{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-16","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Qmutator imports product feeds, cleans catalog data, and builds QFlow pipelines. Inspect schemas and violations, revise records or mappings, and deploy pipeline endpoints. Actions follow your account roles, with previews and confirmation for irreversible changes.","did":"6bcb3f93-d087-4426-b0ac-df9e19758671","documentation_url":"https://qmutator.com/docs","editorial_description":{"extended_description":"Tools manage multilingual field mappings, constraints, filtered export views, import status, and pipeline versions. Workflows support validation and sample previews before imports or deployments; destructive tools can delete catalog configuration or data.","schema_version":1,"summary":"Qmutator imports product feeds, cleans catalog data, and builds QFlow pipelines.\nInspect schemas and violations, revise records or mappings, and deploy pipeline endpoints.\nActions follow your account roles, with previews and confirmation for irreversible changes."},"homepage_url":"","icon":"https://qmutator.com/favicon.png","id":"6bcb3f93-d087-4426-b0ac-df9e19758671","installs":0,"last_scanned":"","license":"","long_description":"Tools manage multilingual field mappings, constraints, filtered export views, import status, and pipeline versions. Workflows support validation and sample previews before imports or deployments; destructive tools can delete catalog configuration or data.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"Explicit delete tools remove import, mutation, perspective, constraint, schema and bucket state.","reasoning":"These actions can irreversibly remove meaningful business configuration or data.","risk_type":"data_deletion","severity":"high","title":"Deletes catalog and workflow resources","triggering_tools_or_skills":["delete_bucket","delete_constraint","delete_import_file","delete_mutation","delete_perspective","delete_schema_field"]},{"evidence":"The tool explicitly deploys a mutation version and exposes its endpoint URL.","reasoning":"It changes live data-processing infrastructure.","risk_type":"deployment_infrastructure","severity":"high","title":"Deploys mutation versions","triggering_tools_or_skills":["deploy_mutation_version"]},{"evidence":"The tool submits a support request to the publisher.","reasoning":"It sends external content as the authenticated user.","risk_type":"messaging_as_user","severity":"high","title":"Files an external support ticket","triggering_tools_or_skills":["file_support_ticket"]},{"evidence":"These tools persist workflow, project, file and schema changes.","reasoning":"They materially change the shared workspace.","risk_type":"data_modification","severity":"medium","title":"Creates, uploads and updates QFlow assets","triggering_tools_or_skills":["create_import_file","create_mutation","create_project","queue_import","update_mutation","upload_import_file_from_url","upsert_schema_field"]},{"evidence":"The tool name explicitly retrieves an import file from a URL.","reasoning":"Caller-selected web content can be fetched into the workspace.","risk_type":"arbitrary_network_access","severity":"low","title":"Imports a file from a supplied URL","triggering_tools_or_skills":["upload_import_file_from_url"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication to the Qmutator admin workspace is required; destructive, deployment and support scopes are not documented in the packet.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/6bcb3f93-d087-4426-b0ac-df9e19758671.json","what_it_proves":"Candidate PR #125 record identity (name \"Qmutator\", publisher, type web_connector) and 61 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/6bcb3f93-d087-4426-b0ac-df9e19758671: complete tool_names inventory (61 tools), remote streamable-http endpoint https://api.qmutator.com/admin/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Qmutator can delete workflow data, deploy live mutations and file support tickets.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:6bcb3f93-d087-4426-b0ac-df9e19758671","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 61 tools. Official docs were not needed to establish the explicit High actions; runtime confirmation and RBAC remain required.","risk_domains":{"arbitrary_network_access":"true","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"true","deployment_or_infrastructure":"true","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":61,"tools_or_skills_total":61},"name":"Qmutator","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=6bcb3f93-d087-4426-b0ac-df9e19758671&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://qmutator.com/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Qmutator","publisher_url":"https://qmutator.com/","remote_url":"https://api.qmutator.com/admin/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can permanently remove data or resources. Review findings: These actions can irreversibly remove meaningful business configuration or data.","evidence":"Deletes catalog and workflow resources: Explicit delete tools remove import, mutation, perspective, constraint, schema and bucket state.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Deletes catalog and workflow resources","triggering_tools":["delete_bucket","delete_constraint","delete_import_file","delete_mutation","delete_perspective","delete_schema_field"]},{"description":"This connector can deploy code or change infrastructure and production environments. Review findings: It changes live data-processing infrastructure.","evidence":"Deploys mutation versions: The tool explicitly deploys a mutation version and exposes its endpoint URL.","manual_risk_type":"deployment_infrastructure","remediation":{"block_tool_categories":["code_execution","state_change"],"steps":["Default to a sandbox or staging environment.","Require code review, human approval, audit logging, and a tested rollback path for production changes."]},"risk_type":"code_deployment","severity":"high","title":"Deploys mutation versions","triggering_tools":["deploy_mutation_version"]},{"description":"This connector can publish or send messages and content using the connected identity. Review findings: It sends external content as the authenticated user.","evidence":"Files an external support ticket: The tool submits a support request to the publisher.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Files an external support ticket","triggering_tools":["file_support_ticket"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change the shared workspace.","evidence":"Creates, uploads and updates QFlow assets: These tools persist workflow, project, file and schema changes.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Creates, uploads and updates QFlow assets","triggering_tools":["create_import_file","create_mutation","create_project","queue_import","update_mutation","upload_import_file_from_url","upsert_schema_field"]},{"description":"This connector can send caller-provided data to an external service or publisher. Review findings: Caller-selected web content can be fetched into the workspace.","evidence":"Imports a file from a supplied URL: The tool name explicitly retrieves an import file from a URL.","manual_risk_type":"arbitrary_network_access","remediation":{"block_tool_categories":["sends_externally"],"steps":["Do not include secrets, regulated data, or customer information unless the destination is approved.","Review the recipient's retention and deletion policy before enabling the connector."]},"risk_type":"forwards_data_to_third_party","severity":"low","title":"Imports a file from a supplied URL","triggering_tools":["upload_import_file_from_url"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@qmutator.com","tags":["code_deployment","deletes_data","forwards_data_to_third_party","modifies_data","network_access","oauth_required","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"create_buckets"},{"description":"","name":"create_import_file","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change the shared workspace."}},{"description":"","name":"create_mutation","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change the shared workspace."}},{"description":"","name":"create_mutation_version"},{"description":"","name":"create_perspective"},{"description":"","name":"create_project","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change the shared workspace."}},{"description":"","name":"delete_bucket","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions can irreversibly remove meaningful business configuration or data."}},{"description":"","name":"delete_constraint","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions can irreversibly remove meaningful business configuration or data."}},{"description":"","name":"delete_import_file","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions can irreversibly remove meaningful business configuration or data."}},{"description":"","name":"delete_mutation","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions can irreversibly remove meaningful business configuration or data."}},{"description":"","name":"delete_perspective","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions can irreversibly remove meaningful business configuration or data."}},{"description":"","name":"delete_schema_field","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These actions can irreversibly remove meaningful business configuration or data."}},{"description":"","name":"deploy_mutation_version","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: It changes live data-processing infrastructure."}},{"description":"","name":"distinct_field_values"},{"description":"","name":"distinct_source_values"},{"description":"","name":"file_support_ticket","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: It sends external content as the authenticated user."}},{"description":"","name":"find_violating_buckets"},{"description":"","name":"get_admin_docs"},{"description":"","name":"get_bucket_by_id"},{"description":"","name":"get_bucket_violations"},{"description":"","name":"get_field_range"},{"description":"","name":"get_import_file"},{"description":"","name":"get_import_status"},{"description":"","name":"get_mutation"},{"description":"","name":"get_mutation_endpoint_url"},{"description":"","name":"get_mutation_summaries"},{"description":"","name":"get_project_schema"},{"description":"","name":"get_qflow_node_doc"},{"description":"","name":"get_violation_counts"},{"description":"","name":"import_mutation_exists"},{"description":"","name":"list_buckets"},{"description":"","name":"list_field_constraints"},{"description":"","name":"list_import_files"},{"description":"","name":"list_mutations"},{"description":"","name":"list_my_companies"},{"description":"","name":"list_my_projects"},{"description":"","name":"list_qflow_node_types"},{"description":"","name":"list_schemas"},{"description":"","name":"merge_bucket_data"},{"description":"","name":"move_mutation_to_folder"},{"description":"","name":"patch_bucket"},{"description":"","name":"peek_import"},{"description":"","name":"preview_mutation"},{"description":"","name":"profile_source"},{"description":"","name":"queue_import","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change the shared workspace."}},{"description":"","name":"rename_perspective"},{"description":"","name":"reorder_import_files"},{"description":"","name":"run_import_mutation"},{"description":"","name":"sample_buckets"},{"description":"","name":"set_perspective_filter"},{"description":"","name":"set_schema_languages"},{"description":"","name":"simulate_mapping"},{"description":"","name":"update_import_file"},{"description":"","name":"update_mutation","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change the shared workspace."}},{"description":"","name":"upload_import_file_from_url","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change the shared workspace."}},{"description":"","name":"upsert_constraint"},{"description":"","name":"upsert_schema_field","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They materially change the shared workspace."}},{"description":"","name":"upsert_schema_fields"},{"description":"","name":"validate_mapping"},{"description":"","name":"validate_mutation"},{"description":"","name":"who_am_i"}],"tools_count":61,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/6bcb3f93-d087-4426-b0ac-df9e19758671","uuid":"d3352abc-3251-577f-938e-1a3ffc12d664","verification_tier":"community","version":""},"query_key":"qmutator qmutator","schema_version":1,"status":"match"}