{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-20","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Truthifi brings linked-account portfolio data into Claude. Analyze holdings, balances, performance, fees, allocation, and spending. A Truthifi account is required; it cannot trade or move money.","did":"45a39388-5143-4980-94dd-12179db0651f","documentation_url":"https://truthifi.com/mcp-tools","editorial_description":{"extended_description":"Users select shared accounts and can track manually entered assets or liabilities. Tools also retrieve automated health findings and score history. The source states that Truthifi does not provide investment advice.","schema_version":1,"summary":"Truthifi brings linked-account portfolio data into Claude.\nAnalyze holdings, balances, performance, fees, allocation, and spending.\nA Truthifi account is required; it cannot trade or move money."},"homepage_url":"","icon":"","id":"45a39388-5143-4980-94dd-12179db0651f","installs":0,"last_scanned":"","license":"","long_description":"Users select shared accounts and can track manually entered assets or liabilities. Tools also retrieve automated health findings and score history. The source states that Truthifi does not provide investment advice.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The complete inventory includes deletion of manually entered real-estate, private-investment or liability records.","reasoning":"It removes persistent user financial records even though it cannot affect linked institution balances.","risk_type":"data_deletion","severity":"high","title":"Deletes manually tracked assets or liabilities","triggering_tools_or_skills":["delete_asset_liability"]}],"assessment_status":"provisional","auth_and_scopes":"Users choose linked financial accounts; aggregation uses Plaid/Yodlee/Morningstar and the connector cannot trade or move money.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"complete","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/45a39388-5143-4980-94dd-12179db0651f.json","what_it_proves":"Candidate PR #125 record identity (name \"Production Truthifi MCP\", publisher, type web_connector) and 25 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/45a39388-5143-4980-94dd-12179db0651f: complete tool_names inventory (25 tools), remote streamable-http endpoint https://api.truthifi.com/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Truthifi can delete manually tracked financial records while otherwise reading highly sensitive portfolio data.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:45a39388-5143-4980-94dd-12179db0651f","reviewed_at":"2026-10-10","reviewer_notes":"No trading or money movement exists; restrict downstream forwarding of aggregated financial data.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":25,"tools_or_skills_total":25},"name":"Production Truthifi MCP","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=45a39388-5143-4980-94dd-12179db0651f&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://truthifi.com/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Truthifi Inc.","publisher_url":"https://truthifi.com/","remote_url":"https://api.truthifi.com/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can permanently remove data or resources. Review findings: It removes persistent user financial records even though it cannot affect linked institution balances.","evidence":"Deletes manually tracked assets or liabilities: The complete inventory includes deletion of manually entered real-estate, private-investment or liability records.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Deletes manually tracked assets or liabilities","triggering_tools":["delete_asset_liability"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@truthifi.com","tags":["deletes_data","network_access","oauth_required","web_connector"],"tools":[{"description":"","name":"create_asset_liability"},{"description":"","name":"delete_asset_liability","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: It removes persistent user financial records even though it cannot affect linked institution balances."}},{"description":"","name":"get_accounts"},{"description":"","name":"get_advisors"},{"description":"","name":"get_asset_liabilities"},{"description":"","name":"get_balance_history"},{"description":"","name":"get_budget_flow_summary"},{"description":"","name":"get_composition"},{"description":"","name":"get_dated_holdings"},{"description":"","name":"get_equity_concentrations"},{"description":"","name":"get_fees"},{"description":"","name":"get_findings"},{"description":"","name":"get_groups"},{"description":"","name":"get_investment_transactions_summary"},{"description":"","name":"get_market_cap_allocation"},{"description":"","name":"get_performance_history"},{"description":"","name":"get_scan_status"},{"description":"","name":"get_security_distributions"},{"description":"","name":"get_security_info"},{"description":"","name":"get_security_news"},{"description":"","name":"get_subscription_info"},{"description":"","name":"get_transactions"},{"description":"","name":"get_truthifi_info"},{"description":"","name":"get_truthifi_score_history"},{"description":"","name":"run_scan"}],"tools_count":25,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/45a39388-5143-4980-94dd-12179db0651f","uuid":"7a23bcf4-03c3-565a-8066-bd681eba3560","verification_tier":"community","version":""},"query_key":"production truthifi mcp","schema_version":1,"status":"match"}