{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-31","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Connects Claude to GoCodes asset and inventory records. Find assets, inspect history or location, and review maintenance or checkout status. Update assets, restore records, and create, assign or maintain related tasks.","did":"b8ae291b-5a8a-44c9-bd75-5da8c1e84b32","documentation_url":"https://github.com/GoCodesAssetManagement/gocodes-mcp-server#1-request-beta-access","editorial_description":{"extended_description":"Tools inspect kits, attachments, asset pictures, customers and custom-field schemas. Lists of overdue assets, maintenance due and upcoming events help with operational follow-up.","schema_version":1,"summary":"Connects Claude to GoCodes asset and inventory records.\nFind assets, inspect history or location, and review maintenance or checkout status.\nUpdate assets, restore records, and create, assign or maintain related tasks."},"homepage_url":"","icon":"","id":"b8ae291b-5a8a-44c9-bd75-5da8c1e84b32","installs":0,"last_scanned":"","license":"","long_description":"Tools inspect kits, attachments, asset pictures, customers and custom-field schemas. Lists of overdue assets, maintenance due and upcoming events help with operational follow-up.","manual_assessment":"medium","manual_review":{"all_findings":[{"evidence":"The inventory declares task creation/assignment/updates, asset updates and asset restoration.","reasoning":"These tools modify meaningful asset-inventory and maintenance workflow records, but no delete or external-send action is listed.","risk_type":"data_modification","severity":"medium","title":"Creates tasks and changes assets","triggering_tools_or_skills":["assign_task","create_task","restore_assets","update_asset","update_task","update_task_status"]},{"evidence":"Named tools retrieve customer inventory, assignment history, locations, pictures and checked-out assets.","reasoning":"Asset and location records are private organizational data.","risk_type":"private_data_read","severity":"low","title":"Reads asset inventory and location history","triggering_tools_or_skills":["get_asset_assignment_history","get_asset_location","get_asset_picture","list_checked_out_assets","summarize_customer_inventory"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication is required for a GoCodes account; the linked beta-access page does not provide packet-level role or scope details.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"medium","evidence_completeness":"partial","manual_overall_risk":"medium","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/b8ae291b-5a8a-44c9-bd75-5da8c1e84b32.json","what_it_proves":"Candidate PR #125 record identity (name \"mcp.gocodes.com\", publisher, type web_connector) and 31 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/b8ae291b-5a8a-44c9-bd75-5da8c1e84b32: complete tool_names inventory (31 tools), remote streamable-http endpoint https://mcp.gocodes.com/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"GoCodes can create/assign tasks and update or restore asset records.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:b8ae291b-5a8a-44c9-bd75-5da8c1e84b32","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 31 tools. restore_assets appears restorative rather than destructive; no delete tool is declared. Runtime verification should confirm tenant boundaries and whether asset restoration has broader side effects.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":31,"tools_or_skills_total":31},"name":"mcp.gocodes.com","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=b8ae291b-5a8a-44c9-bd75-5da8c1e84b32&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://gocodes.com/privacy-policy/","provisional_risk":null,"publication_recommendation":"accept","publisher":"GoCodes, Inc.","publisher_url":"https://gocodes.com/","remote_url":"https://mcp.gocodes.com/mcp","repository_url":"","risk":"medium","risk_severity":"medium","security_risks":[{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These tools modify meaningful asset-inventory and maintenance workflow records, but no delete or external-send action is listed.","evidence":"Creates tasks and changes assets: The inventory declares task creation/assignment/updates, asset updates and asset restoration.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Creates tasks and changes assets","triggering_tools":["assign_task","create_task","restore_assets","update_asset","update_task","update_task_status"]},{"description":"This connector can read information available to the connected account and return it to the AI. Review findings: Asset and location records are private organizational data.","evidence":"Reads asset inventory and location history: Named tools retrieve customer inventory, assignment history, locations, pictures and checked-out assets.","manual_risk_type":"private_data_read","remediation":{"block_tool_categories":["data_exfiltration"],"steps":["Use a least-privilege account limited to the information required by the workflow.","Restrict folders, projects, tenants, and other data scopes wherever the provider allows it.","Review access logs for unexpected reads or bulk retrieval."]},"risk_type":"reads_private_data","severity":"low","title":"Reads asset inventory and location history","triggering_tools":["get_asset_assignment_history","get_asset_location","get_asset_picture","list_checked_out_assets","summarize_customer_inventory"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@gocodes.com","tags":["accesses_calendar","modifies_data","network_access","oauth_required","reads_private_data","web_connector"],"tools":[{"description":"","name":"assign_task","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These tools modify meaningful asset-inventory and maintenance workflow records, but no delete or external-send action is listed."}},{"description":"","name":"create_task","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These tools modify meaningful asset-inventory and maintenance workflow records, but no delete or external-send action is listed."}},{"description":"","name":"get_asset_assignment_history"},{"description":"","name":"get_asset_details"},{"description":"","name":"get_asset_history"},{"description":"","name":"get_asset_location"},{"description":"","name":"get_asset_picture"},{"description":"","name":"get_assets_batch"},{"description":"","name":"get_custom_field_schema"},{"description":"","name":"get_kit_contents"},{"description":"","name":"get_task_details"},{"description":"","name":"get_tasks_for_asset"},{"description":"","name":"list_asset_attachments"},{"description":"","name":"list_asset_types"},{"description":"","name":"list_assets_by_location"},{"description":"","name":"list_checked_out_assets"},{"description":"","name":"list_customers"},{"description":"","name":"list_kits"},{"description":"","name":"list_maintenance_due"},{"description":"","name":"list_my_tasks"},{"description":"","name":"list_overdue_assets"},{"description":"","name":"list_task_attachments"},{"description":"","name":"list_task_statuses"},{"description":"","name":"list_tasks"},{"description":"","name":"list_upcoming_events"},{"description":"","name":"restore_assets","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These tools modify meaningful asset-inventory and maintenance workflow records, but no delete or external-send action is listed."}},{"description":"","name":"search_assets"},{"description":"","name":"summarize_customer_inventory"},{"description":"","name":"update_asset","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These tools modify meaningful asset-inventory and maintenance workflow records, but no delete or external-send action is listed."}},{"description":"","name":"update_task","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These tools modify meaningful asset-inventory and maintenance workflow records, but no delete or external-send action is listed."}},{"description":"","name":"update_task_status","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These tools modify meaningful asset-inventory and maintenance workflow records, but no delete or external-send action is listed."}}],"tools_count":31,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/b8ae291b-5a8a-44c9-bd75-5da8c1e84b32","uuid":"a2f4ad6e-46f9-52ed-9b15-ab68bc50b3e6","verification_tier":"community","version":""},"query_key":"mcp gocodes com","schema_version":1,"status":"match"}