{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-22","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Work with ONES projects, issues, wikis and test cases in Claude. Search records, create or update work, and manage comments or time entries. Access follows the selected team and authorizing user's permissions.","did":"07f9f03e-8461-4179-84f7-2ef56de62c30","documentation_url":"https://docs.ones.com/ones-assistant-new/mcp-service-and-external-integrations/mcp-service-overview","editorial_description":{"extended_description":"The connector supports issue fields and workflows, project membership, wiki pages and attachments, time estimates, and test-case libraries and modules. Queries can use ONESQL. It requires a connected ONES account and can make changes as well as retrieve information.","schema_version":1,"summary":"Work with ONES projects, issues, wikis and test cases in Claude.\nSearch records, create or update work, and manage comments or time entries.\nAccess follows the selected team and authorizing user's permissions."},"homepage_url":"","icon":"https://cdn.ones.com/favicon2020.ico","id":"07f9f03e-8461-4179-84f7-2ef56de62c30","installs":0,"last_scanned":"","license":"","long_description":"The connector supports issue fields and workflows, project membership, wiki pages and attachments, time estimates, and test-case libraries and modules. Queries can use ONESQL. It requires a connected ONES account and can make changes as well as retrieve information.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The inventory includes ONESQL grammar help and an explicit query_issues_by_onesql execution tool over authenticated workspace issues.","reasoning":"A caller-supplied query language can retrieve broad private project data and needs grammar and row-scope enforcement.","risk_type":"query_execution","severity":"high","title":"Caller-selected ONESQL queries execute","triggering_tools_or_skills":["query_issues_by_onesql"]},{"evidence":"The declared tools publish new shared issue comments and update existing comments in the connected workspace.","reasoning":"Comments communicate to project collaborators under the connected user's identity.","risk_type":"messaging_as_user","severity":"high","title":"Issue comments can be posted and updated","triggering_tools_or_skills":["post_issue_comment","update_issue_comment"]},{"evidence":"The explicit add_project_members tool changes who belongs to a project.","reasoning":"Membership changes can grant access to confidential project records and actions.","risk_type":"credential_admin","severity":"high","title":"Project membership can be granted","triggering_tools_or_skills":["add_project_members"]},{"evidence":"The complete inventory contains extensive create, workflow, time, and update actions across ONES records.","reasoning":"These tools persistently change product-development and time-tracking state.","risk_type":"data_modification","severity":"medium","title":"Projects, issues, pages, sprints, tests, and worklogs can change","triggering_tools_or_skills":["create_new_issue","create_new_project","create_page","create_sprint","execute_issue_workflow","update_issue","update_project_by_project_id","update_sprint","update_testcase"]},{"evidence":"The connector creates wiki pages and reads attachment content associated with workspace pages and issues.","reasoning":"It writes shared document content and reads repository-like attachment data, though no local filesystem path is exposed.","risk_type":"file_write","severity":"medium","title":"Wiki pages and attachments are accessible","triggering_tools_or_skills":["create_page","read_attachment_content","get_page_attachment_text"]},{"evidence":"These tools return collaborator-authored free-form text and file contents.","reasoning":"Workspace content can contain adversarial instructions.","risk_type":"prompt_injection_exposure","severity":"low","title":"Issues, wiki pages, comments, and attachments enter context","triggering_tools_or_skills":["get_list_of_issue_comments","get_page_details","read_attachment_content","search_for_references_in_wiki"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication scoped to a selected ONES team and the authorizing user's permissions; exact workflow, membership, wiki, test, and ONESQL scopes are not documented here.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/07f9f03e-8461-4179-84f7-2ef56de62c30.json","what_it_proves":"Candidate PR #125 record identity (name \"ONES\", publisher, type web_connector) and 65 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/07f9f03e-8461-4179-84f7-2ef56de62c30: complete tool_names inventory (65 tools), remote streamable-http endpoint https://us.ones.com/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"ONESQL execution, collaborator messaging, project membership changes, and broad record modification establish high impact.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:07f9f03e-8461-4179-84f7-2ef56de62c30","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 65 names. Runtime checks should verify ONESQL restrictions, workflow side effects, membership roles, notifications, attachment limits, deletion paths, and permission inheritance.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"true","deletes_data":"unknown","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"true","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"true","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":65,"tools_or_skills_total":65},"name":"ONES","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=07f9f03e-8461-4179-84f7-2ef56de62c30&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://ones.com/legal/privacy-policy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Beautiful ONES Inc.","publisher_url":"https://ones.com/","remote_url":"https://us.ones.com/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: A caller-supplied query language can retrieve broad private project data and needs grammar and row-scope enforcement.","evidence":"Caller-selected ONESQL queries execute: The inventory includes ONESQL grammar help and an explicit query_issues_by_onesql execution tool over authenticated workspace issues.","manual_risk_type":"query_execution","remediation":{"block_tool_categories":["code_execution"],"steps":["Run only in a sandbox with least-privilege credentials and strict resource limits.","Disable generic execution gateways unless their reachable action set is fully understood.","Require approval before execution against production systems or sensitive data."]},"risk_type":"runs_code","severity":"high","title":"Caller-selected ONESQL queries execute","triggering_tools":["query_issues_by_onesql"]},{"description":"This connector can publish or send messages and content using the connected identity. Review findings: Comments communicate to project collaborators under the connected user's identity.","evidence":"Issue comments can be posted and updated: The declared tools publish new shared issue comments and update existing comments in the connected workspace.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Issue comments can be posted and updated","triggering_tools":["post_issue_comment","update_issue_comment"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Membership changes can grant access to confidential project records and actions.; These tools persistently change product-development and time-tracking state.","evidence":"Project membership can be granted: The explicit add_project_members tool changes who belongs to a project. | Projects, issues, pages, sprints, tests, and worklogs can change: The complete inventory contains extensive create, workflow, time, and update actions across ONES records.","manual_risk_type":"credential_admin,data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"high","title":"Can change connected resources","triggering_tools":["add_project_members","create_new_issue","create_new_project","create_page","create_sprint","execute_issue_workflow","update_issue","update_project_by_project_id","update_sprint","update_testcase"]},{"description":"This connector can create, change, export, or otherwise write files. Review findings: It writes shared document content and reads repository-like attachment data, though no local filesystem path is exposed.","evidence":"Wiki pages and attachments are accessible: The connector creates wiki pages and reads attachment content associated with workspace pages and issues.","manual_risk_type":"file_write","remediation":{"block_tool_categories":["state_change"],"steps":["Limit file access to a dedicated working directory.","Review generated or modified files before they are shared or executed."]},"risk_type":"filesystem_access","severity":"medium","title":"Wiki pages and attachments are accessible","triggering_tools":["create_page","read_attachment_content","get_page_attachment_text"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@ones.com","tags":["filesystem_access","modifies_data","network_access","oauth_required","runs_code","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"add_manhour_estimated_in_summary_mode"},{"description":"","name":"add_project_members","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Membership changes can grant access to confidential project records and actions.; These tools persistently change product-development and time-tracking state."}},{"description":"","name":"add_workhour_in_simple_mode"},{"description":"","name":"add_workhour_in_summary_mode"},{"description":"","name":"create_module_in_testcase_library"},{"description":"","name":"create_new_issue","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Membership changes can grant access to confidential project records and actions.; These tools persistently change product-development and time-tracking state."}},{"description":"","name":"create_new_project","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Membership changes can grant access to confidential project records and actions.; These tools persistently change product-development and time-tracking state."}},{"description":"","name":"create_new_testcase_in_library"},{"description":"","name":"create_page","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Membership changes can grant access to confidential project records and actions.; These tools persistently change product-development and time-tracking state."}},{"description":"","name":"create_sprint","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Membership changes can grant access to confidential project records and actions.; These tools persistently change product-development and time-tracking state."}},{"description":"","name":"execute_issue_workflow","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Membership changes can grant access to confidential project records and actions.; These tools persistently change product-development and time-tracking state."}},{"description":"","name":"find_similar_issues"},{"description":"","name":"get_favorite_or_watch_pages"},{"description":"","name":"get_issue_activities"},{"description":"","name":"get_issue_code_info"},{"description":"","name":"get_issue_details"},{"description":"","name":"get_issue_executable_workflows"},{"description":"","name":"get_issue_fields"},{"description":"","name":"get_issue_human_readable_keys"},{"description":"","name":"get_issue_status"},{"description":"","name":"get_issue_type_hierarchy_configs"},{"description":"","name":"get_list_of_issue_comments"},{"description":"","name":"get_list_of_space_pages"},{"description":"","name":"get_manhour_list_in_simple_mode"},{"description":"","name":"get_manhour_list_in_summary_mode"},{"description":"","name":"get_manhour_mode"},{"description":"","name":"get_onesql_grammar_help"},{"description":"","name":"get_page_attachment_text","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: It writes shared document content and reads repository-like attachment data, though no local filesystem path is exposed."}},{"description":"","name":"get_page_changes"},{"description":"","name":"get_page_details"},{"description":"","name":"get_project_details_by_project_id"},{"description":"","name":"get_space_details"},{"description":"","name":"get_sprint_details"},{"description":"","name":"get_testcase_details"},{"description":"","name":"get_testcase_library_fields"},{"description":"","name":"get_user_notices"},{"description":"","name":"post_issue_comment","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Comments communicate to project collaborators under the connected user's identity."}},{"description":"","name":"query_issues_by_onesql","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: A caller-supplied query language can retrieve broad private project data and needs grammar and row-scope enforcement."}},{"description":"","name":"read_attachment_content","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: It writes shared document content and reads repository-like attachment data, though no local filesystem path is exposed."}},{"description":"","name":"search_for_epics"},{"description":"","name":"search_for_issue_field_options"},{"description":"","name":"search_for_issue_types"},{"description":"","name":"search_for_modules"},{"description":"","name":"search_for_modules_in_testcase_library"},{"description":"","name":"search_for_projects"},{"description":"","name":"search_for_references_in_wiki"},{"description":"","name":"search_for_releases"},{"description":"","name":"search_for_spaces"},{"description":"","name":"search_for_sprints"},{"description":"","name":"search_for_testcase_libraries"},{"description":"","name":"search_for_testcases_in_library"},{"description":"","name":"search_for_users"},{"description":"","name":"search_pages_by_title"},{"description":"","name":"set_manhour_estimated_in_simple_mode"},{"description":"","name":"set_manhour_remaining_in_simple_mode"},{"description":"","name":"update_issue","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Membership changes can grant access to confidential project records and actions.; These tools persistently change product-development and time-tracking state."}},{"description":"","name":"update_issue_comment","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Comments communicate to project collaborators under the connected user's identity."}},{"description":"","name":"update_manhour_estimated_in_summary_mode"},{"description":"","name":"update_module_in_testcase_library"},{"description":"","name":"update_project_by_project_id","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Membership changes can grant access to confidential project records and actions.; These tools persistently change product-development and time-tracking state."}},{"description":"","name":"update_sprint","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Membership changes can grant access to confidential project records and actions.; These tools persistently change product-development and time-tracking state."}},{"description":"","name":"update_testcase","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Membership changes can grant access to confidential project records and actions.; These tools persistently change product-development and time-tracking state."}},{"description":"","name":"update_workhour_in_simple_mode"},{"description":"","name":"update_workhour_in_summary_mode"},{"description":"","name":"who_am_i"}],"tools_count":65,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/07f9f03e-8461-4179-84f7-2ef56de62c30","uuid":"3729fe3e-2510-5711-b9a5-cdacd87efbf5","verification_tier":"community","version":""},"query_key":"ones","schema_version":1,"status":"match"}