{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-20","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","catalog_reconciliation":{"basis":"Documented actions on the identified catalog surface; not an execution test.","confidence":"medium","evidence_completeness":"partial","previous":{"confidence":"low","detail_sha256":"5424ff8119db9331420449d0dddc5aa37934a756a93e3aee890de35c71ab4cd4","risk":"medium"},"proposal_file":"claude-tail-proposals.json","rationale":"Medium is right, but on a different basis than the only visible card. docs.logrocket.com/docs/mcp (now readable, resolving the earlier gap) describes build_metric as 'Queries LogRocket analytics data' and every tool in retrieval terms, so the 'Can build account metrics' modifies_data card is not supported. The real Medium basis is read access to private session replays, end-user sessions, issues and per-session network requests/responses (get_network_entries returns HAR), with OAuth granting the user's own org/project access. The stored inventory is also stale: it lacks get_network_entries.","review_key":"claudesec:208548e2-6412-4813-8364-9f21982ad62a","reviewed_at":"2026-10-12","runtime_verified":false,"sources":["https://docs.logrocket.com/docs/mcp","https://docs.logrocket.com/mcp","https://mcp.logrocket.com/.well-known/oauth-protected-resource","https://api.anthropic.com/api/directory/servers"],"status":"resolved"},"category":"Web Connector","confidence":"low","description":"Connects Claude to LogRocket session replays, product analytics and frontend issues. Find and watch user sessions, build metrics, and investigate errors or UX friction. Use the evidence to debug reports, understand feature usage and check regressions.","did":"208548e2-6412-4813-8364-9f21982ad62a","documentation_url":"https://docs.logrocket.com/mcp","editorial_description":{"extended_description":"Powered by Ask Galileo, the connector works across your accessible LogRocket organizations and projects. Session and issue searches help investigate behaviors such as rage clicks and trace the context around reported problems.","schema_version":1,"summary":"Connects Claude to LogRocket session replays, product analytics and frontend issues.\nFind and watch user sessions, build metrics, and investigate errors or UX friction.\nUse the evidence to debug reports, understand feature usage and check regressions."},"homepage_url":"","icon":"https://logrocket.com/images/rocket.svg","id":"208548e2-6412-4813-8364-9f21982ad62a","installs":0,"last_scanned":"","license":"","long_description":"Powered by Ask Galileo, the connector works across your accessible LogRocket organizations and projects. Session and issue searches help investigate behaviors such as rage clicks and trace the context around reported problems.","manual_assessment":"medium","manual_review":{"all_findings":[{"evidence":"The complete Directory inventory contains build_metric alongside organization, project, issue and session access; the product description says it can build metrics from LogRocket data.","reasoning":"Building a metric is treated conservatively as creation of a persistent analytics object until schemas prove it is only an ephemeral calculation.","risk_type":"data_modification","severity":"medium","title":"Can build account metrics","triggering_tools_or_skills":["build_metric"]}],"assessment_status":"provisional","auth_and_scopes":"OAuth/account authentication is required, but requested scopes and whether metric construction persists are unknown.","blocked_missing_evidence":null,"confidence":"low","displayed_risk":"medium","evidence_completeness":"partial","manual_overall_risk":"medium","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/208548e2-6412-4813-8364-9f21982ad62a.json","what_it_proves":"Candidate PR #125 record identity (name \"LogRocket\", publisher, type web_connector) and 7 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/208548e2-6412-4813-8364-9f21982ad62a: complete tool_names inventory (7 tools), remote streamable-http endpoint https://mcp.logrocket.com/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"The connector reads private replay and analytics data and may create a metric, with no declared High action.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:208548e2-6412-4813-8364-9f21982ad62a","reviewed_at":"2026-10-10","reviewer_notes":"The documentation URL https://docs.logrocket.com/mcp could not be fetched, so build_metric persistence and the ambiguous use_logrocket behavior remain unresolved; runtime schema verification is required. Identity is otherwise coherent.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"unknown","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":7,"tools_or_skills_total":7},"name":"LogRocket","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=208548e2-6412-4813-8364-9f21982ad62a&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://logrocket.com/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"LogRocket Inc","publisher_url":"https://logrocket.com/","remote_url":"https://mcp.logrocket.com/mcp","repository_url":"","risk":"medium","risk_severity":"medium","security_risks":[{"description":"Retrieves end-user sessions, replays, issues, analytics and session network requests and responses, including HAR data.","evidence":"Actions: find_sessions, watch_sessions, get_network_entries, find_issues, build_metric, use_logrocket. https://docs.logrocket.com/docs/mcp — Tools section: get_network_entries returns HAR; build_metric queries analytics data","risk_type":"reads_private_data","severity":"medium","title":"Reads session replays and network activity"}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://docs.logrocket.com/docs/mcp","tags":["reads_private_data"],"tools":[{"description":"","name":"build_metric","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Building a metric is treated conservatively as creation of a persistent analytics object until schemas prove it is only an ephemeral calculation."}},{"description":"","name":"find_issues"},{"description":"","name":"find_sessions"},{"description":"","name":"list_organizations"},{"description":"","name":"list_projects"},{"description":"","name":"use_logrocket"},{"description":"","name":"watch_sessions"}],"tools_count":7,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/208548e2-6412-4813-8364-9f21982ad62a","uuid":"10001f33-c754-5b81-8886-4e57f7315f70","verification_tier":"community","version":""},"query_key":"logrocket","schema_version":1,"status":"match"}