{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-19","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"high","description":"BOCP retrieves business indicators already calculated in your ERP account. Compare trends, invoiced values, stock positions, and customer or product counts. The connector exposes indicator data rather than general ERP operations.","did":"785ab259-a37f-430d-b2c3-a6cfc9052500","documentation_url":"https://kb.bocp.eu/view/0/1054-cum-conectez-un-asistent-ai-la-bocp.html","editorial_description":{"extended_description":"Stock can be valued at purchase or sale prices with potential margin. Historical stock-value positions are reconstructed from movements for 7, 30, 90, and 365 days earlier.","schema_version":1,"summary":"BOCP retrieves business indicators already calculated in your ERP account.\nCompare trends, invoiced values, stock positions, and customer or product counts.\nThe connector exposes indicator data rather than general ERP operations."},"homepage_url":"","icon":"https://reallife.solutions/downloads/logos/bocpsquare.png","id":"785ab259-a37f-430d-b2c3-a6cfc9052500","installs":0,"last_scanned":"","license":"","long_description":"Stock can be valued at purchase or sale prices with potential margin. Historical stock-value positions are reconstructed from movements for 7, 30, 90, and 365 days earlier.","manual_assessment":"low","manual_review":{"all_findings":[{"evidence":"The declared permissions say only ERP-approved daily totals/counts are exposed, without client PII.","reasoning":"Business performance indicators are private company information.","risk_type":"private_data_read","severity":"low","title":"Reads allowed private business KPI values and periods","triggering_tools_or_skills":["get_business_indicator_period","get_business_indicator_values","get_business_levels","list_business_indicators","list_business_levels"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication to BOCP is required; the ERP administrator explicitly selects which KPI indicators the connector may read.","blocked_missing_evidence":null,"confidence":"high","displayed_risk":"low","evidence_completeness":"partial","manual_overall_risk":"low","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/785ab259-a37f-430d-b2c3-a6cfc9052500.json","what_it_proves":"Candidate PR #125 record identity (name \"BOCP - Business Online Control Panel\", publisher, type web_connector) and 5 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/785ab259-a37f-430d-b2c3-a6cfc9052500: complete tool_names inventory (5 tools), remote streamable-http endpoint https://secure.bocp.eu/app/rest/mcp, auth_posture auth_required, publisher-declared permissions text, directory tier community"},{"accessed_at":"2026-10-11T01:44:00Z","url_or_path":"https://kb.bocp.eu/view/0/1054-cum-conectez-un-asistent-ai-la-bocp.html","what_it_proves":"Official BOCP guide and Directory declaration describe ERP-authorized KPI totals/counts without client PII."}],"primary_reason":"BOCP exposes exactly five administrator-allowed read-only KPI retrieval tools.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:785ab259-a37f-430d-b2c3-a6cfc9052500","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all five tools and the official setup statement; no record-level mutation, export, payment or generic query is exposed.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"false","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":5,"tools_or_skills_total":5},"name":"BOCP - Business Online Control Panel","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=785ab259-a37f-430d-b2c3-a6cfc9052500&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://kb.bocp.eu/view/0/1055-privacy-policy-%E2%80%94-bocp-erp-connector-for-ai-assistants.html","provisional_risk":null,"publication_recommendation":"accept","publisher":"Real Life SRL","publisher_url":"https://www.bocp.ro/","remote_url":"https://secure.bocp.eu/app/rest/mcp","repository_url":"","risk":"low","risk_severity":"low","security_risks":[{"description":"This connector can read information available to the connected account and return it to the AI. Review findings: Business performance indicators are private company information.","evidence":"Reads allowed private business KPI values and periods: The declared permissions say only ERP-approved daily totals/counts are exposed, without client PII.","manual_risk_type":"private_data_read","remediation":{"block_tool_categories":["data_exfiltration"],"steps":["Use a least-privilege account limited to the information required by the workflow.","Restrict folders, projects, tenants, and other data scopes wherever the provider allows it.","Review access logs for unexpected reads or bulk retrieval."]},"risk_type":"reads_private_data","severity":"low","title":"Reads allowed private business KPI values and periods","triggering_tools":["get_business_indicator_period","get_business_indicator_values","get_business_levels","list_business_indicators","list_business_levels"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"office@reallife.solutions","tags":["network_access","oauth_required","reads_private_data","web_connector"],"tools":[{"description":"","name":"get_business_indicator_period"},{"description":"","name":"get_business_indicator_values"},{"description":"","name":"get_business_levels"},{"description":"","name":"list_business_indicators"},{"description":"","name":"list_business_levels"}],"tools_count":5,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/785ab259-a37f-430d-b2c3-a6cfc9052500","uuid":"f244eb55-4b68-5e17-99b6-11ad11a76e6e","verification_tier":"community","version":""},"query_key":"real life srl bocp business online control panel","schema_version":1,"status":"match"}