{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-06","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Pagos connects Claude to payment-card BIN information and your harmonized payments data. Look up card issuers and types, or analyze transactions, disputes, refunds, and fees. Compare payment performance and costs across processors, geographies, and card categories.","did":"49619ee1-ff2b-41a5-9b7f-9d998cb4d9cc","documentation_url":"https://docs.pagos.ai/mcp/getting-started-with-pagos-mcp-server","editorial_description":{"extended_description":"BIN lookups return card brand, issuer, network, and type information. Separate metric and dimension tools describe the available transaction, dispute, refund, and fee datasets before queries are constructed.","schema_version":1,"summary":"Pagos connects Claude to payment-card BIN information and your harmonized payments data.\nLook up card issuers and types, or analyze transactions, disputes, refunds, and fees.\nCompare payment performance and costs across processors, geographies, and card categories."},"homepage_url":"","icon":"","id":"49619ee1-ff2b-41a5-9b7f-9d998cb4d9cc","installs":0,"last_scanned":"","license":"","long_description":"BIN lookups return card brand, issuer, network, and type information. Separate metric and dimension tools describe the available transaction, dispute, refund, and fee datasets before queries are constructed.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The description says natural-language queries analyze harmonized payment events across processors, geographies and card types.","reasoning":"These calls execute user-selected analytics queries against sensitive transaction data.","risk_type":"query_execution","severity":"high","title":"Executes queries over private payments data","triggering_tools_or_skills":["query_dispute_data","query_fee_data","query_refund_data","query_transaction_data"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication grants access to harmonized transaction, refund, dispute and fee data across the business's payment processors plus BIN lookup.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"complete","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/49619ee1-ff2b-41a5-9b7f-9d998cb4d9cc.json","what_it_proves":"Candidate PR #125 record identity (name \"Pagos\", publisher, type web_connector) and 14 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/49619ee1-ff2b-41a5-9b7f-9d998cb4d9cc: complete tool_names inventory (14 tools), remote streamable-http endpoint https://mcp.pagos.ai/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Pagos queries sensitive harmonized payments, refunds, disputes and fees.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:49619ee1-ff2b-41a5-9b7f-9d998cb4d9cc","reviewed_at":"2026-10-10","reviewer_notes":"Enforce aggregation/redaction for cardholder and transaction details.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"false","persistent_credentials":"true","prompt_injection_exposure":"false","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"true","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":14,"tools_or_skills_total":14},"name":"Pagos","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=49619ee1-ff2b-41a5-9b7f-9d998cb4d9cc&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://pagos.ai/legal/privacy-policy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Pagos.ai","publisher_url":"https://pagos.ai/","remote_url":"https://mcp.pagos.ai/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: These calls execute user-selected analytics queries against sensitive transaction data.","evidence":"Executes queries over private payments data: The description says natural-language queries analyze harmonized payment events across processors, geographies and card types.","manual_risk_type":"query_execution","remediation":{"block_tool_categories":["code_execution"],"steps":["Run only in a sandbox with least-privilege credentials and strict resource limits.","Disable generic execution gateways unless their reachable action set is fully understood.","Require approval before execution against production systems or sensitive data."]},"risk_type":"runs_code","severity":"high","title":"Executes queries over private payments data","triggering_tools":["query_dispute_data","query_fee_data","query_refund_data","query_transaction_data"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@pagos.ai","tags":["network_access","oauth_required","runs_code","web_connector"],"tools":[{"description":"","name":"get_bin_data"},{"description":"","name":"hello"},{"description":"","name":"list_dispute_dimensions"},{"description":"","name":"list_dispute_metrics"},{"description":"","name":"list_fee_dimensions"},{"description":"","name":"list_fee_metrics"},{"description":"","name":"list_refund_dimensions"},{"description":"","name":"list_refund_metrics"},{"description":"","name":"list_transaction_dimensions"},{"description":"","name":"list_transaction_metrics"},{"description":"","name":"query_dispute_data","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: These calls execute user-selected analytics queries against sensitive transaction data."}},{"description":"","name":"query_fee_data","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: These calls execute user-selected analytics queries against sensitive transaction data."}},{"description":"","name":"query_refund_data","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: These calls execute user-selected analytics queries against sensitive transaction data."}},{"description":"","name":"query_transaction_data","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: These calls execute user-selected analytics queries against sensitive transaction data."}}],"tools_count":14,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/49619ee1-ff2b-41a5-9b7f-9d998cb4d9cc","uuid":"05e5cff1-698c-5149-892c-45542d10c570","verification_tier":"community","version":""},"query_key":"pagos","schema_version":1,"status":"match"}