{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-01","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"NeetoDesk manages support tickets, customers, and team workflows. Triage queues, create drafts or ticket comments, update assignments, and inspect reports. Connector replies stay on the ticket and are never emailed to customers.","did":"7f076e72-2634-4ac7-8e98-615b9697cdfe","documentation_url":"https://apidocs.neetodesk.com/mcp/introduction","editorial_description":{"extended_description":"OAuth access follows the user's own-ticket or group scope. Team-member changes require member-management permission; tools can create or delete team members and report on agents, groups, tickets, or satisfaction.","schema_version":1,"summary":"NeetoDesk manages support tickets, customers, and team workflows.\nTriage queues, create drafts or ticket comments, update assignments, and inspect reports.\nConnector replies stay on the ticket and are never emailed to customers."},"homepage_url":"","icon":"https://d2v7kzglnr2dnh.cloudfront.net/logos/neetodesk.png","id":"7f076e72-2634-4ac7-8e98-615b9697cdfe","installs":0,"last_scanned":"","license":"","long_description":"OAuth access follows the user's own-ticket or group scope. Team-member changes require member-management permission; tools can create or delete team members and report on agents, groups, tickets, or satisfaction.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The Directory description explicitly says the connector can invite/manage team members and requires member-management permission.","reasoning":"Adding, changing or removing workspace members is a privileged account-administration action.","risk_type":"credential_admin","severity":"high","title":"Invites, updates and removes helpdesk team members","triggering_tools_or_skills":["CreateTeamMember","UpdateTeamMember","DeleteTeamMember"]},{"evidence":"The declared tool explicitly deletes a team-member resource.","reasoning":"Removing a user is destructive and can revoke access or disrupt assignment history.","risk_type":"data_deletion","severity":"high","title":"Deletes a workspace team member","triggering_tools_or_skills":["DeleteTeamMember"]},{"evidence":"These tools persist helpdesk customers, tickets, drafts, replies/notes and workflow state.","reasoning":"They materially change customer-support records.","risk_type":"data_modification","severity":"medium","title":"Creates and updates customer, ticket and comment records","triggering_tools_or_skills":["CreateCustomer","CreateTicket","CreateTicketComment","CreateTicketDraft","UpdateTicket"]},{"evidence":"The names do not establish whether their targets are restricted to NeetoDesk documentation or caller-selected URLs.","reasoning":"Runtime schemas are needed to rule out arbitrary outbound retrieval.","risk_type":"arbitrary_network_access","severity":"low","title":"Includes generic fetch/search retrieval tools","triggering_tools_or_skills":["fetch","search"]}],"assessment_status":"provisional","auth_and_scopes":"OAuth acts with the connected NeetoDesk agent permissions; managing team members requires member-management permission and ticket visibility follows agent/group scope.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/7f076e72-2634-4ac7-8e98-615b9697cdfe.json","what_it_proves":"Candidate PR #125 record identity (name \"NeetoDesk\", publisher, type web_connector) and 23 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/7f076e72-2634-4ac7-8e98-615b9697cdfe: complete tool_names inventory (23 tools), remote streamable-http endpoint https://connect.neetodesk.com/mcp/messages, auth_posture auth_required, directory tier community"}],"primary_reason":"NeetoDesk can administer workspace members and delete a team member.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:7f076e72-2634-4ac7-8e98-615b9697cdfe","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 23 tools. The listing states comments are stored on the ticket and never emailed, so sends_messages_as_user is false despite CreateTicketComment; fetch target bounds remain unclear.","risk_domains":{"arbitrary_network_access":"true","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"true","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":23,"tools_or_skills_total":23},"name":"NeetoDesk","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=7f076e72-2634-4ac7-8e98-615b9697cdfe&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://neetodesk.com/legal/privacy-policy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Neeto","publisher_url":"https://neeto.com/","remote_url":"https://connect.neetodesk.com/mcp/messages","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Adding, changing or removing workspace members is a privileged account-administration action.; They materially change customer-support records.","evidence":"Invites, updates and removes helpdesk team members: The Directory description explicitly says the connector can invite/manage team members and requires member-management permission. | Creates and updates customer, ticket and comment records: These tools persist helpdesk customers, tickets, drafts, replies/notes and workflow state.","manual_risk_type":"credential_admin,data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"high","title":"Can change connected resources","triggering_tools":["CreateTeamMember","UpdateTeamMember","DeleteTeamMember","CreateCustomer","CreateTicket","CreateTicketComment","CreateTicketDraft","UpdateTicket"]},{"description":"This connector can permanently remove data or resources. Review findings: Removing a user is destructive and can revoke access or disrupt assignment history.","evidence":"Deletes a workspace team member: The declared tool explicitly deletes a team-member resource.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Deletes a workspace team member","triggering_tools":["DeleteTeamMember"]},{"description":"This connector can send caller-provided data to an external service or publisher. Review findings: Runtime schemas are needed to rule out arbitrary outbound retrieval.","evidence":"Includes generic fetch/search retrieval tools: The names do not establish whether their targets are restricted to NeetoDesk documentation or caller-selected URLs.","manual_risk_type":"arbitrary_network_access","remediation":{"block_tool_categories":["sends_externally"],"steps":["Do not include secrets, regulated data, or customer information unless the destination is approved.","Review the recipient's retention and deletion policy before enabling the connector."]},"risk_type":"forwards_data_to_third_party","severity":"low","title":"Includes generic fetch/search retrieval tools","triggering_tools":["fetch","search"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@neetodesk.com","tags":["deletes_data","forwards_data_to_third_party","modifies_data","network_access","oauth_required","web_connector"],"tools":[{"description":"","name":"CreateCustomer","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Adding, changing or removing workspace members is a privileged account-administration action.; They materially change customer-support records."}},{"description":"","name":"CreateTeamMember","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Adding, changing or removing workspace members is a privileged account-administration action.; They materially change customer-support records."}},{"description":"","name":"CreateTicket","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Adding, changing or removing workspace members is a privileged account-administration action.; They materially change customer-support records."}},{"description":"","name":"CreateTicketComment","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Adding, changing or removing workspace members is a privileged account-administration action.; They materially change customer-support records."}},{"description":"","name":"CreateTicketDraft","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Adding, changing or removing workspace members is a privileged account-administration action.; They materially change customer-support records."}},{"description":"","name":"DeleteTeamMember","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Removing a user is destructive and can revoke access or disrupt assignment history."}},{"description":"","name":"GetAgentReports"},{"description":"","name":"GetGroupReports"},{"description":"","name":"GetSurveyReports"},{"description":"","name":"GetTeamMember"},{"description":"","name":"GetTicket"},{"description":"","name":"GetTicketComment"},{"description":"","name":"GetTicketReports"},{"description":"","name":"GetTicketTimeSeriesReport"},{"description":"","name":"ListForms"},{"description":"","name":"ListTeamMembers"},{"description":"","name":"ListTicketComments"},{"description":"","name":"ListTickets"},{"description":"","name":"ListWorkspaces"},{"description":"","name":"UpdateTeamMember","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Adding, changing or removing workspace members is a privileged account-administration action.; They materially change customer-support records."}},{"description":"","name":"UpdateTicket","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Adding, changing or removing workspace members is a privileged account-administration action.; They materially change customer-support records."}},{"description":"","name":"fetch"},{"description":"","name":"search"}],"tools_count":23,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/7f076e72-2634-4ac7-8e98-615b9697cdfe","uuid":"e8d2b4ee-1c8c-5ef9-8de1-0b362771f6f9","verification_tier":"community","version":""},"query_key":"neetodesk","schema_version":1,"status":"match"}