{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-22","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Inspect and control building automation through Normal Framework. Discover devices, read or trend points, model equipment, and diagnose site health. Write setpoints, overrides, or schedules and deploy automation hooks for actual connected systems.","did":"e64bf2ca-c906-4c7a-9e7e-cfc9f82b649f","documentation_url":"https://docs.normal.dev/","editorial_description":{"extended_description":"Supported protocols include BACnet, Modbus, and Niagara/Fox; equipment models use Haystack or Brick. Tools manage points, tags, sites, workflows, streams of values, and automation configuration across buildings.","schema_version":1,"summary":"Inspect and control building automation through Normal Framework.\nDiscover devices, read or trend points, model equipment, and diagnose site health.\nWrite setpoints, overrides, or schedules and deploy automation hooks for actual connected systems."},"homepage_url":"","icon":"https://www.normal.dev/assets/images/logo.svg","id":"e64bf2ca-c906-4c7a-9e7e-cfc9f82b649f","installs":0,"last_scanned":"","license":"","long_description":"Supported protocols include BACnet, Modbus, and Niagara/Fox; equipment models use Haystack or Brick. Tools manage points, tags, sites, workflows, streams of values, and automation configuration across buildings.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"These tools operate actual BACnet/Modbus/Niagara equipment.","reasoning":"They can affect physical building systems.","risk_type":"deployment_infrastructure","severity":"high","title":"Building setpoints, overrides, schedules and hooks can be controlled/deployed","triggering_tools_or_skills":["control","manage_schedule","deploy_hook","manage_hooks"]},{"evidence":"The explicit tool removes modeled/managed control points.","reasoning":"This can break automation and monitoring.","risk_type":"data_deletion","severity":"high","title":"Building points can be deleted","triggering_tools_or_skills":["delete_points"]},{"evidence":"These operations execute logic in building-control infrastructure.","reasoning":"They are remote automation/code execution.","risk_type":"code_execution","severity":"high","title":"Automation hooks/workflows can be deployed and managed","triggering_tools_or_skills":["deploy_hook","manage_workflow","manage_app"]},{"evidence":"The tools alter privileged integration state.","reasoning":"They require strong authorization.","risk_type":"credential_admin","severity":"high","title":"Connections/sites/apps can be administered","triggering_tools_or_skills":["connect","manage_site","manage_app"]},{"evidence":"Device-supplied content is returned.","reasoning":"It may contain prompt injection.","risk_type":"prompt_injection_exposure","severity":"low","title":"Device metadata/logs enter model context","triggering_tools_or_skills":["scan","discover_fox","diagnose"]},{"evidence":"The connector runs at https://portal.normal-online.net/mcp without a pinned server implementation in the packet.","reasoning":"The implementation can change independently, so runtime verification and change monitoring remain necessary.","risk_type":"provenance_uncertainty","severity":"low","title":"Normal Framework is a mutable hosted service","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"Authentication connects real building automation systems; site/portfolio roles and safety interlocks are not documented.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/e64bf2ca-c906-4c7a-9e7e-cfc9f82b649f.json","what_it_proves":"Candidate PR #125 record identity (name \"Normal Framework\", publisher, type web_connector) and 22 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/e64bf2ca-c906-4c7a-9e7e-cfc9f82b649f: complete tool_names inventory (22 tools), remote streamable-http endpoint https://portal.normal-online.net/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Normal Framework controls physical building systems, deploys automation and deletes points.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:e64bf2ca-c906-4c7a-9e7e-cfc9f82b649f","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 22 tools.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"true","deletes_data":"true","deployment_or_infrastructure":"true","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"true","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":22,"tools_or_skills_total":22},"name":"Normal Framework","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=e64bf2ca-c906-4c7a-9e7e-cfc9f82b649f&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.normal.dev/assets/downloads/Normal%20Terms%20of%20Service%20January%202025.pdf","provisional_risk":null,"publication_recommendation":"accept","publisher":"Normal Software","publisher_url":"https://www.normal.dev/","remote_url":"https://portal.normal-online.net/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can deploy code or change infrastructure and production environments. Review findings: They can affect physical building systems.","evidence":"Building setpoints, overrides, schedules and hooks can be controlled/deployed: These tools operate actual BACnet/Modbus/Niagara equipment.","manual_risk_type":"deployment_infrastructure","remediation":{"block_tool_categories":["code_execution","state_change"],"steps":["Default to a sandbox or staging environment.","Require code review, human approval, audit logging, and a tested rollback path for production changes."]},"risk_type":"code_deployment","severity":"high","title":"Building setpoints, overrides, schedules and hooks can be controlled/deployed","triggering_tools":["control","manage_schedule","deploy_hook","manage_hooks"]},{"description":"This connector can permanently remove data or resources. Review findings: This can break automation and monitoring.","evidence":"Building points can be deleted: The explicit tool removes modeled/managed control points.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Building points can be deleted","triggering_tools":["delete_points"]},{"description":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: They are remote automation/code execution.","evidence":"Automation hooks/workflows can be deployed and managed: These operations execute logic in building-control infrastructure.","manual_risk_type":"code_execution","remediation":{"block_tool_categories":["code_execution"],"steps":["Run only in a sandbox with least-privilege credentials and strict resource limits.","Disable generic execution gateways unless their reachable action set is fully understood.","Require approval before execution against production systems or sensitive data."]},"risk_type":"runs_code","severity":"high","title":"Automation hooks/workflows can be deployed and managed","triggering_tools":["deploy_hook","manage_workflow","manage_app"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They require strong authorization.","evidence":"Connections/sites/apps can be administered: The tools alter privileged integration state.","manual_risk_type":"credential_admin","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"high","title":"Connections/sites/apps can be administered","triggering_tools":["connect","manage_site","manage_app"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"hello@normal.dev","tags":["code_deployment","deletes_data","modifies_data","network_access","oauth_required","runs_code","web_connector"],"tools":[{"description":"","name":"classify_points"},{"description":"","name":"connect","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They require strong authorization."}},{"description":"","name":"control","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: They can affect physical building systems."}},{"description":"","name":"delete_points","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: This can break automation and monitoring."}},{"description":"","name":"deploy_hook","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: They are remote automation/code execution."}},{"description":"","name":"diagnose"},{"description":"","name":"discover_fox"},{"description":"","name":"manage_app","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They require strong authorization."}},{"description":"","name":"manage_conversions"},{"description":"","name":"manage_equipment"},{"description":"","name":"manage_hooks","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: They can affect physical building systems."}},{"description":"","name":"manage_schedule","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: They can affect physical building systems."}},{"description":"","name":"manage_site","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They require strong authorization."}},{"description":"","name":"manage_workflow","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: They are remote automation/code execution."}},{"description":"","name":"modbus"},{"description":"","name":"read_values"},{"description":"","name":"scan"},{"description":"","name":"search_points"},{"description":"","name":"session"},{"description":"","name":"tag_points"},{"description":"","name":"test_template"},{"description":"","name":"upload_file"}],"tools_count":22,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/e64bf2ca-c906-4c7a-9e7e-cfc9f82b649f","uuid":"ab16d610-0d53-57b8-a6b3-42833454aee5","verification_tier":"community","version":""},"query_key":"normal framework","schema_version":1,"status":"match"}