{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-18","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Trackr reads creator-marketing campaigns, posts, analytics, and invoices. Inspect creators, performance trends, playbooks, and comment insights. Access is read-only and limited to one authorized team; reports use Los Angeles business days.","did":"a4a05395-eba5-4c43-9994-4b347b779094","documentation_url":"https://app.ugctrackr.com/docs/integrations/mcp","editorial_description":{"extended_description":"Browse content across TikTok, Instagram, and YouTube, review payout records, and search Trackr documentation. The connector cannot create, edit, or delete workspace data, and access can be revoked in Trackr settings.","schema_version":1,"summary":"Trackr reads creator-marketing campaigns, posts, analytics, and invoices.\nInspect creators, performance trends, playbooks, and comment insights.\nAccess is read-only and limited to one authorized team; reports use Los Angeles business days."},"homepage_url":"","icon":"https://app.ugctrackr.com/logo.png","id":"a4a05395-eba5-4c43-9994-4b347b779094","installs":0,"last_scanned":"","license":"","long_description":"Browse content across TikTok, Instagram, and YouTube, review payout records, and search Trackr documentation. The connector cannot create, edit, or delete workspace data, and access can be revoked in Trackr settings.","manual_assessment":"low","manual_review":{"all_findings":[{"evidence":"All 17 tools are get/list/search operations.","reasoning":"The connector is explicitly read-only.","risk_type":"private_data_read","severity":"low","title":"Reads private campaigns, creators, invoices, documents and analytics","triggering_tools_or_skills":["list_campaigns","list_creators","list_invoices","get_campaign_client_hq_document"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication scopes Trackr campaign/creator data to the team.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"low","evidence_completeness":"partial","manual_overall_risk":"low","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/a4a05395-eba5-4c43-9994-4b347b779094.json","what_it_proves":"Candidate PR #125 record identity (name \"Trackr\", publisher, type web_connector) and 17 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/a4a05395-eba5-4c43-9994-4b347b779094: complete tool_names inventory (17 tools), remote streamable-http endpoint https://app.ugctrackr.com/api/external/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Trackr is read-only creator-marketing analytics.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:a4a05395-eba5-4c43-9994-4b347b779094","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 17 tools.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"false","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":17,"tools_or_skills_total":17},"name":"Trackr","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=a4a05395-eba5-4c43-9994-4b347b779094&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://ugctrackr.com/legal/privacy-policy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Playkit","publisher_url":"https://ugctrackr.com/","remote_url":"https://app.ugctrackr.com/api/external/mcp","repository_url":"","risk":"low","risk_severity":"low","security_risks":[{"description":"This connector can read information available to the connected account and return it to the AI. Review findings: The connector is explicitly read-only.","evidence":"Reads private campaigns, creators, invoices, documents and analytics: All 17 tools are get/list/search operations.","manual_risk_type":"private_data_read","remediation":{"block_tool_categories":["data_exfiltration"],"steps":["Use a least-privilege account limited to the information required by the workflow.","Restrict folders, projects, tenants, and other data scopes wherever the provider allows it.","Review access logs for unexpected reads or bulk retrieval."]},"risk_type":"reads_private_data","severity":"low","title":"Reads private campaigns, creators, invoices, documents and analytics","triggering_tools":["list_campaigns","list_creators","list_invoices","get_campaign_client_hq_document"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@ugctrackr.com","tags":["network_access","oauth_required","reads_private_data","web_connector"],"tools":[{"description":"","name":"get_campaign"},{"description":"","name":"get_campaign_client_hq_document"},{"description":"","name":"get_campaign_playbook"},{"description":"","name":"get_comment_summary"},{"description":"","name":"get_doc"},{"description":"","name":"get_invoice"},{"description":"","name":"get_overview_analytics"},{"description":"","name":"get_post"},{"description":"","name":"list_analyzed_comments"},{"description":"","name":"list_campaign_client_hq_items"},{"description":"","name":"list_campaigns"},{"description":"","name":"list_creators"},{"description":"","name":"list_invoices"},{"description":"","name":"list_posts"},{"description":"","name":"list_top_comment_posts"},{"description":"","name":"list_trending_posts"},{"description":"","name":"search_docs"}],"tools_count":17,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/a4a05395-eba5-4c43-9994-4b347b779094","uuid":"92206184-8006-57d9-8c7e-c41e87f4a7ff","verification_tier":"community","version":""},"query_key":"playkit trackr","schema_version":1,"status":"match"}