{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-06","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Rebbel prepares brand guides, strategies, campaigns, and social content. Connect a brand or publish your own copy through supported workflows. The source requires human approval for costs, assets, scheduling, and publication.","did":"31a32ea7-669b-4c89-a61b-9c7ff819a6bc","documentation_url":"https://rebbel.io/mcp","editorial_description":{"extended_description":"Campaign content can include text, images, and video. Tools generate and revise guides and strategies, create posts, approve them, and schedule or publish them. Separate operations archive brands and campaigns and disconnect social connections.","schema_version":1,"summary":"Rebbel prepares brand guides, strategies, campaigns, and social content.\nConnect a brand or publish your own copy through supported workflows.\nThe source requires human approval for costs, assets, scheduling, and publication."},"homepage_url":"","icon":"","id":"31a32ea7-669b-4c89-a61b-9c7ff819a6bc","installs":0,"last_scanned":"","license":"","long_description":"Campaign content can include text, images, and video. Tools generate and revise guides and strategies, create posts, approve them, and schedule or publish them. Separate operations archive brands and campaigns and disconnect social connections.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The complete inventory includes explicit publish and schedule actions for connected brand social accounts.","reasoning":"These communicate publicly as the connected business.","risk_type":"messaging_as_user","severity":"high","title":"Publishes and schedules social posts","triggering_tools_or_skills":["approve_post","publish_post","schedule_post"]},{"evidence":"The Directory description says every dollar of AI generation cost goes through approval and that accounts have a monthly generation allowance.","reasoning":"Generation can consume finite paid usage or approved cost.","risk_type":"financial_transaction","severity":"high","title":"Generation actions consume an approved generation allowance or cost","triggering_tools_or_skills":["generate_brand_guide","generate_campaign","generate_strategy","regenerate_brand_guide_section","regenerate_strategy_section"]},{"evidence":"The declared tool explicitly disconnects an existing integration.","reasoning":"Revoking a connected account changes credential/integration state.","risk_type":"credential_admin","severity":"high","title":"Can disconnect a linked social connection","triggering_tools_or_skills":["disconnect_connection"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication connects brand and social accounts. The description states publication and generation cost require human approval, but exact social scopes and billing mechanics are not listed.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"complete","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/31a32ea7-669b-4c89-a61b-9c7ff819a6bc.json","what_it_proves":"Candidate PR #125 record identity (name \"Rebbel\", publisher, type web_connector) and 26 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/31a32ea7-669b-4c89-a61b-9c7ff819a6bc: complete tool_names inventory (26 tools), remote streamable-http endpoint https://app.rebbel.io/api/mcp, auth_posture auth_required, publisher-declared permissions text, declared sensitive data types, directory tier community"}],"primary_reason":"Rebbel can spend generation allowance, publish/schedule social content and disconnect linked accounts.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:31a32ea7-669b-4c89-a61b-9c7ff819a6bc","reviewed_at":"2026-10-10","reviewer_notes":"Approval requirements are useful safeguards but do not reduce capability severity. Verify which generation tools can incur billable overage versus only included allowance.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"true","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"true"},"tools_or_skills_reviewed":26,"tools_or_skills_total":26},"name":"Rebbel","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=31a32ea7-669b-4c89-a61b-9c7ff819a6bc&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://rebbel.io/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Rebbel","publisher_url":"https://rebbel.io/","remote_url":"https://app.rebbel.io/api/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: These communicate publicly as the connected business.","evidence":"Publishes and schedules social posts: The complete inventory includes explicit publish and schedule actions for connected brand social accounts.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Publishes and schedules social posts","triggering_tools":["approve_post","publish_post","schedule_post"]},{"description":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Generation can consume finite paid usage or approved cost.","evidence":"Generation actions consume an approved generation allowance or cost: The Directory description says every dollar of AI generation cost goes through approval and that accounts have a monthly generation allowance.","manual_risk_type":"financial_transaction","remediation":{"block_tool_categories":["financial"],"steps":["Set provider-side spending limits and require approval for every financial action.","Use a dedicated low-balance account and review transaction logs."]},"risk_type":"spends_money","severity":"high","title":"Generation actions consume an approved generation allowance or cost","triggering_tools":["generate_brand_guide","generate_campaign","generate_strategy","regenerate_brand_guide_section","regenerate_strategy_section"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Revoking a connected account changes credential/integration state.","evidence":"Can disconnect a linked social connection: The declared tool explicitly disconnects an existing integration.","manual_risk_type":"credential_admin","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"high","title":"Can disconnect a linked social connection","triggering_tools":["disconnect_connection"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@rebbel.io","tags":["modifies_data","network_access","oauth_required","sends_messages_as_you","spends_money","web_connector"],"tools":[{"description":"","name":"approve_brand_guide"},{"description":"","name":"approve_post","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: These communicate publicly as the connected business."}},{"description":"","name":"approve_strategy"},{"description":"","name":"archive_brand"},{"description":"","name":"archive_campaign"},{"description":"","name":"create_adhoc_post"},{"description":"","name":"create_brand"},{"description":"","name":"create_post"},{"description":"","name":"disconnect_connection","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Revoking a connected account changes credential/integration state."}},{"description":"","name":"draft_first_post"},{"description":"","name":"generate_brand_guide","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Generation can consume finite paid usage or approved cost."}},{"description":"","name":"generate_campaign","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Generation can consume finite paid usage or approved cost."}},{"description":"","name":"generate_strategy","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Generation can consume finite paid usage or approved cost."}},{"description":"","name":"get_brand_guide"},{"description":"","name":"get_results_verdict"},{"description":"","name":"get_strategy"},{"description":"","name":"list_brands"},{"description":"","name":"list_campaigns"},{"description":"","name":"list_connections"},{"description":"","name":"list_posts"},{"description":"","name":"publish_post","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: These communicate publicly as the connected business."}},{"description":"","name":"regenerate_brand_guide_section","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Generation can consume finite paid usage or approved cost."}},{"description":"","name":"regenerate_strategy_section","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Generation can consume finite paid usage or approved cost."}},{"description":"","name":"rename_brand"},{"description":"","name":"retry_brand_ingest"},{"description":"","name":"schedule_post","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: These communicate publicly as the connected business."}}],"tools_count":26,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/31a32ea7-669b-4c89-a61b-9c7ff819a6bc","uuid":"29144943-ac3a-554e-958b-f1c6d4bae380","verification_tier":"community","version":""},"query_key":"rebbel rebbel","schema_version":1,"status":"match"}