{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-19","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","catalog_reconciliation":{"basis":"Documented actions on the identified catalog surface; not an execution test.","confidence":"medium","evidence_completeness":"partial","previous":{"confidence":"low","detail_sha256":"51b8136bddf05a0d32b8ef6c0f5b5ed2a590d2ad9833555b60ce8e8664cb7bac","risk":"high"},"proposal_file":"parent-proposals.json","rationale":"Agrees with first pass (Medium). Per Ruddr's help article and engineering post, writes require a separate mcp:write grant (read-only connections get no write tools), act as the member within their security role, and are attributed in record history. The documented writes are time entries (suggest, then preflight, then save with user confirmation) and support tickets. Invoices and payments are documented only as reads. No delete, financial-transaction, or admin action is evidenced, so Medium. The 'Executes Code or Commands' row and the claude_refresh 'Can send messages as you' High have no support.","review_key":"claudesec:c54ba5df-c28c-4be8-8b47-d0c8ce46193b","reviewed_at":"2026-10-12","runtime_verified":false,"sources":["blind packet stored_tool_inventory","https://help.ruddr.io/getting-started/connect-ai-apps","https://www.ruddr.com/post/why-we-built-ruddrs-mcp-server-the-way-we-did"],"status":"resolved"},"category":"Web Connector","confidence":"low","description":"Explore professional-services operations in Ruddr from Claude. Ask about projects, time, expenses, resource plans, billing and financial performance. Use your selected workspace and security role with Ruddr Assistant enabled.","did":"c54ba5df-c28c-4be8-8b47-d0c8ce46193b","documentation_url":"https://help.ruddr.io/getting-started/connect-ai-apps","editorial_description":{"extended_description":"Ruddr can calculate budget variance, utilization, realization, effective bill rates, margins and forecasts, including multicurrency totals at workspace rates. Queries cover clients, timesheets, allocations, invoices, receivables and the sales pipeline. Recorded changes are attributed to your account and identify the connected application in history; access is revocable from your profile.","schema_version":1,"summary":"Explore professional-services operations in Ruddr from Claude.\nAsk about projects, time, expenses, resource plans, billing and financial performance.\nUse your selected workspace and security role with Ruddr Assistant enabled."},"homepage_url":"","icon":"https://www.ruddr.io/logo512.png","id":"c54ba5df-c28c-4be8-8b47-d0c8ce46193b","installs":0,"last_scanned":"","license":"","long_description":"Ruddr can calculate budget variance, utilization, realization, effective bill rates, margins and forecasts, including multicurrency totals at workspace rates. Queries cover clients, timesheets, allocations, invoices, receivables and the sales pipeline. Recorded changes are attributed to your account and identify the connected application in history; access is revocable from your profile.","manual_assessment":"unassessed","manual_review":{"all_findings":[{"evidence":"The listing spans invoicing/payments/time/project operations while the generic command lacks schema.","reasoning":"Hidden actions may include financial, deletion or external messaging effects.","risk_type":"generic_gateway","severity":"medium","title":"Generic PSA command is undocumented","triggering_tools_or_skills":["ruddr-command"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication covers PSA projects, time, expenses, invoices, payments and sales pipeline; scopes are unspecified.","blocked_missing_evidence":"Official input schema and complete dispatch/action list for ruddr-command, including invoice/payment, delete, send and admin behavior.","confidence":"low","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"unassessed","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/c54ba5df-c28c-4be8-8b47-d0c8ce46193b.json","what_it_proves":"Candidate PR #125 record identity (name \"Ruddr\", publisher, type web_connector) and 12 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/c54ba5df-c28c-4be8-8b47-d0c8ce46193b: complete tool_names inventory (12 tools), remote streamable-http endpoint https://www.ruddr.io/api/mcp, auth_posture auth_required, publisher-declared permissions text, declared sensitive data types, directory tier community"}],"primary_reason":"Ruddr exposes a generic ruddr-command over financial/project operations without an enumerated action boundary.","provisional_risk":"high","publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:c54ba5df-c28c-4be8-8b47-d0c8ce46193b","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 12 names. Official help fetch failed; submit-feedback/open-support-ticket are bounded submissions, but ruddr-command may dispatch writes.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"unknown","deployment_or_infrastructure":"false","dynamic_hidden_actions":"true","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"unknown","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"unknown","spends_or_moves_money":"unknown"},"tools_or_skills_reviewed":12,"tools_or_skills_total":12},"name":"Ruddr","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=c54ba5df-c28c-4be8-8b47-d0c8ce46193b&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.ruddr.com/privacy-policy","provisional_risk":"high","publication_recommendation":"fix","publisher":"Ruddr","publisher_url":"https://www.ruddr.com/","remote_url":"https://www.ruddr.io/api/mcp","repository_url":"","risk":"medium","risk_severity":"medium","security_risks":[{"description":"Ruddr retrieves authorized project, financial and operational information using the member’s security role.","evidence":"https://help.ruddr.io/getting-started/connect-ai-apps\nRead your Ruddr data: projects, time, expenses, billing, reporting","risk_type":"reads_private_data","severity":"medium","title":"Reads professional-services business records"},{"description":"An additional mcp:write grant enables attributed record changes, including time entries saved after preflight and user confirmation.","evidence":"https://www.ruddr.com/post/why-we-built-ruddrs-mcp-server-the-way-we-did\nmcp:write grant; track-time 3-step with confirmation\n\nhttps://help.ruddr.io/getting-started/connect-ai-apps\nCreate and update records on your behalf","risk_type":"modifies_data","severity":"medium","title":"Creates time entries with write permission"}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"help@ruddr.io","tags":["reads_private_data","modifies_data"],"tools":[{"description":"","name":"api-docs-search"},{"description":"","name":"kb-search"},{"description":"","name":"open-support-ticket"},{"description":"","name":"ruddr-command","risk":{"category":"code_execution","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: Hidden actions may include financial, deletion or external messaging effects."}},{"description":"","name":"ruddr-query"},{"description":"","name":"ruddr-status"},{"description":"","name":"ruddr-website"},{"description":"","name":"sitemap-directory"},{"description":"","name":"sitemap-url-builder"},{"description":"","name":"skill-load"},{"description":"","name":"submit-feedback"},{"description":"","name":"whats-new"}],"tools_count":12,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/c54ba5df-c28c-4be8-8b47-d0c8ce46193b","uuid":"8a480cf1-65d7-5165-b063-f9fcadbe534a","verification_tier":"community","version":""},"query_key":"ruddr ruddr","schema_version":1,"status":"match"}