{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-05","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Connects Claude to project and portfolio management in Onplana. Manage tasks, sprints, risks, timesheets, documents, resources and governance workflows. Access follows your organization permissions; destructive operations require explicit admin enablement.","did":"21849bdf-1a40-4b79-a4e5-5d71eeee2da4","documentation_url":"https://docs.onplana.com/","editorial_description":{"extended_description":"Capabilities include dependencies, milestones, capacity planning, earned-value analysis, budgets, proposals, gate reviews, change control, goals and audit trails. The platform supports migration from Microsoft Project and related Microsoft planning products. Connector tools also cover workspace search, document publishing and connected Teams or Outlook communications.","schema_version":1,"summary":"Connects Claude to project and portfolio management in Onplana.\nManage tasks, sprints, risks, timesheets, documents, resources and governance workflows.\nAccess follows your organization permissions; destructive operations require explicit admin enablement."},"homepage_url":"","icon":"https://onplana.com/apple-touch-icon.png","id":"21849bdf-1a40-4b79-a4e5-5d71eeee2da4","installs":0,"last_scanned":"","license":"","long_description":"Capabilities include dependencies, milestones, capacity planning, earned-value analysis, budgets, proposals, gate reviews, change control, goals and audit trails. The platform supports migration from Microsoft Project and related Microsoft planning products. Connector tools also cover workspace search, document publishing and connected Teams or Outlook communications.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The Directory inventory explicitly declares deletion tools for documents, projects, tasks and workspace tables.","reasoning":"These are destructive operations on meaningful collaboration data.","risk_type":"data_deletion","severity":"high","title":"Deletes core project and document resources","triggering_tools_or_skills":["delete_document","delete_project","delete_task","delete_workspace_table"]},{"evidence":"The declared tool names explicitly send messages to external recipients/channels and publish a page.","reasoning":"These actions communicate externally as the authenticated user or organization.","risk_type":"messaging_as_user","severity":"high","title":"Sends Outlook and Teams messages and publishes pages","triggering_tools_or_skills":["send_outlook_message","post_teams_channel_message","publish_page"]},{"evidence":"The inventory explicitly includes update_member_role.","reasoning":"Changing a member role is a broad authorization/admin action.","risk_type":"credential_admin","severity":"high","title":"Can change organization member roles","triggering_tools_or_skills":["update_member_role"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication is required and actions are organization-scoped according to the description; exact scopes are unavailable, and destructive operations are described as administrator-enabled.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/21849bdf-1a40-4b79-a4e5-5d71eeee2da4.json","what_it_proves":"Candidate PR #125 record identity (name \"Onplana\", publisher, type web_connector) and 80 stored tool names (truncated vs Directory); no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/21849bdf-1a40-4b79-a4e5-5d71eeee2da4: complete tool_names inventory (265 tools), remote streamable-http endpoint https://mcp.onplana.com/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Onplana exposes destructive, messaging and role-management capabilities across a broad project workspace.","provisional_risk":null,"publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:21849bdf-1a40-4b79-a4e5-5d71eeee2da4","reviewed_at":"2026-10-10","reviewer_notes":"The candidate_tools_truncated flag is true even though 265 Directory names were reviewed; regenerate the candidate so the full Directory inventory is retained. attach_file_from_url/fetch add arbitrary-network exposure, and bootstrap/workflow tools leave hidden behavior requiring runtime verification.","risk_domains":{"arbitrary_network_access":"true","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"true","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"true","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":265,"tools_or_skills_total":265},"name":"Onplana","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=21849bdf-1a40-4b79-a4e5-5d71eeee2da4&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://onplana.com/privacy","provisional_risk":null,"publication_recommendation":"fix","publisher":"Devsoft Solutions","publisher_url":"https://onplana.com/","remote_url":"https://mcp.onplana.com/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can permanently remove data or resources. Review findings: These are destructive operations on meaningful collaboration data.","evidence":"Deletes core project and document resources: The Directory inventory explicitly declares deletion tools for documents, projects, tasks and workspace tables.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Deletes core project and document resources","triggering_tools":["delete_document","delete_project","delete_task","delete_workspace_table"]},{"description":"This connector can publish or send messages and content using the connected identity. Review findings: These actions communicate externally as the authenticated user or organization.","evidence":"Sends Outlook and Teams messages and publishes pages: The declared tool names explicitly send messages to external recipients/channels and publish a page.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Sends Outlook and Teams messages and publishes pages","triggering_tools":["send_outlook_message","post_teams_channel_message","publish_page"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Changing a member role is a broad authorization/admin action.","evidence":"Can change organization member roles: The inventory explicitly includes update_member_role.","manual_risk_type":"credential_admin","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"high","title":"Can change organization member roles","triggering_tools":["update_member_role"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@onplana.com","tags":["accesses_calendar","accesses_messaging","deletes_data","modifies_data","network_access","oauth_required","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"add_ccb_member"},{"description":"","name":"add_project_member"},{"description":"","name":"add_project_to_portfolio"},{"description":"","name":"add_subtasks"},{"description":"","name":"add_timesheet_approver"},{"description":"","name":"advance_proposal_stage"},{"description":"","name":"agent_bootstrap"},{"description":"","name":"analyze_project_risks"},{"description":"","name":"append_log"},{"description":"","name":"approve_timesheet_entry"},{"description":"","name":"approve_timesheet_week"},{"description":"","name":"assign_tag"},{"description":"","name":"assign_task"},{"description":"","name":"attach_file_from_url"},{"description":"","name":"attach_link"},{"description":"","name":"attach_sharepoint_document"},{"description":"","name":"audit_filter_metadata"},{"description":"","name":"auto_detect_import_risks"},{"description":"","name":"auto_schedule_proposal"},{"description":"","name":"bulk_assign"},{"description":"","name":"bulk_create_tasks"},{"description":"","name":"bulk_update_status"},{"description":"","name":"bulk_update_tasks"},{"description":"","name":"calculate_evm"},{"description":"","name":"calculate_evm_history"},{"description":"","name":"cancel_workflow_run"},{"description":"","name":"capture_baseline"},{"description":"","name":"compose_evm_narrative"},{"description":"","name":"compose_meeting_brief"},{"description":"","name":"compose_meeting_invite"},{"description":"","name":"compose_release_notes"},{"description":"","name":"compose_status_digest"},{"description":"","name":"compute_risk_patterns"},{"description":"","name":"create_change_request"},{"description":"","name":"create_comment"},{"description":"","name":"create_custom_field_def"},{"description":"","name":"create_epic"},{"description":"","name":"create_evaluation_criterion"},{"description":"","name":"create_goal"},{"description":"","name":"create_idea"},{"description":"","name":"create_issue"},{"description":"","name":"create_key_result"},{"description":"","name":"create_library"},{"description":"","name":"create_milestone"},{"description":"","name":"create_office_document"},{"description":"","name":"create_page"},{"description":"","name":"create_portfolio"},{"description":"","name":"create_project"},{"description":"","name":"create_proposal"},{"description":"","name":"create_risk"},{"description":"","name":"create_sprint_with_tasks"},{"description":"","name":"create_tag"},{"description":"","name":"create_task"},{"description":"","name":"create_timesheet_entry"},{"description":"","name":"create_whiteboard"},{"description":"","name":"create_wiki_page"},{"description":"","name":"create_workspace_row"},{"description":"","name":"create_workspace_table"},{"description":"","name":"critical_path_narrative"},{"description":"","name":"decide_workflow_approval"},{"description":"","name":"delete_document","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These are destructive operations on meaningful collaboration data."}},{"description":"","name":"delete_project","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These are destructive operations on meaningful collaboration data."}},{"description":"","name":"delete_task","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These are destructive operations on meaningful collaboration data."}},{"description":"","name":"delete_workspace_table","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These are destructive operations on meaningful collaboration data."}},{"description":"","name":"describe_capabilities"},{"description":"","name":"describe_schema"},{"description":"","name":"design_page_draft"},{"description":"","name":"designate_gate_reviewer"},{"description":"","name":"detect_evm_data_source"},{"description":"","name":"dismiss_all_read_notifications"},{"description":"","name":"dismiss_notification"},{"description":"","name":"dismiss_risk"},{"description":"","name":"draft_document"},{"description":"","name":"duplicate_workflow"},{"description":"","name":"edit_comment"},{"description":"","name":"end_session"},{"description":"","name":"export_audit_log"},{"description":"","name":"fetch"},{"description":"","name":"find_meeting_times"},{"description":"","name":"find_similar_projects"},{"description":"","name":"gantt_optimize"},{"description":"","name":"generate_status_report"},{"description":"","name":"get_ai_budget"},{"description":"","name":"get_audit_entry"},{"description":"","name":"get_baseline"},{"description":"","name":"get_capacity"},{"description":"","name":"get_change_request"},{"description":"","name":"get_change_request_history"},{"description":"","name":"get_custom_field_values"},{"description":"","name":"get_document_history"},{"description":"","name":"get_document_metadata"},{"description":"","name":"get_epic"},{"description":"","name":"get_idea"},{"description":"","name":"get_issue"},{"description":"","name":"get_issue_history"},{"description":"","name":"get_milestone"},{"description":"","name":"get_my_quota_usage"},{"description":"","name":"get_notification_preferences"},{"description":"","name":"get_page"},{"description":"","name":"get_plan"},{"description":"","name":"get_plan_features"},{"description":"","name":"get_portfolio"},{"description":"","name":"get_project"},{"description":"","name":"get_project_history"},{"description":"","name":"get_project_velocity"},{"description":"","name":"get_proposal"},{"description":"","name":"get_proposal_history"},{"description":"","name":"get_row_history"},{"description":"","name":"get_seat_count"},{"description":"","name":"get_sprint"},{"description":"","name":"get_subtree"},{"description":"","name":"get_task"},{"description":"","name":"get_task_history"},{"description":"","name":"get_team"},{"description":"","name":"get_template"},{"description":"","name":"get_user_input"},{"description":"","name":"get_webhook"},{"description":"","name":"get_whiteboard"},{"description":"","name":"get_wiki_page"},{"description":"","name":"get_workflow"},{"description":"","name":"get_workflow_run"},{"description":"","name":"get_working_calendar"},{"description":"","name":"get_workspace_table"},{"description":"","name":"implement_change_request"},{"description":"","name":"instantiate_plan"},{"description":"","name":"instantiate_template"},{"description":"","name":"leveling_narrative"},{"description":"","name":"link_dependency"},{"description":"","name":"link_issue"},{"description":"","name":"list_assigned_tasks"},{"description":"","name":"list_audit_log"},{"description":"","name":"list_baselines"},{"description":"","name":"list_calendar_events"},{"description":"","name":"list_ccb_members"},{"description":"","name":"list_change_requests"},{"description":"","name":"list_comments"},{"description":"","name":"list_compliance_exceptions"},{"description":"","name":"list_custom_field_defs"},{"description":"","name":"list_dependencies"},{"description":"","name":"list_document_versions"},{"description":"","name":"list_documents"},{"description":"","name":"list_epics"},{"description":"","name":"list_evaluation_criteria"},{"description":"","name":"list_gate_approvals"},{"description":"","name":"list_gate_reviewers"},{"description":"","name":"list_ideas"},{"description":"","name":"list_issues"},{"description":"","name":"list_libraries"},{"description":"","name":"list_mentions"},{"description":"","name":"list_milestones"},{"description":"","name":"list_my_operations"},{"description":"","name":"list_my_tasks"},{"description":"","name":"list_notification_types"},{"description":"","name":"list_notifications"},{"description":"","name":"list_org_members"},{"description":"","name":"list_org_risk_patterns"},{"description":"","name":"list_org_risks"},{"description":"","name":"list_outlook_messages"},{"description":"","name":"list_overdue"},{"description":"","name":"list_pages"},{"description":"","name":"list_projects"},{"description":"","name":"list_proposal_reviews"},{"description":"","name":"list_proposals"},{"description":"","name":"list_recent_activity"},{"description":"","name":"list_recycle_bin"},{"description":"","name":"list_related_issues"},{"description":"","name":"list_related_tasks"},{"description":"","name":"list_risks"},{"description":"","name":"list_sharepoint_sites"},{"description":"","name":"list_sprints"},{"description":"","name":"list_tags"},{"description":"","name":"list_task_attachments"},{"description":"","name":"list_tasks"},{"description":"","name":"list_team_members"},{"description":"","name":"list_teams"},{"description":"","name":"list_templates"},{"description":"","name":"list_timesheet_approvers"},{"description":"","name":"list_timesheet_entries"},{"description":"","name":"list_webhook_deliveries"},{"description":"","name":"list_webhook_events"},{"description":"","name":"list_webhooks"},{"description":"","name":"list_whiteboards"},{"description":"","name":"list_wiki_pages"},{"description":"","name":"list_workflow_approvals"},{"description":"","name":"list_workflow_runs"},{"description":"","name":"list_workflows"},{"description":"","name":"list_working_calendars"},{"description":"","name":"list_workspace_rows"},{"description":"","name":"list_workspace_tables"},{"description":"","name":"lookup_governance_alerts"},{"description":"","name":"lookup_help_topic"},{"description":"","name":"mark_all_notifications_read"},{"description":"","name":"mark_notification_read"},{"description":"","name":"move_task_to_epic"},{"description":"","name":"move_task_to_sprint"},{"description":"","name":"parse_pasted_schedule"},{"description":"","name":"post_teams_channel_message","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: These actions communicate externally as the authenticated user or organization."}},{"description":"","name":"preview_migration"},{"description":"","name":"promote_idea"},{"description":"","name":"propose_assignment"},{"description":"","name":"propose_deadline_extension"},{"description":"","name":"propose_dependency"},{"description":"","name":"propose_milestone_completion"},{"description":"","name":"propose_status_change"},{"description":"","name":"propose_task_split"},{"description":"","name":"publish_page","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: These actions communicate externally as the authenticated user or organization."}},{"description":"","name":"read_agent_brief"},{"description":"","name":"read_document_content"},{"description":"","name":"read_task_attachment"},{"description":"","name":"refresh_link_preview"},{"description":"","name":"reject_timesheet_entry"},{"description":"","name":"reject_timesheet_week"},{"description":"","name":"request_user_input"},{"description":"","name":"resolve_issue"},{"description":"","name":"resource_leveler_analyze"},{"description":"","name":"restore_document_version"},{"description":"","name":"restore_page_version"},{"description":"","name":"save_project_as_template"},{"description":"","name":"schedule_health_check"},{"description":"","name":"search"},{"description":"","name":"search_docs"},{"description":"","name":"search_org_knowledge"},{"description":"","name":"send_outlook_message","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: These actions communicate externally as the authenticated user or organization."}},{"description":"","name":"set_bulk_custom_field_values"},{"description":"","name":"set_capacity"},{"description":"","name":"set_custom_field_value"},{"description":"","name":"submit_change_request"},{"description":"","name":"submit_cr_review"},{"description":"","name":"submit_proposal_review"},{"description":"","name":"submit_timesheet"},{"description":"","name":"submit_timesheet_week"},{"description":"","name":"summarize_project"},{"description":"","name":"test_run_workflow"},{"description":"","name":"test_webhook"},{"description":"","name":"unassign_tag"},{"description":"","name":"unlink_dependency"},{"description":"","name":"update_custom_field_def"},{"description":"","name":"update_document_content"},{"description":"","name":"update_epic"},{"description":"","name":"update_evaluation_criterion"},{"description":"","name":"update_goal"},{"description":"","name":"update_idea"},{"description":"","name":"update_issue"},{"description":"","name":"update_key_result_value"},{"description":"","name":"update_member_role","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Changing a member role is a broad authorization/admin action."}},{"description":"","name":"update_milestone"},{"description":"","name":"update_notification_preferences"},{"description":"","name":"update_page"},{"description":"","name":"update_portfolio"},{"description":"","name":"update_project"},{"description":"","name":"update_proposal"},{"description":"","name":"update_sprint"},{"description":"","name":"update_task"},{"description":"","name":"update_template"},{"description":"","name":"update_timesheet_entry"},{"description":"","name":"update_whiteboard"},{"description":"","name":"update_wiki_page"},{"description":"","name":"update_workspace_row"},{"description":"","name":"upload_library_document"},{"description":"","name":"upload_task_attachment"},{"description":"","name":"week_status"},{"description":"","name":"weekly_compliance"},{"description":"","name":"whoami"},{"description":"","name":"withdraw_change_request"},{"description":"","name":"workflow_stats"}],"tools_count":265,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/21849bdf-1a40-4b79-a4e5-5d71eeee2da4","uuid":"572f7160-74b2-5f43-8d03-33240b434a19","verification_tier":"community","version":""},"query_key":"onplana","schema_version":1,"status":"match"}