{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-31","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Investigate frontend test results in Meticulous. Review visual or DOM differences, recorded sessions and JavaScript coverage. Register builds and trigger tests to examine changes or coverage gaps.","did":"0d2fd422-2962-4304-9243-c40adfc09355","documentation_url":"https://app.meticulous.ai/docs/agents/mcp-server","editorial_description":{"extended_description":"The connector retrieves runs for commits, diff counts, images and replay coverage, and supports asset or container build registration and upload requests. Code changes and repository pushes in the source examples require capabilities beyond the listed Meticulous tools.","schema_version":1,"summary":"Investigate frontend test results in Meticulous.\nReview visual or DOM differences, recorded sessions and JavaScript coverage.\nRegister builds and trigger tests to examine changes or coverage gaps."},"homepage_url":"","icon":"","id":"0d2fd422-2962-4304-9243-c40adfc09355","installs":0,"last_scanned":"","license":"","long_description":"The connector retrieves runs for commits, diff counts, images and replay coverage, and supports asset or container build registration and upload requests. Code changes and repository pushes in the source examples require capabilities beyond the listed Meticulous tools.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The connector registers executable application or container builds and triggers automated tests against them.","reasoning":"Test execution runs supplied code in publisher infrastructure.","risk_type":"code_execution","severity":"high","title":"Uploaded builds can be executed in test runs","triggering_tools_or_skills":["register_asset_build","register_container_build","trigger_test_run"]},{"evidence":"Meticulous test runs replay browser sessions and compare DOM, images, coverage, and timelines.","reasoning":"Browser automation exercises application behavior and can touch authenticated test state.","risk_type":"browser_control","severity":"high","title":"Automated replay tests drive applications","triggering_tools_or_skills":["trigger_test_run","get_session_data","get_timeline_diff"]},{"evidence":"Explicit tools upload and register assets or containers as test infrastructure inputs.","reasoning":"They change executable testing infrastructure.","risk_type":"deployment_infrastructure","severity":"high","title":"Build artifacts are registered for automation","triggering_tools_or_skills":["register_asset_build","register_container_build","request_asset_upload","request_container_upload"]},{"evidence":"Tools return application DOM, replay, and session-derived content.","reasoning":"Test-page content is untrusted model input.","risk_type":"prompt_injection_exposure","severity":"low","title":"DOM and session data enter context","triggering_tools_or_skills":["get_dom_diff","get_session_data","get_timeline_diff"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication to Meticulous projects, test runs, sessions, replays, coverage, asset builds, and container builds; exact build and execution scopes are undocumented.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/0d2fd422-2962-4304-9243-c40adfc09355.json","what_it_proves":"Candidate PR #125 record identity (name \"Meticulous\", publisher, type web_connector) and 18 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/0d2fd422-2962-4304-9243-c40adfc09355: complete tool_names inventory (18 tools), remote streamable-http endpoint https://app.meticulous.ai/api/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Build registration, container upload, browser replay, and test triggering establish code execution and test infrastructure impact.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:0d2fd422-2962-4304-9243-c40adfc09355","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 18 names. Runtime checks should verify sandbox isolation, network egress, secrets, production targeting, upload validation, billing effects, and test-data cleanup.","risk_domains":{"arbitrary_network_access":"unknown","authz_ambiguity":"true","browser_control":"true","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"true","dynamic_hidden_actions":"false","filesystem_or_repo_access":"true","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"true","sends_messages_as_user":"false","spends_or_moves_money":"unknown"},"tools_or_skills_reviewed":18,"tools_or_skills_total":18},"name":"Meticulous","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=0d2fd422-2962-4304-9243-c40adfc09355&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.meticulous.ai/privacy-policy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Meticulous","publisher_url":"https://www.meticulous.ai/","remote_url":"https://app.meticulous.ai/api/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Test execution runs supplied code in publisher infrastructure.","evidence":"Uploaded builds can be executed in test runs: The connector registers executable application or container builds and triggers automated tests against them.","manual_risk_type":"code_execution","remediation":{"block_tool_categories":["code_execution"],"steps":["Run only in a sandbox with least-privilege credentials and strict resource limits.","Disable generic execution gateways unless their reachable action set is fully understood.","Require approval before execution against production systems or sensitive data."]},"risk_type":"runs_code","severity":"high","title":"Uploaded builds can be executed in test runs","triggering_tools":["register_asset_build","register_container_build","trigger_test_run"]},{"description":"This connector can navigate pages and interact with browser content on the user's behalf. Review findings: Browser automation exercises application behavior and can touch authenticated test state.","evidence":"Automated replay tests drive applications: Meticulous test runs replay browser sessions and compare DOM, images, coverage, and timelines.","manual_risk_type":"browser_control","remediation":{"block_tool_categories":["state_change"],"steps":["Use an isolated browser profile without unrelated authenticated sessions.","Require confirmation before form submission, download, upload, or purchase actions."]},"risk_type":"browser_control","severity":"high","title":"Automated replay tests drive applications","triggering_tools":["trigger_test_run","get_session_data","get_timeline_diff"]},{"description":"This connector can deploy code or change infrastructure and production environments. Review findings: They change executable testing infrastructure.","evidence":"Build artifacts are registered for automation: Explicit tools upload and register assets or containers as test infrastructure inputs.","manual_risk_type":"deployment_infrastructure","remediation":{"block_tool_categories":["code_execution","state_change"],"steps":["Default to a sandbox or staging environment.","Require code review, human approval, audit logging, and a tested rollback path for production changes."]},"risk_type":"code_deployment","severity":"high","title":"Build artifacts are registered for automation","triggering_tools":["register_asset_build","register_container_build","request_asset_upload","request_container_upload"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@meticulous.ai","tags":["browser_control","code_deployment","network_access","oauth_required","runs_code","web_connector"],"tools":[{"description":"","name":"get_dom_diff"},{"description":"","name":"get_image_urls"},{"description":"","name":"get_project_js_coverage"},{"description":"","name":"get_replay_diff_js_coverage_diff"},{"description":"","name":"get_replay_js_coverage"},{"description":"","name":"get_session_data","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can navigate pages and interact with browser content on the user's behalf. Review findings: Browser automation exercises application behavior and can touch authenticated test state."}},{"description":"","name":"get_sessions"},{"description":"","name":"get_test_run_diffs"},{"description":"","name":"get_test_run_diffs_counts"},{"description":"","name":"get_test_run_for_commit"},{"description":"","name":"get_test_run_js_coverage"},{"description":"","name":"get_timeline_diff","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can navigate pages and interact with browser content on the user's behalf. Review findings: Browser automation exercises application behavior and can touch authenticated test state."}},{"description":"","name":"register_asset_build","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: They change executable testing infrastructure."}},{"description":"","name":"register_container_build","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: They change executable testing infrastructure."}},{"description":"","name":"request_asset_upload","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: They change executable testing infrastructure."}},{"description":"","name":"request_container_upload","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: They change executable testing infrastructure."}},{"description":"","name":"submit_feedback"},{"description":"","name":"trigger_test_run","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can navigate pages and interact with browser content on the user's behalf. Review findings: Browser automation exercises application behavior and can touch authenticated test state."}}],"tools_count":18,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/0d2fd422-2962-4304-9243-c40adfc09355","uuid":"9b093e42-8e06-5904-b04b-33b8dc73aa92","verification_tier":"community","version":""},"query_key":"meticulous","schema_version":1,"status":"match"}