{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-07","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Work with your team's tasks, goals, and documents in Ovillo. Find assigned or overdue work, inspect progress, and log time. Create or update work only where your connected account has write access.","did":"d0ade43e-5c1a-4176-968a-edbfcadab16d","documentation_url":"https://ovillo.lat/en/mcp.html","editorial_description":{"extended_description":"An Ovillo account is required. Tools can create spaces, write documents, comment on tasks, and request missing information from reporters. Access follows the connecting user's space permissions; users without write access are not offered write tools. You can revoke the connection in Ovillo.","schema_version":1,"summary":"Work with your team's tasks, goals, and documents in Ovillo.\nFind assigned or overdue work, inspect progress, and log time.\nCreate or update work only where your connected account has write access."},"homepage_url":"","icon":"https://ovillo.lat/icon-512.png","id":"d0ade43e-5c1a-4176-968a-edbfcadab16d","installs":0,"last_scanned":"","license":"","long_description":"An Ovillo account is required. Tools can create spaces, write documents, comment on tasks, and request missing information from reporters. Access follows the connecting user's space permissions; users without write access are not offered write tools. You can revoke the connection in Ovillo.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The listing says Claude can comment on tasks and ask a ticket reporter for missing information.","reasoning":"These actions communicate to collaborators as the user.","risk_type":"messaging_as_user","severity":"high","title":"Comments can be posted and reporters contacted","triggering_tools_or_skills":["add_comment","request_reporter_info"]},{"evidence":"The inventory explicitly persists operational records.","reasoning":"These are meaningful workspace changes.","risk_type":"data_modification","severity":"medium","title":"Spaces, goals, tasks, documents and time logs can be created/updated","triggering_tools_or_skills":["create_space","create_goal","create_task","create_doc","update_task","log_time"]},{"evidence":"The connector runs at https://app.ovillo.lat/api/mcp/web without a pinned server implementation in the packet.","reasoning":"The hosted implementation can change independently of this snapshot, so runtime verification and change monitoring remain necessary.","risk_type":"provenance_uncertainty","severity":"low","title":"ovilloMCP is a mutable remote service","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"Authentication inherits the user’s Ovillo space permissions; exact write scopes are not published.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/d0ade43e-5c1a-4176-968a-edbfcadab16d.json","what_it_proves":"Candidate PR #125 record identity (name \"ovilloMCP\", publisher, type web_connector) and 24 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/d0ade43e-5c1a-4176-968a-edbfcadab16d: complete tool_names inventory (24 tools), remote streamable-http endpoint https://app.ovillo.lat/api/mcp/web, auth_posture auth_required, directory tier community"}],"primary_reason":"Ovillo can communicate with collaborators and create/update execution records.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:d0ade43e-5c1a-4176-968a-edbfcadab16d","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 24 tools. No explicit deletion action is declared; messaging drives High.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":24,"tools_or_skills_total":24},"name":"ovilloMCP","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=d0ade43e-5c1a-4176-968a-edbfcadab16d&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://ovillo.lat/en/privacy.html","provisional_risk":null,"publication_recommendation":"accept","publisher":"Ovillo.lat","publisher_url":"https://ovillo.lat/","remote_url":"https://app.ovillo.lat/api/mcp/web","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: These actions communicate to collaborators as the user.","evidence":"Comments can be posted and reporters contacted: The listing says Claude can comment on tasks and ask a ticket reporter for missing information.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Comments can be posted and reporters contacted","triggering_tools":["add_comment","request_reporter_info"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are meaningful workspace changes.","evidence":"Spaces, goals, tasks, documents and time logs can be created/updated: The inventory explicitly persists operational records.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Spaces, goals, tasks, documents and time logs can be created/updated","triggering_tools":["create_space","create_goal","create_task","create_doc","update_task","log_time"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"hello@ovillo.lat","tags":["modifies_data","network_access","oauth_required","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"add_comment","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: These actions communicate to collaborators as the user."}},{"description":"","name":"blockers_report"},{"description":"","name":"create_doc","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are meaningful workspace changes."}},{"description":"","name":"create_goal","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are meaningful workspace changes."}},{"description":"","name":"create_space","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are meaningful workspace changes."}},{"description":"","name":"create_task","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are meaningful workspace changes."}},{"description":"","name":"due_soon"},{"description":"","name":"list_attachments"},{"description":"","name":"list_comments"},{"description":"","name":"list_docs"},{"description":"","name":"list_goals"},{"description":"","name":"list_people"},{"description":"","name":"list_spaces"},{"description":"","name":"list_tasks"},{"description":"","name":"log_time","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are meaningful workspace changes."}},{"description":"","name":"my_tasks"},{"description":"","name":"read_attachment"},{"description":"","name":"read_doc"},{"description":"","name":"request_reporter_info","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: These actions communicate to collaborators as the user."}},{"description":"","name":"search_tasks"},{"description":"","name":"space_stats"},{"description":"","name":"update_doc"},{"description":"","name":"update_goal"},{"description":"","name":"update_task","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are meaningful workspace changes."}}],"tools_count":24,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/d0ade43e-5c1a-4176-968a-edbfcadab16d","uuid":"c11ca000-a35b-5dbf-8298-1032c15ea095","verification_tier":"community","version":""},"query_key":"ovillo lat ovillomcp","schema_version":1,"status":"match"}