{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-16","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"ProposalApp supports government-opportunity research and proposal preparation. Find solicitations, manage capture pipelines, and generate or score draft responses. Analyze risks, requirements, and company capabilities before exporting proposal material.","did":"91bb31b8-6d36-4513-8cbe-f64aaba3e7e2","documentation_url":"https://proposalapp.net/blog/connect-claude-to-proposalapp","editorial_description":{"extended_description":"Coverage includes federal, state, and local contracting. Tools research agencies and recompetes, manage capability statements, sync attachments, and publish polished proposal artifacts; draft scores do not guarantee compliance or contract awards.","schema_version":1,"summary":"ProposalApp supports government-opportunity research and proposal preparation.\nFind solicitations, manage capture pipelines, and generate or score draft responses.\nAnalyze risks, requirements, and company capabilities before exporting proposal material."},"homepage_url":"","icon":"https://media.proposalapp.net/claude/images/logo.png","id":"91bb31b8-6d36-4513-8cbe-f64aaba3e7e2","installs":0,"last_scanned":"","license":"","long_description":"Coverage includes federal, state, and local contracting. Tools research agencies and recompetes, manage capability statements, sync attachments, and publish polished proposal artifacts; draft scores do not guarantee compliance or contract awards.","manual_assessment":"medium","manual_review":{"all_findings":[{"evidence":"These tools persist government-contracting capture and proposal records.","reasoning":"They materially alter shared business workflow but do not submit a bid to an agency.","risk_type":"data_modification","severity":"medium","title":"Creates/updates proposals, customers, capability statements and pipeline state","triggering_tools_or_skills":["create_proposal","create_capability_statement","update_customer","update_pipeline_status","save_opportunity_to_pipeline"]},{"evidence":"These tools transfer and generate proposal artifacts.","reasoning":"They persist/expose sensitive company content.","risk_type":"file_write","severity":"medium","title":"Uploads company documents and exports proposal files","triggering_tools_or_skills":["upload_company_document","upload_capability_statement_document","download_polished_export","export_proposal_fast"]},{"evidence":"The name suggests publication, but the description frames proposal drafting/export and does not say it submits externally.","reasoning":"Schema/docs are needed before treating it as external communication.","risk_type":"evidence_gap","severity":"low","title":"Publish semantics are unclear","triggering_tools_or_skills":["publish_polished_proposal"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication is required; proposal, customer, pipeline, document and opportunity visibility follows workspace roles.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"medium","evidence_completeness":"partial","manual_overall_risk":"medium","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/91bb31b8-6d36-4513-8cbe-f64aaba3e7e2.json","what_it_proves":"Candidate PR #125 record identity (name \"Proposal App\", publisher, type web_connector) and 43 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/91bb31b8-6d36-4513-8cbe-f64aaba3e7e2: complete tool_names inventory (43 tools), remote streamable-http endpoint https://proposalapp.net/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Proposal App writes proposal/pipeline records and files; external publication/submission is not demonstrated.","provisional_risk":null,"publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:91bb31b8-6d36-4513-8cbe-f64aaba3e7e2","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 43 tools. No delete, send, submit-bid or payment tool appears; publish_polished_proposal should be documented to clarify whether it only finalizes an internal/export artifact.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"true","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":43,"tools_or_skills_total":43},"name":"Proposal App","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=91bb31b8-6d36-4513-8cbe-f64aaba3e7e2&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://proposalapp.net/privacy","provisional_risk":null,"publication_recommendation":"fix","publisher":"Proposal App","publisher_url":"https://proposalapp.net/","remote_url":"https://proposalapp.net/mcp","repository_url":"","risk":"medium","risk_severity":"medium","security_risks":[{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially alter shared business workflow but do not submit a bid to an agency.","evidence":"Creates/updates proposals, customers, capability statements and pipeline state: These tools persist government-contracting capture and proposal records.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Creates/updates proposals, customers, capability statements and pipeline state","triggering_tools":["create_proposal","create_capability_statement","update_customer","update_pipeline_status","save_opportunity_to_pipeline"]},{"description":"This connector can create, change, export, or otherwise write files. Review findings: They persist/expose sensitive company content.","evidence":"Uploads company documents and exports proposal files: These tools transfer and generate proposal artifacts.","manual_risk_type":"file_write","remediation":{"block_tool_categories":["state_change"],"steps":["Limit file access to a dedicated working directory.","Review generated or modified files before they are shared or executed."]},"risk_type":"filesystem_access","severity":"medium","title":"Uploads company documents and exports proposal files","triggering_tools":["upload_company_document","upload_capability_statement_document","download_polished_export","export_proposal_fast"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"info@proposalapp.net","tags":["filesystem_access","modifies_data","network_access","oauth_required","web_connector"],"tools":[{"description":"","name":"create_capability_statement","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially alter shared business workflow but do not submit a bid to an agency."}},{"description":"","name":"create_proposal","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially alter shared business workflow but do not submit a bid to an agency."}},{"description":"","name":"create_proposal_from_pipeline"},{"description":"","name":"download_polished_export","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: They persist/expose sensitive company content."}},{"description":"","name":"export_proposal_fast","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: They persist/expose sensitive company content."}},{"description":"","name":"generate_clarity_qa"},{"description":"","name":"generate_market_intel"},{"description":"","name":"generate_proposal_draft"},{"description":"","name":"get_bid_no_bid_analysis"},{"description":"","name":"get_content_generation_status"},{"description":"","name":"get_contract_intel"},{"description":"","name":"get_market_intel"},{"description":"","name":"get_opportunity_attachment_status"},{"description":"","name":"get_polish_instructions"},{"description":"","name":"get_proposal"},{"description":"","name":"get_proposal_draft"},{"description":"","name":"get_proposal_next_steps"},{"description":"","name":"get_recompete_contacts"},{"description":"","name":"get_recompete_radar"},{"description":"","name":"get_scoring_job_status"},{"description":"","name":"list_capability_statements"},{"description":"","name":"list_customers"},{"description":"","name":"list_my_workspaces"},{"description":"","name":"list_pipeline"},{"description":"","name":"list_proposal_documents"},{"description":"","name":"list_proposals"},{"description":"","name":"match_opportunities_to_capabilities"},{"description":"","name":"publish_polished_proposal"},{"description":"","name":"run_bid_no_bid_analysis"},{"description":"","name":"run_proposal_scoring"},{"description":"","name":"run_risk_analysis"},{"description":"","name":"save_opportunity_to_pipeline","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially alter shared business workflow but do not submit a bid to an agency."}},{"description":"","name":"search_agency_contacts"},{"description":"","name":"search_opportunities_keyword"},{"description":"","name":"search_opportunities_semantic"},{"description":"","name":"submit_feedback"},{"description":"","name":"sync_opportunity_attachments"},{"description":"","name":"trigger_opportunity_scoring"},{"description":"","name":"update_capability_statement"},{"description":"","name":"update_customer","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially alter shared business workflow but do not submit a bid to an agency."}},{"description":"","name":"update_pipeline_status","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially alter shared business workflow but do not submit a bid to an agency."}},{"description":"","name":"upload_capability_statement_document","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: They persist/expose sensitive company content."}},{"description":"","name":"upload_company_document","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: They persist/expose sensitive company content."}}],"tools_count":43,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/91bb31b8-6d36-4513-8cbe-f64aaba3e7e2","uuid":"ee1a675c-d9b5-5183-8d82-f52167069f51","verification_tier":"community","version":""},"query_key":"proposal app","schema_version":1,"status":"match"}