{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-02","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Reviews expenses, trips and policy information from your Rydoo account. Approve or reject expenses with confirmation under your own identity and permissions. Card and wallet tools require the Rydoo Cards module, including virtual-card requests with confirmed limits.","did":"b920f757-175f-4be4-8d66-3cf3894e4c0b","documentation_url":"https://developers.rydoo.com/page/mcp","editorial_description":{"extended_description":"Search expenses you own or oversee, find missing receipts and inspect totals or trip context. Cards features include transactions, wallet balances, spending summaries and monthly statements. Company-record lookups and feedback tools support administration.","schema_version":1,"summary":"Reviews expenses, trips and policy information from your Rydoo account.\nApprove or reject expenses with confirmation under your own identity and permissions.\nCard and wallet tools require the Rydoo Cards module, including virtual-card requests with confirmed limits."},"homepage_url":"","icon":"","id":"b920f757-175f-4be4-8d66-3cf3894e4c0b","installs":0,"last_scanned":"","license":"","long_description":"Search expenses you own or oversee, find missing receipts and inspect totals or trip context. Cards features include transactions, wallet balances, spending summaries and monthly statements. Company-record lookups and feedback tools support administration.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The inventory explicitly includes expense approval and rejection in an expense-management system.","reasoning":"Approval can authorize reimbursement or accounting treatment with financial consequences.","risk_type":"financial_transaction","severity":"high","title":"Approves or rejects expenses","triggering_tools_or_skills":["approve_expense","reject_expense"]},{"evidence":"request_virtual_card creates or requests access to a payment instrument for the authenticated user.","reasoning":"Issuing a virtual card is a powerful financial/credential administration action.","risk_type":"credential_admin","severity":"high","title":"Requests a virtual payment card","triggering_tools_or_skills":["request_virtual_card"]},{"evidence":"Tools retrieve private expenses, card transactions, wallets and statements.","reasoning":"These are sensitive employee and corporate financial records.","risk_type":"private_data_read","severity":"low","title":"Reads expenses, cards and transactions","triggering_tools_or_skills":["list_expenses","list_cards","list_card_transactions","list_wallet_monthly_statements"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication is required; branch/card roles, monetary limits and approval workflows are not documented in the packet.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/b920f757-175f-4be4-8d66-3cf3894e4c0b.json","what_it_proves":"Candidate PR #125 record identity (name \"Rydoo\", publisher, type web_connector) and 20 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/b920f757-175f-4be4-8d66-3cf3894e4c0b: complete tool_names inventory (20 tools), remote streamable-http endpoint https://mcp.rydoo.com/, auth_posture auth_required, directory tier community"}],"primary_reason":"Rydoo can approve expenses and request a virtual payment card.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:b920f757-175f-4be4-8d66-3cf3894e4c0b","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 20 tools. Runtime verification should confirm whether approval triggers payment and whether card requests require a second human approval.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"true","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"true"},"tools_or_skills_reviewed":20,"tools_or_skills_total":20},"name":"Rydoo","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=b920f757-175f-4be4-8d66-3cf3894e4c0b&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://rydoo.com/legal/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Rydoo","publisher_url":"https://rydoo.com/","remote_url":"https://mcp.rydoo.com/","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Approval can authorize reimbursement or accounting treatment with financial consequences.","evidence":"Approves or rejects expenses: The inventory explicitly includes expense approval and rejection in an expense-management system.","manual_risk_type":"financial_transaction","remediation":{"block_tool_categories":["financial"],"steps":["Set provider-side spending limits and require approval for every financial action.","Use a dedicated low-balance account and review transaction logs."]},"risk_type":"spends_money","severity":"high","title":"Approves or rejects expenses","triggering_tools":["approve_expense","reject_expense"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Issuing a virtual card is a powerful financial/credential administration action.","evidence":"Requests a virtual payment card: request_virtual_card creates or requests access to a payment instrument for the authenticated user.","manual_risk_type":"credential_admin","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"high","title":"Requests a virtual payment card","triggering_tools":["request_virtual_card"]},{"description":"This connector can read information available to the connected account and return it to the AI. Review findings: These are sensitive employee and corporate financial records.","evidence":"Reads expenses, cards and transactions: Tools retrieve private expenses, card transactions, wallets and statements.","manual_risk_type":"private_data_read","remediation":{"block_tool_categories":["data_exfiltration"],"steps":["Use a least-privilege account limited to the information required by the workflow.","Restrict folders, projects, tenants, and other data scopes wherever the provider allows it.","Review access logs for unexpected reads or bulk retrieval."]},"risk_type":"reads_private_data","severity":"low","title":"Reads expenses, cards and transactions","triggering_tools":["list_expenses","list_cards","list_card_transactions","list_wallet_monthly_statements"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://help.rydoo.com","tags":["modifies_data","network_access","oauth_required","reads_private_data","spends_money","web_connector"],"tools":[{"description":"","name":"list_expenses"},{"description":"","name":"get_expense"},{"description":"","name":"ask_policy_assistant"},{"description":"","name":"approve_expense","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Approval can authorize reimbursement or accounting treatment with financial consequences."}},{"description":"","name":"reject_expense","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Approval can authorize reimbursement or accounting treatment with financial consequences."}},{"description":"","name":"list_wallets"},{"description":"","name":"list_cards"},{"description":"","name":"list_card_transactions"},{"description":"","name":"get_wallet_spend_summary"},{"description":"","name":"list_wallet_monthly_statements"},{"description":"","name":"request_virtual_card","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Issuing a virtual card is a powerful financial/credential administration action."}},{"description":"","name":"find_trip"},{"description":"","name":"find_category"},{"description":"","name":"find_owner"},{"description":"","name":"find_branch"},{"description":"","name":"find_group"},{"description":"","name":"list_reject_reasons"},{"description":"","name":"submit_feedback"},{"description":"","name":"get_user_context"},{"description":"","name":"list_branch_card_currencies"}],"tools_count":20,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/b920f757-175f-4be4-8d66-3cf3894e4c0b","uuid":"e4cff4f0-f9d0-558d-a100-adf0335c642e","verification_tier":"community","version":""},"query_key":"rydoo rydoo","schema_version":1,"status":"match"}