{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-21","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"reviewed","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Manages email marketing and automation in your SalesAutopilot account. Create email content, subscriber lists, segments, forms, landing pages and scheduled sends. Live-send activation and deletions require explicit confirmation within your connected account.","did":"2c367ad4-3b00-485c-95ef-b2e570f08e01","documentation_url":"https://support.salesautopilot.com/hu/articles/15434947-mcp-ai-asszisztens-integracio-a-salesautopilotban","editorial_description":{"extended_description":"Review campaign performance, update subscribers and custom fields, and configure actions triggered by email events or form submissions. Tools can send test emails or messages to individual subscribers. Forms may include ecommerce orders, while billing-history and shipping-method tools provide account context.","schema_version":1,"summary":"Manages email marketing and automation in your SalesAutopilot account.\nCreate email content, subscriber lists, segments, forms, landing pages and scheduled sends.\nLive-send activation and deletions require explicit confirmation within your connected account."},"homepage_url":"","icon":"","id":"2c367ad4-3b00-485c-95ef-b2e570f08e01","installs":0,"last_scanned":"","license":"","long_description":"Review campaign performance, update subscribers and custom fields, and configure actions triggered by email events or form submissions. Tools can send test emails or messages to individual subscribers. Forms may include ecommerce orders, while billing-history and shipping-method tools provide account context.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The complete tool inventory includes activation and direct/test email-send operations.","reasoning":"These tools communicate externally as the connected user and can activate a live marketing send.","risk_type":"messaging_as_user","severity":"high","title":"Can activate campaigns and send email","triggering_tools_or_skills":["activate_send","send_letter_to_subscriber","send_test_emails"]},{"evidence":"The complete inventory explicitly includes delete_form_field.","reasoning":"Deleting a form field can irreversibly alter a live form and its data model.","risk_type":"data_deletion","severity":"high","title":"Can delete form fields","triggering_tools_or_skills":["delete_form_field"]}],"assessment_status":"reviewed","auth_and_scopes":"OAuth 2.0 access is scoped to the connected SalesAutopilot account; exact granted scopes are not listed.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"complete","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/2c367ad4-3b00-485c-95ef-b2e570f08e01.json","what_it_proves":"Candidate PR #125 record identity (name \"SalesAutopilot\", publisher, type web_connector) and 57 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/2c367ad4-3b00-485c-95ef-b2e570f08e01: complete tool_names inventory (57 tools), remote streamable-http endpoint https://mcp.salesautopilot.com/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"SalesAutopilot can activate live sends, send email, and delete form fields.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":false,"review_key":"claude:2c367ad4-3b00-485c-95ef-b2e570f08e01","reviewed_at":"2026-10-10","reviewer_notes":"The description says irreversible actions require explicit confirmation, but that safeguard does not reduce the capability rating.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"true","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"false","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":57,"tools_or_skills_total":57},"name":"SalesAutopilot","needs_runtime_verification":false,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=2c367ad4-3b00-485c-95ef-b2e570f08e01&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://support.salesautopilot.com/hu/articles/17027545-adatkezelesi-tajekoztato-mcp-integracio-ai-asszisztens-csatlakoztatasahoz","provisional_risk":null,"publication_recommendation":"accept","publisher":"SalesAutopilot Kft.","publisher_url":"https://salesautopilot.hu/","remote_url":"https://mcp.salesautopilot.com/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: These tools communicate externally as the connected user and can activate a live marketing send.","evidence":"Can activate campaigns and send email: The complete tool inventory includes activation and direct/test email-send operations.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Can activate campaigns and send email","triggering_tools":["activate_send","send_letter_to_subscriber","send_test_emails"]},{"description":"This connector can permanently remove data or resources. Review findings: Deleting a form field can irreversibly alter a live form and its data model.","evidence":"Can delete form fields: The complete inventory explicitly includes delete_form_field.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Can delete form fields","triggering_tools":["delete_form_field"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://support.salesautopilot.com","tags":["deletes_data","network_access","oauth_required","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"activate_send","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: These tools communicate externally as the connected user and can activate a live marketing send."}},{"description":"","name":"add_form_fields"},{"description":"","name":"add_subscriber"},{"description":"","name":"archive_segment"},{"description":"","name":"copy_segment"},{"description":"","name":"create_action"},{"description":"","name":"create_folder"},{"description":"","name":"create_form"},{"description":"","name":"create_landing_page"},{"description":"","name":"create_landing_page_folder"},{"description":"","name":"create_letter"},{"description":"","name":"create_list"},{"description":"","name":"create_list_field"},{"description":"","name":"create_segment"},{"description":"","name":"create_send"},{"description":"","name":"delete_form_field","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deleting a form field can irreversibly alter a live form and its data model."}},{"description":"","name":"echo_test"},{"description":"","name":"fetch"},{"description":"","name":"get_action"},{"description":"","name":"get_campaign"},{"description":"","name":"get_form"},{"description":"","name":"get_form_fields"},{"description":"","name":"get_invoice"},{"description":"","name":"get_landing_page"},{"description":"","name":"get_letter"},{"description":"","name":"get_list_field"},{"description":"","name":"get_segment"},{"description":"","name":"get_send"},{"description":"","name":"get_subscriber"},{"description":"","name":"list_actions"},{"description":"","name":"list_campaigns"},{"description":"","name":"list_folders"},{"description":"","name":"list_forms"},{"description":"","name":"list_invoices"},{"description":"","name":"list_landing_page_folders"},{"description":"","name":"list_landing_pages"},{"description":"","name":"list_letters"},{"description":"","name":"list_list_fields"},{"description":"","name":"list_lists"},{"description":"","name":"list_segment_groups"},{"description":"","name":"list_segments"},{"description":"","name":"list_sends"},{"description":"","name":"list_shipping_methods"},{"description":"","name":"list_subscribers"},{"description":"","name":"request_feedback"},{"description":"","name":"search"},{"description":"","name":"send_letter_to_subscriber","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: These tools communicate externally as the connected user and can activate a live marketing send."}},{"description":"","name":"send_test_emails","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: These tools communicate externally as the connected user and can activate a live marketing send."}},{"description":"","name":"submit_feedback"},{"description":"","name":"update_action"},{"description":"","name":"update_folder"},{"description":"","name":"update_form"},{"description":"","name":"update_landing_page"},{"description":"","name":"update_letter"},{"description":"","name":"update_segment"},{"description":"","name":"update_send"},{"description":"","name":"update_subscriber"}],"tools_count":57,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/2c367ad4-3b00-485c-95ef-b2e570f08e01","uuid":"ef998c56-615a-5700-b39f-880197227727","verification_tier":"community","version":""},"query_key":"salesautopilot","schema_version":1,"status":"match"}