{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-03","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"high","description":"Sacflow lets Claude inspect support operations in an authorized workspace. Find tickets, conversations, contacts, CRM pipelines, tasks, and reports. Access is read-only and requires an authenticated Sacflow account.","did":"62da967f-0394-457c-bbfb-3c109f58941d","documentation_url":"https://ajuda.sacflow.io/hyerdev/articles/298-ferramentas-de-leitura-do-mcp-do-sacflow","editorial_description":{"extended_description":"Reports cover SLA performance, ratings, transfers, outbound activity, and AI-agent outcomes. Lookup tools also expose attachments, channels, departments, and workflow history.","schema_version":1,"summary":"Sacflow lets Claude inspect support operations in an authorized workspace.\nFind tickets, conversations, contacts, CRM pipelines, tasks, and reports.\nAccess is read-only and requires an authenticated Sacflow account."},"homepage_url":"","icon":"https://sacflow.com.br/favicon.ico","id":"62da967f-0394-457c-bbfb-3c109f58941d","installs":0,"last_scanned":"","license":"","long_description":"Reports cover SLA performance, ratings, transfers, outbound activity, and AI-agent outcomes. Lookup tools also expose attachments, channels, departments, and workflow history.","manual_assessment":"low","manual_review":{"all_findings":[{"evidence":"The official page says the connector can consult conversations, contacts, CRM cards, tasks and operational reports without changing them.","reasoning":"Support conversations and customer/contact records are private account data.","risk_type":"private_data_read","severity":"low","title":"Reads customer-support and CRM data","triggering_tools_or_skills":["get_contact","get_ticket","list_messages","list_contacts","list_tickets","list_pipe_cards"]}],"assessment_status":"provisional","auth_and_scopes":"The authenticated Sacflow user’s existing permissions are enforced; the endpoint is specifically the documented read-only MCP surface.","blocked_missing_evidence":null,"confidence":"high","displayed_risk":"low","evidence_completeness":"complete","manual_overall_risk":"low","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/62da967f-0394-457c-bbfb-3c109f58941d.json","what_it_proves":"Candidate PR #125 record identity (name \"sacflow\", publisher, type web_connector) and 40 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/62da967f-0394-457c-bbfb-3c109f58941d: complete tool_names inventory (40 tools), remote streamable-http endpoint https://api.sacflow.io/mcp/read, auth_posture auth_required, directory tier community"},{"accessed_at":"2026-10-10T20:50:48Z","url_or_path":"https://ajuda.sacflow.io/hyerdev/articles/298-ferramentas-de-leitura-do-mcp-do-sacflow","what_it_proves":"Sacflow explicitly documents this /mcp/read endpoint as read-only, permission-aware, and unable to create, edit, transfer, resolve or delete data."}],"primary_reason":"Sacflow’s official documentation confirms that this endpoint is strictly read-only over authenticated support data.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:62da967f-0394-457c-bbfb-3c109f58941d","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 40 get/list/search tools against the official read-only endpoint documentation. Attachments and messages can contain untrusted customer content, so prompt-injection exposure remains true.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"false","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":40,"tools_or_skills_total":40},"name":"sacflow","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=62da967f-0394-457c-bbfb-3c109f58941d&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://sacflow.com.br/privacidade","provisional_risk":null,"publication_recommendation":"accept","publisher":"Sacflow","publisher_url":"https://sacflow.com.br/","remote_url":"https://api.sacflow.io/mcp/read","repository_url":"","risk":"low","risk_severity":"low","security_risks":[{"description":"This connector can read information available to the connected account and return it to the AI. Review findings: Support conversations and customer/contact records are private account data.","evidence":"Reads customer-support and CRM data: The official page says the connector can consult conversations, contacts, CRM cards, tasks and operational reports without changing them.","manual_risk_type":"private_data_read","remediation":{"block_tool_categories":["data_exfiltration"],"steps":["Use a least-privilege account limited to the information required by the workflow.","Restrict folders, projects, tenants, and other data scopes wherever the provider allows it.","Review access logs for unexpected reads or bulk retrieval."]},"risk_type":"reads_private_data","severity":"low","title":"Reads customer-support and CRM data","triggering_tools":["get_contact","get_ticket","list_messages","list_contacts","list_tickets","list_pipe_cards"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://api.whatsapp.com/send?phone=556239323632","tags":["accesses_calendar","accesses_messaging","network_access","oauth_required","reads_private_data","web_connector"],"tools":[{"description":"","name":"get_ai_agents_handover_reasons"},{"description":"","name":"get_ai_agents_lost_reasons"},{"description":"","name":"get_ai_agents_report"},{"description":"","name":"get_ai_agents_series"},{"description":"","name":"get_attachment"},{"description":"","name":"get_contact"},{"description":"","name":"get_contacts_report"},{"description":"","name":"get_current_user"},{"description":"","name":"get_organization"},{"description":"","name":"get_organizations_report"},{"description":"","name":"get_outbounds_report"},{"description":"","name":"get_period_report"},{"description":"","name":"get_pipe"},{"description":"","name":"get_pipe_card"},{"description":"","name":"get_sla_report"},{"description":"","name":"get_ticket"},{"description":"","name":"get_ticket_ratings_report"},{"description":"","name":"get_ticket_tags_report"},{"description":"","name":"get_transfers_report"},{"description":"","name":"list_account_users"},{"description":"","name":"list_channels"},{"description":"","name":"list_contacts"},{"description":"","name":"list_departments"},{"description":"","name":"list_flows"},{"description":"","name":"list_messages"},{"description":"","name":"list_organizations"},{"description":"","name":"list_pipe_card_events"},{"description":"","name":"list_pipe_cards"},{"description":"","name":"list_pipe_history_cards"},{"description":"","name":"list_pipes"},{"description":"","name":"list_quick_answers"},{"description":"","name":"list_redirects"},{"description":"","name":"list_slas"},{"description":"","name":"list_special_dates"},{"description":"","name":"list_tags"},{"description":"","name":"list_tasks"},{"description":"","name":"list_tickets"},{"description":"","name":"list_users"},{"description":"","name":"search_contacts"},{"description":"","name":"search_messages"}],"tools_count":40,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/62da967f-0394-457c-bbfb-3c109f58941d","uuid":"ecfdb6b7-70be-52d2-a748-72a9bb9ab6da","verification_tier":"community","version":""},"query_key":"sacflow sacflow","schema_version":1,"status":"match"}