{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-03","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Plan Shopify inventory with Prediko using stock data and demand forecasts. Investigate stockouts, excess inventory and late purchase orders. Draft or edit orders, record received units and adjust SKU planning settings.","did":"01c952c7-952b-4900-acf8-3009c2ceeff4","documentation_url":"https://mcp.prediko.io/docs/mcp/","editorial_description":{"extended_description":"Planning data includes current and projected stock health and 12-month demand forecasts. Editable SKU settings include safety stock, reorder points, lead times and minimum order quantities. The connector also supports purchase-order exports and change-history lookup through your connected account.","schema_version":1,"summary":"Plan Shopify inventory with Prediko using stock data and demand forecasts.\nInvestigate stockouts, excess inventory and late purchase orders.\nDraft or edit orders, record received units and adjust SKU planning settings."},"homepage_url":"","icon":"","id":"01c952c7-952b-4900-acf8-3009c2ceeff4","installs":0,"last_scanned":"","license":"","long_description":"Planning data includes current and projected stock health and 12-month demand forecasts. Editable SKU settings include safety stock, reorder points, lead times and minimum order quantities. The connector also supports purchase-order exports and change-history lookup through your connected account.","manual_assessment":"medium","manual_review":{"all_findings":[{"evidence":"Tool reference: draft PO creation, line edits/removals, status reverts that reset received units, receipt deltas, reorder/lead-time/MOQ changes.","reasoning":"Can materially alter inventory planning records; no supplier email, payment or deletion, so not High.","risk_type":"data_modification","severity":"medium","title":"Creates and edits purchase orders, records receipts and changes SKU planning settings","triggering_tools_or_skills":["create_purchase_order","update_purchase_order","receive_units","update_sku_settings"]},{"evidence":"Tool reference: writes PDF/XLSX to Prediko's public export bucket and returns a public URL; scope table files it under write:purchase_orders.","reasoning":"Supplier pricing/quantities become reachable by anyone with the link.","risk_type":"authz_ambiguity","severity":"low","title":"PO export publishes the document to a public URL","triggering_tools_or_skills":["export_purchase_order"]},{"evidence":"Docs list 19 tools including create_transfer, update_transfer, receive_transfer_units, update_forecast_plan, receive_po_units, search_transfers; Directory lists 13.","reasoning":"Additional write tools exist beyond the catalogued inventory; they are Medium-class per docs.","risk_type":"identity_discrepancy","severity":"low","title":"Directory inventory lags the documented tool set","triggering_tools_or_skills":[]},{"evidence":"Directory remote.url is mcp.prediko.io/mcp; no pinned source or version is available for the server.","reasoning":"Tool behaviour can change server-side after review; ratings rest on the 2026-09-22 snapshot.","risk_type":"provenance_uncertainty","severity":"low","title":"Closed hosted MCP server for Prediko can change without notice","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"OAuth 2.1 via Auth0 (JWT tenant resolution); scopes read:inventory, write:purchase_orders, write:sku_settings, write:forecasts, write:transfers; docs say real boundary is tenant + backend permissions.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"medium","evidence_completeness":"partial","manual_overall_risk":"medium","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/01c952c7-952b-4900-acf8-3009c2ceeff4.json","what_it_proves":"Candidate PR #125 record identity (name \"Prediko\", publisher, type web_connector) and 13 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/01c952c7-952b-4900-acf8-3009c2ceeff4: complete tool_names inventory (13 tools), remote streamable-http endpoint https://mcp.prediko.io/mcp, auth_posture auth_required, directory tier community"},{"accessed_at":"2026-10-10T20:28:25Z","url_or_path":"https://mcp.prediko.io/docs/mcp/","what_it_proves":"Prediko MCP docs list 19 tools (10 read, 9 write incl. create_transfer, update_forecast_plan not in Directory inventory), OAuth 2.1 via Auth0 with scopes read:inventory, write:purchase_orders, write:sku_settings, write:forecasts, write:transfers; dry_run on writes; no delete tools."},{"accessed_at":"2026-10-10T20:29:05Z","url_or_path":"https://mcp.prediko.io/docs/mcp/tools/","what_it_proves":"Tool reference: create_purchase_order creates a draft with no supplier notice; update_purchase_order edits/removes lines and can revert status (resetting received units); receive units records deltas; export_purchase_order writes a PDF/XLSX to a public export bucket and returns a public URL; no email, payment or delete/cancel."}],"primary_reason":"Write tools create and edit draft purchase orders, record receipts and change SKU settings, with no supplier send, payment or delete action documented.","provisional_risk":null,"publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:01c952c7-952b-4900-acf8-3009c2ceeff4","reviewed_at":"2026-10-10","reviewer_notes":"Identity consistent (prediko.io). Reviewed all 13 declared tool names. Recommend fix to refresh the inventory to the 19 documented tools. Judgment: removing PO lines/reverting status treated as modification, not resource deletion; confidence medium because the documented set exceeds the catalogued one.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"false","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":13,"tools_or_skills_total":13},"name":"Prediko","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=01c952c7-952b-4900-acf8-3009c2ceeff4&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.prediko.io/privacy-policy","provisional_risk":null,"publication_recommendation":"fix","publisher":"Prediko","publisher_url":"https://prediko.io/","remote_url":"https://mcp.prediko.io/mcp","repository_url":"","risk":"medium","risk_severity":"medium","security_risks":[{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Can materially alter inventory planning records; no supplier email, payment or deletion, so not High.","evidence":"Creates and edits purchase orders, records receipts and changes SKU planning settings: Tool reference: draft PO creation, line edits/removals, status reverts that reset received units, receipt deltas, reorder/lead-time/MOQ changes.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Creates and edits purchase orders, records receipts and changes SKU planning settings","triggering_tools":["create_purchase_order","update_purchase_order","receive_units","update_sku_settings"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"hq@prediko.io","tags":["modifies_data","network_access","oauth_required","web_connector"],"tools":[{"description":"","name":"create_purchase_order","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Can materially alter inventory planning records; no supplier email, payment or deletion, so not High."}},{"description":"","name":"export_purchase_order"},{"description":"","name":"find_entity"},{"description":"","name":"get_change_history"},{"description":"","name":"get_entity"},{"description":"","name":"get_insights"},{"description":"","name":"list_entities"},{"description":"","name":"receive_units","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Can materially alter inventory planning records; no supplier email, payment or deletion, so not High."}},{"description":"","name":"search_forecasts"},{"description":"","name":"search_inventory"},{"description":"","name":"search_purchase_orders"},{"description":"","name":"update_purchase_order","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Can materially alter inventory planning records; no supplier email, payment or deletion, so not High."}},{"description":"","name":"update_sku_settings","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Can materially alter inventory planning records; no supplier email, payment or deletion, so not High."}}],"tools_count":13,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/01c952c7-952b-4900-acf8-3009c2ceeff4","uuid":"026af264-e5cb-54c6-b937-ec1c28cfb9fd","verification_tier":"community","version":""},"query_key":"prediko","schema_version":1,"status":"match"}