{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-23","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Pearl helps analyze personal and business finances from linked accounts. Review cash flow, budgets, debts, subscriptions, and goals, then correct financial categories or plans. It requires an active Pearl subscription and at least one linked bank.","did":"6cb5242c-2649-4153-bc14-c497d879d62b","documentation_url":"https://joinpearlai.com/connect-claude","editorial_description":{"extended_description":"Accounts are linked through Plaid and scoped to your own account. Tools support business/personal tags, bill detection corrections, debt-payoff scenarios, and goal timelines. Pearl does not provide securities buy/sell advice.","schema_version":1,"summary":"Pearl helps analyze personal and business finances from linked accounts.\nReview cash flow, budgets, debts, subscriptions, and goals, then correct financial categories or plans.\nIt requires an active Pearl subscription and at least one linked bank."},"homepage_url":"","icon":"https://joinpearlai.com/pearl_logos/pearl_logo_256.png.","id":"6cb5242c-2649-4153-bc14-c497d879d62b","installs":0,"last_scanned":"","license":"","long_description":"Accounts are linked through Plaid and scoped to your own account. Tools support business/personal tags, bill detection corrections, debt-payoff scenarios, and goal timelines. Pearl does not provide securities buy/sell advice.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The complete inventory explicitly includes delete_recurring_bill.","reasoning":"Deleting a recurring financial record is a meaningful destructive action.","risk_type":"data_deletion","severity":"high","title":"Deletes recurring-bill records","triggering_tools_or_skills":["delete_recurring_bill"]},{"evidence":"These tools persist changes across personal and business financial records.","reasoning":"They materially alter sensitive account data.","risk_type":"data_modification","severity":"medium","title":"Creates and edits budgets, goals, bills and tax/account metadata","triggering_tools_or_skills":["annotate_transaction","create_goal","create_recurring_bill","recategorize_transactions","set_budget","update_goal","update_recurring_bill","update_tax_profile","mark_account_closed"]},{"evidence":"The connector covers spending, investments, debt, tax profile, cash and net worth.","reasoning":"These are highly sensitive private financial records.","risk_type":"private_data_read","severity":"low","title":"Reads broad personal and business financial data","triggering_tools_or_skills":["get_budgets","get_cash_accounts","get_debts","get_financial_snapshot","get_investments","get_tax_profile","query_financial_data"]},{"evidence":"The tool name does not reveal its query grammar or accessible datasets.","reasoning":"Runtime query semantics and authorization determine its exact reach.","risk_type":"generic_gateway","severity":"low","title":"Generic financial-data query is not statically bounded","triggering_tools_or_skills":["query_financial_data"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication is required; bank-link, tax and financial-record scopes are not documented in accessible official evidence.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/6cb5242c-2649-4153-bc14-c497d879d62b.json","what_it_proves":"Candidate PR #125 record identity (name \"Pearl\", publisher, type web_connector) and 34 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/6cb5242c-2649-4153-bc14-c497d879d62b: complete tool_names inventory (34 tools), remote streamable-http endpoint https://api.joinpearlai.com/functions/v1/pearl_mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Pearl can delete recurring-bill records and broadly modify sensitive financial data.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:6cb5242c-2649-4153-bc14-c497d879d62b","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 34 tools. get_connect_accounts_link appears to return a connection flow rather than itself creating credentials; that behavior still requires runtime verification.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"true","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":34,"tools_or_skills_total":34},"name":"Pearl","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=6cb5242c-2649-4153-bc14-c497d879d62b&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://joinpearlai.com/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Pearl Tech Inc.","publisher_url":"https://joinpearlai.com/","remote_url":"https://api.joinpearlai.com/functions/v1/pearl_mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can permanently remove data or resources. Review findings: Deleting a recurring financial record is a meaningful destructive action.","evidence":"Deletes recurring-bill records: The complete inventory explicitly includes delete_recurring_bill.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Deletes recurring-bill records","triggering_tools":["delete_recurring_bill"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially alter sensitive account data.","evidence":"Creates and edits budgets, goals, bills and tax/account metadata: These tools persist changes across personal and business financial records.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Creates and edits budgets, goals, bills and tax/account metadata","triggering_tools":["annotate_transaction","create_goal","create_recurring_bill","recategorize_transactions","set_budget","update_goal","update_recurring_bill","update_tax_profile","mark_account_closed"]},{"description":"This connector can read information available to the connected account and return it to the AI. Review findings: These are highly sensitive private financial records.","evidence":"Reads broad personal and business financial data: The connector covers spending, investments, debt, tax profile, cash and net worth.","manual_risk_type":"private_data_read","remediation":{"block_tool_categories":["data_exfiltration"],"steps":["Use a least-privilege account limited to the information required by the workflow.","Restrict folders, projects, tenants, and other data scopes wherever the provider allows it.","Review access logs for unexpected reads or bulk retrieval."]},"risk_type":"reads_private_data","severity":"low","title":"Reads broad personal and business financial data","triggering_tools":["get_budgets","get_cash_accounts","get_debts","get_financial_snapshot","get_investments","get_tax_profile","query_financial_data"]},{"description":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Runtime query semantics and authorization determine its exact reach.","evidence":"Generic financial-data query is not statically bounded: The tool name does not reveal its query grammar or accessible datasets.","manual_risk_type":"generic_gateway","remediation":{"block_tool_categories":["code_execution"],"steps":["Run only in a sandbox with least-privilege credentials and strict resource limits.","Disable generic execution gateways unless their reachable action set is fully understood.","Require approval before execution against production systems or sensitive data."]},"risk_type":"runs_code","severity":"low","title":"Generic financial-data query is not statically bounded","triggering_tools":["query_financial_data"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"pearl@pearltech.xyz","tags":["deletes_data","modifies_data","network_access","oauth_required","reads_private_data","runs_code","web_connector"],"tools":[{"description":"","name":"annotate_transaction","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially alter sensitive account data."}},{"description":"","name":"calculate_average_surplus"},{"description":"","name":"calculate_debt_payoff"},{"description":"","name":"calculate_dti"},{"description":"","name":"calculate_goal_timeline"},{"description":"","name":"calculate_net_worth"},{"description":"","name":"calculate_runway"},{"description":"","name":"create_goal","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially alter sensitive account data."}},{"description":"","name":"create_recurring_bill","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially alter sensitive account data."}},{"description":"","name":"delete_recurring_bill","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deleting a recurring financial record is a meaningful destructive action."}},{"description":"","name":"get_budgets"},{"description":"","name":"get_cash_accounts"},{"description":"","name":"get_connect_accounts_link"},{"description":"","name":"get_debts"},{"description":"","name":"get_financial_snapshot"},{"description":"","name":"get_goals"},{"description":"","name":"get_investments"},{"description":"","name":"get_plan_history"},{"description":"","name":"get_recurring_bills"},{"description":"","name":"get_tax_profile"},{"description":"","name":"project_cashflow"},{"description":"","name":"project_next_income"},{"description":"","name":"query_financial_data"},{"description":"","name":"recategorize_transactions","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially alter sensitive account data."}},{"description":"","name":"set_account_visibility"},{"description":"","name":"set_budget","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially alter sensitive account data."}},{"description":"","name":"simulate_scenario"},{"description":"","name":"tag_account_business_personal"},{"description":"","name":"tag_transactions_business_personal"},{"description":"","name":"update_goal","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially alter sensitive account data."}},{"description":"","name":"update_recurring_bill","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially alter sensitive account data."}},{"description":"","name":"update_tax_profile","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially alter sensitive account data."}},{"description":"","name":"submit_feedback"},{"description":"","name":"mark_account_closed","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially alter sensitive account data."}}],"tools_count":34,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/6cb5242c-2649-4153-bc14-c497d879d62b","uuid":"7a7f600e-45ca-5bed-a11e-53703f0e41bf","verification_tier":"community","version":""},"query_key":"pearl","schema_version":1,"status":"match"}