{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-05","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"high","description":"Processes, transcodes and prepares video for streaming through Qencode. Create MP4 or adaptive streams, edit media, and produce thumbnails, audio or transcripts. Submit jobs, track results and deliver outputs to configured cloud storage.","did":"1ff24ca4-f016-4643-a28d-afb87a8a7808","documentation_url":"https://docs.qencode.com/","editorial_description":{"extended_description":"Supported workflows include HLS/DASH, modern video codecs, trimming, stitching, resizing, subtitles and watermarks. Advanced processing covers video analysis, transcription, quality scoring and encryption or DRM options. Tools also manage storage buckets, import URLs, retrieve download links and consult Qencode documentation.","schema_version":1,"summary":"Processes, transcodes and prepares video for streaming through Qencode.\nCreate MP4 or adaptive streams, edit media, and produce thumbnails, audio or transcripts.\nSubmit jobs, track results and deliver outputs to configured cloud storage."},"homepage_url":"","icon":"https://marketing-assets-all.media-storage.us-west.qencode.com/video/mcp/profilepicture.png","id":"1ff24ca4-f016-4643-a28d-afb87a8a7808","installs":0,"last_scanned":"","license":"","long_description":"Supported workflows include HLS/DASH, modern video codecs, trimming, stitching, resizing, subtitles and watermarks. Advanced processing covers video analysis, transcription, quality scoring and encryption or DRM options. Tools also manage storage buckets, import URLs, retrieve download links and consult Qencode documentation.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"Official MCP docs launch transcoding/analysis jobs; official billing docs describe a consumption balance and automatic payment-method refill when the threshold is reached.","reasoning":"Starting usage can spend paid balance and indirectly charge a saved payment method.","risk_type":"financial_transaction","severity":"high","title":"Media jobs consume wallet balance and can trigger auto-refill charges","triggering_tools_or_skills":["transcode_video","start_encode2_raw"]},{"evidence":"The official tool table says start_encode2_raw submits an advanced raw Qencode API query.","reasoning":"It is an unrestricted expressive job gateway beyond fixed schemas.","risk_type":"query_execution","severity":"high","title":"Submits advanced raw Qencode API queries","triggering_tools_or_skills":["start_encode2_raw"]},{"evidence":"Official examples support saving output and notifying a webhook when the job finishes.","reasoning":"This sends externally directed notifications from the user's job.","risk_type":"messaging_as_user","severity":"high","title":"Jobs can notify user-selected webhooks","triggering_tools_or_skills":["transcode_video","start_encode2_raw"]},{"evidence":"Official docs confirm persistent bucket creation and copying a public URL into Media Storage.","reasoning":"These actions write account storage.","risk_type":"data_modification","severity":"medium","title":"Creates storage buckets and copies URL content","triggering_tools_or_skills":["create_bucket","download_url_to_bucket"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication launches jobs and manages Media Storage in the Qencode account; billing balance may auto-refill from a saved payment method, while job/bucket role granularity is undocumented.","blocked_missing_evidence":null,"confidence":"high","displayed_risk":"high","evidence_completeness":"complete","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/1ff24ca4-f016-4643-a28d-afb87a8a7808.json","what_it_proves":"Candidate PR #125 record identity (name \"Qencode\", publisher, type web_connector) and 16 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/1ff24ca4-f016-4643-a28d-afb87a8a7808: complete tool_names inventory (16 tools), remote streamable-http endpoint https://mcp.qencode.com/mcp, auth_posture auth_required, publisher-declared permissions text, directory tier community"},{"accessed_at":"2026-10-10T21:19:34Z","url_or_path":"https://docs.qencode.com/tutorials/mcp/prompts-and-tools/","what_it_proves":"Official MCP docs enumerate transcoding jobs, arbitrary raw queries, bucket creation, public-URL staging and output behavior."},{"accessed_at":"2026-10-10T21:19:34Z","url_or_path":"https://docs.qencode.com/tutorials/account/auto-refill/","what_it_proves":"Official billing docs show usage consumes a wallet that may automatically charge a saved payment method when the balance threshold is reached."}],"primary_reason":"Qencode jobs spend wallet balance, can trigger automatic charges and webhooks, and expose an advanced raw API query.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:1ff24ca4-f016-4643-a28d-afb87a8a7808","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 16 names against official MCP and billing docs. Verify per-job cost previews, auto-refill safeguards, webhook/URL restrictions and bucket quotas.","risk_domains":{"arbitrary_network_access":"true","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"true","sends_messages_as_user":"true","spends_or_moves_money":"true"},"tools_or_skills_reviewed":16,"tools_or_skills_total":16},"name":"Qencode","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=1ff24ca4-f016-4643-a28d-afb87a8a7808&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://cloud.qencode.com/qencode-privacy-policy.pdf","provisional_risk":null,"publication_recommendation":"accept","publisher":"Qencode Corp.","publisher_url":"https://cloud.qencode.com/","remote_url":"https://mcp.qencode.com/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Starting usage can spend paid balance and indirectly charge a saved payment method.","evidence":"Media jobs consume wallet balance and can trigger auto-refill charges: Official MCP docs launch transcoding/analysis jobs; official billing docs describe a consumption balance and automatic payment-method refill when the threshold is reached.","manual_risk_type":"financial_transaction","remediation":{"block_tool_categories":["financial"],"steps":["Set provider-side spending limits and require approval for every financial action.","Use a dedicated low-balance account and review transaction logs."]},"risk_type":"spends_money","severity":"high","title":"Media jobs consume wallet balance and can trigger auto-refill charges","triggering_tools":["transcode_video","start_encode2_raw"]},{"description":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: It is an unrestricted expressive job gateway beyond fixed schemas.","evidence":"Submits advanced raw Qencode API queries: The official tool table says start_encode2_raw submits an advanced raw Qencode API query.","manual_risk_type":"query_execution","remediation":{"block_tool_categories":["code_execution"],"steps":["Run only in a sandbox with least-privilege credentials and strict resource limits.","Disable generic execution gateways unless their reachable action set is fully understood.","Require approval before execution against production systems or sensitive data."]},"risk_type":"runs_code","severity":"high","title":"Submits advanced raw Qencode API queries","triggering_tools":["start_encode2_raw"]},{"description":"This connector can publish or send messages and content using the connected identity. Review findings: This sends externally directed notifications from the user's job.","evidence":"Jobs can notify user-selected webhooks: Official examples support saving output and notifying a webhook when the job finishes.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Jobs can notify user-selected webhooks","triggering_tools":["transcode_video","start_encode2_raw"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions write account storage.","evidence":"Creates storage buckets and copies URL content: Official docs confirm persistent bucket creation and copying a public URL into Media Storage.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Creates storage buckets and copies URL content","triggering_tools":["create_bucket","download_url_to_bucket"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@qencode.com","tags":["modifies_data","network_access","oauth_required","runs_code","sends_messages_as_you","spends_money","web_connector"],"tools":[{"description":"","name":"fetch_qencode_doc"},{"description":"","name":"get_job_status"},{"description":"","name":"search_qencode_docs"},{"description":"","name":"start_encode2_raw","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: This sends externally directed notifications from the user's job."}},{"description":"","name":"transcode_video","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: This sends externally directed notifications from the user's job."}},{"description":"","name":"wait_for_job"},{"description":"","name":"list_buckets"},{"description":"","name":"create_bucket","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions write account storage."}},{"description":"","name":"list_objects"},{"description":"","name":"get_download_url"},{"description":"","name":"download_url_to_bucket","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These actions write account storage."}},{"description":"","name":"fetch_job_result"},{"description":"","name":"get_job_status_detailed"},{"description":"","name":"list_jobs"},{"description":"","name":"open_player"},{"description":"","name":"refresh_jobs"}],"tools_count":16,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/1ff24ca4-f016-4643-a28d-afb87a8a7808","uuid":"0d2e1d3e-7895-5d01-ab7c-20ec09c77000","verification_tier":"community","version":""},"query_key":"qencode corp qencode","schema_version":1,"status":"match"}