{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-07","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Planoly connects Claude to social content planning, scheduling, and performance. Create posts, manage media, set schedules, and review post results across linked accounts. Social networks are connected through Planoly, rather than by giving their login credentials to this connector.","did":"5ceb8704-204c-4da1-93fb-ef96294d5e7f","documentation_url":"https://planoly.ai/documentation","editorial_description":{"extended_description":"Supported networks include Instagram, TikTok, Facebook, YouTube, Pinterest, LinkedIn, Threads, and X. Available features include Instagram analytics, Pinterest boards, TikTok trending sounds, report share links, media uploads, and post updates or deletion.","schema_version":1,"summary":"Planoly connects Claude to social content planning, scheduling, and performance.\nCreate posts, manage media, set schedules, and review post results across linked accounts.\nSocial networks are connected through Planoly, rather than by giving their login credentials to this connector."},"homepage_url":"","icon":"","id":"5ceb8704-204c-4da1-93fb-ef96294d5e7f","installs":0,"last_scanned":"","license":"","long_description":"Supported networks include Instagram, TikTok, Facebook, YouTube, Pinterest, LinkedIn, Threads, and X. Available features include Instagram analytics, Pinterest boards, TikTok trending sounds, report share links, media uploads, and post updates or deletion.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The listing promises plan, schedule and publish capabilities and the complete inventory creates posts and sets post-group schedules.","reasoning":"Publishing or scheduling content to social channels communicates externally as the authenticated user.","risk_type":"messaging_as_user","severity":"high","title":"Schedules and publishes social posts","triggering_tools_or_skills":["create_post","set_post_group_schedule","update_post"]},{"evidence":"Both deletion tools explicitly remove stored media-library content or a post group.","reasoning":"Removing user-managed social assets or grouped posts is destructive to meaningful account data.","risk_type":"data_deletion","severity":"high","title":"Deletes media and post groups","triggering_tools_or_skills":["delete_media_library_item","delete_post_group"]},{"evidence":"The declared tool creates a Planoly asset from a URL supplied to the connector.","reasoning":"Fetching a caller-selected URL gives the hosted connector arbitrary outbound network reach within its validation rules.","risk_type":"arbitrary_network_access","severity":"low","title":"Imports assets from supplied URLs","triggering_tools_or_skills":["create_asset_from_url"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication is required; specific Planoly OAuth scopes and channel-level permissions are not present in the packet.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/5ceb8704-204c-4da1-93fb-ef96294d5e7f.json","what_it_proves":"Candidate PR #125 record identity (name \"Planoly\", publisher, type web_connector) and 24 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/5ceb8704-204c-4da1-93fb-ef96294d5e7f: complete tool_names inventory (24 tools), remote streamable-http endpoint https://mcp.planoly.com/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Planoly can publish social content and delete managed media or post groups.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:5ceb8704-204c-4da1-93fb-ef96294d5e7f","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 24 tools. Read tools cover channels, analytics and media; write tools manage posts and media. Tool schemas were unavailable, so runtime scope and URL validation still require verification.","risk_domains":{"arbitrary_network_access":"true","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":24,"tools_or_skills_total":24},"name":"Planoly","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=5ceb8704-204c-4da1-93fb-ef96294d5e7f&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.planoly.com/privacy-policy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Planoly","publisher_url":"https://www.planoly.com/","remote_url":"https://mcp.planoly.com/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: Publishing or scheduling content to social channels communicates externally as the authenticated user.","evidence":"Schedules and publishes social posts: The listing promises plan, schedule and publish capabilities and the complete inventory creates posts and sets post-group schedules.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Schedules and publishes social posts","triggering_tools":["create_post","set_post_group_schedule","update_post"]},{"description":"This connector can permanently remove data or resources. Review findings: Removing user-managed social assets or grouped posts is destructive to meaningful account data.","evidence":"Deletes media and post groups: Both deletion tools explicitly remove stored media-library content or a post group.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Deletes media and post groups","triggering_tools":["delete_media_library_item","delete_post_group"]},{"description":"This connector can send caller-provided data to an external service or publisher. Review findings: Fetching a caller-selected URL gives the hosted connector arbitrary outbound network reach within its validation rules.","evidence":"Imports assets from supplied URLs: The declared tool creates a Planoly asset from a URL supplied to the connector.","manual_risk_type":"arbitrary_network_access","remediation":{"block_tool_categories":["sends_externally"],"steps":["Do not include secrets, regulated data, or customer information unless the destination is approved.","Review the recipient's retention and deletion policy before enabling the connector."]},"risk_type":"forwards_data_to_third_party","severity":"low","title":"Imports assets from supplied URLs","triggering_tools":["create_asset_from_url"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@planoly.com","tags":["deletes_data","forwards_data_to_third_party","network_access","oauth_required","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"confirm_asset_upload"},{"description":"","name":"create_asset_from_url"},{"description":"","name":"create_media_library_folder"},{"description":"","name":"create_media_library_item"},{"description":"","name":"create_post","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Publishing or scheduling content to social channels communicates externally as the authenticated user."}},{"description":"","name":"create_post_report_share_link"},{"description":"","name":"delete_media_library_item","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Removing user-managed social assets or grouped posts is destructive to meaningful account data."}},{"description":"","name":"delete_post_group","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Removing user-managed social assets or grouped posts is destructive to meaningful account data."}},{"description":"","name":"get_instagram_account_posts"},{"description":"","name":"get_instagram_analytics"},{"description":"","name":"get_media_preview"},{"description":"","name":"list_channels"},{"description":"","name":"list_media_library"},{"description":"","name":"list_pinterest_boards"},{"description":"","name":"list_post_groups"},{"description":"","name":"list_post_performance"},{"description":"","name":"list_tiktok_trending_sounds"},{"description":"","name":"list_workspaces"},{"description":"","name":"request_asset_upload"},{"description":"","name":"search_instagram_locations"},{"description":"","name":"search_instagram_products"},{"description":"","name":"set_post_group_schedule","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Publishing or scheduling content to social channels communicates externally as the authenticated user."}},{"description":"","name":"update_media_library_item"},{"description":"","name":"update_post","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Publishing or scheduling content to social channels communicates externally as the authenticated user."}}],"tools_count":24,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/5ceb8704-204c-4da1-93fb-ef96294d5e7f","uuid":"39ffacb8-3e30-5d0f-8f44-62b29782de1f","verification_tier":"community","version":""},"query_key":"planoly planoly","schema_version":1,"status":"match"}