{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-11","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Interactive Connector","confidence":"medium","description":"Compose and manage email campaigns with Nitrosend from Claude. Build automation flows, maintain audiences and send transactional or campaign email. Sends require explicit approval, destructive actions prompt, and large imports wait for review.","did":"cc166367-4873-4cc8-912f-796964833523","documentation_url":"https://docs.nitrosend.com/","editorial_description":{"extended_description":"Brand-kit context supports section-based email composition and validation, with review and test sends before delivery. Tools also manage sending domains, providers, templates, segments and contact imports, plus deliverability analytics. Connect with OAuth and select the relevant account or brand.","schema_version":1,"summary":"Compose and manage email campaigns with Nitrosend from Claude.\nBuild automation flows, maintain audiences and send transactional or campaign email.\nSends require explicit approval, destructive actions prompt, and large imports wait for review."},"homepage_url":"","icon":"","id":"cc166367-4873-4cc8-912f-796964833523","installs":0,"last_scanned":"","license":"","long_description":"Brand-kit context supports section-based email composition and validation, with review and test sends before delivery. Tools also manage sending domains, providers, templates, segments and contact imports, plus deliverability analytics. Connect with OAuth and select the relevant account or brand.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"Declared tools and listing explicitly send campaigns/transactional mail and control delivery after approval.","reasoning":"External email delivery as the user is High impact.","risk_type":"messaging_as_user","severity":"high","title":"Campaign, transactional and test email can be sent","triggering_tools_or_skills":["nitro_send_message","nitro_send_test_message","nitro_control_delivery"]},{"evidence":"The inventory exposes provider, domain and account configuration.","reasoning":"Changing email delivery infrastructure and authenticated domains is a powerful administrative action.","risk_type":"credential_admin","severity":"high","title":"Sending providers and domains can be configured","triggering_tools_or_skills":["nitro_configure_providers","nitro_manage_domains","nitro_configure_account"]},{"evidence":"Several tools are generic managers without action schemas.","reasoning":"Their hidden operation sets may change billing, audiences or other sensitive state beyond what names reveal.","risk_type":"generic_gateway","severity":"high","title":"Broad manage/configure/query tools hide sub-actions","triggering_tools_or_skills":["nitro_manage_billing","nitro_manage_audience","nitro_query"]},{"evidence":"The connector runs at https://api.nitrosend.com/mcp without a pinned server implementation in the packet.","reasoning":"The hosted implementation can change independently of this catalog snapshot, requiring runtime verification and change monitoring.","risk_type":"provenance_uncertainty","severity":"low","title":"Nitrosend is a mutable remote service","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"OAuth grants access to email programs, audience, domains, providers and billing; exact scopes are not enumerated.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/cc166367-4873-4cc8-912f-796964833523.json","what_it_proves":"Candidate PR #125 record identity (name \"Nitrosend\", publisher, type interactive_connector) and 25 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/cc166367-4873-4cc8-912f-796964833523: complete tool_names inventory (25 tools), remote streamable-http endpoint https://api.nitrosend.com/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Nitrosend can send email and administer delivery providers/domains through broad action tools.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:cc166367-4873-4cc8-912f-796964833523","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 25 tools. Sending is clear; paid-spend behavior of manage_billing is unknown without schemas.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"true","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"true","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"unknown"},"tools_or_skills_reviewed":25,"tools_or_skills_total":25},"name":"Nitrosend","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=cc166367-4873-4cc8-912f-796964833523&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://nitrosend.com/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Nitrosend","publisher_url":"https://nitrosend.com/","remote_url":"https://api.nitrosend.com/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: External email delivery as the user is High impact.","evidence":"Campaign, transactional and test email can be sent: Declared tools and listing explicitly send campaigns/transactional mail and control delivery after approval.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Campaign, transactional and test email can be sent","triggering_tools":["nitro_send_message","nitro_send_test_message","nitro_control_delivery"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Changing email delivery infrastructure and authenticated domains is a powerful administrative action.","evidence":"Sending providers and domains can be configured: The inventory exposes provider, domain and account configuration.","manual_risk_type":"credential_admin","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"high","title":"Sending providers and domains can be configured","triggering_tools":["nitro_configure_providers","nitro_manage_domains","nitro_configure_account"]},{"description":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Their hidden operation sets may change billing, audiences or other sensitive state beyond what names reveal.","evidence":"Broad manage/configure/query tools hide sub-actions: Several tools are generic managers without action schemas.","manual_risk_type":"generic_gateway","remediation":{"block_tool_categories":["code_execution"],"steps":["Run only in a sandbox with least-privilege credentials and strict resource limits.","Disable generic execution gateways unless their reachable action set is fully understood.","Require approval before execution against production systems or sensitive data."]},"risk_type":"runs_code","severity":"high","title":"Broad manage/configure/query tools hide sub-actions","triggering_tools":["nitro_manage_billing","nitro_manage_audience","nitro_query"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"contact@nitrosend.com","tags":["accesses_messaging","interactive_connector","modifies_data","network_access","oauth_required","runs_code","sends_messages_as_you"],"tools":[{"description":"","name":"nitro_compose_campaign"},{"description":"","name":"nitro_compose_flow"},{"description":"","name":"nitro_configure_account","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Changing email delivery infrastructure and authenticated domains is a powerful administrative action."}},{"description":"","name":"nitro_configure_providers","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Changing email delivery infrastructure and authenticated domains is a powerful administrative action."}},{"description":"","name":"nitro_control_delivery","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: External email delivery as the user is High impact."}},{"description":"","name":"nitro_define_segment"},{"description":"","name":"nitro_get_insights"},{"description":"","name":"nitro_get_status"},{"description":"","name":"nitro_import_contacts"},{"description":"","name":"nitro_ingest"},{"description":"","name":"nitro_manage_audience","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Their hidden operation sets may change billing, audiences or other sensitive state beyond what names reveal."}},{"description":"","name":"nitro_manage_billing","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Their hidden operation sets may change billing, audiences or other sensitive state beyond what names reveal."}},{"description":"","name":"nitro_manage_domains","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Changing email delivery infrastructure and authenticated domains is a powerful administrative action."}},{"description":"","name":"nitro_manage_template"},{"description":"","name":"nitro_query","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Their hidden operation sets may change billing, audiences or other sensitive state beyond what names reveal."}},{"description":"","name":"nitro_request_support"},{"description":"","name":"nitro_review_delivery"},{"description":"","name":"nitro_search_contacts"},{"description":"","name":"nitro_search_docs"},{"description":"","name":"nitro_select_account"},{"description":"","name":"nitro_select_brand"},{"description":"","name":"nitro_send_message","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: External email delivery as the user is High impact."}},{"description":"","name":"nitro_send_test_message","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: External email delivery as the user is High impact."}},{"description":"","name":"nitro_set_brand_kit"},{"description":"","name":"nitro_set_memory"}],"tools_count":25,"transport":"streamable-http","type":"interactive_connector","url":"https://claude.ai/directory/cc166367-4873-4cc8-912f-796964833523","uuid":"d8d833c8-93a0-585a-ad54-ad58e00ed88b","verification_tier":"community","version":""},"query_key":"nitrosend nitrosend","schema_version":1,"status":"match"}