{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-27","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Reads and writes POHODA accounting data through the independent ÚčtoMost connector. Manage supported invoices, contacts, stock, orders and accounting records, or export documents. Requires your own licensed POHODA environment and authenticated mServer access; it is not endorsed by STORMWARE.","did":"be1731ac-e7ae-4847-bb63-0569f6d0288a","documentation_url":"https://uctomost.sk/ai-integracia-pohoda","editorial_description":{"extended_description":"Tools cover document retrieval, printing, email sending and selected record creation, updates or deletion. XML reference and status tools support integration work. Bank and cash operations concern accounting records rather than establishing direct transfers of funds.","schema_version":1,"summary":"Reads and writes POHODA accounting data through the independent ÚčtoMost connector.\nManage supported invoices, contacts, stock, orders and accounting records, or export documents.\nRequires your own licensed POHODA environment and authenticated mServer access; it is not endorsed by STORMWARE."},"homepage_url":"","icon":"","id":"be1731ac-e7ae-4847-bb63-0569f6d0288a","installs":0,"last_scanned":"","license":"","long_description":"Tools cover document retrieval, printing, email sending and selected record creation, updates or deletion. XML reference and status tools support integration work. Bank and cash operations concern accounting records rather than establishing direct transfers of funds.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The inventory explicitly includes an email-send action.","reasoning":"It sends external content as the accounting user.","risk_type":"messaging_as_user","severity":"high","title":"Sends email from POHODA","triggering_tools_or_skills":["pohoda_email_send"]},{"evidence":"Multiple declared tools delete addresses, orders, inventory and user agendas.","reasoning":"These are destructive actions on meaningful business records.","risk_type":"data_deletion","severity":"high","title":"Deletes business and accounting records","triggering_tools_or_skills":["pohoda_adresar_delete","pohoda_objednavky_delete","pohoda_zasoby_delete","pohoda_uzivatelske_agendy_delete"]},{"evidence":"candidate_tools_truncated is true for a 95-tool stored inventory.","reasoning":"Missing tools prevent a complete published capability inventory.","risk_type":"identity_discrepancy","severity":"low","title":"Candidate omits Directory tools","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"Authentication exposes broad company accounting and inventory administration; exact role/scopes are not documented.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/be1731ac-e7ae-4847-bb63-0569f6d0288a.json","what_it_proves":"Candidate PR #125 record identity (name \"POHODA – AI účtovný konektor od ÚčtoMost\", publisher, type web_connector) and 80 stored tool names (truncated vs Directory); no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/be1731ac-e7ae-4847-bb63-0569f6d0288a: complete tool_names inventory (95 tools), remote streamable-http endpoint https://pohoda-mcp.uctomost.sk/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"POHODA can send email and delete accounting, inventory, order and directory records; its candidate inventory is also truncated.","provisional_risk":null,"publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:be1731ac-e7ae-4847-bb63-0569f6d0288a","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 95 stored names. candidate_tools_truncated=true means additional Directory actions are omitted; the catalog must be fixed before relying on this action boundary.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"true"},"tools_or_skills_reviewed":95,"tools_or_skills_total":95},"name":"POHODA – AI účtovný konektor od ÚčtoMost","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=be1731ac-e7ae-4847-bb63-0569f6d0288a&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://uctomost.sk/privacy","provisional_risk":null,"publication_recommendation":"fix","publisher":"ÚčtoMost","publisher_url":"https://uctomost.sk/","remote_url":"https://pohoda-mcp.uctomost.sk/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: It sends external content as the accounting user.","evidence":"Sends email from POHODA: The inventory explicitly includes an email-send action.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Sends email from POHODA","triggering_tools":["pohoda_email_send"]},{"description":"This connector can permanently remove data or resources. Review findings: These are destructive actions on meaningful business records.","evidence":"Deletes business and accounting records: Multiple declared tools delete addresses, orders, inventory and user agendas.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Deletes business and accounting records","triggering_tools":["pohoda_adresar_delete","pohoda_objednavky_delete","pohoda_zasoby_delete","pohoda_uzivatelske_agendy_delete"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"info@uctomost.sk","tags":["deletes_data","network_access","oauth_required","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"pohoda_adresar_create"},{"description":"","name":"pohoda_adresar_delete","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These are destructive actions on meaningful business records."}},{"description":"","name":"pohoda_adresar_export"},{"description":"","name":"pohoda_adresar_update"},{"description":"","name":"pohoda_banka_create"},{"description":"","name":"pohoda_banka_export"},{"description":"","name":"pohoda_banka_liquidation_create"},{"description":"","name":"pohoda_bankovni_ucty_create"},{"description":"","name":"pohoda_bankovni_ucty_export"},{"description":"","name":"pohoda_cenove_akce_export"},{"description":"","name":"pohoda_cinnosti_create"},{"description":"","name":"pohoda_cinnosti_delete"},{"description":"","name":"pohoda_cinnosti_export"},{"description":"","name":"pohoda_cinnosti_update"},{"description":"","name":"pohoda_ciselne_rady_export"},{"description":"","name":"pohoda_cleneni_dph_export"},{"description":"","name":"pohoda_cleneni_skladu_create"},{"description":"","name":"pohoda_cleneni_skladu_export"},{"description":"","name":"pohoda_company_detail_get"},{"description":"","name":"pohoda_document_get"},{"description":"","name":"pohoda_dokumenty_link_export"},{"description":"","name":"pohoda_email_send","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: It sends external content as the accounting user."}},{"description":"","name":"pohoda_evidencni_cisla_export"},{"description":"","name":"pohoda_faktury_create"},{"description":"","name":"pohoda_faktury_export"},{"description":"","name":"pohoda_faktury_isdoc_export"},{"description":"","name":"pohoda_formy_uhrad_export"},{"description":"","name":"pohoda_gpsr_create"},{"description":"","name":"pohoda_gpsr_delete"},{"description":"","name":"pohoda_gpsr_export"},{"description":"","name":"pohoda_gpsr_update"},{"description":"","name":"pohoda_individualni_ceny_create"},{"description":"","name":"pohoda_individualni_ceny_export"},{"description":"","name":"pohoda_internetove_kategorie_create"},{"description":"","name":"pohoda_internetove_kategorie_export"},{"description":"","name":"pohoda_interni_doklady_create"},{"description":"","name":"pohoda_interni_doklady_export"},{"description":"","name":"pohoda_inventurni_seznamy_create"},{"description":"","name":"pohoda_inventurni_seznamy_export"},{"description":"","name":"pohoda_merne_jednotky_export"},{"description":"","name":"pohoda_nabidky_create"},{"description":"","name":"pohoda_nabidky_export"},{"description":"","name":"pohoda_objednavky_create"},{"description":"","name":"pohoda_objednavky_delete","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These are destructive actions on meaningful business records."}},{"description":"","name":"pohoda_objednavky_export"},{"description":"","name":"pohoda_pohyby_export"},{"description":"","name":"pohoda_pokladna_create"},{"description":"","name":"pohoda_pokladna_export"},{"description":"","name":"pohoda_poptavky_create"},{"description":"","name":"pohoda_poptavky_export"},{"description":"","name":"pohoda_prevody_create"},{"description":"","name":"pohoda_prevody_export"},{"description":"","name":"pohoda_prijemky_create"},{"description":"","name":"pohoda_prijemky_export"},{"description":"","name":"pohoda_print_run"},{"description":"","name":"pohoda_prodejky_create"},{"description":"","name":"pohoda_prodejky_export"},{"description":"","name":"pohoda_recyklacni_prispevky_create"},{"description":"","name":"pohoda_recyklacni_prispevky_delete"},{"description":"","name":"pohoda_recyklacni_prispevky_export"},{"description":"","name":"pohoda_recyklacni_prispevky_update"},{"description":"","name":"pohoda_reklamace_export"},{"description":"","name":"pohoda_saldo_export"},{"description":"","name":"pohoda_servis_create"},{"description":"","name":"pohoda_servis_export"},{"description":"","name":"pohoda_sklady_create"},{"description":"","name":"pohoda_sklady_export"},{"description":"","name":"pohoda_status_get"},{"description":"","name":"pohoda_strediska_create"},{"description":"","name":"pohoda_strediska_delete"},{"description":"","name":"pohoda_strediska_export"},{"description":"","name":"pohoda_strediska_update"},{"description":"","name":"pohoda_subscription_status_get"},{"description":"","name":"pohoda_table_export"},{"description":"","name":"pohoda_ucetni_denik_export"},{"description":"","name":"pohoda_ucetni_jednotky_export"},{"description":"","name":"pohoda_uzivatelske_agendy_create"},{"description":"","name":"pohoda_uzivatelske_agendy_delete","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These are destructive actions on meaningful business records."}},{"description":"","name":"pohoda_uzivatelske_agendy_export"},{"description":"","name":"pohoda_uzivatelske_seznamy_create"},{"description":"","name":"pohoda_uzivatelske_seznamy_export"},{"description":"","name":"pohoda_vydejky_create"},{"description":"","name":"pohoda_vydejky_export"},{"description":"","name":"pohoda_vyroba_create"},{"description":"","name":"pohoda_vyroba_export"},{"description":"","name":"pohoda_vyrobni_pozadavky_create"},{"description":"","name":"pohoda_vyrobni_pozadavky_export"},{"description":"","name":"pohoda_xml_reference_get"},{"description":"","name":"pohoda_zakazky_create"},{"description":"","name":"pohoda_zakazky_export"},{"description":"","name":"pohoda_zasoby_create"},{"description":"","name":"pohoda_zasoby_delete","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These are destructive actions on meaningful business records."}},{"description":"","name":"pohoda_zasoby_dodavatele_export"},{"description":"","name":"pohoda_zasoby_export"},{"description":"","name":"pohoda_zasoby_update"}],"tools_count":95,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/be1731ac-e7ae-4847-bb63-0569f6d0288a","uuid":"211112fe-f1b1-5292-9583-a811e654f166","verification_tier":"community","version":""},"query_key":"pohoda ai uctovny konektor od uctomost","schema_version":1,"status":"match"}