{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-17","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"MobiCRM connects Claude to accounts, contacts, appointments, and tasks. Search customer records and inspect addresses, contact details, relationships, and custom fields. Create or update records, schedule or reschedule appointments, and add meeting minutes or to-dos.","did":"4d7bcdc8-cc0d-4baf-8e24-c6826cc96848","documentation_url":"https://docs.mobicrm.fr/","editorial_description":{"extended_description":"Tools also manage account discussion topics, retrieve records by external IDs, and list recently created or modified accounts, contacts, and appointments.","schema_version":1,"summary":"MobiCRM connects Claude to accounts, contacts, appointments, and tasks.\nSearch customer records and inspect addresses, contact details, relationships, and custom fields.\nCreate or update records, schedule or reschedule appointments, and add meeting minutes or to-dos."},"homepage_url":"","icon":"https://mobicrm.app/fav/favicon-196x196.png","id":"4d7bcdc8-cc0d-4baf-8e24-c6826cc96848","installs":0,"last_scanned":"","license":"","long_description":"Tools also manage account discussion topics, retrieve records by external IDs, and list recently created or modified accounts, contacts, and appointments.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"Declared name explicitly deletes an account discussion topic.","reasoning":"Deleting CRM discussion data is High.","risk_type":"data_deletion","severity":"high","title":"Can delete CRM discussion topics","triggering_tools_or_skills":["delete_account_discussion_topic"]},{"evidence":"Names explicitly create externally visible discussion and appointment records.","reasoning":"Discussion content and appointments communicate/commit externally.","risk_type":"messaging_as_user","severity":"high","title":"Can create account discussions and appointments","triggering_tools_or_skills":["create_account_discussion_topic","create_appointment"]},{"evidence":"Declared tools create and update CRM records.","reasoning":"These are persistent business-data changes.","risk_type":"data_modification","severity":"medium","title":"Can mutate contacts and CRM records","triggering_tools_or_skills":["create_account","create_contact","update_account","update_contact","reschedule_appointment"]},{"evidence":"Remote implementation is unpinned.","reasoning":"Runtime may drift.","risk_type":"provenance_uncertainty","severity":"low","title":"Hosted implementation is mutable","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"Authenticated CRM access is implied; scopes and tenant isolation are undocumented.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/4d7bcdc8-cc0d-4baf-8e24-c6826cc96848.json","what_it_proves":"Candidate PR #125 record identity (name \"MobiCRM\", publisher, type web_connector) and 42 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/4d7bcdc8-cc0d-4baf-8e24-c6826cc96848: complete tool_names inventory (42 tools), remote streamable-http endpoint https://mcp.mobicrm.app/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"MobiCRM can delete discussions, create appointments/discussions, and modify CRM records.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:4d7bcdc8-cc0d-4baf-8e24-c6826cc96848","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 42 tool names; no schemas were available.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":42,"tools_or_skills_total":42},"name":"MobiCRM","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=4d7bcdc8-cc0d-4baf-8e24-c6826cc96848&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.mobifactory.fr/politique-de-confidentialite/","provisional_risk":null,"publication_recommendation":"accept","publisher":"MOBIFACTORY","publisher_url":"https://mobifactory.fr/","remote_url":"https://mcp.mobicrm.app/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can permanently remove data or resources. Review findings: Deleting CRM discussion data is High.","evidence":"Can delete CRM discussion topics: Declared name explicitly deletes an account discussion topic.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Can delete CRM discussion topics","triggering_tools":["delete_account_discussion_topic"]},{"description":"This connector can publish or send messages and content using the connected identity. Review findings: Discussion content and appointments communicate/commit externally.","evidence":"Can create account discussions and appointments: Names explicitly create externally visible discussion and appointment records.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Can create account discussions and appointments","triggering_tools":["create_account_discussion_topic","create_appointment"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are persistent business-data changes.","evidence":"Can mutate contacts and CRM records: Declared tools create and update CRM records.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Can mutate contacts and CRM records","triggering_tools":["create_account","create_contact","update_account","update_contact","reschedule_appointment"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@mobifactory.fr","tags":["deletes_data","modifies_data","network_access","oauth_required","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"create_account","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are persistent business-data changes."}},{"description":"","name":"create_account_discussion_topic","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Discussion content and appointments communicate/commit externally."}},{"description":"","name":"create_appointment","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Discussion content and appointments communicate/commit externally."}},{"description":"","name":"create_contact","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are persistent business-data changes."}},{"description":"","name":"create_minutes"},{"description":"","name":"create_todo"},{"description":"","name":"delete_account_discussion_topic","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deleting CRM discussion data is High."}},{"description":"","name":"get_account"},{"description":"","name":"get_account_addresses"},{"description":"","name":"get_account_badges"},{"description":"","name":"get_account_by_external_id"},{"description":"","name":"get_account_contacts"},{"description":"","name":"get_account_custom_fields"},{"description":"","name":"get_account_discussion_topic"},{"description":"","name":"get_account_discussion_topics"},{"description":"","name":"get_account_relationships"},{"description":"","name":"get_appointment"},{"description":"","name":"get_appointment_by_external_id"},{"description":"","name":"get_appointment_natures"},{"description":"","name":"get_contact_addresses"},{"description":"","name":"get_contact_badges"},{"description":"","name":"get_contact_businesses"},{"description":"","name":"get_contact_by_external_id"},{"description":"","name":"get_contact_custom_fields"},{"description":"","name":"get_contact_emails"},{"description":"","name":"get_contact_phones"},{"description":"","name":"get_last_created_accounts"},{"description":"","name":"get_last_created_contacts"},{"description":"","name":"get_last_modified_accounts"},{"description":"","name":"get_last_modified_appointments"},{"description":"","name":"get_last_modified_contacts"},{"description":"","name":"reschedule_appointment","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are persistent business-data changes."}},{"description":"","name":"search_accounts"},{"description":"","name":"search_appointments"},{"description":"","name":"search_contacts"},{"description":"","name":"search_minutes"},{"description":"","name":"update_account","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are persistent business-data changes."}},{"description":"","name":"update_account_addresses"},{"description":"","name":"update_account_discussion_topic"},{"description":"","name":"update_account_external_id"},{"description":"","name":"update_contact","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are persistent business-data changes."}},{"description":"","name":"update_contact_external_id"}],"tools_count":42,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/4d7bcdc8-cc0d-4baf-8e24-c6826cc96848","uuid":"564d9019-42d1-5e9a-a2c2-c7bb514773a8","verification_tier":"community","version":""},"query_key":"mobifactory mobicrm","schema_version":1,"status":"match"}