{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-05","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Mekago connects drivers with garages in France. Find services and availability, identify vehicles, and book or change appointments. Customer, garage-staff, and fleet-management actions follow the connected role.","did":"3f05007c-36df-4e48-9fdf-b26e17d0d807","documentation_url":"https://www.mekago.fr/docs/mcp","editorial_description":{"extended_description":"Sign-in uses email and a one-time code. Customers manage their vehicles and bookings; staff manage opening hours, mechanics, services, and incoming reservations, while fleet managers handle vehicles and intervention authorizations.","schema_version":1,"summary":"Mekago connects drivers with garages in France.\nFind services and availability, identify vehicles, and book or change appointments.\nCustomer, garage-staff, and fleet-management actions follow the connected role."},"homepage_url":"","icon":"","id":"3f05007c-36df-4e48-9fdf-b26e17d0d807","installs":0,"last_scanned":"","license":"","long_description":"Sign-in uses email and a one-time code. Customers manage their vehicles and bookings; staff manage opening hours, mechanics, services, and incoming reservations, while fleet managers handle vehicles and intervention authorizations.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The packet reports 116 tools but only stores the first 80 names, explicitly marking candidate_tools_truncated=true.","reasoning":"Thirty-six unreviewable tools may add destructive, financial, messaging or administrative actions beyond the already broad surface.","risk_type":"identity_discrepancy","severity":"high","title":"Stored tool inventory is truncated","triggering_tools_or_skills":["read-resource"]},{"evidence":"The visible inventory includes credential issuance/revocation, admin assignment, account deactivation and impersonation-link creation.","reasoning":"These are security-sensitive credential and administrative actions.","risk_type":"credential_admin","severity":"high","title":"Manages API keys, admins, users and impersonation links","triggering_tools_or_skills":["api-key-create","api-key-revoke","user-create","user-deactivate","user-set-admin","impersonation-link-create"]},{"evidence":"Numerous visible operations explicitly cancel, delete, clear or remove account and operational records.","reasoning":"These changes can disrupt real garage appointments, fleet authorization and integrations.","risk_type":"data_deletion","severity":"high","title":"Cancels or removes vehicles, reservations, integrations and organization data","triggering_tools_or_skills":["customer-reservation-cancel","customer-vehicle-delete","fleet-offering-authorization-cancel","fleet-vehicle-remove","garage-closing-period-remove","garage-make-remove","garage-mechanic-remove","garage-offering-remove","integration-webhook-delete","make-delete","mechanic-hours-clear","mechanic-time-off-remove","model-delete","network-garage-remove","reservation-cancel"]},{"evidence":"The explicit notification tool contacts a customer about a real reservation.","reasoning":"It communicates externally under the garage's identity.","risk_type":"messaging_as_user","severity":"high","title":"Sends vehicle-ready notifications","triggering_tools_or_skills":["garage-reservation-notify-vehicle-ready"]},{"evidence":"The connector exposes IVR provisioning and call-routing/speech updates.","reasoning":"These operations deploy or reconfigure production telephony infrastructure.","risk_type":"deployment_infrastructure","severity":"high","title":"Provisions and changes garage IVR infrastructure","triggering_tools_or_skills":["garage-ivr-provision","garage-ivr-speech-update","garage-ivr-transfers-set","garage-ivr-update"]}],"assessment_status":"provisional","auth_and_scopes":"Email/OTP authentication can create a new account; permissions vary across customer, garage staff, fleet manager and administrative roles.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/3f05007c-36df-4e48-9fdf-b26e17d0d807.json","what_it_proves":"Candidate PR #125 record identity (name \"Mekago\", publisher, type web_connector) and 80 stored tool names (truncated vs Directory); no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/3f05007c-36df-4e48-9fdf-b26e17d0d807: complete tool_names inventory (116 tools), remote streamable-http endpoint https://www.mekago.fr/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Mekago combines real reservation operations, credentials, admin roles, notifications and telephony with a 36-tool catalog truncation.","provisional_risk":null,"publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:3f05007c-36df-4e48-9fdf-b26e17d0d807","reviewed_at":"2026-10-10","reviewer_notes":"Capture all 116 names and schemas, split high-impact confirmations by role, and re-review the omitted 36 tools before publication.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"true","deletes_data":"true","deployment_or_infrastructure":"true","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"unknown"},"tools_or_skills_reviewed":116,"tools_or_skills_total":116},"name":"Mekago","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=3f05007c-36df-4e48-9fdf-b26e17d0d807&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.mekago.fr/privacy","provisional_risk":null,"publication_recommendation":"fix","publisher":"Mekago","publisher_url":"https://www.mekago.fr/","remote_url":"https://www.mekago.fr/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are security-sensitive credential and administrative actions.","evidence":"Manages API keys, admins, users and impersonation links: The visible inventory includes credential issuance/revocation, admin assignment, account deactivation and impersonation-link creation.","manual_risk_type":"credential_admin","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"high","title":"Manages API keys, admins, users and impersonation links","triggering_tools":["api-key-create","api-key-revoke","user-create","user-deactivate","user-set-admin","impersonation-link-create"]},{"description":"This connector can permanently remove data or resources. Review findings: These changes can disrupt real garage appointments, fleet authorization and integrations.","evidence":"Cancels or removes vehicles, reservations, integrations and organization data: Numerous visible operations explicitly cancel, delete, clear or remove account and operational records.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Cancels or removes vehicles, reservations, integrations and organization data","triggering_tools":["customer-reservation-cancel","customer-vehicle-delete","fleet-offering-authorization-cancel","fleet-vehicle-remove","garage-closing-period-remove","garage-make-remove","garage-mechanic-remove","garage-offering-remove","integration-webhook-delete","make-delete","mechanic-hours-clear","mechanic-time-off-remove","model-delete","network-garage-remove","reservation-cancel"]},{"description":"This connector can publish or send messages and content using the connected identity. Review findings: It communicates externally under the garage's identity.","evidence":"Sends vehicle-ready notifications: The explicit notification tool contacts a customer about a real reservation.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Sends vehicle-ready notifications","triggering_tools":["garage-reservation-notify-vehicle-ready"]},{"description":"This connector can deploy code or change infrastructure and production environments. Review findings: These operations deploy or reconfigure production telephony infrastructure.","evidence":"Provisions and changes garage IVR infrastructure: The connector exposes IVR provisioning and call-routing/speech updates.","manual_risk_type":"deployment_infrastructure","remediation":{"block_tool_categories":["code_execution","state_change"],"steps":["Default to a sandbox or staging environment.","Require code review, human approval, audit logging, and a tested rollback path for production changes."]},"risk_type":"code_deployment","severity":"high","title":"Provisions and changes garage IVR infrastructure","triggering_tools":["garage-ivr-provision","garage-ivr-speech-update","garage-ivr-transfers-set","garage-ivr-update"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://mekago.zohodesk.eu/portal/fr/newticket","tags":["accesses_calendar","code_deployment","deletes_data","modifies_data","network_access","oauth_required","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"api-key-create","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are security-sensitive credential and administrative actions."}},{"description":"","name":"api-key-list"},{"description":"","name":"api-key-revoke","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are security-sensitive credential and administrative actions."}},{"description":"","name":"customer-notification-preferences-get"},{"description":"","name":"customer-notification-preferences-update"},{"description":"","name":"customer-profile-get"},{"description":"","name":"customer-profile-update"},{"description":"","name":"customer-reservation-cancel","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These changes can disrupt real garage appointments, fleet authorization and integrations."}},{"description":"","name":"customer-reservation-create"},{"description":"","name":"customer-reservation-get"},{"description":"","name":"customer-reservation-reschedule"},{"description":"","name":"customer-reservations-list"},{"description":"","name":"customer-vehicle-add"},{"description":"","name":"customer-vehicle-delete","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These changes can disrupt real garage appointments, fleet authorization and integrations."}},{"description":"","name":"customer-vehicle-get"},{"description":"","name":"customer-vehicle-update"},{"description":"","name":"customer-vehicles-list"},{"description":"","name":"customers-search"},{"description":"","name":"fleet-create"},{"description":"","name":"fleet-get"},{"description":"","name":"fleet-list"},{"description":"","name":"fleet-offering-authorization-cancel","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These changes can disrupt real garage appointments, fleet authorization and integrations."}},{"description":"","name":"fleet-offering-authorization-create"},{"description":"","name":"fleet-offering-authorization-list"},{"description":"","name":"fleet-update"},{"description":"","name":"fleet-vehicle-add"},{"description":"","name":"fleet-vehicle-remove","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These changes can disrupt real garage appointments, fleet authorization and integrations."}},{"description":"","name":"fleet-vehicles-list"},{"description":"","name":"garage-activate"},{"description":"","name":"garage-address-update"},{"description":"","name":"garage-availability-get"},{"description":"","name":"garage-booking-preferences-update"},{"description":"","name":"garage-calendar-events-list"},{"description":"","name":"garage-closing-period-add"},{"description":"","name":"garage-closing-period-remove","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These changes can disrupt real garage appointments, fleet authorization and integrations."}},{"description":"","name":"garage-closing-periods-list"},{"description":"","name":"garage-create"},{"description":"","name":"garage-deactivate"},{"description":"","name":"garage-drop-off-hours-update"},{"description":"","name":"garage-feature-set"},{"description":"","name":"garage-get"},{"description":"","name":"garage-hours-update"},{"description":"","name":"garage-info-get"},{"description":"","name":"garage-ivr-provision","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: These operations deploy or reconfigure production telephony infrastructure."}},{"description":"","name":"garage-ivr-speech-update","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: These operations deploy or reconfigure production telephony infrastructure."}},{"description":"","name":"garage-ivr-transfers-set","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: These operations deploy or reconfigure production telephony infrastructure."}},{"description":"","name":"garage-ivr-update","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: These operations deploy or reconfigure production telephony infrastructure."}},{"description":"","name":"garage-make-add"},{"description":"","name":"garage-make-remove","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These changes can disrupt real garage appointments, fleet authorization and integrations."}},{"description":"","name":"garage-make-set-certified"},{"description":"","name":"garage-mechanic-add"},{"description":"","name":"garage-mechanic-remove","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These changes can disrupt real garage appointments, fleet authorization and integrations."}},{"description":"","name":"garage-mechanic-specializations-update"},{"description":"","name":"garage-mechanic-update"},{"description":"","name":"garage-mechanics-list"},{"description":"","name":"garage-mechanics-sync"},{"description":"","name":"garage-notification-preferences-update"},{"description":"","name":"garage-offering-add"},{"description":"","name":"garage-offering-make-restrictions-set"},{"description":"","name":"garage-offering-remove","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These changes can disrupt real garage appointments, fleet authorization and integrations."}},{"description":"","name":"garage-offering-update"},{"description":"","name":"garage-offerings-list"},{"description":"","name":"garage-owner-set"},{"description":"","name":"garage-reservation-assign-mechanic"},{"description":"","name":"garage-reservation-create"},{"description":"","name":"garage-reservation-notify-vehicle-ready","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: It communicates externally under the garage's identity."}},{"description":"","name":"garage-reservation-update"},{"description":"","name":"garage-reservation-update-comment"},{"description":"","name":"garage-reservation-update-status"},{"description":"","name":"garage-reservations-list"},{"description":"","name":"garage-search"},{"description":"","name":"garage-supported-energy-toggle"},{"description":"","name":"garage-supported-type-toggle"},{"description":"","name":"garage-update"},{"description":"","name":"garages-list"},{"description":"","name":"impersonation-link-create","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are security-sensitive credential and administrative actions."}},{"description":"","name":"integration-webhook-delete","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These changes can disrupt real garage appointments, fleet authorization and integrations."}},{"description":"","name":"integration-webhook-list"},{"description":"","name":"integration-webhook-register"},{"description":"","name":"make-create"},{"description":"","name":"make-delete","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These changes can disrupt real garage appointments, fleet authorization and integrations."}},{"description":"","name":"make-get"},{"description":"","name":"make-update"},{"description":"","name":"makes-list"},{"description":"","name":"mechanic-garages-list"},{"description":"","name":"mechanic-hours-clear","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These changes can disrupt real garage appointments, fleet authorization and integrations."}},{"description":"","name":"mechanic-hours-list"},{"description":"","name":"mechanic-hours-set"},{"description":"","name":"mechanic-reception-toggle"},{"description":"","name":"mechanic-specialization-add"},{"description":"","name":"mechanic-time-off-add"},{"description":"","name":"mechanic-time-off-remove","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These changes can disrupt real garage appointments, fleet authorization and integrations."}},{"description":"","name":"model-create"},{"description":"","name":"model-delete","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These changes can disrupt real garage appointments, fleet authorization and integrations."}},{"description":"","name":"model-get"},{"description":"","name":"model-update"},{"description":"","name":"models-list"},{"description":"","name":"network-create"},{"description":"","name":"network-garage-add"},{"description":"","name":"network-garage-remove","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These changes can disrupt real garage appointments, fleet authorization and integrations."}},{"description":"","name":"network-garages-list"},{"description":"","name":"network-list"},{"description":"","name":"network-update"},{"description":"","name":"offering-categories-list"},{"description":"","name":"offering-category-get"},{"description":"","name":"offering-get"},{"description":"","name":"offerings-list"},{"description":"","name":"read-resource"},{"description":"","name":"reservation-cancel","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These changes can disrupt real garage appointments, fleet authorization and integrations."}},{"description":"","name":"user-create","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are security-sensitive credential and administrative actions."}},{"description":"","name":"user-deactivate","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are security-sensitive credential and administrative actions."}},{"description":"","name":"user-set-admin","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are security-sensitive credential and administrative actions."}},{"description":"","name":"user-set-beta"},{"description":"","name":"user-update"},{"description":"","name":"users-list"},{"description":"","name":"vehicle-lookup-by-plate"}],"tools_count":116,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/3f05007c-36df-4e48-9fdf-b26e17d0d807","uuid":"7656cdee-1651-5d5b-8449-9d2c8e100c0d","verification_tier":"community","version":""},"query_key":"mekago mekago","schema_version":1,"status":"match"}