{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-17","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Quotient connects marketing planning and content execution in one workspace. Manage campaigns, tasks, contacts, documents, blogs, and social posts through Claude. The connector can publish blog and social content, not just prepare drafts.","did":"4c67b3d4-ca5c-4b3c-b703-0dc890e07e05","documentation_url":"https://www.getquotient.ai/docs/mcp/from-other-apps","editorial_description":{"extended_description":"Campaigns organize briefs, timelines, tasks, and deliverables around a goal. Brand documents and stored preferences provide context for content creation. The tool inventory also supports asset imports, email-broadcast lookups, and communication with Quotient's agent.","schema_version":1,"summary":"Quotient connects marketing planning and content execution in one workspace.\nManage campaigns, tasks, contacts, documents, blogs, and social posts through Claude.\nThe connector can publish blog and social content, not just prepare drafts."},"homepage_url":"","icon":"","id":"4c67b3d4-ca5c-4b3c-b703-0dc890e07e05","installs":0,"last_scanned":"","license":"","long_description":"Campaigns organize briefs, timelines, tasks, and deliverables around a goal. Brand documents and stored preferences provide context for content creation. The tool inventory also supports asset imports, email-broadcast lookups, and communication with Quotient's agent.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"Names explicitly declare sending an A2A message and publishing blog/social content.","reasoning":"These actions communicate externally as the user.","risk_type":"messaging_as_user","severity":"high","title":"Can send and publish external marketing content","triggering_tools_or_skills":["a2a-send-message","publish-blog","publish-social-post"]},{"evidence":"memory-rm explicitly removes remote memory data.","reasoning":"Deleting meaningful stored memory is High.","risk_type":"data_deletion","severity":"high","title":"Can remove stored memory","triggering_tools_or_skills":["memory-rm"]},{"evidence":"Inventory declares creation and updates across campaign/account objects.","reasoning":"These tools persist meaningful business data.","risk_type":"data_modification","severity":"medium","title":"Can create and update campaigns and records","triggering_tools_or_skills":["create-campaign","create-company","create-person","update-campaign"]},{"evidence":"Remote server code is not pinned.","reasoning":"Runtime may drift.","risk_type":"provenance_uncertainty","severity":"low","title":"Hosted implementation is mutable","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"Authenticated Quotient account is implied; OAuth scopes are not stated.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/4c67b3d4-ca5c-4b3c-b703-0dc890e07e05.json","what_it_proves":"Candidate PR #125 record identity (name \"Quotient\", publisher, type web_connector) and 53 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/4c67b3d4-ca5c-4b3c-b703-0dc890e07e05: complete tool_names inventory (53 tools), remote streamable-http endpoint https://www.getquotient.ai/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Quotient can publish content, send messages, delete memory, and mutate marketing records.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:4c67b3d4-ca5c-4b3c-b703-0dc890e07e05","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 53 declared names; no tool schemas were available.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":53,"tools_or_skills_total":53},"name":"Quotient","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=4c67b3d4-ca5c-4b3c-b703-0dc890e07e05&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.getquotient.ai/legal/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Quotient Software, Inc.","publisher_url":"https://www.getquotient.ai/","remote_url":"https://www.getquotient.ai/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: These actions communicate externally as the user.","evidence":"Can send and publish external marketing content: Names explicitly declare sending an A2A message and publishing blog/social content.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Can send and publish external marketing content","triggering_tools":["a2a-send-message","publish-blog","publish-social-post"]},{"description":"This connector can permanently remove data or resources. Review findings: Deleting meaningful stored memory is High.","evidence":"Can remove stored memory: memory-rm explicitly removes remote memory data.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Can remove stored memory","triggering_tools":["memory-rm"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These tools persist meaningful business data.","evidence":"Can create and update campaigns and records: Inventory declares creation and updates across campaign/account objects.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Can create and update campaigns and records","triggering_tools":["create-campaign","create-company","create-person","update-campaign"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://www.getquotient.ai/support","tags":["accesses_messaging","deletes_data","modifies_data","network_access","oauth_required","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"a2a-get-response"},{"description":"","name":"a2a-send-message","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: These actions communicate externally as the user."}},{"description":"","name":"create-asset-from-url"},{"description":"","name":"create-blog"},{"description":"","name":"create-campaign","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These tools persist meaningful business data."}},{"description":"","name":"create-campaign-task"},{"description":"","name":"create-company","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These tools persist meaningful business data."}},{"description":"","name":"create-document"},{"description":"","name":"create-person","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These tools persist meaningful business data."}},{"description":"","name":"create-social-post"},{"description":"","name":"get-asset"},{"description":"","name":"get-blog"},{"description":"","name":"get-campaign"},{"description":"","name":"get-campaign-task"},{"description":"","name":"get-company"},{"description":"","name":"get-doc"},{"description":"","name":"get-document"},{"description":"","name":"get-email-broadcast"},{"description":"","name":"get-person"},{"description":"","name":"get-social-post"},{"description":"","name":"list-assets"},{"description":"","name":"list-blogs"},{"description":"","name":"list-campaign-tasks"},{"description":"","name":"list-campaigns"},{"description":"","name":"list-companies"},{"description":"","name":"list-deals"},{"description":"","name":"list-documents"},{"description":"","name":"list-email-broadcasts"},{"description":"","name":"list-people"},{"description":"","name":"list-social-accounts"},{"description":"","name":"list-social-posts"},{"description":"","name":"memory-cat"},{"description":"","name":"memory-ls"},{"description":"","name":"memory-mkdir"},{"description":"","name":"memory-mv"},{"description":"","name":"memory-rm","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deleting meaningful stored memory is High."}},{"description":"","name":"memory-search"},{"description":"","name":"memory-write"},{"description":"","name":"publish-blog","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: These actions communicate externally as the user."}},{"description":"","name":"publish-social-post","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: These actions communicate externally as the user."}},{"description":"","name":"search-assets"},{"description":"","name":"search-docs"},{"description":"","name":"unpublish-blog"},{"description":"","name":"unschedule-social-post"},{"description":"","name":"update-blog"},{"description":"","name":"update-campaign","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These tools persist meaningful business data."}},{"description":"","name":"update-campaign-task"},{"description":"","name":"update-company"},{"description":"","name":"update-document"},{"description":"","name":"update-person"},{"description":"","name":"update-social-post"},{"description":"","name":"upsert-company"},{"description":"","name":"whoami"}],"tools_count":53,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/4c67b3d4-ca5c-4b3c-b703-0dc890e07e05","uuid":"a9cee361-42d4-5b32-84e0-7904815bf939","verification_tier":"community","version":""},"query_key":"quotient software inc quotient","schema_version":1,"status":"match"}