{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-06-26","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"no_auth","catalog_reconciliation":{"basis":"Documented actions on the identified catalog surface; not an execution test.","confidence":"medium","evidence_completeness":"partial","previous":{"confidence":"low","detail_sha256":"57fe5848106a046aadf0553be58ea68f9413d1a3435c2a9bfb7b59ad2c81bf69","risk":"high"},"proposal_file":"claude-tail-proposals.json","rationale":"Prior High rests on 'Initiates a mortgage-expert callback request' typed sends_messages_as_you, confidence low. Meilleurtaux's AI-app CGU now documents the flow: the user enters email, phone and a preferred callback slot, and entering a phone number consents to a call from a Meilleurtaux advisor. That is a lead submission to the connector's own publisher, not a message sent as the user to other people, and nothing is published, purchased or deleted. It does forward personal financial data (income, existing loans, age, property, down payment) plus contact details and creates a persistent lead that triggers a sales call, which fits Medium's 'bounded forwarding'. Revision from my Low first pass: on rereading the rubric, a persistent lead with personal financial data is forwarding, not a purely informational operation. The low-confidence uncertainty is resolved on what the tool does, but not on who triggers submission.","review_key":"claudesec:bb1c855a-72e5-44f5-9a79-1b91a7e3f822","reviewed_at":"2026-10-12","runtime_verified":false,"sources":["https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community","https://www.meilleurtaux.com/a-propos-de-meilleurtaux/mentions-legales/conditions-generales-utilisation-application-ia.html","https://www.meilleurtaux.com/a-propos-de-meilleurtaux/politique-donnee.html","https://www.meilleurtaux.com/"],"status":"resolved"},"category":"Interactive Connector","confidence":"low","description":"Estimates mortgage borrowing capacity with Meilleurtaux. Explore whether a property project is feasible using market-rate assumptions. Open a callback form to request help from a credit expert.","did":"bb1c855a-72e5-44f5-9a79-1b91a7e3f822","documentation_url":"https://www.meilleurtaux.com/","editorial_description":{"extended_description":"The connector requires no authentication. Estimates support planning and do not constitute loan approval.","schema_version":1,"summary":"Estimates mortgage borrowing capacity with Meilleurtaux.\nExplore whether a property project is feasible using market-rate assumptions.\nOpen a callback form to request help from a credit expert."},"homepage_url":"","icon":"","id":"bb1c855a-72e5-44f5-9a79-1b91a7e3f822","installs":0,"last_scanned":"","license":"","long_description":"The connector requires no authentication. Estimates support planning and do not constitute loan approval.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The Directory description says the connector supports being contacted by a credit expert, and show_callback_form is the declared interactive tool.","reasoning":"Submitting the form communicates a request and personal contact data to an external human as the user; the exact submit boundary is not documented.","risk_type":"messaging_as_user","severity":"high","title":"Initiates a mortgage-expert callback request","triggering_tools_or_skills":["show_callback_form"]},{"evidence":"The two show_* tools and listing text describe mortgage capacity and feasibility estimates based on market rates.","reasoning":"These calculations do not themselves book a loan or move money.","risk_type":"public_data_read","severity":"low","title":"Calculates borrowing and feasibility scenarios","triggering_tools_or_skills":["show_borrowing_capacity","show_feasibility_study"]}],"assessment_status":"provisional","auth_and_scopes":"No account authentication is declared; the public interactive app accepts mortgage scenario inputs and can expose a callback-request form.","blocked_missing_evidence":null,"confidence":"low","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/bb1c855a-72e5-44f5-9a79-1b91a7e3f822.json","what_it_proves":"Candidate PR #125 record identity (name \"Meilleurtaux\", publisher, type interactive_connector) and 3 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/bb1c855a-72e5-44f5-9a79-1b91a7e3f822: complete tool_names inventory (3 tools), remote streamable-http endpoint https://mcp.meilleurtaux.com/credit-immobilier/mcp, auth_posture no_auth, directory tier community"},{"accessed_at":"2026-10-10T20:56:14Z","url_or_path":"https://www.meilleurtaux.com/","what_it_proves":"Official publisher site establishes Meilleurtaux as a mortgage simulation and broker service."}],"primary_reason":"The connector's stated callback flow can submit contact details so a credit expert contacts the user.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:bb1c855a-72e5-44f5-9a79-1b91a7e3f822","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 3 names and the official corporate homepage. show_callback_form is ambiguous at the tool-name level, but the Directory description explicitly promises being contacted by an expert; runtime inspection must confirm whether submission is a separate app event and capture consent fields.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"false","persistent_credentials":"false","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"false","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":3,"tools_or_skills_total":3},"name":"Meilleurtaux","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=bb1c855a-72e5-44f5-9a79-1b91a7e3f822&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.meilleurtaux.com/a-propos-de-meilleurtaux/politique-donnee.html","provisional_risk":null,"publication_recommendation":"accept","publisher":"Manufact, Inc","publisher_url":"https://manufact.com/","remote_url":"https://mcp.meilleurtaux.com/credit-immobilier/mcp","repository_url":"","risk":"medium","risk_severity":"medium","security_risks":[{"description":"Submitting the callback form sends personal contact information and mortgage-related financial details to Meilleurtaux and creates a request for an adviser to call.","evidence":"Actions: show_callback_form. https://www.meilleurtaux.com/a-propos-de-meilleurtaux/mentions-legales/conditions-generales-utilisation-application-ia.html — data collected: revenus, charges, age, email, phone, callback slot; phone entry = consent to be called; https://www.meilleurtaux.com/a-propos-de-meilleurtaux/politique-donnee.html — data may go to partner banks/brokers","risk_type":"forwards_data_to_third_party","severity":"medium","title":"Sends contact and financial details for a callback"}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://www.meilleurtaux.com/a-propos-de-meilleurtaux/contactez-nous.html","tags":["forwards_data_to_third_party"],"tools":[{"description":"","name":"show_borrowing_capacity"},{"description":"","name":"show_callback_form","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Submitting the form communicates a request and personal contact data to an external human as the user; the exact submit boundary is not documented."}},{"description":"","name":"show_feasibility_study"}],"tools_count":3,"transport":"streamable-http","type":"interactive_connector","url":"https://claude.ai/directory/bb1c855a-72e5-44f5-9a79-1b91a7e3f822","uuid":"26027f00-a643-516d-8178-b02c95d7e1df","verification_tier":"community","version":""},"query_key":"manufact inc meilleurtaux","schema_version":1,"status":"match"}