{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"reviewed","auth_posture":"no_auth","category":"Web Connector","confidence":"high","description":"Retrieve Pyth market data across crypto, equities, currencies and other asset classes. Discover symbols and fetch current prices, historical snapshots or candlesticks. Use the data for comparisons, volatility analysis and market research.","did":"01256fd9-c9f2-48df-8c56-c70e4209fb1c","documentation_url":"https://docs.pyth.network/price-feeds/pro/mcp","editorial_description":{"extended_description":"Available price data includes bid/ask spreads and confidence intervals, while historical snapshots and OHLC candles support time-based analysis. The listed tools retrieve market data; they do not place trades or manage brokerage accounts. The connector is listed as usable without authentication.","schema_version":1,"summary":"Retrieve Pyth market data across crypto, equities, currencies and other asset classes.\nDiscover symbols and fetch current prices, historical snapshots or candlesticks.\nUse the data for comparisons, volatility analysis and market research."},"homepage_url":"","icon":"","id":"01256fd9-c9f2-48df-8c56-c70e4209fb1c","installs":0,"last_scanned":"","license":"","long_description":"Available price data includes bid/ask spreads and confidence intervals, while historical snapshots and OHLC candles support time-based analysis. The listed tools retrieve market data; they do not place trades or manage brokerage accounts. The connector is listed as usable without authentication.","manual_assessment":"low","manual_review":{"all_findings":[{"evidence":"Docs describe each tool as retrieving prices/feeds/candles; none changes data.","reasoning":"Market data only; no trading tools despite the financial category.","risk_type":"public_data_read","severity":"low","title":"Retrieves market price feeds, history and candles","triggering_tools_or_skills":["get_symbols","get_latest_price","get_historical_price","get_candlestick_data"]},{"evidence":"Docs: key can be passed via the access_token parameter on each call; docs advise against pasting it into chat.","reasoning":"In a no_auth Directory connector the per-call parameter is the likely path, exposing the API key in conversation context.","risk_type":"authz_ambiguity","severity":"low","title":"no_auth listing but price tools need a key that may be pasted into chat","triggering_tools_or_skills":["get_latest_price","get_historical_price","get_candlestick_data"]},{"evidence":"Docs add get_price_range and convert_date_to_timestamp not present in Directory tool_names.","reasoning":"Inventory drift; extra tools are also read-only. Publisher 'Nazare Operations Ltd' / dourolabs.xyz vs pyth.network host is a known operator relationship not resolved here.","risk_type":"identity_discrepancy","severity":"low","title":"Docs list more tools than the Directory inventory","triggering_tools_or_skills":[]},{"evidence":"Directory remote.url is mcp.pyth.network/mcp; no pinned source or version is available for the server.","reasoning":"Tool behaviour can change server-side after review; ratings rest on the 2026-09-22 snapshot.","risk_type":"provenance_uncertainty","severity":"low","title":"Closed hosted MCP server for Pyth can change without notice","triggering_tools_or_skills":[]}],"assessment_status":"reviewed","auth_and_scopes":"Directory no_auth; docs: users supply their own Pyth Pro API key (Authorization header or per-call access_token parameter); without a key only get_symbols works. No user account data.","blocked_missing_evidence":null,"confidence":"high","displayed_risk":"low","evidence_completeness":"complete","manual_overall_risk":"low","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/01256fd9-c9f2-48df-8c56-c70e4209fb1c.json","what_it_proves":"Candidate PR #125 record identity (name \"Pyth\", publisher, type web_connector) and 4 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/01256fd9-c9f2-48df-8c56-c70e4209fb1c: complete tool_names inventory (4 tools), remote streamable-http endpoint https://mcp.pyth.network/mcp, auth_posture no_auth, directory tier community"},{"accessed_at":"2026-10-10T20:27:50Z","url_or_path":"https://docs.pyth.network/price-feeds/pro/mcp","what_it_proves":"Pyth docs list the MCP tools (get_symbols, get_latest_price, get_historical_price, get_price_range, get_candlestick_data, convert_date_to_timestamp), all market-data retrieval; most require a user-supplied Pyth Pro API key via header, env or access_token parameter; hosted server holds no key."}],"primary_reason":"Official docs confirm every tool only retrieves market price data; there is no trading or account access.","provisional_risk":null,"publication_recommendation":"fix","requires_runtime_verification":false,"review_key":"claude:01256fd9-c9f2-48df-8c56-c70e4209fb1c","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 4 declared tool names. Publisher legal entity (Nazare Operations Ltd, author URL dourolabs.xyz) differs from the pyth.network host; docs on pyth.network document this MCP, so identity accepted but the publisher field could be clarified. Recommend fix for inventory drift (6 tools in docs) and the auth posture (key needed for most tools).","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"false","persistent_credentials":"false","prompt_injection_exposure":"false","provenance_uncertainty":"true","reads_private_data":"false","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":4,"tools_or_skills_total":4},"name":"Pyth","needs_runtime_verification":false,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=01256fd9-c9f2-48df-8c56-c70e4209fb1c&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.dourolabs.xyz/Privacy-Notice.pdf","provisional_risk":null,"publication_recommendation":"fix","publisher":"Nazare Operations Ltd","publisher_url":"https://www.dourolabs.xyz/","remote_url":"https://mcp.pyth.network/mcp","repository_url":"","risk":"low","risk_severity":"low","security_risks":[{"description":"This connector retrieves public or publisher-provided information and returns it to the AI. Review findings: Market data only; no trading tools despite the financial category.","evidence":"Retrieves market price feeds, history and candles: Docs describe each tool as retrieving prices/feeds/candles; none changes data.","manual_risk_type":"public_data_read","remediation":{"block_tool_categories":[],"steps":["Treat returned third-party content as untrusted input and verify consequential claims.","Do not assume public content is accurate, current, or free of embedded instructions."]},"risk_type":"reads_public_data","severity":"low","title":"Retrieves market price feeds, history and candles","triggering_tools":["get_symbols","get_latest_price","get_historical_price","get_candlestick_data"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://dev-forum.pyth.network/","tags":["network_access","reads_public_data","web_connector"],"tools":[{"description":"","name":"get_symbols"},{"description":"","name":"get_latest_price"},{"description":"","name":"get_historical_price"},{"description":"","name":"get_candlestick_data"}],"tools_count":4,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/01256fd9-c9f2-48df-8c56-c70e4209fb1c","uuid":"bd22bcd7-a31d-5d61-9030-3d515975061f","verification_tier":"community","version":""},"query_key":"pyth","schema_version":1,"status":"match"}