.","risk_type":"deployment_infrastructure","severity":"high","title":"Changes live storefront search/merchandising","triggering_tools_or_skills":["merchandise-rules-manage","request-transforms-manage","attributes-manage"]},{"evidence":"Generic manage tools lack operation schemas.","reasoning":"Hidden actions may include destructive/configuration operations.","risk_type":"generic_gateway","severity":"high","title":"Manage tools hide operation sets","triggering_tools_or_skills":["attributes-manage","merchandise-rules-manage"]},{"evidence":"Remote hosted implementation is unpinned.","reasoning":"Runtime capabilities can drift.","risk_type":"provenance_uncertainty","severity":"low","title":"Hosted implementation is mutable","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"OAuth/account authorization required; exact scopes are not documented.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/5402a27d-f274-4a98-a2d1-20a165e5f543.json","what_it_proves":"Candidate PR #125 record identity (name \"Layers\", publisher, type web_connector) and 15 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/5402a27d-f274-4a98-a2d1-20a165e5f543: complete tool_names inventory (15 tools), remote streamable-http endpoint https://app.uselayers.com/mcp/v1, auth_posture auth_required, directory tier community"}],"primary_reason":"Layers changes live Shopify search and merchandising configuration through broad manage gateways.","provisional_risk":null,"publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:5402a27d-f274-4a98-a2d1-20a165e5f543","reviewed_at":"2026-10-10","reviewer_notes":"All declared tool names were reviewed; schemas were not available.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"true","dynamic_hidden_actions":"true","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":15,"tools_or_skills_total":15},"name":"Layers","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=5402a27d-f274-4a98-a2d1-20a165e5f543&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://docs.uselayers.com/legal/privacy-statement","provisional_risk":null,"publication_recommendation":"fix","publisher":"Layers","publisher_url":"https://uselayers.com/","remote_url":"https://app.uselayers.com/mcp/v1","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can deploy code or change infrastructure and production environments. Review findings: Material live production configuration changes are High.","evidence":"Changes live storefront search/merchandising: Directory description says changes happen in the live Shopify environment.","manual_risk_type":"deployment_infrastructure","remediation":{"block_tool_categories":["code_execution","state_change"],"steps":["Default to a sandbox or staging environment.","Require code review, human approval, audit logging, and a tested rollback path for production changes."]},"risk_type":"code_deployment","severity":"high","title":"Changes live storefront search/merchandising","triggering_tools":["merchandise-rules-manage","request-transforms-manage","attributes-manage"]},{"description":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Hidden actions may include destructive/configuration operations.","evidence":"Manage tools hide operation sets: Generic manage tools lack operation schemas.","manual_risk_type":"generic_gateway","remediation":{"block_tool_categories":["code_execution"],"steps":["Run only in a sandbox with least-privilege credentials and strict resource limits.","Disable generic execution gateways unless their reachable action set is fully understood.","Require approval before execution against production systems or sensitive data."]},"risk_type":"runs_code","severity":"high","title":"Manage tools hide operation sets","triggering_tools":["attributes-manage","merchandise-rules-manage"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@uselayers.com","tags":["code_deployment","network_access","oauth_required","runs_code","web_connector"],"tools":[{"description":"","name":"attributes-manage","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Hidden actions may include destructive/configuration operations."}},{"description":"","name":"browse"},{"description":"","name":"docs-search"},{"description":"","name":"merchandise-rules-manage","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Hidden actions may include destructive/configuration operations."}},{"description":"","name":"product-families"},{"description":"","name":"product-sequences"},{"description":"","name":"query_catalog"},{"description":"","name":"request-transforms-manage","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: Material live production configuration changes are High."}},{"description":"","name":"search-autocomplete"},{"description":"","name":"search-semantic"},{"description":"","name":"store-details"},{"description":"","name":"store-list"},{"description":"","name":"store-operational-status"},{"description":"","name":"store-search-configuration"},{"description":"","name":"variant-breakouts"}],"tools_count":15,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/5402a27d-f274-4a98-a2d1-20a165e5f543","uuid":"336a32f6-72c1-5edf-8249-401122a971cc","verification_tier":"community","version":""},"query_key":"layers","schema_version":1,"status":"match"}