{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-06","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"PostNitro generates or imports social carousels, images, and videos. Manage brand settings, social accounts, and scheduled posts. It uses your existing Embed API key and credit balance.","did":"3b571599-0e7a-4292-96d0-171ae18683b7","documentation_url":"https://postnitro.ai/docs/embed/mcp","editorial_description":{"extended_description":"Tools retrieve generation status and outputs, manage scheduled posts, list templates and presets, and inspect or disconnect social accounts.","schema_version":1,"summary":"PostNitro generates or imports social carousels, images, and videos.\nManage brand settings, social accounts, and scheduled posts.\nIt uses your existing Embed API key and credit balance."},"homepage_url":"","icon":"https://postnitro.ai/images/avatar.png","id":"3b571599-0e7a-4292-96d0-171ae18683b7","installs":0,"last_scanned":"","license":"","long_description":"Tools retrieve generation status and outputs, manage scheduled posts, list templates and presets, and inspect or disconnect social accounts.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The inventory and description explicitly expose scheduled publication to connected social accounts.","reasoning":"These communicate externally as the user's social profiles.","risk_type":"messaging_as_user","severity":"high","title":"Generates and schedules social posts","triggering_tools_or_skills":["postnitro_create_scheduled_post","postnitro_generate_and_schedule","postnitro_import_and_schedule"]},{"evidence":"The complete inventory includes both deletion actions.","reasoning":"These can irreversibly remove media and scheduled content.","risk_type":"data_deletion","severity":"high","title":"Deletes audio and scheduled posts","triggering_tools_or_skills":["postnitro_delete_audio","postnitro_delete_scheduled_post"]},{"evidence":"The Directory description says MCP uses the same API key and credits as the REST API for content generation.","reasoning":"Generation can spend finite paid account credits.","risk_type":"financial_transaction","severity":"high","title":"Generation actions consume the account's API credits","triggering_tools_or_skills":["postnitro_generate_carousel","postnitro_generate_image","postnitro_generate_video","postnitro_generate_and_wait"]},{"evidence":"The tool explicitly removes a connected social integration.","reasoning":"This revokes persistent third-party account access.","risk_type":"credential_admin","severity":"high","title":"Disconnects a social account","triggering_tools_or_skills":["postnitro_disconnect_social_account"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication uses the same Embed API key, social accounts and credits as the REST API; exact credit costs and platform scopes are not listed.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"complete","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/3b571599-0e7a-4292-96d0-171ae18683b7.json","what_it_proves":"Candidate PR #125 record identity (name \"PostNitro\", publisher, type web_connector) and 35 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/3b571599-0e7a-4292-96d0-171ae18683b7: complete tool_names inventory (35 tools), remote streamable-http endpoint https://mcp.postnitro.ai/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"PostNitro spends credits, schedules social content, deletes resources and disconnects accounts.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:3b571599-0e7a-4292-96d0-171ae18683b7","reviewed_at":"2026-10-10","reviewer_notes":"Verify per-operation credit cost, bulk targeting and publication confirmation.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"true","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"true"},"tools_or_skills_reviewed":35,"tools_or_skills_total":35},"name":"PostNitro","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=3b571599-0e7a-4292-96d0-171ae18683b7&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://postnitro.ai/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"PostNitro Inc.","publisher_url":"https://postnitro.ai/","remote_url":"https://mcp.postnitro.ai/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: These communicate externally as the user's social profiles.","evidence":"Generates and schedules social posts: The inventory and description explicitly expose scheduled publication to connected social accounts.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Generates and schedules social posts","triggering_tools":["postnitro_create_scheduled_post","postnitro_generate_and_schedule","postnitro_import_and_schedule"]},{"description":"This connector can permanently remove data or resources. Review findings: These can irreversibly remove media and scheduled content.","evidence":"Deletes audio and scheduled posts: The complete inventory includes both deletion actions.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Deletes audio and scheduled posts","triggering_tools":["postnitro_delete_audio","postnitro_delete_scheduled_post"]},{"description":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Generation can spend finite paid account credits.","evidence":"Generation actions consume the account's API credits: The Directory description says MCP uses the same API key and credits as the REST API for content generation.","manual_risk_type":"financial_transaction","remediation":{"block_tool_categories":["financial"],"steps":["Set provider-side spending limits and require approval for every financial action.","Use a dedicated low-balance account and review transaction logs."]},"risk_type":"spends_money","severity":"high","title":"Generation actions consume the account's API credits","triggering_tools":["postnitro_generate_carousel","postnitro_generate_image","postnitro_generate_video","postnitro_generate_and_wait"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: This revokes persistent third-party account access.","evidence":"Disconnects a social account: The tool explicitly removes a connected social integration.","manual_risk_type":"credential_admin","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"high","title":"Disconnects a social account","triggering_tools":["postnitro_disconnect_social_account"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@postnitro.ai","tags":["deletes_data","modifies_data","network_access","oauth_required","sends_messages_as_you","spends_money","web_connector"],"tools":[{"description":"","name":"postnitro_check_status"},{"description":"","name":"postnitro_create_brand"},{"description":"","name":"postnitro_create_scheduled_post","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: These communicate externally as the user's social profiles."}},{"description":"","name":"postnitro_delete_audio","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These can irreversibly remove media and scheduled content."}},{"description":"","name":"postnitro_delete_scheduled_post","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These can irreversibly remove media and scheduled content."}},{"description":"","name":"postnitro_disconnect_social_account","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: This revokes persistent third-party account access."}},{"description":"","name":"postnitro_generate_and_schedule","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: These communicate externally as the user's social profiles."}},{"description":"","name":"postnitro_generate_and_wait","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Generation can spend finite paid account credits."}},{"description":"","name":"postnitro_generate_carousel","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Generation can spend finite paid account credits."}},{"description":"","name":"postnitro_generate_image","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Generation can spend finite paid account credits."}},{"description":"","name":"postnitro_generate_image_and_wait"},{"description":"","name":"postnitro_generate_video","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Generation can spend finite paid account credits."}},{"description":"","name":"postnitro_generate_video_and_wait"},{"description":"","name":"postnitro_get_brand"},{"description":"","name":"postnitro_get_defaults"},{"description":"","name":"postnitro_get_import_template"},{"description":"","name":"postnitro_get_output"},{"description":"","name":"postnitro_get_scheduled_post"},{"description":"","name":"postnitro_get_social_account"},{"description":"","name":"postnitro_import_and_schedule","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: These communicate externally as the user's social profiles."}},{"description":"","name":"postnitro_import_and_wait"},{"description":"","name":"postnitro_import_carousel"},{"description":"","name":"postnitro_import_image"},{"description":"","name":"postnitro_import_image_and_wait"},{"description":"","name":"postnitro_import_video"},{"description":"","name":"postnitro_import_video_and_wait"},{"description":"","name":"postnitro_list_ai_presets"},{"description":"","name":"postnitro_list_audio"},{"description":"","name":"postnitro_list_brands"},{"description":"","name":"postnitro_list_scheduled_posts"},{"description":"","name":"postnitro_list_social_accounts"},{"description":"","name":"postnitro_list_templates"},{"description":"","name":"postnitro_set_defaults"},{"description":"","name":"postnitro_update_brand"},{"description":"","name":"postnitro_update_scheduled_post"}],"tools_count":35,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/3b571599-0e7a-4292-96d0-171ae18683b7","uuid":"160f36ca-477a-5bbe-9d05-c2c774fae634","verification_tier":"community","version":""},"query_key":"postnitro inc postnitro","schema_version":1,"status":"match"}