{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-14","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"PartnerOS supports partner-program recruitment, enablement, and deal operations. Research or score partners, prepare pitch materials, and track leads or opportunities. Register deals, manage training progress, and respond to co-marketing workflows.","did":"79460603-a261-4c15-90b3-17e5f0dce336","documentation_url":"https://docs.partneros.ai/","editorial_description":{"extended_description":"Authenticated tools create partners and action items, send invitations, enroll partners, and update certifications or statuses. Email tools create drafts.","schema_version":1,"summary":"PartnerOS supports partner-program recruitment, enablement, and deal operations.\nResearch or score partners, prepare pitch materials, and track leads or opportunities.\nRegister deals, manage training progress, and respond to co-marketing workflows."},"homepage_url":"","icon":"","id":"79460603-a261-4c15-90b3-17e5f0dce336","installs":0,"last_scanned":"","license":"","long_description":"Authenticated tools create partners and action items, send invitations, enroll partners, and update certifications or statuses. Email tools create drafts.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"These tools send consequential partner-facing invitations/responses.","reasoning":"They communicate externally as the authenticated organization.","risk_type":"messaging_as_user","severity":"high","title":"Invites partners and responds to co-marketing requests","triggering_tools_or_skills":["invite_partner","respond_to_comarketing"]},{"evidence":"These operations persist relationship, pipeline and enablement state.","reasoning":"They materially alter shared partner-operations data.","risk_type":"data_modification","severity":"medium","title":"Creates partners, leads, opportunities, deals and workflow records","triggering_tools_or_skills":["create_partner","create_lead","create_opportunity","register_deal","enroll_partner","update_partner_status","update_certification_status"]},{"evidence":"The packet exposes web search/fetch without a fixed source catalogue.","reasoning":"It retrieves untrusted external content and can contact caller-selected resources.","risk_type":"arbitrary_network_access","severity":"low","title":"Searches/fetches public web content","triggering_tools_or_skills":["web_search","search","fetch"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication to a PartnerOS workspace is required; partner invitation, enrollment, certification and deal-registration permissions are not documented.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/79460603-a261-4c15-90b3-17e5f0dce336.json","what_it_proves":"Candidate PR #125 record identity (name \"PartnerOS\", publisher, type web_connector) and 42 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/79460603-a261-4c15-90b3-17e5f0dce336: complete tool_names inventory (42 tools), remote streamable-http endpoint https://app.partneros.ai/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"PartnerOS sends partner invitations/co-marketing responses and broadly modifies partner/deal operations.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:79460603-a261-4c15-90b3-17e5f0dce336","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 42 tools. draft_partner_email only drafts; High is based on explicit invite/respond actions, not the draft tool.","risk_domains":{"arbitrary_network_access":"true","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":42,"tools_or_skills_total":42},"name":"PartnerOS","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=79460603-a261-4c15-90b3-17e5f0dce336&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.partneros.ai/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"PartnerOS, Inc.","publisher_url":"https://partneros.ai/","remote_url":"https://app.partneros.ai/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: They communicate externally as the authenticated organization.","evidence":"Invites partners and responds to co-marketing requests: These tools send consequential partner-facing invitations/responses.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Invites partners and responds to co-marketing requests","triggering_tools":["invite_partner","respond_to_comarketing"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially alter shared partner-operations data.","evidence":"Creates partners, leads, opportunities, deals and workflow records: These operations persist relationship, pipeline and enablement state.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Creates partners, leads, opportunities, deals and workflow records","triggering_tools":["create_partner","create_lead","create_opportunity","register_deal","enroll_partner","update_partner_status","update_certification_status"]},{"description":"This connector can send caller-provided data to an external service or publisher. Review findings: It retrieves untrusted external content and can contact caller-selected resources.","evidence":"Searches/fetches public web content: The packet exposes web search/fetch without a fixed source catalogue.","manual_risk_type":"arbitrary_network_access","remediation":{"block_tool_categories":["sends_externally"],"steps":["Do not include secrets, regulated data, or customer information unless the destination is approved.","Review the recipient's retention and deletion policy before enabling the connector."]},"risk_type":"forwards_data_to_third_party","severity":"low","title":"Searches/fetches public web content","triggering_tools":["web_search","search","fetch"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@partneros.ai","tags":["forwards_data_to_third_party","modifies_data","network_access","oauth_required","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"assess_artifact"},{"description":"","name":"create_action_item"},{"description":"","name":"create_lead","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially alter shared partner-operations data."}},{"description":"","name":"create_opportunity","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially alter shared partner-operations data."}},{"description":"","name":"create_partner","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially alter shared partner-operations data."}},{"description":"","name":"draft_partner_email"},{"description":"","name":"draft_variants"},{"description":"","name":"edit_icp"},{"description":"","name":"edit_ipp"},{"description":"","name":"edit_opportunity"},{"description":"","name":"edit_pitch_slide"},{"description":"","name":"enroll_partner","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially alter shared partner-operations data."}},{"description":"","name":"fetch"},{"description":"","name":"filter_by_icp"},{"description":"","name":"generate_one_pager"},{"description":"","name":"generate_workflow"},{"description":"","name":"invite_partner","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: They communicate externally as the authenticated organization."}},{"description":"","name":"list_certifications"},{"description":"","name":"list_pending_co_marketing"},{"description":"","name":"list_training_progress"},{"description":"","name":"log_services_engagement"},{"description":"","name":"lookup_partner"},{"description":"","name":"query_action_items"},{"description":"","name":"query_deal_registrations"},{"description":"","name":"query_leads"},{"description":"","name":"query_opportunities"},{"description":"","name":"query_partners"},{"description":"","name":"query_trainings"},{"description":"","name":"rank_records"},{"description":"","name":"read_cjm"},{"description":"","name":"read_deals"},{"description":"","name":"read_executive_summary"},{"description":"","name":"read_icp"},{"description":"","name":"read_ipp"},{"description":"","name":"read_joint_plan"},{"description":"","name":"register_deal","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially alter shared partner-operations data."}},{"description":"","name":"respond_to_comarketing","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: They communicate externally as the authenticated organization."}},{"description":"","name":"score_deal_health"},{"description":"","name":"search"},{"description":"","name":"update_certification_status","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially alter shared partner-operations data."}},{"description":"","name":"update_partner_status","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially alter shared partner-operations data."}},{"description":"","name":"web_search"}],"tools_count":42,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/79460603-a261-4c15-90b3-17e5f0dce336","uuid":"d34eb78e-99ce-50c8-a2db-aa253d8bf087","verification_tier":"community","version":""},"query_key":"partneros","schema_version":1,"status":"match"}