{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-03","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Pipedrive connects Claude to live CRM deals, leads, contacts, and activities. Review pipelines, update records, add notes, and schedule follow-ups. Existing permissions apply; a paid Pipedrive plan is required.","did":"30f3f2c8-e6e4-4bf9-845f-46f5afeea73a","documentation_url":"https://www.pipedrive.com/en/features/mcp-server","editorial_description":{"extended_description":"Tools also convert leads into deals and check conversion status, retrieve pipeline stages, and search customer records. It is maintained by Pipedrive and connects through OAuth. Changes occur in the live CRM account.","schema_version":1,"summary":"Pipedrive connects Claude to live CRM deals, leads, contacts, and activities.\nReview pipelines, update records, add notes, and schedule follow-ups.\nExisting permissions apply; a paid Pipedrive plan is required."},"homepage_url":"","icon":"","id":"30f3f2c8-e6e4-4bf9-845f-46f5afeea73a","installs":0,"last_scanned":"","license":"","long_description":"Tools also convert leads into deals and check conversion status, retrieve pipeline stages, and search customer records. It is maintained by Pipedrive and connects through OAuth. Changes occur in the live CRM account.","manual_assessment":"medium","manual_review":{"all_findings":[{"evidence":"The complete inventory contains persistent create, conversion and update operations over core CRM objects.","reasoning":"These actions change customer, pipeline and follow-up state but do not directly delete records or send external messages.","risk_type":"data_modification","severity":"medium","title":"Creates and updates CRM records and activities","triggering_tools_or_skills":["addActivity","addDeal","addLead","addNote","addOrganization","addPerson","convertLeadToDeal","updateActivity","updateDeal","updateLead","updateNote","updateOrganization","updatePerson"]}],"assessment_status":"provisional","auth_and_scopes":"Pipedrive OAuth respects the connected user's existing CRM permissions; the packet does not enumerate OAuth scopes.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"medium","evidence_completeness":"complete","manual_overall_risk":"medium","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/30f3f2c8-e6e4-4bf9-845f-46f5afeea73a.json","what_it_proves":"Candidate PR #125 record identity (name \"Pipedrive\", publisher, type web_connector) and 32 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/30f3f2c8-e6e4-4bf9-845f-46f5afeea73a: complete tool_names inventory (32 tools), remote streamable-http endpoint https://mcp.pipedrive.ai/mcp, auth_posture auth_required, directory tier partner"}],"primary_reason":"Pipedrive can create and update live CRM data under the connected user's permissions.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:30f3f2c8-e6e4-4bf9-845f-46f5afeea73a","reviewed_at":"2026-10-10","reviewer_notes":"Scheduling an internal activity is not treated as sending an invitation because no email/message action or recipient side effect is documented.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":32,"tools_or_skills_total":32},"name":"Pipedrive","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=30f3f2c8-e6e4-4bf9-845f-46f5afeea73a&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.pipedrive.com/en/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Pipedrive","publisher_url":"https://pipedrive.com/","remote_url":"https://mcp.pipedrive.ai/mcp","repository_url":"","risk":"medium","risk_severity":"medium","security_risks":[{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions change customer, pipeline and follow-up state but do not directly delete records or send external messages.","evidence":"Creates and updates CRM records and activities: The complete inventory contains persistent create, conversion and update operations over core CRM objects.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Creates and updates CRM records and activities","triggering_tools":["addActivity","addDeal","addLead","addNote","addOrganization","addPerson","convertLeadToDeal","updateActivity","updateDeal","updateLead","updateNote","updateOrganization","updatePerson"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://support.pipedrive.com/en/contact-us","tags":["modifies_data","network_access","oauth_required","web_connector"],"tools":[{"description":"","name":"addActivity","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions change customer, pipeline and follow-up state but do not directly delete records or send external messages."}},{"description":"","name":"addDeal","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions change customer, pipeline and follow-up state but do not directly delete records or send external messages."}},{"description":"","name":"addNote","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions change customer, pipeline and follow-up state but do not directly delete records or send external messages."}},{"description":"","name":"addOrganization","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions change customer, pipeline and follow-up state but do not directly delete records or send external messages."}},{"description":"","name":"addPerson","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions change customer, pipeline and follow-up state but do not directly delete records or send external messages."}},{"description":"","name":"convertLeadToDeal","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions change customer, pipeline and follow-up state but do not directly delete records or send external messages."}},{"description":"","name":"getActivities"},{"description":"","name":"getActivity"},{"description":"","name":"getDeal"},{"description":"","name":"getDeals"},{"description":"","name":"getLeadConversionStatus"},{"description":"","name":"getNote"},{"description":"","name":"getNotes"},{"description":"","name":"getOrganization"},{"description":"","name":"getOrganizations"},{"description":"","name":"getPerson"},{"description":"","name":"getPersons"},{"description":"","name":"getStage"},{"description":"","name":"getStages"},{"description":"","name":"searchDeals"},{"description":"","name":"searchLeads"},{"description":"","name":"searchOrganization"},{"description":"","name":"searchPersons"},{"description":"","name":"updateActivity","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions change customer, pipeline and follow-up state but do not directly delete records or send external messages."}},{"description":"","name":"updateDeal","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions change customer, pipeline and follow-up state but do not directly delete records or send external messages."}},{"description":"","name":"updateNote","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions change customer, pipeline and follow-up state but do not directly delete records or send external messages."}},{"description":"","name":"updateOrganization","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions change customer, pipeline and follow-up state but do not directly delete records or send external messages."}},{"description":"","name":"updatePerson","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions change customer, pipeline and follow-up state but do not directly delete records or send external messages."}},{"description":"","name":"getLeads"},{"description":"","name":"getLead"},{"description":"","name":"addLead","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions change customer, pipeline and follow-up state but do not directly delete records or send external messages."}},{"description":"","name":"updateLead","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions change customer, pipeline and follow-up state but do not directly delete records or send external messages."}}],"tools_count":32,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/30f3f2c8-e6e4-4bf9-845f-46f5afeea73a","uuid":"3f80f94e-a649-5f4d-8f6c-7fa047a252f0","verification_tier":"partner","version":""},"query_key":"pipedrive pipedrive","schema_version":1,"status":"match"}