{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-06-19","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"OctoPerf manages load-testing workflows from Claude. Import and validate virtual users, configure scenarios, and run or schedule tests. Retrieve metrics, errors, alarms, and reports using your OctoPerf account.","did":"75e6abe7-8153-49cf-b8bf-4c54bc2a3889","documentation_url":"https://api.octoperf.com/doc/mcp/","editorial_description":{"extended_description":"Supported imports include HAR, Postman, Playwright, WebDriver, JMX, and URLs. Tools manage correlations, variables, projects, scenarios, and result files, with PDF report export and test stopping. OAuth supports SaaS and self-hosted instances.","schema_version":1,"summary":"OctoPerf manages load-testing workflows from Claude.\nImport and validate virtual users, configure scenarios, and run or schedule tests.\nRetrieve metrics, errors, alarms, and reports using your OctoPerf account."},"homepage_url":"","icon":"https://octoperf.com/favicon.ico","id":"75e6abe7-8153-49cf-b8bf-4c54bc2a3889","installs":0,"last_scanned":"","license":"","long_description":"Supported imports include HAR, Postman, Playwright, WebDriver, JMX, and URLs. Tools manage correlations, variables, projects, scenarios, and result files, with PDF report export and test stopping. OAuth supports SaaS and self-hosted instances.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"These actions start/stop infrastructure-backed load generation and future jobs.","reasoning":"They can impose external traffic and consume shared testing infrastructure.","risk_type":"deployment_infrastructure","severity":"high","title":"Runs, stops and schedules load tests","triggering_tools_or_skills":["run_scenario","stop_bench_result","schedule_scenario_cron","schedule_scenario_once"]},{"evidence":"The inventory explicitly removes multiple durable testing resources.","reasoning":"These actions can destroy test assets, results and schedules.","risk_type":"data_deletion","severity":"high","title":"Deletes reports, projects files, scenarios, jobs, variables and virtual users","triggering_tools_or_skills":["delete_bench_report","delete_project_file","delete_scenario","delete_scheduled_job","delete_variable","delete_virtual_user"]},{"evidence":"Secret variables store credentials used by test workflows.","reasoning":"Creating or changing credential-bearing configuration is privileged.","risk_type":"credential_admin","severity":"high","title":"Creates secret variables","triggering_tools_or_skills":["create_secret_variable"]},{"evidence":"These tools create durable executable test/file artifacts.","reasoning":"They modify project contents and future workload behavior.","risk_type":"file_write","severity":"medium","title":"Imports/uploads test definitions and project files","triggering_tools_or_skills":["import_har_virtual_user","import_playwright_virtual_user","import_postman_virtual_user","upload_jmx_virtual_user","upload_project_file"]},{"evidence":"candidate_tools_truncated=true while 96 names are listed.","reasoning":"Unlisted tools may add capabilities and prevent a complete ceiling review.","risk_type":"evidence_gap","severity":"low","title":"Candidate tool list is truncated","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"Authentication to OctoPerf workspaces/projects is required; load-generator, secret-variable, deletion and scheduling roles are not documented in the packet.","blocked_missing_evidence":"The complete untruncated tool list with descriptions/schemas, plus authorization and confirmation rules for secrets, deletion, schedules and load generators.","confidence":"medium","displayed_risk":"high","evidence_completeness":"insufficient","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/75e6abe7-8153-49cf-b8bf-4c54bc2a3889.json","what_it_proves":"Candidate PR #125 record identity (name \"OctoPerf MCP\", publisher, type web_connector) and 80 stored tool names (truncated vs Directory); no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/75e6abe7-8153-49cf-b8bf-4c54bc2a3889: complete tool_names inventory (96 tools), remote streamable-http endpoint https://api.octoperf.com/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"OctoPerf executes/schedules load tests, deletes resources and manages secret-bearing test configuration, while the inventory is truncated.","provisional_risk":null,"publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:75e6abe7-8153-49cf-b8bf-4c54bc2a3889","reviewed_at":"2026-10-10","reviewer_notes":"Manually reviewed all 96 listed names. High is explicit, but no claim is made that the omitted tools are safe.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"true","deletes_data":"true","deployment_or_infrastructure":"true","dynamic_hidden_actions":"false","filesystem_or_repo_access":"true","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":96,"tools_or_skills_total":96},"name":"OctoPerf MCP","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=75e6abe7-8153-49cf-b8bf-4c54bc2a3889&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://api.octoperf.com/doc/privacy/","provisional_risk":null,"publication_recommendation":"fix","publisher":"OctoPerf","publisher_url":"https://octoperf.com/","remote_url":"https://api.octoperf.com/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can deploy code or change infrastructure and production environments. Review findings: They can impose external traffic and consume shared testing infrastructure.","evidence":"Runs, stops and schedules load tests: These actions start/stop infrastructure-backed load generation and future jobs.","manual_risk_type":"deployment_infrastructure","remediation":{"block_tool_categories":["code_execution","state_change"],"steps":["Default to a sandbox or staging environment.","Require code review, human approval, audit logging, and a tested rollback path for production changes."]},"risk_type":"code_deployment","severity":"high","title":"Runs, stops and schedules load tests","triggering_tools":["run_scenario","stop_bench_result","schedule_scenario_cron","schedule_scenario_once"]},{"description":"This connector can permanently remove data or resources. Review findings: These actions can destroy test assets, results and schedules.","evidence":"Deletes reports, projects files, scenarios, jobs, variables and virtual users: The inventory explicitly removes multiple durable testing resources.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Deletes reports, projects files, scenarios, jobs, variables and virtual users","triggering_tools":["delete_bench_report","delete_project_file","delete_scenario","delete_scheduled_job","delete_variable","delete_virtual_user"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Creating or changing credential-bearing configuration is privileged.","evidence":"Creates secret variables: Secret variables store credentials used by test workflows.","manual_risk_type":"credential_admin","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"high","title":"Creates secret variables","triggering_tools":["create_secret_variable"]},{"description":"This connector can create, change, export, or otherwise write files. Review findings: They modify project contents and future workload behavior.","evidence":"Imports/uploads test definitions and project files: These tools create durable executable test/file artifacts.","manual_risk_type":"file_write","remediation":{"block_tool_categories":["state_change"],"steps":["Limit file access to a dedicated working directory.","Review generated or modified files before they are shared or executed."]},"risk_type":"filesystem_access","severity":"medium","title":"Imports/uploads test definitions and project files","triggering_tools":["import_har_virtual_user","import_playwright_virtual_user","import_postman_virtual_user","upload_jmx_virtual_user","upload_project_file"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@octoperf.com","tags":["code_deployment","deletes_data","filesystem_access","modifies_data","network_access","oauth_required","web_connector"],"tools":[{"description":"","name":"add_correlation_framework_to_project"},{"description":"","name":"apply_correlations_to_virtual_user"},{"description":"","name":"backup_virtual_user"},{"description":"","name":"create_constant_variable"},{"description":"","name":"create_correlation_rule"},{"description":"","name":"create_counter_variable"},{"description":"","name":"create_csv_variable"},{"description":"","name":"create_project"},{"description":"","name":"create_random_variable"},{"description":"","name":"create_scenario_ramp_up"},{"description":"","name":"create_scenario_ramp_up_down"},{"description":"","name":"create_scenario_stairs"},{"description":"","name":"create_secret_variable","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Creating or changing credential-bearing configuration is privileged."}},{"description":"","name":"create_trend_report_by_creation_date"},{"description":"","name":"create_trend_report_by_name"},{"description":"","name":"create_trend_report_by_tags"},{"description":"","name":"delete_bench_report","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions can destroy test assets, results and schedules."}},{"description":"","name":"delete_correlation_rule"},{"description":"","name":"delete_http_server"},{"description":"","name":"delete_project_file","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions can destroy test assets, results and schedules."}},{"description":"","name":"delete_scenario","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions can destroy test assets, results and schedules."}},{"description":"","name":"delete_scheduled_job","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions can destroy test assets, results and schedules."}},{"description":"","name":"delete_unused_http_servers"},{"description":"","name":"delete_variable","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions can destroy test assets, results and schedules."}},{"description":"","name":"delete_virtual_user","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions can destroy test assets, results and schedules."}},{"description":"","name":"describe_virtual_user"},{"description":"","name":"disable_scheduled_job"},{"description":"","name":"download_bench_result_file"},{"description":"","name":"download_project_file"},{"description":"","name":"enable_scheduled_job"},{"description":"","name":"export_bench_report_pdf"},{"description":"","name":"fetch_bench_error_http"},{"description":"","name":"fetch_validation_http_body"},{"description":"","name":"get_bench_report"},{"description":"","name":"get_bench_result"},{"description":"","name":"get_bench_status"},{"description":"","name":"get_report_area_range_values"},{"description":"","name":"get_report_errors"},{"description":"","name":"get_report_insights"},{"description":"","name":"get_report_line_chart_values"},{"description":"","name":"get_report_pie_values"},{"description":"","name":"get_report_stacked_chart_values"},{"description":"","name":"get_report_summary_values"},{"description":"","name":"get_report_table_values"},{"description":"","name":"get_report_textual_monitors"},{"description":"","name":"get_report_threshold_alarms"},{"description":"","name":"get_report_top_values"},{"description":"","name":"get_report_tree_values"},{"description":"","name":"get_scenario"},{"description":"","name":"get_scenario_matching_plans"},{"description":"","name":"get_task_result"},{"description":"","name":"get_validation_failure_detail"},{"description":"","name":"get_virtual_user"},{"description":"","name":"get_virtual_user_validation"},{"description":"","name":"get_virtual_user_validation_index"},{"description":"","name":"import_har_virtual_user","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: They modify project contents and future workload behavior."}},{"description":"","name":"import_playwright_virtual_user","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: They modify project contents and future workload behavior."}},{"description":"","name":"import_postman_virtual_user","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: They modify project contents and future workload behavior."}},{"description":"","name":"import_urls_virtual_user"},{"description":"","name":"import_webdriver_virtual_user"},{"description":"","name":"list_active_subscriptions"},{"description":"","name":"list_bench_docker_logs"},{"description":"","name":"list_bench_load_generators"},{"description":"","name":"list_bench_reports_by_project"},{"description":"","name":"list_bench_result_files"},{"description":"","name":"list_correlation_frameworks"},{"description":"","name":"list_correlation_rules"},{"description":"","name":"list_docker_providers_by_workspace"},{"description":"","name":"list_http_server_usages"},{"description":"","name":"list_http_servers_by_project"},{"description":"","name":"list_project_files"},{"description":"","name":"list_projects_by_workspace"},{"description":"","name":"list_public_docker_providers"},{"description":"","name":"list_scenarios_by_project"},{"description":"","name":"list_scheduled_jobs_by_project"},{"description":"","name":"list_variables"},{"description":"","name":"list_virtual_users"},{"description":"","name":"list_workspaces"},{"description":"","name":"patch_bench_report"},{"description":"","name":"patch_scenario"},{"description":"","name":"patch_virtual_user"},{"description":"","name":"read_bench_result_file_lines"},{"description":"","name":"read_project_file_lines"},{"description":"","name":"run_scenario","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: They can impose external traffic and consume shared testing infrastructure."}},{"description":"","name":"sanity_check_virtual_user"},{"description":"","name":"schedule_scenario_cron","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: They can impose external traffic and consume shared testing infrastructure."}},{"description":"","name":"schedule_scenario_once","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: They can impose external traffic and consume shared testing infrastructure."}},{"description":"","name":"stop_bench_result","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: They can impose external traffic and consume shared testing infrastructure."}},{"description":"","name":"update_bench_report"},{"description":"","name":"update_http_server"},{"description":"","name":"update_project"},{"description":"","name":"update_scenario"},{"description":"","name":"update_virtual_user"},{"description":"","name":"upload_jmx_virtual_user","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: They modify project contents and future workload behavior."}},{"description":"","name":"upload_project_file","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: They modify project contents and future workload behavior."}},{"description":"","name":"validate_virtual_user"}],"tools_count":96,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/75e6abe7-8153-49cf-b8bf-4c54bc2a3889","uuid":"717fd8d4-db01-5b0a-b895-ad37ee99d183","verification_tier":"community","version":""},"query_key":"octoperf octoperf mcp","schema_version":1,"status":"match"}