{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-18","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Manage Amazon FBA inbound inventory and shipments through ScanPower. Build shipping plans, configure packing or placement, and generate item or box labels. Arrange transport, purchase partnered freight, and submit shipment tracking.","did":"e098f755-da55-4d19-b052-e012bca558a1","documentation_url":"https://help.scanpower.com/en/articles/14546006-scanpower-api-and-mcp-server-guide","editorial_description":{"extended_description":"Maintain batches, purchase orders, inventory items, boxes, and pallets. Inspect preparation and compliance details, compare delivery-window or transportation options, schedule self-ship appointments, and confirm or cancel supported inbound plans.","schema_version":1,"summary":"Manage Amazon FBA inbound inventory and shipments through ScanPower.\nBuild shipping plans, configure packing or placement, and generate item or box labels.\nArrange transport, purchase partnered freight, and submit shipment tracking."},"homepage_url":"","icon":"","id":"e098f755-da55-4d19-b052-e012bca558a1","installs":0,"last_scanned":"","license":"","long_description":"Maintain batches, purchase orders, inventory items, boxes, and pallets. Inspect preparation and compliance details, compare delivery-window or transportation options, schedule self-ship appointments, and confirm or cancel supported inbound plans.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The description explicitly supports purchasing partnered freight and the inventory creates purchase orders.","reasoning":"These actions create financial obligations.","risk_type":"financial_transaction","severity":"high","title":"Partnered freight and purchase orders can be confirmed/created","triggering_tools_or_skills":["confirm_transportation_options","create_purchase_order","create_purchase_order_items"]},{"evidence":"Explicit destructive logistics actions are exposed.","reasoning":"They can disrupt real shipments.","risk_type":"data_deletion","severity":"high","title":"Inbound plans, appointments, boxes and pallets can be cancelled/deleted","triggering_tools_or_skills":["cancel_inbound_plan","cancel_self_ship_appointment","delete_box","delete_pallet"]},{"evidence":"Credential retrieval/authorization administration is highly sensitive.","reasoning":"Token leakage or proxy changes can compromise accounts.","risk_type":"credential_admin","severity":"high","title":"Amazon and API access tokens are exposed and proxy users can be cleared","triggering_tools_or_skills":["get_amazon_access_token","get_api_token","clear_proxy_user"]},{"evidence":"These tools operate production fulfillment workflows.","reasoning":"They materially change logistics infrastructure.","risk_type":"deployment_infrastructure","severity":"high","title":"Inbound shipping plans and appointments can be created/scheduled","triggering_tools_or_skills":["create_inbound_plan","schedule_self_ship_appointment","confirm_placement_option"]},{"evidence":"Marketplace/supplier content is returned.","reasoning":"It should remain untrusted.","risk_type":"prompt_injection_exposure","severity":"low","title":"Catalog and shipment data enters model context","triggering_tools_or_skills":["search_catalog_items","get_shipment_history"]},{"evidence":"The connector runs at https://mcp.scanpower.com/mcp without a pinned server implementation in the packet.","reasoning":"The implementation can change independently, so runtime verification and change monitoring remain necessary.","risk_type":"provenance_uncertainty","severity":"low","title":"mcp.scanpower.com is a mutable hosted service","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"OAuth/API authorization reaches Amazon Selling Partner and ScanPower resources; proxy-user/token scopes are not documented.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/e098f755-da55-4d19-b052-e012bca558a1.json","what_it_proves":"Candidate PR #125 record identity (name \"mcp.scanpower.com\", publisher, type web_connector) and 80 stored tool names (truncated vs Directory); no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/e098f755-da55-4d19-b052-e012bca558a1: complete tool_names inventory (104 tools), remote streamable-http endpoint https://mcp.scanpower.com/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"ScanPower can buy freight, manage Amazon credentials and destructively alter live inbound shipments.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:e098f755-da55-4d19-b052-e012bca558a1","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 104 tools. Token-return behavior should be reconsidered or redacted.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"true","deletes_data":"true","deployment_or_infrastructure":"true","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"true"},"tools_or_skills_reviewed":104,"tools_or_skills_total":104},"name":"mcp.scanpower.com","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=e098f755-da55-4d19-b052-e012bca558a1&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://scanpower.com/privacy/","provisional_risk":null,"publication_recommendation":"accept","publisher":"ScanPower","publisher_url":"https://scanpower.com/","remote_url":"https://mcp.scanpower.com/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: These actions create financial obligations.","evidence":"Partnered freight and purchase orders can be confirmed/created: The description explicitly supports purchasing partnered freight and the inventory creates purchase orders.","manual_risk_type":"financial_transaction","remediation":{"block_tool_categories":["financial"],"steps":["Set provider-side spending limits and require approval for every financial action.","Use a dedicated low-balance account and review transaction logs."]},"risk_type":"spends_money","severity":"high","title":"Partnered freight and purchase orders can be confirmed/created","triggering_tools":["confirm_transportation_options","create_purchase_order","create_purchase_order_items"]},{"description":"This connector can permanently remove data or resources. Review findings: They can disrupt real shipments.","evidence":"Inbound plans, appointments, boxes and pallets can be cancelled/deleted: Explicit destructive logistics actions are exposed.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Inbound plans, appointments, boxes and pallets can be cancelled/deleted","triggering_tools":["cancel_inbound_plan","cancel_self_ship_appointment","delete_box","delete_pallet"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Token leakage or proxy changes can compromise accounts.","evidence":"Amazon and API access tokens are exposed and proxy users can be cleared: Credential retrieval/authorization administration is highly sensitive.","manual_risk_type":"credential_admin","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"high","title":"Amazon and API access tokens are exposed and proxy users can be cleared","triggering_tools":["get_amazon_access_token","get_api_token","clear_proxy_user"]},{"description":"This connector can deploy code or change infrastructure and production environments. Review findings: They materially change logistics infrastructure.","evidence":"Inbound shipping plans and appointments can be created/scheduled: These tools operate production fulfillment workflows.","manual_risk_type":"deployment_infrastructure","remediation":{"block_tool_categories":["code_execution","state_change"],"steps":["Default to a sandbox or staging environment.","Require code review, human approval, audit logging, and a tested rollback path for production changes."]},"risk_type":"code_deployment","severity":"high","title":"Inbound shipping plans and appointments can be created/scheduled","triggering_tools":["create_inbound_plan","schedule_self_ship_appointment","confirm_placement_option"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@scanpower.com","tags":["code_deployment","deletes_data","modifies_data","network_access","oauth_required","spends_money","web_connector"],"tools":[{"description":"","name":"cancel_inbound_plan","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: They can disrupt real shipments."}},{"description":"","name":"cancel_self_ship_appointment","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: They can disrupt real shipments."}},{"description":"","name":"clear_proxy_user","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Token leakage or proxy changes can compromise accounts."}},{"description":"","name":"confirm_delivery_window_option"},{"description":"","name":"confirm_packing_option"},{"description":"","name":"confirm_placement_option","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: They materially change logistics infrastructure."}},{"description":"","name":"confirm_shipment_content_update_preview"},{"description":"","name":"confirm_transportation_options","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: These actions create financial obligations."}},{"description":"","name":"create_batch"},{"description":"","name":"create_batch_items"},{"description":"","name":"create_buylist_items"},{"description":"","name":"create_inbound_plan","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: They materially change logistics infrastructure."}},{"description":"","name":"create_inbound_plan_from_batch"},{"description":"","name":"create_marketplace_item_labels"},{"description":"","name":"create_purchase_order","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: These actions create financial obligations."}},{"description":"","name":"create_purchase_order_items","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: These actions create financial obligations."}},{"description":"","name":"delete_box","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: They can disrupt real shipments."}},{"description":"","name":"delete_box_item"},{"description":"","name":"delete_pallet","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: They can disrupt real shipments."}},{"description":"","name":"generate_delivery_window_options"},{"description":"","name":"generate_packing_options"},{"description":"","name":"generate_placement_options"},{"description":"","name":"generate_self_ship_appointment_slots"},{"description":"","name":"generate_shipment_content_update_previews"},{"description":"","name":"generate_transportation_options"},{"description":"","name":"get_amazon_access_token","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Token leakage or proxy changes can compromise accounts."}},{"description":"","name":"get_api_token","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Token leakage or proxy changes can compromise accounts."}},{"description":"","name":"get_batch_inbound_plans"},{"description":"","name":"get_batch_items"},{"description":"","name":"get_batches"},{"description":"","name":"get_bill_of_lading"},{"description":"","name":"get_box"},{"description":"","name":"get_box_labels"},{"description":"","name":"get_buylist"},{"description":"","name":"get_delivery_challan_document"},{"description":"","name":"get_inbound_operation_status"},{"description":"","name":"get_inbound_plan"},{"description":"","name":"get_inventory"},{"description":"","name":"get_mobile_inventory"},{"description":"","name":"get_pallet"},{"description":"","name":"get_proxy_users"},{"description":"","name":"get_purchase_order_items"},{"description":"","name":"get_purchase_orders"},{"description":"","name":"get_resource"},{"description":"","name":"get_self_ship_appointment_slots"},{"description":"","name":"get_shipment"},{"description":"","name":"get_shipment_by_confirmation"},{"description":"","name":"get_shipment_content_update_preview"},{"description":"","name":"get_shipment_history"},{"description":"","name":"get_shipment_labels"},{"description":"","name":"get_users"},{"description":"","name":"import_purchase_order_items"},{"description":"","name":"insert_box"},{"description":"","name":"insert_box_item"},{"description":"","name":"insert_pallet"},{"description":"","name":"list_box_items"},{"description":"","name":"list_boxes"},{"description":"","name":"list_delivery_window_options"},{"description":"","name":"list_inbound_plan_boxes"},{"description":"","name":"list_inbound_plan_items"},{"description":"","name":"list_inbound_plan_pallets"},{"description":"","name":"list_inbound_plans"},{"description":"","name":"list_item_compliance_details"},{"description":"","name":"list_packing_group_boxes"},{"description":"","name":"list_packing_group_items"},{"description":"","name":"list_packing_options"},{"description":"","name":"list_pallets"},{"description":"","name":"list_placement_options"},{"description":"","name":"list_prep_details"},{"description":"","name":"list_shipment_boxes"},{"description":"","name":"list_shipment_content_update_previews"},{"description":"","name":"list_shipment_items"},{"description":"","name":"list_shipment_pallets"},{"description":"","name":"list_transportation_options"},{"description":"","name":"print_box_labels"},{"description":"","name":"print_item_labels"},{"description":"","name":"schedule_self_ship_appointment","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: They materially change logistics infrastructure."}},{"description":"","name":"scout_search"},{"description":"","name":"search_catalog_items"},{"description":"","name":"set_packing_information"},{"description":"","name":"set_prep_details"},{"description":"","name":"sp_get_delivery_window_option"},{"description":"","name":"sp_get_inbound_plan"},{"description":"","name":"sp_get_transportation_option"},{"description":"","name":"sp_list_delivery_window_options"},{"description":"","name":"sp_list_inbound_plans"},{"description":"","name":"sp_list_packing_options"},{"description":"","name":"sp_list_placement_options"},{"description":"","name":"sp_list_shipments"},{"description":"","name":"sp_list_transportation_options"},{"description":"","name":"submit_batch_boxes"},{"description":"","name":"update_batch"},{"description":"","name":"update_batch_item"},{"description":"","name":"update_box"},{"description":"","name":"update_box_item"},{"description":"","name":"update_inbound_plan_name"},{"description":"","name":"update_inventory_items"},{"description":"","name":"update_item_compliance_details"},{"description":"","name":"update_pallet"},{"description":"","name":"update_purchase_order"},{"description":"","name":"update_purchase_order_item"},{"description":"","name":"update_shipment_name"},{"description":"","name":"update_shipment_source_address"},{"description":"","name":"update_shipment_tracking_details"}],"tools_count":104,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/e098f755-da55-4d19-b052-e012bca558a1","uuid":"91c0ab0d-c95d-5a71-a27c-2daa4011c397","verification_tier":"community","version":""},"query_key":"scanpower mcp scanpower com","schema_version":1,"status":"match"}