{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-04","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Query and manage connected data through Peaka. Explore tables and schemas, build reusable queries and work with semantic catalogs. Create or refresh caches and inspect data-processing status for reporting workflows.","did":"10f28d24-1e56-434f-aa92-9c9cb53aec91","documentation_url":"https://docs.peaka.com/mcp/overview","editorial_description":{"extended_description":"Tools retrieve projects, connections, relationships and table statistics. They also create, update or delete saved queries, caches and semantic tables. Access requires an authenticated Peaka account and includes management actions as well as queries.","schema_version":1,"summary":"Query and manage connected data through Peaka.\nExplore tables and schemas, build reusable queries and work with semantic catalogs.\nCreate or refresh caches and inspect data-processing status for reporting workflows."},"homepage_url":"","icon":"","id":"10f28d24-1e56-434f-aa92-9c9cb53aec91","installs":0,"last_scanned":"","license":"","long_description":"Tools retrieve projects, connections, relationships and table statistics. They also create, update or delete saved queries, caches and semantic tables. Access requires an authenticated Peaka account and includes management actions as well as queries.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The complete inventory explicitly includes SQL-query and query execution tools.","reasoning":"Arbitrary SQL or equivalent remote queries can expose or alter connected data depending on backend permissions.","risk_type":"query_execution","severity":"high","title":"Executes SQL and saved queries","triggering_tools_or_skills":["peaka_execute_query","peaka_execute_sql_query"]},{"evidence":"Three declared tools explicitly delete persistent Peaka resources.","reasoning":"These actions destroy analytical and semantic data assets.","risk_type":"data_deletion","severity":"high","title":"Deletes caches, queries and semantic tables","triggering_tools_or_skills":["peaka_delete_cache","peaka_delete_query","peaka_delete_semantic_table"]},{"evidence":"The named tools create, refresh and update caches, queries, semantic catalogs and semantic tables.","reasoning":"They materially modify shared analytical state.","risk_type":"data_modification","severity":"medium","title":"Creates and updates governed data products","triggering_tools_or_skills":["peaka_create_cache","peaka_create_query","peaka_create_semantic_catalog","peaka_create_semantic_table","peaka_refresh_cache_full","peaka_refresh_cache_incremental","peaka_update_cache","peaka_update_query"]},{"evidence":"Query results, metadata and saved query text originate in connected user databases and workspaces.","reasoning":"Database content can include untrusted text.","risk_type":"prompt_injection_exposure","severity":"low","title":"Connected data and saved queries enter model context","triggering_tools_or_skills":["peaka_execute_query","peaka_execute_sql_query","peaka_get_query","peaka_get_project_metadata"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication is required for Peaka projects and data connections; SQL execution permissions, connection scopes and confirmation gates are not documented.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/10f28d24-1e56-434f-aa92-9c9cb53aec91.json","what_it_proves":"Candidate PR #125 record identity (name \"Peaka\", publisher, type web_connector) and 32 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/10f28d24-1e56-434f-aa92-9c9cb53aec91: complete tool_names inventory (32 tools), remote streamable-http endpoint https://mcp.peaka.studio/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Declared tools execute SQL and delete Peaka query, cache and semantic-table resources.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:10f28d24-1e56-434f-aa92-9c9cb53aec91","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 32 names. Runtime verification should confirm whether SQL is read-only or can mutate connected sources and which database credentials and roles it inherits.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"true","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":32,"tools_or_skills_total":32},"name":"Peaka","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=10f28d24-1e56-434f-aa92-9c9cb53aec91&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.peaka.com/privacy-policy/","provisional_risk":null,"publication_recommendation":"accept","publisher":"Peaka","publisher_url":"https://peaka.com/","remote_url":"https://mcp.peaka.studio/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Arbitrary SQL or equivalent remote queries can expose or alter connected data depending on backend permissions.","evidence":"Executes SQL and saved queries: The complete inventory explicitly includes SQL-query and query execution tools.","manual_risk_type":"query_execution","remediation":{"block_tool_categories":["code_execution"],"steps":["Run only in a sandbox with least-privilege credentials and strict resource limits.","Disable generic execution gateways unless their reachable action set is fully understood.","Require approval before execution against production systems or sensitive data."]},"risk_type":"runs_code","severity":"high","title":"Executes SQL and saved queries","triggering_tools":["peaka_execute_query","peaka_execute_sql_query"]},{"description":"This connector can permanently remove data or resources. Review findings: These actions destroy analytical and semantic data assets.","evidence":"Deletes caches, queries and semantic tables: Three declared tools explicitly delete persistent Peaka resources.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Deletes caches, queries and semantic tables","triggering_tools":["peaka_delete_cache","peaka_delete_query","peaka_delete_semantic_table"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially modify shared analytical state.","evidence":"Creates and updates governed data products: The named tools create, refresh and update caches, queries, semantic catalogs and semantic tables.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Creates and updates governed data products","triggering_tools":["peaka_create_cache","peaka_create_query","peaka_create_semantic_catalog","peaka_create_semantic_table","peaka_refresh_cache_full","peaka_refresh_cache_incremental","peaka_update_cache","peaka_update_query"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://github.com/peakacom/peaka-mcp-server/issues","tags":["deletes_data","modifies_data","network_access","oauth_required","runs_code","web_connector"],"tools":[{"description":"","name":"peaka_create_cache","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially modify shared analytical state."}},{"description":"","name":"peaka_create_cache_batch"},{"description":"","name":"peaka_create_query","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially modify shared analytical state."}},{"description":"","name":"peaka_create_semantic_catalog","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially modify shared analytical state."}},{"description":"","name":"peaka_create_semantic_table","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially modify shared analytical state."}},{"description":"","name":"peaka_delete_cache","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions destroy analytical and semantic data assets."}},{"description":"","name":"peaka_delete_query","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions destroy analytical and semantic data assets."}},{"description":"","name":"peaka_delete_semantic_table","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions destroy analytical and semantic data assets."}},{"description":"","name":"peaka_execute_query","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Arbitrary SQL or equivalent remote queries can expose or alter connected data depending on backend permissions."}},{"description":"","name":"peaka_execute_sql_query","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Arbitrary SQL or equivalent remote queries can expose or alter connected data depending on backend permissions."}},{"description":"","name":"peaka_get_cache_statuses"},{"description":"","name":"peaka_get_connection_detail"},{"description":"","name":"peaka_get_materialized_query_statuses"},{"description":"","name":"peaka_get_metadata_refresh_status"},{"description":"","name":"peaka_get_project_metadata"},{"description":"","name":"peaka_get_query"},{"description":"","name":"peaka_get_relations"},{"description":"","name":"peaka_get_table_statistics"},{"description":"","name":"peaka_list_catalogs"},{"description":"","name":"peaka_list_columns"},{"description":"","name":"peaka_list_connections"},{"description":"","name":"peaka_list_projects"},{"description":"","name":"peaka_list_queries"},{"description":"","name":"peaka_list_schemas"},{"description":"","name":"peaka_list_tables"},{"description":"","name":"peaka_query_golden_sqls"},{"description":"","name":"peaka_refresh_cache_full","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially modify shared analytical state."}},{"description":"","name":"peaka_refresh_cache_incremental","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially modify shared analytical state."}},{"description":"","name":"peaka_refresh_materialized_query"},{"description":"","name":"peaka_refresh_project_metadata"},{"description":"","name":"peaka_update_cache","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially modify shared analytical state."}},{"description":"","name":"peaka_update_query","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially modify shared analytical state."}}],"tools_count":32,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/10f28d24-1e56-434f-aa92-9c9cb53aec91","uuid":"9f9649b2-43b6-5165-a757-62782a6b20e7","verification_tier":"community","version":""},"query_key":"peaka peaka","schema_version":1,"status":"match"}