{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-28","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"high","description":"Reads and manages Pepper Cloud CRM data directly from Claude. Find or update contacts and opportunities, log activities, and review tickets and quotations. Explore conversation summaries and sentiment insights from your CRM data.","did":"228a07da-3059-4ffc-ab6b-66285df5f90f","documentation_url":"https://blog.peppercloud.com/pepper-cloud-assistai-now-inside-claude","editorial_description":{"extended_description":"Tools can create or update quotations and their status, save tickets and business records, and inspect module schemas or associated records. Xero-linked functions check or synchronize contacts and quotes when that integration is available.","schema_version":1,"summary":"Reads and manages Pepper Cloud CRM data directly from Claude.\nFind or update contacts and opportunities, log activities, and review tickets and quotations.\nExplore conversation summaries and sentiment insights from your CRM data."},"homepage_url":"","icon":"https://assistai.peppercloud.com/favicon.ico","id":"228a07da-3059-4ffc-ab6b-66285df5f90f","installs":0,"last_scanned":"","license":"","long_description":"Tools can create or update quotations and their status, save tickets and business records, and inspect module schemas or associated records. Xero-linked functions check or synchronize contacts and quotes when that integration is available.","manual_assessment":"medium","manual_review":{"all_findings":[{"evidence":"The declared inventory exposes these writes, and official docs confirm create/update support for leads, contacts, accounts, deals, tickets, quotations, activities and linked Xero quotations while explicitly excluding deletion.","reasoning":"These operations persistently change customer, sales and finance-workflow records, without an evidenced payment or external-send action.","risk_type":"data_modification","severity":"medium","title":"Creates and updates CRM and Xero-linked records","triggering_tools_or_skills":["create_quotation","save_activity","save_business_record","save_ticket","sync_xero_contact_tool","sync_xero_quote_tool","update_quotation","change_quotation_status"]}],"assessment_status":"provisional","auth_and_scopes":"OAuth 2.0 uses the connected Pepper Cloud login and existing CRM permissions; organization owners enable the connector for Team/Enterprise, and official docs state writes require user confirmation.","blocked_missing_evidence":null,"confidence":"high","displayed_risk":"medium","evidence_completeness":"complete","manual_overall_risk":"medium","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/228a07da-3059-4ffc-ab6b-66285df5f90f.json","what_it_proves":"Candidate PR #125 record identity (name \"Pepper Cloud\", publisher, type web_connector) and 30 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/228a07da-3059-4ffc-ab6b-66285df5f90f: complete tool_names inventory (30 tools), remote streamable-http endpoint https://assistai.peppercloud.com/mcp, auth_posture auth_required, directory tier community"},{"accessed_at":"2026-10-10T21:24:12Z","url_or_path":"https://blog.peppercloud.com/pepper-cloud-assistai-now-inside-claude","what_it_proves":"Official Pepper Cloud documentation states the connector can create/update CRM records, activities, tickets and Xero quotations, cannot delete, respects existing permissions, and requests confirmation before changes."}],"primary_reason":"Pepper Cloud can create and update sensitive CRM and Xero-linked records but official docs explicitly exclude deletion.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:228a07da-3059-4ffc-ab6b-66285df5f90f","reviewed_at":"2026-10-10","reviewer_notes":"Official docs cover supported objects and permission behavior. Creating CRM meetings/events is treated as an internal activity record because no invitation/send action is documented; verify that sync tools cannot finalize or send a quotation.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":30,"tools_or_skills_total":30},"name":"Pepper Cloud","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=228a07da-3059-4ffc-ab6b-66285df5f90f&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://peppercloud.com/privacy/","provisional_risk":null,"publication_recommendation":"accept","publisher":"Pepper Cloud","publisher_url":"https://peppercloud.com/","remote_url":"https://assistai.peppercloud.com/mcp","repository_url":"","risk":"medium","risk_severity":"medium","security_risks":[{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These operations persistently change customer, sales and finance-workflow records, without an evidenced payment or external-send action.","evidence":"Creates and updates CRM and Xero-linked records: The declared inventory exposes these writes, and official docs confirm create/update support for leads, contacts, accounts, deals, tickets, quotations, activities and linked Xero quotations while explicitly excluding deletion.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Creates and updates CRM and Xero-linked records","triggering_tools":["create_quotation","save_activity","save_business_record","save_ticket","sync_xero_contact_tool","sync_xero_quote_tool","update_quotation","change_quotation_status"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@peppercloud.com","tags":["accesses_messaging","modifies_data","network_access","oauth_required","web_connector"],"tools":[{"description":"","name":"change_quotation_status","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These operations persistently change customer, sales and finance-workflow records, without an evidenced payment or external-send action."}},{"description":"","name":"check_xero_contact_link_tool"},{"description":"","name":"create_quotation","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These operations persistently change customer, sales and finance-workflow records, without an evidenced payment or external-send action."}},{"description":"","name":"get_accessible_modules"},{"description":"","name":"get_activities"},{"description":"","name":"get_associated_records"},{"description":"","name":"get_conversation_users"},{"description":"","name":"get_conversations_aggregate"},{"description":"","name":"get_conversations_aggregate_paginated"},{"description":"","name":"get_crm_users"},{"description":"","name":"get_current_date"},{"description":"","name":"get_exchange_rate"},{"description":"","name":"get_integrations"},{"description":"","name":"get_module_schema"},{"description":"","name":"get_quotation_by_id"},{"description":"","name":"get_quotation_form"},{"description":"","name":"get_quotations_aggregate_paginated"},{"description":"","name":"get_records_paginated"},{"description":"","name":"get_suggestion_params"},{"description":"","name":"get_ticket_info"},{"description":"","name":"get_tickets_aggregate_paginated"},{"description":"","name":"get_xero_contacts"},{"description":"","name":"save_activity","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These operations persistently change customer, sales and finance-workflow records, without an evidenced payment or external-send action."}},{"description":"","name":"save_business_record","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These operations persistently change customer, sales and finance-workflow records, without an evidenced payment or external-send action."}},{"description":"","name":"save_ticket","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These operations persistently change customer, sales and finance-workflow records, without an evidenced payment or external-send action."}},{"description":"","name":"search_knowledge_base"},{"description":"","name":"sync_xero_contact_tool","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These operations persistently change customer, sales and finance-workflow records, without an evidenced payment or external-send action."}},{"description":"","name":"sync_xero_quote_tool","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These operations persistently change customer, sales and finance-workflow records, without an evidenced payment or external-send action."}},{"description":"","name":"update_quotation","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These operations persistently change customer, sales and finance-workflow records, without an evidenced payment or external-send action."}},{"description":"","name":"validate_pipeline"}],"tools_count":30,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/228a07da-3059-4ffc-ab6b-66285df5f90f","uuid":"fc8a03ff-6e12-5b80-822d-4ba5fd0e378d","verification_tier":"community","version":""},"query_key":"pepper cloud","schema_version":1,"status":"match"}