{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-12","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Projexion connects Claude to construction portfolio data from systems such as Procore, Sage, Autodesk, and P6. Inspect dashboards, run saved calculations, search project knowledge, and update records. It requires a Projexion account and applies your permissions in the accounts you authorize.","did":"4e3105f4-5fa7-4864-a02c-5ca02224c961","documentation_url":"https://www.projexion.io/mcp-docs","editorial_description":{"extended_description":"The platform also integrates Excel and describes nightly synchronization with connected systems. Tools inspect tables and widgets, discover and validate GraphQL operations, execute queries or permitted updates, and search the knowledge base.","schema_version":1,"summary":"Projexion connects Claude to construction portfolio data from systems such as Procore, Sage, Autodesk, and P6.\nInspect dashboards, run saved calculations, search project knowledge, and update records.\nIt requires a Projexion account and applies your permissions in the accounts you authorize."},"homepage_url":"","icon":"","id":"4e3105f4-5fa7-4864-a02c-5ca02224c961","installs":0,"last_scanned":"","license":"","long_description":"The platform also integrates Excel and describes nightly synchronization with connected systems. Tools inspect tables and widgets, discover and validate GraphQL operations, execute queries or permitted updates, and search the knowledge base.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"Inventory exposes schema discovery, validation, and execution of GraphQL.","reasoning":"Generic GraphQL execution can include broad queries or mutations.","risk_type":"query_execution","severity":"high","title":"Can execute arbitrary GraphQL operations","triggering_tools_or_skills":["execute_graphql","get_graphql_schema","validate_graphql"]},{"evidence":"No operation allowlist or mutation restriction is supplied.","reasoning":"The action set is dynamic and potentially High.","risk_type":"generic_gateway","severity":"high","title":"GraphQL gateway hides reachable operations","triggering_tools_or_skills":["execute_graphql"]},{"evidence":"Packet does not document authorization boundaries for arbitrary GraphQL.","reasoning":"Runtime authorization cannot be established.","risk_type":"authz_ambiguity","severity":"low","title":"GraphQL scopes are undocumented","triggering_tools_or_skills":["execute_graphql"]}],"assessment_status":"provisional","auth_and_scopes":"Authenticated Projexion workspace access is implied; GraphQL scopes and mutation restrictions are undocumented.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/4e3105f4-5fa7-4864-a02c-5ca02224c961.json","what_it_proves":"Candidate PR #125 record identity (name \"Projexion\", publisher, type web_connector) and 11 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/4e3105f4-5fa7-4864-a02c-5ca02224c961: complete tool_names inventory (11 tools), remote streamable-http endpoint https://api.projexion.io/api/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Projexion exposes generic GraphQL execution without documented operation or mutation bounds.","provisional_risk":null,"publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:4e3105f4-5fa7-4864-a02c-5ca02224c961","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 11 tools; require schema plus evidence that mutation fields are bounded or absent.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"true","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"unknown","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"true","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":11,"tools_or_skills_total":11},"name":"Projexion","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=4e3105f4-5fa7-4864-a02c-5ca02224c961&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.projexion.io/privacy","provisional_risk":null,"publication_recommendation":"fix","publisher":"Projexion, Inc","publisher_url":"https://www.projexion.io/","remote_url":"https://api.projexion.io/api/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Generic GraphQL execution can include broad queries or mutations.; The action set is dynamic and potentially High.","evidence":"Can execute arbitrary GraphQL operations: Inventory exposes schema discovery, validation, and execution of GraphQL. | GraphQL gateway hides reachable operations: No operation allowlist or mutation restriction is supplied.","manual_risk_type":"query_execution,generic_gateway","remediation":{"block_tool_categories":["code_execution"],"steps":["Run only in a sandbox with least-privilege credentials and strict resource limits.","Disable generic execution gateways unless their reachable action set is fully understood.","Require approval before execution against production systems or sensitive data."]},"risk_type":"runs_code","severity":"high","title":"Can execute code, queries, or dynamic actions","triggering_tools":["execute_graphql","get_graphql_schema","validate_graphql"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"contact@projexion.io","tags":["network_access","oauth_required","runs_code","web_connector"],"tools":[{"description":"","name":"execute_graphql","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Generic GraphQL execution can include broad queries or mutations.; The action set is dynamic and potentially High."}},{"description":"","name":"get_graphql_schema","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Generic GraphQL execution can include broad queries or mutations.; The action set is dynamic and potentially High."}},{"description":"","name":"get_skill"},{"description":"","name":"get_table_content"},{"description":"","name":"get_widget_content"},{"description":"","name":"list_accounts"},{"description":"","name":"list_integrations"},{"description":"","name":"run_calculation"},{"description":"","name":"search_knowledgebase"},{"description":"","name":"semantic_search"},{"description":"","name":"validate_graphql","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Generic GraphQL execution can include broad queries or mutations.; The action set is dynamic and potentially High."}}],"tools_count":11,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/4e3105f4-5fa7-4864-a02c-5ca02224c961","uuid":"2dbdb6f3-b421-5ca8-bda9-5104ba20012e","verification_tier":"community","version":""},"query_key":"projexion","schema_version":1,"status":"match"}