{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-29","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","catalog_reconciliation":{"basis":"Documented actions on the identified catalog surface; not an execution test.","confidence":"medium","evidence_completeness":"partial","previous":{"confidence":"low","detail_sha256":"99263a5a0e4f250c0cdf2e76b58f93e613af1c40257170cec952091084e0adeb","risk":"high"},"proposal_file":"parent-proposals.json","rationale":"Medium: authenticated organization-specific referral metrics and campaign configuration are private business data, even when aggregated and without individual PII.","review_key":"claudesec:c92f250d-723d-4865-b492-3dbf46b7f17a","reviewed_at":"2026-10-12","runtime_verified":false,"sources":["blind packet stored_tool_inventory","https://docs.mention-me.com/developer-docs/mcp/setup"],"status":"resolved"},"category":"Web Connector","confidence":"low","description":"Explore referral-program performance in Mention Me from Claude. Review referral volumes, conversion rates, trends and industry benchmarks. Requires an active Mention Me account.","did":"c92f250d-723d-4865-b492-3dbf46b7f17a","documentation_url":"https://docs.mention-me.com/developer-docs/mcp/setup","editorial_description":{"extended_description":"Campaign and metric tools provide individual values, time series and breakdowns by dimension across accessible organizations.","schema_version":1,"summary":"Explore referral-program performance in Mention Me from Claude.\nReview referral volumes, conversion rates, trends and industry benchmarks.\nRequires an active Mention Me account."},"homepage_url":"","icon":"","id":"c92f250d-723d-4865-b492-3dbf46b7f17a","installs":0,"last_scanned":"","license":"","long_description":"Campaign and metric tools provide individual values, time series and breakdowns by dimension across accessible organizations.","manual_assessment":"unassessed","manual_review":{"all_findings":[{"evidence":"Seven declared actions are fetch/list operations and the listing describes referral-volume and conversion reporting.","reasoning":"The visible inventory supports read-only access to private referral analytics.","risk_type":"private_data_read","severity":"low","title":"Referral campaigns and metrics can be read","triggering_tools_or_skills":["fetch_campaign","fetch_campaigns","fetch_metric","fetch_metric_by_dimension","fetch_metric_series","fetch_metric_series_by_dimension","list_organizations"]},{"evidence":"The complete Directory inventory includes get_more_tools, but neither its return schema nor the additional action names are available; the official documentation URL was inaccessible.","reasoning":"The verified issue is an evidence gap rather than a verified High action; dynamically exposing undisclosed actions prevents ruling out delete, send, spend, query or administrative capabilities, so a conservative provisional High ceiling is required.","risk_type":"generic_gateway","severity":"low","title":"Additional server-defined tools are hidden","triggering_tools_or_skills":["get_more_tools"]},{"evidence":"The connector runs at https://mcp.mention-me.com/ and no pinned server implementation was available in the review packet.","reasoning":"The hosted implementation and action semantics can change independently of this catalog snapshot, so runtime verification and change monitoring remain necessary.","risk_type":"provenance_uncertainty","severity":"low","title":"Mention Me is a mutable remote service","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"Authentication is required for Mention Me organization data, but scopes and the actions revealed by get_more_tools are not documented in accessible evidence.","blocked_missing_evidence":"An official complete MCP tools reference or authenticated tools/list capture showing every action returned/revealed by get_more_tools, with descriptions and input schemas.","confidence":"low","displayed_risk":"high","evidence_completeness":"insufficient","manual_overall_risk":"unassessed","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/c92f250d-723d-4865-b492-3dbf46b7f17a.json","what_it_proves":"Candidate PR #125 record identity (name \"Mention Me\", publisher, type web_connector) and 8 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/c92f250d-723d-4865-b492-3dbf46b7f17a: complete tool_names inventory (8 tools), remote streamable-http endpoint https://mcp.mention-me.com/, auth_posture auth_required, directory tier community"}],"primary_reason":"Visible referral reporting is read-only, but get_more_tools hides an unknown additional action set.","provisional_risk":"high","publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:c92f250d-723d-4865-b492-3dbf46b7f17a","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 8 declared names. The official MCP setup URL was inaccessible to the web tool. Do not present this connector as safe until the dynamically disclosed tool set is enumerated.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"unknown","deletes_data":"unknown","deployment_or_infrastructure":"unknown","dynamic_hidden_actions":"true","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"unknown","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"unknown","sends_messages_as_user":"unknown","spends_or_moves_money":"unknown"},"tools_or_skills_reviewed":8,"tools_or_skills_total":8},"name":"Mention Me","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=c92f250d-723d-4865-b492-3dbf46b7f17a&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://mention-me.com/help/privacy_policy_s","provisional_risk":"high","publication_recommendation":"fix","publisher":"Mention Me","publisher_url":"https://www.mention-me.com/","remote_url":"https://mcp.mention-me.com/","repository_url":"","risk":"medium","risk_severity":"medium","security_risks":[{"description":"Authenticated tools fetch referral metrics, campaign configuration and organization information from the customer’s Mention Me account. Aggregated customer-specific metrics are still private business data.","evidence":"https://docs.mention-me.com/developer-docs/mcp/setup\ntool list: six fetch/list tools","risk_type":"reads_private_data","severity":"medium","title":"Reads the organization’s referral analytics"}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@mention-me.com","tags":["reads_private_data"],"tools":[{"description":"","name":"fetch_campaign"},{"description":"","name":"fetch_campaigns"},{"description":"","name":"fetch_metric"},{"description":"","name":"fetch_metric_by_dimension"},{"description":"","name":"fetch_metric_series"},{"description":"","name":"fetch_metric_series_by_dimension"},{"description":"","name":"get_more_tools"},{"description":"","name":"list_organizations"}],"tools_count":8,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/c92f250d-723d-4865-b492-3dbf46b7f17a","uuid":"e699d2be-10c7-55e5-b132-081efa93446e","verification_tier":"community","version":""},"query_key":"mention me","schema_version":1,"status":"match"}