{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-21","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Pepita lets Claude build and maintain hosted websites. Edit pages, create previews, manage repeatable content such as posts or products, and publish changes. New content records stay drafts until published, while form tools inspect submissions and manage confirmation-email templates.","did":"58dc22cc-01cc-4aa6-af10-0de2afc3916e","documentation_url":"https://pepita.dev/developers","editorial_description":{"extended_description":"Sites can use a pepita.page address or custom domain and remain editable in the browser. Tools export form responses, manage content templates, and maintain videos and email-template assets. Creating a new site is described as making it live immediately.","schema_version":1,"summary":"Pepita lets Claude build and maintain hosted websites.\nEdit pages, create previews, manage repeatable content such as posts or products, and publish changes.\nNew content records stay drafts until published, while form tools inspect submissions and manage confirmation-email templates."},"homepage_url":"","icon":"","id":"58dc22cc-01cc-4aa6-af10-0de2afc3916e","installs":0,"last_scanned":"","license":"","long_description":"Sites can use a pepita.page address or custom domain and remain editable in the browser. Tools export form responses, manage content templates, and maintain videos and email-template assets. Creating a new site is described as making it live immediately.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"Tools change live public website state.","reasoning":"Deployment/publication is High.","risk_type":"deployment_infrastructure","severity":"high","title":"Publishes sites and content","triggering_tools_or_skills":["publish_site","publish_content_record","unpublish_content_record"]},{"evidence":"Tools explicitly delete meaningful site content.","reasoning":"Deletion is High.","risk_type":"data_deletion","severity":"high","title":"Deletes site resources","triggering_tools_or_skills":["delete_content_record","delete_email_template","delete_video","delete_preview"]},{"evidence":"Tools persist remote files/content.","reasoning":"File writes are Medium.","risk_type":"file_write","severity":"medium","title":"Writes site files/templates","triggering_tools_or_skills":["write_site_file","write_content_template","write_email_template"]},{"evidence":"Remote hosted implementation is unpinned.","reasoning":"Runtime capability can drift.","risk_type":"provenance_uncertainty","severity":"low","title":"Hosted implementation is mutable","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"OAuth/account authorization required; exact scopes are not documented.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/58dc22cc-01cc-4aa6-af10-0de2afc3916e.json","what_it_proves":"Candidate PR #125 record identity (name \"Pepita\", publisher, type web_connector) and 37 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/58dc22cc-01cc-4aa6-af10-0de2afc3916e: complete tool_names inventory (37 tools), remote streamable-http endpoint https://mcp.pepita.dev/mcp, auth_posture auth_required, publisher-declared permissions text, declared sensitive data types, directory tier community"}],"primary_reason":"Pepita deploys public websites/content and deletes site records, templates, previews, media, and forms.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:58dc22cc-01cc-4aa6-af10-0de2afc3916e","reviewed_at":"2026-10-10","reviewer_notes":"All declared tool names were reviewed; schemas were unavailable.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"true","deployment_or_infrastructure":"true","dynamic_hidden_actions":"false","filesystem_or_repo_access":"true","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":37,"tools_or_skills_total":37},"name":"Pepita","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=58dc22cc-01cc-4aa6-af10-0de2afc3916e&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://pepita.dev/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Pepita","publisher_url":"https://pepita.dev/","remote_url":"https://mcp.pepita.dev/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can deploy code or change infrastructure and production environments. Review findings: Deployment/publication is High.","evidence":"Publishes sites and content: Tools change live public website state.","manual_risk_type":"deployment_infrastructure","remediation":{"block_tool_categories":["code_execution","state_change"],"steps":["Default to a sandbox or staging environment.","Require code review, human approval, audit logging, and a tested rollback path for production changes."]},"risk_type":"code_deployment","severity":"high","title":"Publishes sites and content","triggering_tools":["publish_site","publish_content_record","unpublish_content_record"]},{"description":"This connector can permanently remove data or resources. Review findings: Deletion is High.","evidence":"Deletes site resources: Tools explicitly delete meaningful site content.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Deletes site resources","triggering_tools":["delete_content_record","delete_email_template","delete_video","delete_preview"]},{"description":"This connector can create, change, export, or otherwise write files. Review findings: File writes are Medium.","evidence":"Writes site files/templates: Tools persist remote files/content.","manual_risk_type":"file_write","remediation":{"block_tool_categories":["state_change"],"steps":["Limit file access to a dedicated working directory.","Review generated or modified files before they are shared or executed."]},"risk_type":"filesystem_access","severity":"medium","title":"Writes site files/templates","triggering_tools":["write_site_file","write_content_template","write_email_template"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@pepita.dev","tags":["code_deployment","deletes_data","filesystem_access","network_access","oauth_required","web_connector"],"tools":[{"description":"","name":"list_sites"},{"description":"","name":"create_site"},{"description":"","name":"get_site_status"},{"description":"","name":"list_site_files"},{"description":"","name":"read_site_file"},{"description":"","name":"write_site_file","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: File writes are Medium."}},{"description":"","name":"publish_site","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: Deployment/publication is High."}},{"description":"","name":"create_preview"},{"description":"","name":"list_previews"},{"description":"","name":"update_preview"},{"description":"","name":"delete_preview","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion is High."}},{"description":"","name":"list_content_templates"},{"description":"","name":"read_content_template"},{"description":"","name":"write_content_template","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: File writes are Medium."}},{"description":"","name":"save_content_template"},{"description":"","name":"delete_content_template"},{"description":"","name":"list_content_records"},{"description":"","name":"add_content_records"},{"description":"","name":"update_content_record"},{"description":"","name":"publish_content_record","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: Deployment/publication is High."}},{"description":"","name":"unpublish_content_record","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: Deployment/publication is High."}},{"description":"","name":"delete_content_record","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion is High."}},{"description":"","name":"get_form_records_count"},{"description":"","name":"list_form_records"},{"description":"","name":"get_form_export_url"},{"description":"","name":"list_email_templates"},{"description":"","name":"read_email_template"},{"description":"","name":"write_email_template","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: File writes are Medium."}},{"description":"","name":"save_email_template"},{"description":"","name":"delete_email_template","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion is High."}},{"description":"","name":"list_email_template_images"},{"description":"","name":"delete_email_template_image"},{"description":"","name":"list_videos"},{"description":"","name":"get_video_original_url"},{"description":"","name":"rename_video"},{"description":"","name":"delete_video","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion is High."}},{"description":"","name":"get_building_guide"}],"tools_count":37,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/58dc22cc-01cc-4aa6-af10-0de2afc3916e","uuid":"6318f7a2-68ce-5022-9cfb-d32295a12402","verification_tier":"community","version":""},"query_key":"pepita pepita","schema_version":1,"status":"match"}