{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-26","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Quiver Quant provides financial and political datasets for stock research. Inspect disclosed trading, institutional holdings, lobbying, executive pay, and government contract awards. Compare tickers and explore related news, political exposure, and company-level context.","did":"58a9bb50-710e-42f8-9609-420209b872c5","documentation_url":"https://api.quiverquant.com/mcp-server/","editorial_description":{"extended_description":"Tools cover congressional and Trump trading disclosures, corporate donors, legislation, patents, dark-pool data, and ownership. Dataset search and a general query interface support discovery of available Quiver information.","schema_version":1,"summary":"Quiver Quant provides financial and political datasets for stock research.\nInspect disclosed trading, institutional holdings, lobbying, executive pay, and government contract awards.\nCompare tickers and explore related news, political exposure, and company-level context."},"homepage_url":"","icon":"https://www.quiverquant.com/static/favicon/apple-touch-icon.png","id":"58a9bb50-710e-42f8-9609-420209b872c5","installs":0,"last_scanned":"","license":"","long_description":"Tools cover congressional and Trump trading disclosures, corporate donors, legislation, patents, dark-pool data, and ownership. Dataset search and a general query interface support discovery of available Quiver information.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"Generic API querying and dataset discovery are declared without an allowlist/schema.","reasoning":"Hidden actions and query shape require conservative High assessment.","risk_type":"generic_gateway","severity":"high","title":"Generic Quiver API query hides reachable endpoints","triggering_tools_or_skills":["query_quiver_api","search_datasets"]},{"evidence":"Named tools retrieve financial intelligence.","reasoning":"Read access is Low aside from generic gateway risk.","risk_type":"private_data_read","severity":"low","title":"Reads financial/political datasets","triggering_tools_or_skills":["get_congress_trades","get_insider_trading","get_institutional_holdings"]},{"evidence":"Remote hosted implementation is unpinned.","reasoning":"Runtime capability can drift.","risk_type":"provenance_uncertainty","severity":"low","title":"Hosted implementation is mutable","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"OAuth/account authorization required; exact scopes are not documented.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/58a9bb50-710e-42f8-9609-420209b872c5.json","what_it_proves":"Candidate PR #125 record identity (name \"Quiver Quant\", publisher, type web_connector) and 19 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/58a9bb50-710e-42f8-9609-420209b872c5: complete tool_names inventory (19 tools), remote streamable-http endpoint https://mcp.quiverquant.com/, auth_posture auth_required, directory tier community"}],"primary_reason":"Quiver Quant exposes a generic API query gateway over financial datasets.","provisional_risk":null,"publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:58a9bb50-710e-42f8-9609-420209b872c5","reviewed_at":"2026-10-10","reviewer_notes":"All declared tool names were reviewed; schemas were unavailable.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"true","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"false","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"true","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":19,"tools_or_skills_total":19},"name":"Quiver Quant","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=58a9bb50-710e-42f8-9609-420209b872c5&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.quiverquant.com/privacypolicy/","provisional_risk":null,"publication_recommendation":"fix","publisher":"Quiver Quantitative","publisher_url":"https://www.quiverquant.com/","remote_url":"https://mcp.quiverquant.com/","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Hidden actions and query shape require conservative High assessment.","evidence":"Generic Quiver API query hides reachable endpoints: Generic API querying and dataset discovery are declared without an allowlist/schema.","manual_risk_type":"generic_gateway","remediation":{"block_tool_categories":["code_execution"],"steps":["Run only in a sandbox with least-privilege credentials and strict resource limits.","Disable generic execution gateways unless their reachable action set is fully understood.","Require approval before execution against production systems or sensitive data."]},"risk_type":"runs_code","severity":"high","title":"Generic Quiver API query hides reachable endpoints","triggering_tools":["query_quiver_api","search_datasets"]},{"description":"This connector can read information available to the connected account and return it to the AI. Review findings: Read access is Low aside from generic gateway risk.","evidence":"Reads financial/political datasets: Named tools retrieve financial intelligence.","manual_risk_type":"private_data_read","remediation":{"block_tool_categories":["data_exfiltration"],"steps":["Use a least-privilege account limited to the information required by the workflow.","Restrict folders, projects, tenants, and other data scopes wherever the provider allows it.","Review access logs for unexpected reads or bulk retrieval."]},"risk_type":"reads_private_data","severity":"low","title":"Reads financial/political datasets","triggering_tools":["get_congress_trades","get_insider_trading","get_institutional_holdings"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"info@quiverquant.com","tags":["network_access","oauth_required","reads_private_data","runs_code","web_connector"],"tools":[{"description":"","name":"compare_tickers"},{"description":"","name":"get_congress_legislation"},{"description":"","name":"get_congress_politician"},{"description":"","name":"get_congress_trades"},{"description":"","name":"get_corporate_donors"},{"description":"","name":"get_dark_pool"},{"description":"","name":"get_executive_compensation"},{"description":"","name":"get_gov_contracts"},{"description":"","name":"get_insider_trading"},{"description":"","name":"get_institutional_holdings"},{"description":"","name":"get_lobbying"},{"description":"","name":"get_patents"},{"description":"","name":"get_political_exposure"},{"description":"","name":"get_quiver_newsfeed"},{"description":"","name":"get_ticker_full_picture"},{"description":"","name":"get_ticker_ownership"},{"description":"","name":"get_trump_trades"},{"description":"","name":"query_quiver_api","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Hidden actions and query shape require conservative High assessment."}},{"description":"","name":"search_datasets","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Hidden actions and query shape require conservative High assessment."}}],"tools_count":19,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/58a9bb50-710e-42f8-9609-420209b872c5","uuid":"663f184c-c01a-5de8-8c3b-ed2c4bbea0de","verification_tier":"community","version":""},"query_key":"quiver quant","schema_version":1,"status":"match"}