{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-06-16","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Plans and manages paid media placements through Medialister. Search outlets, organize campaigns and prepare content or cart selections. Review orders and approve placements within the connected organization.","did":"b8e73c71-72c8-483b-820f-2beda7cd592d","documentation_url":"https://roadmap.medialister.com/docs/other/client-mcp-server","editorial_description":{"extended_description":"Tools manage projects, bookmarks and campaign text, inspect balances and order activity, and send orders for review. Campaigns or text can be deleted, and work can switch between organizations or projects.","schema_version":1,"summary":"Plans and manages paid media placements through Medialister.\nSearch outlets, organize campaigns and prepare content or cart selections.\nReview orders and approve placements within the connected organization."},"homepage_url":"","icon":"","id":"b8e73c71-72c8-483b-820f-2beda7cd592d","installs":0,"last_scanned":"","license":"","long_description":"Tools manage projects, bookmarks and campaign text, inspect balances and order activity, and send orders for review. Campaigns or text can be deleted, and work can switch between organizations or projects.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The inventory includes a cart and approve_order_placement; the listing describes executing a paid media strategy and exposes balances, costs, orders and extras.","reasoning":"Approving placement can commit media spend or paid credits, which is a High financial action.","risk_type":"financial_transaction","severity":"high","title":"Approves paid media orders","triggering_tools_or_skills":["approve_order_placement","add_to_cart","remove_from_cart"]},{"evidence":"The connector explicitly declares campaign and text deletion tools.","reasoning":"These actions can permanently remove meaningful campaign work.","risk_type":"data_deletion","severity":"high","title":"Deletes campaign and text assets","triggering_tools_or_skills":["delete_campaign","delete_text"]},{"evidence":"Named tools create campaigns/projects/text, link orders and update campaign organization.","reasoning":"They materially change the authenticated media-planning workspace.","risk_type":"data_modification","severity":"medium","title":"Creates and restructures campaign projects","triggering_tools_or_skills":["create_campaign","create_project","create_text","link_text_to_orders","move_order_to_campaign","update_campaign"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication is required; financial approval roles, spend ceilings and recipient/confirmation semantics are not provided.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/b8e73c71-72c8-483b-820f-2beda7cd592d.json","what_it_proves":"Candidate PR #125 record identity (name \"Medialister\", publisher, type web_connector) and 44 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/b8e73c71-72c8-483b-820f-2beda7cd592d: complete tool_names inventory (44 tools), remote streamable-http endpoint https://api.medialister.com/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Medialister can approve paid media placement and delete campaign assets.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:b8e73c71-72c8-483b-820f-2beda7cd592d","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 44 tools. Runtime testing should establish exactly when approve_order_placement becomes chargeable and whether send_order_to_review communicates externally.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"unknown","spends_or_moves_money":"true"},"tools_or_skills_reviewed":44,"tools_or_skills_total":44},"name":"Medialister","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=b8e73c71-72c8-483b-820f-2beda7cd592d&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://medialister.com/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Medialister Inc.","publisher_url":"https://medialister.com/","remote_url":"https://api.medialister.com/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Approving placement can commit media spend or paid credits, which is a High financial action.","evidence":"Approves paid media orders: The inventory includes a cart and approve_order_placement; the listing describes executing a paid media strategy and exposes balances, costs, orders and extras.","manual_risk_type":"financial_transaction","remediation":{"block_tool_categories":["financial"],"steps":["Set provider-side spending limits and require approval for every financial action.","Use a dedicated low-balance account and review transaction logs."]},"risk_type":"spends_money","severity":"high","title":"Approves paid media orders","triggering_tools":["approve_order_placement","add_to_cart","remove_from_cart"]},{"description":"This connector can permanently remove data or resources. Review findings: These actions can permanently remove meaningful campaign work.","evidence":"Deletes campaign and text assets: The connector explicitly declares campaign and text deletion tools.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Deletes campaign and text assets","triggering_tools":["delete_campaign","delete_text"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change the authenticated media-planning workspace.","evidence":"Creates and restructures campaign projects: Named tools create campaigns/projects/text, link orders and update campaign organization.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Creates and restructures campaign projects","triggering_tools":["create_campaign","create_project","create_text","link_text_to_orders","move_order_to_campaign","update_campaign"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"feedback@medialister.com","tags":["accesses_messaging","deletes_data","modifies_data","network_access","oauth_required","spends_money","web_connector"],"tools":[{"description":"","name":"add_to_bookmark_group"},{"description":"","name":"add_to_cart","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Approving placement can commit media spend or paid credits, which is a High financial action."}},{"description":"","name":"approve_order_placement","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Approving placement can commit media spend or paid credits, which is a High financial action."}},{"description":"","name":"create_bookmark_group"},{"description":"","name":"create_campaign","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change the authenticated media-planning workspace."}},{"description":"","name":"create_project","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change the authenticated media-planning workspace."}},{"description":"","name":"create_text","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change the authenticated media-planning workspace."}},{"description":"","name":"delete_campaign","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions can permanently remove meaningful campaign work."}},{"description":"","name":"delete_text","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions can permanently remove meaningful campaign work."}},{"description":"","name":"get_balance"},{"description":"","name":"get_bookmark_groups"},{"description":"","name":"get_bookmarks"},{"description":"","name":"get_campaign"},{"description":"","name":"get_cart"},{"description":"","name":"get_order"},{"description":"","name":"get_order_activities"},{"description":"","name":"get_order_chat"},{"description":"","name":"get_organization"},{"description":"","name":"get_project"},{"description":"","name":"get_project_activities"},{"description":"","name":"get_text"},{"description":"","name":"health_check"},{"description":"","name":"link_text_to_orders","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change the authenticated media-planning workspace."}},{"description":"","name":"list_campaign_texts"},{"description":"","name":"list_campaigns"},{"description":"","name":"list_order_extras"},{"description":"","name":"list_orders"},{"description":"","name":"list_organizations"},{"description":"","name":"list_projects"},{"description":"","name":"locations"},{"description":"","name":"marketplace_search"},{"description":"","name":"move_order_to_campaign","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change the authenticated media-planning workspace."}},{"description":"","name":"ping"},{"description":"","name":"public_bookmark_groups"},{"description":"","name":"public_saved_views"},{"description":"","name":"remove_from_cart","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Approving placement can commit media spend or paid credits, which is a High financial action."}},{"description":"","name":"semantic_search"},{"description":"","name":"send_order_to_review"},{"description":"","name":"set_cart_item_excluded"},{"description":"","name":"show_all_orders"},{"description":"","name":"switch_campaign"},{"description":"","name":"switch_organization"},{"description":"","name":"switch_project"},{"description":"","name":"update_campaign","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change the authenticated media-planning workspace."}}],"tools_count":44,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/b8e73c71-72c8-483b-820f-2beda7cd592d","uuid":"173da5cb-672e-552c-a699-fca1f71cbda1","verification_tier":"community","version":""},"query_key":"medialister inc medialister","schema_version":1,"status":"match"}