{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"high","description":"Adds review and approval records for consequential Claude actions through OSuite. Check planned work, route sensitive steps for approval and record the outcome. Open audit records with replay or verification links for oversight.","did":"c0b47b2e-0b0c-4667-ab48-cc5b15549499","documentation_url":"https://docs.osuite.ai/docs/api-sdk/claude-connectors-directory","editorial_description":{"extended_description":"Intended workflows include publishing, deployments and production changes. Tools check approval status separately from recording the final result.","schema_version":1,"summary":"Adds review and approval records for consequential Claude actions through OSuite.\nCheck planned work, route sensitive steps for approval and record the outcome.\nOpen audit records with replay or verification links for oversight."},"homepage_url":"","icon":"","id":"c0b47b2e-0b0c-4667-ab48-cc5b15549499","installs":0,"last_scanned":"","license":"","long_description":"Intended workflows include publishing, deployments and production changes. Tools check approval status separately from recording the final result.","manual_assessment":"medium","manual_review":{"all_findings":[{"evidence":"Official docs state calls create runtime sessions, actions, assumptions, approvals, replay links and proof exports.","reasoning":"These persist governance records, while underlying high-risk work remains outside this connector.","risk_type":"data_modification","severity":"medium","title":"Writes governance and audit evidence","triggering_tools_or_skills":["record_final_outcome","review_planned_work"]}],"assessment_status":"provisional","auth_and_scopes":"Official docs specify OAuth 2.0 PKCE with osuite.runtime.write bound to a chosen workspace.","blocked_missing_evidence":null,"confidence":"high","displayed_risk":"medium","evidence_completeness":"partial","manual_overall_risk":"medium","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/c0b47b2e-0b0c-4667-ab48-cc5b15549499.json","what_it_proves":"Candidate PR #125 record identity (name \"OSuite\", publisher, type web_connector) and 4 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/c0b47b2e-0b0c-4667-ab48-cc5b15549499: complete tool_names inventory (4 tools), remote streamable-http endpoint https://studio.osuite.ai/api/connectors/osuite/mcp, auth_posture auth_required, directory tier community"},{"accessed_at":"2026-10-10T21:00:03Z","url_or_path":"https://docs.osuite.ai/docs/api-sdk/claude-connectors-directory","what_it_proves":"Official docs define the four-tool surface, OAuth write scope and persisted governance/audit records."}],"primary_reason":"OSuite records governed-action outcomes and audit records but does not execute the underlying deployment or production action.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:c0b47b2e-0b0c-4667-ab48-cc5b15549499","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 4 names and official docs. Runtime verification should confirm open_audit_record is read/navigation only and records cannot be deleted.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":4,"tools_or_skills_total":4},"name":"OSuite","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=c0b47b2e-0b0c-4667-ab48-cc5b15549499&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://osuite.ai/privacy-policy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Ond Holdings Inc.","publisher_url":"https://osuite.ai","remote_url":"https://studio.osuite.ai/api/connectors/osuite/mcp","repository_url":"","risk":"medium","risk_severity":"medium","security_risks":[{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These persist governance records, while underlying high-risk work remains outside this connector.","evidence":"Writes governance and audit evidence: Official docs state calls create runtime sessions, actions, assumptions, approvals, replay links and proof exports.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Writes governance and audit evidence","triggering_tools":["record_final_outcome","review_planned_work"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@nd.im","tags":["modifies_data","network_access","oauth_required","web_connector"],"tools":[{"description":"","name":"review_planned_work","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These persist governance records, while underlying high-risk work remains outside this connector."}},{"description":"","name":"check_if_approved"},{"description":"","name":"record_final_outcome","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These persist governance records, while underlying high-risk work remains outside this connector."}},{"description":"","name":"open_audit_record"}],"tools_count":4,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/c0b47b2e-0b0c-4667-ab48-cc5b15549499","uuid":"9918fab1-b42d-5899-ab7c-82c7f9d8ac39","verification_tier":"community","version":""},"query_key":"osuite","schema_version":1,"status":"match"}