{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-06","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Oviond lets Claude create and manage client marketing reports and dashboards. Connect data, configure charts and widgets, and analyze campaign performance. Generate PDFs, schedule report emails, and maintain branding or team settings.","did":"421dc7bb-e4cd-4ded-8824-5ea87a35f4bf","documentation_url":"https://docs.oviond.com/","editorial_description":{"extended_description":"Tools support clients, templates, reusable sections, calculated metrics, goals, and report automation. Many resources can be archived and restored; separate deletion tools also exist.","schema_version":1,"summary":"Oviond lets Claude create and manage client marketing reports and dashboards.\nConnect data, configure charts and widgets, and analyze campaign performance.\nGenerate PDFs, schedule report emails, and maintain branding or team settings."},"homepage_url":"","icon":"https://app.oviond.com/favicon.svg","id":"421dc7bb-e4cd-4ded-8824-5ea87a35f4bf","installs":0,"last_scanned":"","license":"","long_description":"Tools support clients, templates, reusable sections, calculated metrics, goals, and report automation. Many resources can be archived and restored; separate deletion tools also exist.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The packet declares 180 tools, stores only 80, and marks the candidate inventory truncated.","reasoning":"Most of the action surface, including possible billing, automation and administrative operations, is unavailable for review.","risk_type":"identity_discrepancy","severity":"high","title":"Stored inventory omits 100 of 180 tools","triggering_tools_or_skills":["search"]},{"evidence":"The visible tool inventory includes API-key revocation/deletion and user invitation/removal/update.","reasoning":"These operations change credentials and organization access.","risk_type":"credential_admin","severity":"high","title":"Deletes/revokes API keys and administers users","triggering_tools_or_skills":["delete_api_key","revoke_api_key","invite_user","remove_user","update_user"]},{"evidence":"The description promises scheduled recurring email reports and the visible tools send email and manage active automations.","reasoning":"These operations communicate reports externally under the agency's identity.","risk_type":"messaging_as_user","severity":"high","title":"Sends email and runs recurring report automations","triggering_tools_or_skills":["send_email","create_automation","test_automation","unpause_automation"]},{"evidence":"Numerous visible tools explicitly delete persistent reporting resources.","reasoning":"Deletion can disrupt client reports, data connections and delivery configuration.","risk_type":"data_deletion","severity":"high","title":"Deletes reports, widgets, connections and notification channels","triggering_tools_or_skills":["delete_connection","delete_email_sender","delete_email_template","delete_folder","delete_media_folder","delete_notification_channel","delete_page","delete_widget","delete_widgets"]},{"evidence":"The visible surface manages custom web/email domains and email provider configuration.","reasoning":"These are production delivery and domain-infrastructure changes.","risk_type":"deployment_infrastructure","severity":"high","title":"Changes custom domains and email-provider infrastructure","triggering_tools_or_skills":["add_domain","add_email_domain","remove_domain","remove_email_domain","set_email_provider","verify_email_domain"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication exposes agency clients, reports, marketing integrations, email automation, users, domains, API keys and branding; scopes for 100 omitted tools are not reviewable.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/421dc7bb-e4cd-4ded-8824-5ea87a35f4bf.json","what_it_proves":"Candidate PR #125 record identity (name \"Oviond\", publisher, type web_connector) and 80 stored tool names (truncated vs Directory); no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/421dc7bb-e4cd-4ded-8824-5ea87a35f4bf: complete tool_names inventory (180 tools), remote streamable-http endpoint https://api.oviond.com/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Oviond exposes messaging, credentials, users, deletion and domain infrastructure while omitting 100 tools from the snapshot.","provisional_risk":null,"publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:421dc7bb-e4cd-4ded-8824-5ea87a35f4bf","reviewed_at":"2026-10-10","reviewer_notes":"Capture all 180 tools and schemas and re-review before publication; preserve recoverable archive semantics separately from hard deletion.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"true","deletes_data":"true","deployment_or_infrastructure":"true","dynamic_hidden_actions":"false","filesystem_or_repo_access":"true","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"unknown"},"tools_or_skills_reviewed":180,"tools_or_skills_total":180},"name":"Oviond","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=421dc7bb-e4cd-4ded-8824-5ea87a35f4bf&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.oviond.com/legal/privacy-policy/","provisional_risk":null,"publication_recommendation":"fix","publisher":"Oviond","publisher_url":"https://www.oviond.com/","remote_url":"https://api.oviond.com/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These operations change credentials and organization access.","evidence":"Deletes/revokes API keys and administers users: The visible tool inventory includes API-key revocation/deletion and user invitation/removal/update.","manual_risk_type":"credential_admin","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"high","title":"Deletes/revokes API keys and administers users","triggering_tools":["delete_api_key","revoke_api_key","invite_user","remove_user","update_user"]},{"description":"This connector can publish or send messages and content using the connected identity. Review findings: These operations communicate reports externally under the agency's identity.","evidence":"Sends email and runs recurring report automations: The description promises scheduled recurring email reports and the visible tools send email and manage active automations.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Sends email and runs recurring report automations","triggering_tools":["send_email","create_automation","test_automation","unpause_automation"]},{"description":"This connector can permanently remove data or resources. Review findings: Deletion can disrupt client reports, data connections and delivery configuration.","evidence":"Deletes reports, widgets, connections and notification channels: Numerous visible tools explicitly delete persistent reporting resources.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Deletes reports, widgets, connections and notification channels","triggering_tools":["delete_connection","delete_email_sender","delete_email_template","delete_folder","delete_media_folder","delete_notification_channel","delete_page","delete_widget","delete_widgets"]},{"description":"This connector can deploy code or change infrastructure and production environments. Review findings: These are production delivery and domain-infrastructure changes.","evidence":"Changes custom domains and email-provider infrastructure: The visible surface manages custom web/email domains and email provider configuration.","manual_risk_type":"deployment_infrastructure","remediation":{"block_tool_categories":["code_execution","state_change"],"steps":["Default to a sandbox or staging environment.","Require code review, human approval, audit logging, and a tested rollback path for production changes."]},"risk_type":"code_deployment","severity":"high","title":"Changes custom domains and email-provider infrastructure","triggering_tools":["add_domain","add_email_domain","remove_domain","remove_email_domain","set_email_provider","verify_email_domain"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"lesedi@oviond.com","tags":["accesses_messaging","code_deployment","deletes_data","modifies_data","network_access","oauth_required","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"add_asset_to_page"},{"description":"","name":"add_button_widget"},{"description":"","name":"add_data_widget"},{"description":"","name":"add_domain","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: These are production delivery and domain-infrastructure changes."}},{"description":"","name":"add_email_domain","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: These are production delivery and domain-infrastructure changes."}},{"description":"","name":"add_embed_widget"},{"description":"","name":"add_image_widget"},{"description":"","name":"add_project_section"},{"description":"","name":"add_text_widget"},{"description":"","name":"add_title_widget"},{"description":"","name":"archive_asset"},{"description":"","name":"archive_automation"},{"description":"","name":"archive_calculated_metric"},{"description":"","name":"archive_client"},{"description":"","name":"archive_clients"},{"description":"","name":"archive_custom_data"},{"description":"","name":"archive_export"},{"description":"","name":"archive_goal"},{"description":"","name":"archive_media_file"},{"description":"","name":"archive_media_files"},{"description":"","name":"archive_notification"},{"description":"","name":"archive_notifications"},{"description":"","name":"archive_project"},{"description":"","name":"archive_projects"},{"description":"","name":"archive_template"},{"description":"","name":"archive_theme"},{"description":"","name":"audit_project_health"},{"description":"","name":"change_my_email"},{"description":"","name":"change_project_date_range"},{"description":"","name":"clear_read_notifications"},{"description":"","name":"connected_datasources"},{"description":"","name":"count_clients"},{"description":"","name":"count_unread_notifications"},{"description":"","name":"create_asset"},{"description":"","name":"create_automation","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: These operations communicate reports externally under the agency's identity."}},{"description":"","name":"create_calculated_metric"},{"description":"","name":"create_client"},{"description":"","name":"create_client_with_project"},{"description":"","name":"create_connection"},{"description":"","name":"create_custom_data"},{"description":"","name":"create_email_sender"},{"description":"","name":"create_email_template"},{"description":"","name":"create_folder"},{"description":"","name":"create_goal"},{"description":"","name":"create_media_folder"},{"description":"","name":"create_page"},{"description":"","name":"create_project"},{"description":"","name":"create_project_from_template"},{"description":"","name":"create_template"},{"description":"","name":"create_theme"},{"description":"","name":"datasource_resources"},{"description":"","name":"datasources"},{"description":"","name":"delete_api_key","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These operations change credentials and organization access."}},{"description":"","name":"delete_connection","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion can disrupt client reports, data connections and delivery configuration."}},{"description":"","name":"delete_email_sender","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion can disrupt client reports, data connections and delivery configuration."}},{"description":"","name":"delete_email_template","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion can disrupt client reports, data connections and delivery configuration."}},{"description":"","name":"delete_folder","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion can disrupt client reports, data connections and delivery configuration."}},{"description":"","name":"delete_media_folder","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion can disrupt client reports, data connections and delivery configuration."}},{"description":"","name":"delete_notification_channel","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion can disrupt client reports, data connections and delivery configuration."}},{"description":"","name":"delete_page","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion can disrupt client reports, data connections and delivery configuration."}},{"description":"","name":"delete_widget","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion can disrupt client reports, data connections and delivery configuration."}},{"description":"","name":"delete_widgets","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion can disrupt client reports, data connections and delivery configuration."}},{"description":"","name":"describe_datasource"},{"description":"","name":"duplicate_asset"},{"description":"","name":"duplicate_calculated_metric"},{"description":"","name":"duplicate_custom_data"},{"description":"","name":"duplicate_goal"},{"description":"","name":"duplicate_project"},{"description":"","name":"generate_company_palette"},{"description":"","name":"generate_pdf"},{"description":"","name":"get_account"},{"description":"","name":"get_account_usage"},{"description":"","name":"get_archive_counts"},{"description":"","name":"get_asset"},{"description":"","name":"get_automation_history"},{"description":"","name":"get_billing"},{"description":"","name":"get_branding"},{"description":"","name":"get_client"},{"description":"","name":"get_company"},{"description":"","name":"get_current_user"},{"description":"","name":"get_custom_data"},{"description":"","name":"get_email_provider"},{"description":"","name":"get_email_template"},{"description":"","name":"get_notification_preferences"},{"description":"","name":"get_pdf_status"},{"description":"","name":"get_project"},{"description":"","name":"get_template"},{"description":"","name":"get_theme"},{"description":"","name":"get_widget"},{"description":"","name":"get_widget_data"},{"description":"","name":"invite_user","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These operations change credentials and organization access."}},{"description":"","name":"link_datasource"},{"description":"","name":"list_activity"},{"description":"","name":"list_api_keys"},{"description":"","name":"list_archive"},{"description":"","name":"list_asset_tags"},{"description":"","name":"list_asset_widgets"},{"description":"","name":"list_assets"},{"description":"","name":"list_automations"},{"description":"","name":"list_calculated_metrics"},{"description":"","name":"list_clients"},{"description":"","name":"list_custom_data"},{"description":"","name":"list_domains"},{"description":"","name":"list_email_domains"},{"description":"","name":"list_email_logs"},{"description":"","name":"list_email_senders"},{"description":"","name":"list_email_templates"},{"description":"","name":"list_exports"},{"description":"","name":"list_folders"},{"description":"","name":"list_goals"},{"description":"","name":"list_invoices"},{"description":"","name":"list_media"},{"description":"","name":"list_media_folders"},{"description":"","name":"list_notification_channels"},{"description":"","name":"list_notifications"},{"description":"","name":"list_pages"},{"description":"","name":"list_projects"},{"description":"","name":"list_template_widgets"},{"description":"","name":"list_templates"},{"description":"","name":"list_themes"},{"description":"","name":"list_users"},{"description":"","name":"list_widgets"},{"description":"","name":"mark_notifications_read"},{"description":"","name":"move_client_to_folder"},{"description":"","name":"move_media_to_folder"},{"description":"","name":"move_widget"},{"description":"","name":"pause_automation"},{"description":"","name":"refresh_account_favicon"},{"description":"","name":"refresh_client_favicon"},{"description":"","name":"refresh_client_screenshot"},{"description":"","name":"refresh_project"},{"description":"","name":"refresh_widgets"},{"description":"","name":"remove_account_favicon"},{"description":"","name":"remove_account_logo"},{"description":"","name":"remove_client_favicon"},{"description":"","name":"remove_client_logo"},{"description":"","name":"remove_domain","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: These are production delivery and domain-infrastructure changes."}},{"description":"","name":"remove_email_domain","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: These are production delivery and domain-infrastructure changes."}},{"description":"","name":"remove_user","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These operations change credentials and organization access."}},{"description":"","name":"rename_connection"},{"description":"","name":"rename_media_file"},{"description":"","name":"restore_from_archive"},{"description":"","name":"revoke_api_key","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These operations change credentials and organization access."}},{"description":"","name":"search"},{"description":"","name":"send_email","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: These operations communicate reports externally under the agency's identity."}},{"description":"","name":"set_default_email_sender"},{"description":"","name":"set_default_email_template"},{"description":"","name":"set_email_provider","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: These are production delivery and domain-infrastructure changes."}},{"description":"","name":"set_notification_channel"},{"description":"","name":"test_automation","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: These operations communicate reports externally under the agency's identity."}},{"description":"","name":"test_connection"},{"description":"","name":"unlink_datasource"},{"description":"","name":"unpause_automation","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: These operations communicate reports externally under the agency's identity."}},{"description":"","name":"update_asset"},{"description":"","name":"update_automation"},{"description":"","name":"update_branding"},{"description":"","name":"update_button_widget"},{"description":"","name":"update_calculated_metric"},{"description":"","name":"update_client"},{"description":"","name":"update_company"},{"description":"","name":"update_custom_data"},{"description":"","name":"update_data_widget"},{"description":"","name":"update_email_sender"},{"description":"","name":"update_email_template"},{"description":"","name":"update_embed_widget"},{"description":"","name":"update_folder"},{"description":"","name":"update_goal"},{"description":"","name":"update_image_widget"},{"description":"","name":"update_media_folder"},{"description":"","name":"update_my_avatar"},{"description":"","name":"update_my_profile"},{"description":"","name":"update_notification_preferences"},{"description":"","name":"update_page"},{"description":"","name":"update_project"},{"description":"","name":"update_template"},{"description":"","name":"update_text_widget"},{"description":"","name":"update_theme"},{"description":"","name":"update_title_widget"},{"description":"","name":"update_user","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These operations change credentials and organization access."}},{"description":"","name":"verify_email_domain","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: These are production delivery and domain-infrastructure changes."}}],"tools_count":180,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/421dc7bb-e4cd-4ded-8824-5ea87a35f4bf","uuid":"93fd31bc-5afb-5dcd-9740-d35f9324a5c4","verification_tier":"community","version":""},"query_key":"oviond","schema_version":1,"status":"match"}