{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-24","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Vibsync carries team memory and current work context between coding sessions. Store decisions, track tasks and ownership, and coordinate questions or claims. It neither runs inference nor launches or controls agents; Git remains the code source of truth.","did":"43171506-edde-412d-b6fe-bdb58a21e784","documentation_url":"https://vibsync.com/","editorial_description":{"extended_description":"Tools recall memories, check conflicts, claim or release work, manage tasks, and exchange thread replies.","schema_version":1,"summary":"Vibsync carries team memory and current work context between coding sessions.\nStore decisions, track tasks and ownership, and coordinate questions or claims.\nIt neither runs inference nor launches or controls agents; Git remains the code source of truth."},"homepage_url":"","icon":"https://vibsync.com/logo.png","id":"43171506-edde-412d-b6fe-bdb58a21e784","installs":0,"last_scanned":"","license":"","long_description":"Tools recall memories, check conflicts, claim or release work, manage tasks, and exchange thread replies.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The complete inventory includes an explicit forget operation over the service's long-term team memory.","reasoning":"It can remove durable shared context relied upon across sessions and agents.","risk_type":"data_deletion","severity":"high","title":"Forgets shared long-term team memory","triggering_tools_or_skills":["forget"]},{"evidence":"The connector exposes inbox, threads and a reply operation for live team work context.","reasoning":"Reply posts a message visible to other team members or agents under the user's collaboration context.","risk_type":"messaging_as_user","severity":"high","title":"Replies into shared team threads","triggering_tools_or_skills":["reply"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication exposes team memory, tasks, claims, threads and inbox context shared across agents and machines.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"complete","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/43171506-edde-412d-b6fe-bdb58a21e784.json","what_it_proves":"Candidate PR #125 record identity (name \"Vibsync\", publisher, type web_connector) and 20 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/43171506-edde-412d-b6fe-bdb58a21e784: complete tool_names inventory (20 tools), remote streamable-http endpoint https://mcp.vibsync.com/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Vibsync can delete shared memory and post replies to team work threads.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:43171506-edde-412d-b6fe-bdb58a21e784","reviewed_at":"2026-10-10","reviewer_notes":"Team memory and messages are untrusted cross-agent input; enforce workspace boundaries.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"true","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":20,"tools_or_skills_total":20},"name":"Vibsync","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=43171506-edde-412d-b6fe-bdb58a21e784&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://vibsync.com/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"LOOSEDAYS Co., Ltd.","publisher_url":"https://loosedays.jp/","remote_url":"https://mcp.vibsync.com/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can permanently remove data or resources. Review findings: It can remove durable shared context relied upon across sessions and agents.","evidence":"Forgets shared long-term team memory: The complete inventory includes an explicit forget operation over the service's long-term team memory.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Forgets shared long-term team memory","triggering_tools":["forget"]},{"description":"This connector can publish or send messages and content using the connected identity. Review findings: Reply posts a message visible to other team members or agents under the user's collaboration context.","evidence":"Replies into shared team threads: The connector exposes inbox, threads and a reply operation for live team work context.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Replies into shared team threads","triggering_tools":["reply"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://vibsync.com/","tags":["deletes_data","network_access","oauth_required","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"ask"},{"description":"","name":"check_conflicts"},{"description":"","name":"claim"},{"description":"","name":"claim_task"},{"description":"","name":"context"},{"description":"","name":"create_task"},{"description":"","name":"dedup"},{"description":"","name":"forget","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: It can remove durable shared context relied upon across sessions and agents."}},{"description":"","name":"inbox"},{"description":"","name":"list_tasks"},{"description":"","name":"list_threads"},{"description":"","name":"onboard"},{"description":"","name":"recall"},{"description":"","name":"release"},{"description":"","name":"remember"},{"description":"","name":"reply","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Reply posts a message visible to other team members or agents under the user's collaboration context."}},{"description":"","name":"resolve"},{"description":"","name":"sync"},{"description":"","name":"update_task"},{"description":"","name":"whoami"}],"tools_count":20,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/43171506-edde-412d-b6fe-bdb58a21e784","uuid":"77b96d57-49db-5476-a6f7-67e2c428a68e","verification_tier":"community","version":""},"query_key":"loosedays co ltd vibsync","schema_version":1,"status":"match"}