{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-10","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"CoCanvas connects interior-design projects, room selections, moodboards, and tasks to Claude. Look up project context or optionally add content and draft purchase orders or invoices. You review and send drafts yourself; financial records are not available to assistants.","did":"f7caea8e-88b0-41b4-862e-542c6c1912d4","documentation_url":"https://cocanvas.studio/help","editorial_description":{"extended_description":"Create editable room boards, add products or notes, and save files to the AI Assistant folder. The connector cannot send documents or messages, record or refund payments, delete content, or change team, billing, or integrations.","schema_version":1,"summary":"CoCanvas connects interior-design projects, room selections, moodboards, and tasks to Claude.\nLook up project context or optionally add content and draft purchase orders or invoices.\nYou review and send drafts yourself; financial records are not available to assistants."},"homepage_url":"","icon":"","id":"f7caea8e-88b0-41b4-862e-542c6c1912d4","installs":0,"last_scanned":"","license":"","long_description":"Create editable room boards, add products or notes, and save files to the AI Assistant folder. The connector cannot send documents or messages, record or refund payments, delete content, or change team, billing, or integrations.","manual_assessment":"medium","manual_review":{"all_findings":[{"evidence":"The connector creates editable boards, tasks, notes, products, uploads, and draft invoices/purchase orders inside CoCanvas.","reasoning":"These writes alter shared design and financial-draft records, but no finalize, issue, approve, or payment tool is declared.","risk_type":"data_modification","severity":"medium","title":"Projects, moodboards, products, tasks, files, notes, and draft POs/invoices can be created","triggering_tools_or_skills":["create_room_board","add_product","create_task","add_project_note","upload_file_inline","create_draft_invoice","create_draft_po"]},{"evidence":"The listing and tools retrieve project selections, paint/product choices, moodboards, vendors, clients, RFQs, POs, rooms, and team members.","reasoning":"This is confidential client, project, supplier, and commercial data.","risk_type":"private_data_read","severity":"medium","title":"Clients, vendors, projects, RFQs, POs, and designs are exposed","triggering_tools_or_skills":["list_clients","list_vendors","list_projects","list_rfqs","list_pos","get_room_design"]},{"evidence":"Uploaded files, project notes, and client/product content are user- or third-party-authored.","reasoning":"Workspace content is untrusted model input.","risk_type":"prompt_injection_exposure","severity":"low","title":"Client project files and notes enter context","triggering_tools_or_skills":["get_project","list_project_notes","get_board","fetch"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication grants CoCanvas access to design projects, clients, vendors, tasks, files, RFQs, POs, and draft financial documents; exact roles are not stated.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"medium","evidence_completeness":"partial","manual_overall_risk":"medium","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/f7caea8e-88b0-41b4-862e-542c6c1912d4.json","what_it_proves":"Candidate PR #125 record identity (name \"CoCanvas\", publisher, type web_connector) and 34 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/f7caea8e-88b0-41b4-862e-542c6c1912d4: complete tool_names inventory (34 tools), remote streamable-http endpoint https://cocanvas.studio/api/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"CoCanvas modifies private project data and financial drafts but exposes no committing invoice/PO or external send action.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:f7caea8e-88b0-41b4-862e-542c6c1912d4","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 34 tools; explain_unavailable_action supports the claim that some higher-impact actions are withheld.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":34,"tools_or_skills_total":34},"name":"CoCanvas","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=f7caea8e-88b0-41b4-862e-542c6c1912d4&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://cocanvas.studio/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Planory LLC","publisher_url":"https://cocanvas.studio/","remote_url":"https://cocanvas.studio/api/mcp","repository_url":"","risk":"medium","risk_severity":"medium","security_risks":[{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These writes alter shared design and financial-draft records, but no finalize, issue, approve, or payment tool is declared.","evidence":"Projects, moodboards, products, tasks, files, notes, and draft POs/invoices can be created: The connector creates editable boards, tasks, notes, products, uploads, and draft invoices/purchase orders inside CoCanvas.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Projects, moodboards, products, tasks, files, notes, and draft POs/invoices can be created","triggering_tools":["create_room_board","add_product","create_task","add_project_note","upload_file_inline","create_draft_invoice","create_draft_po"]},{"description":"This connector can read information available to the connected account and return it to the AI. Review findings: This is confidential client, project, supplier, and commercial data.","evidence":"Clients, vendors, projects, RFQs, POs, and designs are exposed: The listing and tools retrieve project selections, paint/product choices, moodboards, vendors, clients, RFQs, POs, rooms, and team members.","manual_risk_type":"private_data_read","remediation":{"block_tool_categories":["data_exfiltration"],"steps":["Use a least-privilege account limited to the information required by the workflow.","Restrict folders, projects, tenants, and other data scopes wherever the provider allows it.","Review access logs for unexpected reads or bulk retrieval."]},"risk_type":"reads_private_data","severity":"medium","title":"Clients, vendors, projects, RFQs, POs, and designs are exposed","triggering_tools":["list_clients","list_vendors","list_projects","list_rfqs","list_pos","get_room_design"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@cocanvas.studio","tags":["modifies_data","network_access","oauth_required","reads_private_data","web_connector"],"tools":[{"description":"","name":"add_product","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These writes alter shared design and financial-draft records, but no finalize, issue, approve, or payment tool is declared."}},{"description":"","name":"add_project_note","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These writes alter shared design and financial-draft records, but no finalize, issue, approve, or payment tool is declared."}},{"description":"","name":"attach_product_to_project"},{"description":"","name":"create_draft_invoice","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These writes alter shared design and financial-draft records, but no finalize, issue, approve, or payment tool is declared."}},{"description":"","name":"create_draft_po","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These writes alter shared design and financial-draft records, but no finalize, issue, approve, or payment tool is declared."}},{"description":"","name":"create_room_board","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These writes alter shared design and financial-draft records, but no finalize, issue, approve, or payment tool is declared."}},{"description":"","name":"create_task","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These writes alter shared design and financial-draft records, but no finalize, issue, approve, or payment tool is declared."}},{"description":"","name":"edit_draft_invoice"},{"description":"","name":"edit_draft_po"},{"description":"","name":"explain_unavailable_action"},{"description":"","name":"fetch"},{"description":"","name":"finalize_upload"},{"description":"","name":"get_board"},{"description":"","name":"get_po"},{"description":"","name":"get_product"},{"description":"","name":"get_project"},{"description":"","name":"get_room_design","risk":{"category":"data_exfiltration","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can read information available to the connected account and return it to the AI. Review findings: This is confidential client, project, supplier, and commercial data."}},{"description":"","name":"get_task"},{"description":"","name":"list_boards"},{"description":"","name":"list_clients","risk":{"category":"data_exfiltration","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can read information available to the connected account and return it to the AI. Review findings: This is confidential client, project, supplier, and commercial data."}},{"description":"","name":"list_pos","risk":{"category":"data_exfiltration","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can read information available to the connected account and return it to the AI. Review findings: This is confidential client, project, supplier, and commercial data."}},{"description":"","name":"list_project_notes"},{"description":"","name":"list_projects","risk":{"category":"data_exfiltration","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can read information available to the connected account and return it to the AI. Review findings: This is confidential client, project, supplier, and commercial data."}},{"description":"","name":"list_rfqs","risk":{"category":"data_exfiltration","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can read information available to the connected account and return it to the AI. Review findings: This is confidential client, project, supplier, and commercial data."}},{"description":"","name":"list_rooms"},{"description":"","name":"list_tasks"},{"description":"","name":"list_team_members"},{"description":"","name":"list_vendors","risk":{"category":"data_exfiltration","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can read information available to the connected account and return it to the AI. Review findings: This is confidential client, project, supplier, and commercial data."}},{"description":"","name":"ping"},{"description":"","name":"request_upload"},{"description":"","name":"search"},{"description":"","name":"search_products"},{"description":"","name":"update_task_status"},{"description":"","name":"upload_file_inline","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These writes alter shared design and financial-draft records, but no finalize, issue, approve, or payment tool is declared."}}],"tools_count":34,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/f7caea8e-88b0-41b4-862e-542c6c1912d4","uuid":"a9912694-6c1b-5db9-87f7-ccb714b844f8","verification_tier":"community","version":""},"query_key":"planory llc cocanvas","schema_version":1,"status":"match"}