{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-06","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"high","description":"Brings Nutshell CRM information into Claude for sales research. Find leads, contacts and companies, inspect deal timelines and pull sales reports. Use pipeline and customer context to prepare calls or review team performance.","did":"24870769-489e-46d7-8ae0-d2ff0dc7ae77","documentation_url":"https://support.nutshell.com/en/articles/12631143-mcp-server","editorial_description":{"extended_description":"Tools retrieve entity details and custom fields, browse saved filters and read events or lead reports. The available inventory supports lookup and reporting rather than creating or updating CRM records.","schema_version":1,"summary":"Brings Nutshell CRM information into Claude for sales research.\nFind leads, contacts and companies, inspect deal timelines and pull sales reports.\nUse pipeline and customer context to prepare calls or review team performance."},"homepage_url":"","icon":"","id":"24870769-489e-46d7-8ae0-d2ff0dc7ae77","installs":0,"last_scanned":"","license":"","long_description":"Tools retrieve entity details and custom fields, browse saved filters and read events or lead reports. The available inventory supports lookup and reporting rather than creating or updating CRM records.","manual_assessment":"low","manual_review":{"all_findings":[{"evidence":"Official docs confirm supported lead/company/person/user searches, pipeline metadata, reports, timeline information and saved filters, and say no account changes are possible.","reasoning":"The connector exposes private sales and contact data but is documented as read-only.","risk_type":"private_data_read","severity":"low","title":"Reads CRM entities, events and sales reports","triggering_tools_or_skills":["fetch","get_individual_entities","nutshell_events","nutshell_leads_report","nutshell_list_entity","search"]}],"assessment_status":"provisional","auth_and_scopes":"OAuth authorizes access to the connected Nutshell account; official docs state the connector is read-only, although the exact OAuth scope string is not shown.","blocked_missing_evidence":null,"confidence":"high","displayed_risk":"low","evidence_completeness":"complete","manual_overall_risk":"low","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/24870769-489e-46d7-8ae0-d2ff0dc7ae77.json","what_it_proves":"Candidate PR #125 record identity (name \"Nutshell CRM\", publisher, type web_connector) and 11 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/24870769-489e-46d7-8ae0-d2ff0dc7ae77: complete tool_names inventory (11 tools), remote streamable-http endpoint https://app.nutshell.com/mcp, auth_posture auth_required, directory tier partner"},{"accessed_at":"2026-10-10T21:27:08Z","url_or_path":"https://support.nutshell.com/en/articles/12631143-mcp-server","what_it_proves":"Official Nutshell documentation states the MCP server only reads CRM data, cannot change the account or trigger automations, and enumerates supported searches/reports."}],"primary_reason":"Nutshell's official documentation confirms read-only CRM search and reporting.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:24870769-489e-46d7-8ae0-d2ff0dc7ae77","reviewed_at":"2026-10-10","reviewer_notes":"The eleven tools align with the official supported reads. CRM fields and timeline content remain prompt-injection-bearing user-generated data.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"false","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":11,"tools_or_skills_total":11},"name":"Nutshell CRM","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=24870769-489e-46d7-8ae0-d2ff0dc7ae77&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.nutshell.com/legal/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Nutshell","publisher_url":"https://www.nutshell.com/","remote_url":"https://app.nutshell.com/mcp","repository_url":"","risk":"low","risk_severity":"low","security_risks":[{"description":"This connector can read information available to the connected account and return it to the AI. Review findings: The connector exposes private sales and contact data but is documented as read-only.","evidence":"Reads CRM entities, events and sales reports: Official docs confirm supported lead/company/person/user searches, pipeline metadata, reports, timeline information and saved filters, and say no account changes are possible.","manual_risk_type":"private_data_read","remediation":{"block_tool_categories":["data_exfiltration"],"steps":["Use a least-privilege account limited to the information required by the workflow.","Restrict folders, projects, tenants, and other data scopes wherever the provider allows it.","Review access logs for unexpected reads or bulk retrieval."]},"risk_type":"reads_private_data","severity":"low","title":"Reads CRM entities, events and sales reports","triggering_tools":["fetch","get_individual_entities","nutshell_events","nutshell_leads_report","nutshell_list_entity","search"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@nutshell.com","tags":["accesses_calendar","network_access","oauth_required","reads_private_data","web_connector"],"tools":[{"description":"","name":"fetch"},{"description":"","name":"get_entity_custom_fields"},{"description":"","name":"get_individual_entities"},{"description":"","name":"get_user"},{"description":"","name":"nutshell_events"},{"description":"","name":"nutshell_leads_report"},{"description":"","name":"nutshell_list_entity"},{"description":"","name":"nutshell_list_entity_field_info"},{"description":"","name":"nutshell_list_entity_from_saved_filter"},{"description":"","name":"nutshell_saved_filter"},{"description":"","name":"search"}],"tools_count":11,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/24870769-489e-46d7-8ae0-d2ff0dc7ae77","uuid":"b2eacbc9-6c76-5076-89c7-74f8cc22e98f","verification_tier":"partner","version":""},"query_key":"nutshell nutshell crm","schema_version":1,"status":"match"}