{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-11","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Setyl manages IT assets, software licenses, and ownership records. Create or update assets, people, applications, locations, teams, and license assignments. Authenticated tools can archive records and manage discovered assets or application documents.","did":"8902884c-7283-411e-abf1-8349fa230e72","documentation_url":"https://help.setyl.com/","editorial_description":{"extended_description":"Assignment tools connect people, service accounts, assets, apps, teams, and groups. Discovery tools link or ignore detected assets, while searches expose organizational and license context.","schema_version":1,"summary":"Setyl manages IT assets, software licenses, and ownership records.\nCreate or update assets, people, applications, locations, teams, and license assignments.\nAuthenticated tools can archive records and manage discovered assets or application documents."},"homepage_url":"","icon":"","id":"8902884c-7283-411e-abf1-8349fa230e72","installs":0,"last_scanned":"","license":"","long_description":"Assignment tools connect people, service accounts, assets, apps, teams, and groups. Discovery tools link or ignore detected assets, while searches expose organizational and license context.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"Archive operations remove durable IT inventory/identity resources from active use.","reasoning":"They can disrupt audits, offboarding and access/license records even if recoverable by support.","risk_type":"data_deletion","severity":"high","title":"Archives people, assets, licenses, service accounts and organizational structures","triggering_tools_or_skills":["archive_person","archive_asset","archive_license","archive_service_account","archive_department","archive_group","archive_team","archive_legal_entity"]},{"evidence":"These tools administer identities, memberships and software entitlements.","reasoning":"They change who/what receives access and paid licenses.","risk_type":"credential_admin","severity":"high","title":"Creates service accounts and assigns people/apps/assets/licenses to groups/teams","triggering_tools_or_skills":["create_service_account","assign_person_to_license","assign_person_to_group","assign_app_to_group","assign_asset_to_license","unassign_service_account_from_license"]},{"evidence":"These tools broadly persist asset-management state.","reasoning":"They materially alter the system of record.","risk_type":"data_modification","severity":"medium","title":"Creates and updates IT inventory and organization records","triggering_tools_or_skills":["create_asset","create_license","create_person","update_asset","update_person","update_license"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication is required; IT asset, person, service-account and license administration follows undocumented Setyl roles.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/8902884c-7283-411e-abf1-8349fa230e72.json","what_it_proves":"Candidate PR #125 record identity (name \"Setyl\", publisher, type web_connector) and 80 stored tool names (truncated vs Directory); no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/8902884c-7283-411e-abf1-8349fa230e72: complete tool_names inventory (93 tools), remote streamable-http endpoint https://app.setyl.com/mcp, auth_posture auth_required, directory tier community"},{"accessed_at":"2026-10-10T21:17:31Z","url_or_path":"https://help.setyl.com/how-do-i-assign-a-license-to-an-asset","what_it_proves":"Official Setyl help confirms license assignment mutates asset/license allocation."},{"accessed_at":"2026-10-10T21:17:31Z","url_or_path":"https://help.setyl.com/kits-guide","what_it_proves":"Official Setyl guide confirms people onboarding and assignment of assets/apps/licenses."}],"primary_reason":"Setyl archives core IT records and administers service accounts, memberships and license assignments.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:8902884c-7283-411e-abf1-8349fa230e72","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 93 stored tools. The record is marked truncated, so runtime inventory may contain additional actions; current tools already establish High risk.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"true","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":93,"tools_or_skills_total":93},"name":"Setyl","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=8902884c-7283-411e-abf1-8349fa230e72&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://setyl.com/legal","provisional_risk":null,"publication_recommendation":"accept","publisher":"Setyl Ltd","publisher_url":"https://setyl.com/","remote_url":"https://app.setyl.com/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can permanently remove data or resources. Review findings: They can disrupt audits, offboarding and access/license records even if recoverable by support.","evidence":"Archives people, assets, licenses, service accounts and organizational structures: Archive operations remove durable IT inventory/identity resources from active use.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Archives people, assets, licenses, service accounts and organizational structures","triggering_tools":["archive_person","archive_asset","archive_license","archive_service_account","archive_department","archive_group","archive_team","archive_legal_entity"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They change who/what receives access and paid licenses.; They materially alter the system of record.","evidence":"Creates service accounts and assigns people/apps/assets/licenses to groups/teams: These tools administer identities, memberships and software entitlements. | Creates and updates IT inventory and organization records: These tools broadly persist asset-management state.","manual_risk_type":"credential_admin,data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"high","title":"Can change connected resources","triggering_tools":["create_service_account","assign_person_to_license","assign_person_to_group","assign_app_to_group","assign_asset_to_license","unassign_service_account_from_license","create_asset","create_license","create_person","update_asset","update_person","update_license"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"hello@setyl.com","tags":["deletes_data","modifies_data","network_access","oauth_required","web_connector"],"tools":[{"description":"","name":"archive_asset","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: They can disrupt audits, offboarding and access/license records even if recoverable by support."}},{"description":"","name":"archive_department","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: They can disrupt audits, offboarding and access/license records even if recoverable by support."}},{"description":"","name":"archive_group","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: They can disrupt audits, offboarding and access/license records even if recoverable by support."}},{"description":"","name":"archive_legal_entity","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: They can disrupt audits, offboarding and access/license records even if recoverable by support."}},{"description":"","name":"archive_license","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: They can disrupt audits, offboarding and access/license records even if recoverable by support."}},{"description":"","name":"archive_location"},{"description":"","name":"archive_person","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: They can disrupt audits, offboarding and access/license records even if recoverable by support."}},{"description":"","name":"archive_service_account","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: They can disrupt audits, offboarding and access/license records even if recoverable by support."}},{"description":"","name":"archive_sublocation"},{"description":"","name":"archive_team","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: They can disrupt audits, offboarding and access/license records even if recoverable by support."}},{"description":"","name":"assign_app_to_group","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They change who/what receives access and paid licenses.; They materially alter the system of record."}},{"description":"","name":"assign_app_to_team"},{"description":"","name":"assign_asset_to_group"},{"description":"","name":"assign_asset_to_license","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They change who/what receives access and paid licenses.; They materially alter the system of record."}},{"description":"","name":"assign_asset_to_team"},{"description":"","name":"assign_person_to_group","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They change who/what receives access and paid licenses.; They materially alter the system of record."}},{"description":"","name":"assign_person_to_license","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They change who/what receives access and paid licenses.; They materially alter the system of record."}},{"description":"","name":"assign_person_to_team"},{"description":"","name":"assign_service_account_to_license"},{"description":"","name":"create_app"},{"description":"","name":"create_app_documents"},{"description":"","name":"create_asset","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They change who/what receives access and paid licenses.; They materially alter the system of record."}},{"description":"","name":"create_brand"},{"description":"","name":"create_department"},{"description":"","name":"create_group"},{"description":"","name":"create_legal_entity"},{"description":"","name":"create_license","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They change who/what receives access and paid licenses.; They materially alter the system of record."}},{"description":"","name":"create_location"},{"description":"","name":"create_person","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They change who/what receives access and paid licenses.; They materially alter the system of record."}},{"description":"","name":"create_service_account","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They change who/what receives access and paid licenses.; They materially alter the system of record."}},{"description":"","name":"create_sublocation"},{"description":"","name":"create_team"},{"description":"","name":"delete_app_documents"},{"description":"","name":"get_app"},{"description":"","name":"get_app_document"},{"description":"","name":"get_asset"},{"description":"","name":"get_brand"},{"description":"","name":"get_department"},{"description":"","name":"get_discovered_asset"},{"description":"","name":"get_group"},{"description":"","name":"get_legal_entity"},{"description":"","name":"get_license"},{"description":"","name":"get_location"},{"description":"","name":"get_person"},{"description":"","name":"get_service_account"},{"description":"","name":"get_sublocation"},{"description":"","name":"get_team"},{"description":"","name":"ignore_discovered_asset"},{"description":"","name":"link_discovered_asset"},{"description":"","name":"list_app_documents"},{"description":"","name":"list_apps"},{"description":"","name":"list_asset_types"},{"description":"","name":"list_assets"},{"description":"","name":"list_brands"},{"description":"","name":"list_departments"},{"description":"","name":"list_discovered_assets"},{"description":"","name":"list_group_apps"},{"description":"","name":"list_group_assets"},{"description":"","name":"list_group_people"},{"description":"","name":"list_groups"},{"description":"","name":"list_legal_entities"},{"description":"","name":"list_licenses"},{"description":"","name":"list_locations"},{"description":"","name":"list_people"},{"description":"","name":"list_person_assets"},{"description":"","name":"list_service_accounts"},{"description":"","name":"list_sublocations"},{"description":"","name":"list_team_apps"},{"description":"","name":"list_team_assets"},{"description":"","name":"list_team_people"},{"description":"","name":"list_teams"},{"description":"","name":"search"},{"description":"","name":"unassign_app_from_group"},{"description":"","name":"unassign_app_from_team"},{"description":"","name":"unassign_asset_from_group"},{"description":"","name":"unassign_asset_from_license"},{"description":"","name":"unassign_asset_from_team"},{"description":"","name":"unassign_person_from_group"},{"description":"","name":"unassign_person_from_license"},{"description":"","name":"unassign_person_from_team"},{"description":"","name":"unassign_service_account_from_license","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They change who/what receives access and paid licenses.; They materially alter the system of record."}},{"description":"","name":"unignore_discovered_asset"},{"description":"","name":"update_app"},{"description":"","name":"update_asset","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They change who/what receives access and paid licenses.; They materially alter the system of record."}},{"description":"","name":"update_department"},{"description":"","name":"update_group"},{"description":"","name":"update_legal_entity"},{"description":"","name":"update_license","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They change who/what receives access and paid licenses.; They materially alter the system of record."}},{"description":"","name":"update_location"},{"description":"","name":"update_person","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They change who/what receives access and paid licenses.; They materially alter the system of record."}},{"description":"","name":"update_service_account"},{"description":"","name":"update_sublocation"},{"description":"","name":"update_team"}],"tools_count":93,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/8902884c-7283-411e-abf1-8349fa230e72","uuid":"a64bbe6f-df63-59fd-a22b-ae91aa14f747","verification_tier":"community","version":""},"query_key":"setyl","schema_version":1,"status":"match"}