{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-07","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"reviewed","auth_posture":"auth_required","category":"Web Connector","confidence":"high","description":"Analyze publisher and media performance with Momently. Compare campaigns, platforms, engagement and goal delivery or export report PDFs. Access is read-only and requires connector-enabled workspaces you belong to.","did":"1a3896b5-f8de-4fd3-93be-378f3e3e436a","documentation_url":"https://momently.com/connector","editorial_description":{"extended_description":"Queries support custom date windows and search of content or creative libraries. Reports use the same metrics as Momently dashboards and only the platforms connected to the workspace. Sign in with your existing account.","schema_version":1,"summary":"Analyze publisher and media performance with Momently.\nCompare campaigns, platforms, engagement and goal delivery or export report PDFs.\nAccess is read-only and requires connector-enabled workspaces you belong to."},"homepage_url":"","icon":"","id":"1a3896b5-f8de-4fd3-93be-378f3e3e436a","installs":0,"last_scanned":"","license":"","long_description":"Queries support custom date windows and search of content or creative libraries. Reports use the same metrics as Momently dashboards and only the platforms connected to the workspace. Sign in with your existing account.","manual_assessment":"low","manual_review":{"all_findings":[{"evidence":"Official docs say the connector retrieves campaign metrics, creatives, benchmarks and report PDFs from the user's authorized workspaces and cannot create, edit, delete, post or publish.","reasoning":"It exposes potentially confidential client analytics but is demonstrably read-only.","risk_type":"private_data_read","severity":"low","title":"Reads workspace campaign and audience analytics","triggering_tools_or_skills":["benchmark_report","campaign_summary","compare_platforms","goal_progress","query_metric","search_media"]},{"evidence":"Official docs say research spans enabled workspaces and returns posts, articles, ads and sends.","reasoning":"Creative text can contain adversarial instructions in model context.","risk_type":"prompt_injection_exposure","severity":"low","title":"Returns externally authored creative and research content","triggering_tools_or_skills":["search","search_entities","search_media"]}],"assessment_status":"reviewed","auth_and_scopes":"Each user authenticates with a Momently login and inherits existing workspace permissions; eligible plans and workspace enablement apply.","blocked_missing_evidence":null,"confidence":"high","displayed_risk":"low","evidence_completeness":"complete","manual_overall_risk":"low","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/1a3896b5-f8de-4fd3-93be-378f3e3e436a.json","what_it_proves":"Candidate PR #125 record identity (name \"Momently\", publisher, type web_connector) and 12 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/1a3896b5-f8de-4fd3-93be-378f3e3e436a: complete tool_names inventory (12 tools), remote streamable-http endpoint https://mcp.momently.com/mcp, auth_posture auth_required, directory tier community"},{"accessed_at":"2026-10-10T21:13:14Z","url_or_path":"https://momently.com/connector","what_it_proves":"Official connector documentation repeatedly states read-only behavior and enumerates campaign analytics, reports, creatives and workspace-permission access."}],"primary_reason":"Official Momently documentation confirms the connector can look but never create, edit, delete or publish.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":false,"review_key":"claude:1a3896b5-f8de-4fd3-93be-378f3e3e436a","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 12 names against official connector behavior; report PDFs are rendered on demand but exposed as read-only output links, not account data mutation.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"false","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":12,"tools_or_skills_total":12},"name":"Momently","needs_runtime_verification":false,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=1a3896b5-f8de-4fd3-93be-378f3e3e436a&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://momently.com/legal/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Momently Inc.","publisher_url":"https://momently.com/","remote_url":"https://mcp.momently.com/mcp","repository_url":"","risk":"low","risk_severity":"low","security_risks":[{"description":"This connector can read information available to the connected account and return it to the AI. Review findings: It exposes potentially confidential client analytics but is demonstrably read-only.","evidence":"Reads workspace campaign and audience analytics: Official docs say the connector retrieves campaign metrics, creatives, benchmarks and report PDFs from the user's authorized workspaces and cannot create, edit, delete, post or publish.","manual_risk_type":"private_data_read","remediation":{"block_tool_categories":["data_exfiltration"],"steps":["Use a least-privilege account limited to the information required by the workflow.","Restrict folders, projects, tenants, and other data scopes wherever the provider allows it.","Review access logs for unexpected reads or bulk retrieval."]},"risk_type":"reads_private_data","severity":"low","title":"Reads workspace campaign and audience analytics","triggering_tools":["benchmark_report","campaign_summary","compare_platforms","goal_progress","query_metric","search_media"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"admin@momently.com","tags":["network_access","oauth_required","reads_private_data","web_connector"],"tools":[{"description":"","name":"benchmark_report"},{"description":"","name":"campaign_summary"},{"description":"","name":"compare_platforms"},{"description":"","name":"fetch"},{"description":"","name":"get_report_pdf"},{"description":"","name":"goal_progress"},{"description":"","name":"list_capabilities"},{"description":"","name":"list_workspaces"},{"description":"","name":"query_metric"},{"description":"","name":"search"},{"description":"","name":"search_entities"},{"description":"","name":"search_media"}],"tools_count":12,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/1a3896b5-f8de-4fd3-93be-378f3e3e436a","uuid":"91b6d6ba-31e1-58c2-bab2-6ea547489e06","verification_tier":"community","version":""},"query_key":"momently inc momently","schema_version":1,"status":"match"}