{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-30","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Connects Claude to your MFIT Personal trainer account. Review named clients, workouts and evaluations, and prepare changes or targeted notifications. Every change or outbound message is previewed and requires explicit confirmation.","did":"1f932b95-c3e2-40fb-9451-05588c9c043b","documentation_url":"https://auth-ai.mfitpersonal.com.br/docs/claude","editorial_description":{"extended_description":"Search clients, groups and exercises; compare a small set of evaluations; prepare custom exercises, workouts or online evaluation requests. Results are bounded: full client lists, group rosters, arbitrary exports, billing data, media libraries and database access are not exposed.","schema_version":1,"summary":"Connects Claude to your MFIT Personal trainer account.\nReview named clients, workouts and evaluations, and prepare changes or targeted notifications.\nEvery change or outbound message is previewed and requires explicit confirmation."},"homepage_url":"","icon":"","id":"1f932b95-c3e2-40fb-9451-05588c9c043b","installs":0,"last_scanned":"","license":"","long_description":"Search clients, groups and exercises; compare a small set of evaluations; prepare custom exercises, workouts or online evaluation requests. Results are bounded: full client lists, group rosters, arbitrary exports, billing data, media libraries and database access are not exposed.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The Directory description says the connector prepares online evaluation requests and push notifications for a client or group, then sends only after explicit confirmation.","reasoning":"The confirmed operation communicates externally as the trainer.","risk_type":"messaging_as_user","severity":"high","title":"Commits evaluation requests and push notifications","triggering_tools_or_skills":["mfit_evaluations_preview_send","mfit_notifications_preview_send","mfit_operations_commit"]},{"evidence":"Preview tools stage supported changes and operations_commit persists them.","reasoning":"They materially modify fitness-program records.","risk_type":"data_modification","severity":"medium","title":"Commits client, group, exercise and workout changes","triggering_tools_or_skills":["mfit_clients_preview_change","mfit_exercises_preview_change","mfit_groups_preview_change","mfit_workouts_preview_change","mfit_operations_commit","mfit_operations_cancel"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication reaches named MFIT clients/groups, evaluations, exercises and workouts; every commit/send is described as previewed and explicitly confirmed, but exact scopes are undocumented.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/1f932b95-c3e2-40fb-9451-05588c9c043b.json","what_it_proves":"Candidate PR #125 record identity (name \"MFIT Personal\", publisher, type web_connector) and 21 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/1f932b95-c3e2-40fb-9451-05588c9c043b: complete tool_names inventory (21 tools), remote streamable-http endpoint https://mcp.mfitpersonal.com.br/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"MFIT can send push/evaluation requests as a trainer and commit changes to client fitness data after confirmation.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:1f932b95-c3e2-40fb-9451-05588c9c043b","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 21 names and detailed Directory description. Official docs were inaccessible; verify operation expiry, confirmation binding, recipient resolution and health-data minimization.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"true","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":21,"tools_or_skills_total":21},"name":"MFIT Personal","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=1f932b95-c3e2-40fb-9451-05588c9c043b&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://auth-ai.mfitpersonal.com.br/privacy/ai-connectors","provisional_risk":null,"publication_recommendation":"accept","publisher":"MFIT Personal","publisher_url":"https://www.mfitpersonal.com.br/","remote_url":"https://mcp.mfitpersonal.com.br/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: The confirmed operation communicates externally as the trainer.","evidence":"Commits evaluation requests and push notifications: The Directory description says the connector prepares online evaluation requests and push notifications for a client or group, then sends only after explicit confirmation.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Commits evaluation requests and push notifications","triggering_tools":["mfit_evaluations_preview_send","mfit_notifications_preview_send","mfit_operations_commit"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially modify fitness-program records.","evidence":"Commits client, group, exercise and workout changes: Preview tools stage supported changes and operations_commit persists them.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Commits client, group, exercise and workout changes","triggering_tools":["mfit_clients_preview_change","mfit_exercises_preview_change","mfit_groups_preview_change","mfit_workouts_preview_change","mfit_operations_commit","mfit_operations_cancel"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://www.mfitpersonal.com.br/pages/contatos.html","tags":["modifies_data","network_access","oauth_required","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"mfit_clients_get"},{"description":"","name":"mfit_clients_preview_change","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially modify fitness-program records."}},{"description":"","name":"mfit_clients_search"},{"description":"","name":"mfit_evaluations_compare"},{"description":"","name":"mfit_evaluations_get"},{"description":"","name":"mfit_evaluations_list"},{"description":"","name":"mfit_evaluations_preview_send","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: The confirmed operation communicates externally as the trainer."}},{"description":"","name":"mfit_exercise_taxonomy_list"},{"description":"","name":"mfit_exercises_get"},{"description":"","name":"mfit_exercises_preview_change","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially modify fitness-program records."}},{"description":"","name":"mfit_exercises_search"},{"description":"","name":"mfit_groups_get"},{"description":"","name":"mfit_groups_preview_change","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially modify fitness-program records."}},{"description":"","name":"mfit_groups_search"},{"description":"","name":"mfit_notifications_preview_send","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: The confirmed operation communicates externally as the trainer."}},{"description":"","name":"mfit_operations_cancel","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially modify fitness-program records."}},{"description":"","name":"mfit_operations_commit","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: The confirmed operation communicates externally as the trainer."}},{"description":"","name":"mfit_operations_get"},{"description":"","name":"mfit_workouts_get"},{"description":"","name":"mfit_workouts_list"},{"description":"","name":"mfit_workouts_preview_change","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially modify fitness-program records."}}],"tools_count":21,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/1f932b95-c3e2-40fb-9451-05588c9c043b","uuid":"317c382e-7fd1-5b32-aac8-71127527a52b","verification_tier":"community","version":""},"query_key":"mfit personal mfit personal","schema_version":1,"status":"match"}