{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-22","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Shoptet connects Claude to day-to-day ecommerce store management. Search products and orders, maintain customers, update stock, and manage catalog content. It can change order status, moderate product reviews, create coupons, and publish or unpublish blog articles.","did":"544b6ae6-908a-4eff-931e-c7f6cac508e3","documentation_url":"https://developers.shoptet.com/home/premium/mcp-premium","editorial_description":{"extended_description":"Tools inspect variants, categories, brands, suppliers, price lists, stock movements, customer groups, and document details. Catalog and inventory actions include creating products, updating categories, and recording stock movements.","schema_version":1,"summary":"Shoptet connects Claude to day-to-day ecommerce store management.\nSearch products and orders, maintain customers, update stock, and manage catalog content.\nIt can change order status, moderate product reviews, create coupons, and publish or unpublish blog articles."},"homepage_url":"","icon":"","id":"544b6ae6-908a-4eff-931e-c7f6cac508e3","installs":0,"last_scanned":"","license":"","long_description":"Tools inspect variants, categories, brands, suppliers, price lists, stock movements, customer groups, and document details. Catalog and inventory actions include creating products, updating categories, and recording stock movements.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"Tool explicitly publishes external content.","reasoning":"Publication as the user is High.","risk_type":"messaging_as_user","severity":"high","title":"Publishes blog articles","triggering_tools_or_skills":["blog_article_publish"]},{"evidence":"These tools alter live commerce state.","reasoning":"Production storefront operations are High.","risk_type":"deployment_infrastructure","severity":"high","title":"Changes live store order and inventory operations","triggering_tools_or_skills":["order_status_update","stock_movements_create","product_update"]},{"evidence":"Persistent commerce records are created.","reasoning":"Meaningful data changes are Medium.","risk_type":"data_modification","severity":"medium","title":"Creates customers/products/coupons","triggering_tools_or_skills":["customer_create","product_create","discount_coupons_create"]},{"evidence":"Remote hosted implementation is unpinned.","reasoning":"Runtime capabilities can drift.","risk_type":"provenance_uncertainty","severity":"low","title":"Hosted implementation is mutable","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"OAuth/account authorization required; exact scopes are not documented.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/544b6ae6-908a-4eff-931e-c7f6cac508e3.json","what_it_proves":"Candidate PR #125 record identity (name \"Shoptet\", publisher, type web_connector) and 50 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/544b6ae6-908a-4eff-931e-c7f6cac508e3: complete tool_names inventory (50 tools), remote streamable-http endpoint https://mcp.shoptet.com/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Shoptet publishes store content and changes orders, inventory, customers, and discounts.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:544b6ae6-908a-4eff-931e-c7f6cac508e3","reviewed_at":"2026-10-10","reviewer_notes":"All declared tool names were reviewed; schemas were not available.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"true","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":50,"tools_or_skills_total":50},"name":"Shoptet","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=544b6ae6-908a-4eff-931e-c7f6cac508e3&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.shoptet.cz/osobni-udaje-a-cookies/","provisional_risk":null,"publication_recommendation":"accept","publisher":"Shoptet","publisher_url":"https://shoptet.cz/","remote_url":"https://mcp.shoptet.com/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: Publication as the user is High.","evidence":"Publishes blog articles: Tool explicitly publishes external content.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Publishes blog articles","triggering_tools":["blog_article_publish"]},{"description":"This connector can deploy code or change infrastructure and production environments. Review findings: Production storefront operations are High.","evidence":"Changes live store order and inventory operations: These tools alter live commerce state.","manual_risk_type":"deployment_infrastructure","remediation":{"block_tool_categories":["code_execution","state_change"],"steps":["Default to a sandbox or staging environment.","Require code review, human approval, audit logging, and a tested rollback path for production changes."]},"risk_type":"code_deployment","severity":"high","title":"Changes live store order and inventory operations","triggering_tools":["order_status_update","stock_movements_create","product_update"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Meaningful data changes are Medium.","evidence":"Creates customers/products/coupons: Persistent commerce records are created.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Creates customers/products/coupons","triggering_tools":["customer_create","product_create","discount_coupons_create"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://podpora.shoptet.cz/","tags":["code_deployment","modifies_data","network_access","oauth_required","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"blog_article_create"},{"description":"","name":"blog_article_detail"},{"description":"","name":"blog_article_publish","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Publication as the user is High."}},{"description":"","name":"blog_article_unpublish"},{"description":"","name":"blog_article_update"},{"description":"","name":"blog_articles_list"},{"description":"","name":"blog_sections_list"},{"description":"","name":"brand_detail"},{"description":"","name":"brand_update"},{"description":"","name":"categories_list"},{"description":"","name":"category_create"},{"description":"","name":"category_detail"},{"description":"","name":"category_update"},{"description":"","name":"customer_create","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Meaningful data changes are Medium."}},{"description":"","name":"customer_detail"},{"description":"","name":"customer_groups_list"},{"description":"","name":"customer_search"},{"description":"","name":"customer_update"},{"description":"","name":"customers_list"},{"description":"","name":"delivery_note_detail"},{"description":"","name":"discount_coupon_detail"},{"description":"","name":"discount_coupons_create","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Meaningful data changes are Medium."}},{"description":"","name":"discount_coupons_list"},{"description":"","name":"order_note_create"},{"description":"","name":"order_status_update","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: Production storefront operations are High."}},{"description":"","name":"order_statuses"},{"description":"","name":"orders_list"},{"description":"","name":"parametric_categories_list"},{"description":"","name":"parametric_category_create"},{"description":"","name":"parametric_category_detail"},{"description":"","name":"parametric_category_update"},{"description":"","name":"pricelist_prices"},{"description":"","name":"pricelists_list"},{"description":"","name":"product_create","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Meaningful data changes are Medium."}},{"description":"","name":"product_detail"},{"description":"","name":"product_find_by_code"},{"description":"","name":"product_update","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: Production storefront operations are High."}},{"description":"","name":"products_by_category"},{"description":"","name":"products_list"},{"description":"","name":"proforma_invoice_detail"},{"description":"","name":"review_product_update"},{"description":"","name":"reviews_products_list"},{"description":"","name":"reviews_project_list"},{"description":"","name":"stock_amounts_by_code"},{"description":"","name":"stock_amounts_by_product"},{"description":"","name":"stock_amounts_low"},{"description":"","name":"stock_movements"},{"description":"","name":"stock_movements_create","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can deploy code or change infrastructure and production environments. Review findings: Production storefront operations are High."}},{"description":"","name":"stocks_list"},{"description":"","name":"suppliers_list"}],"tools_count":50,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/544b6ae6-908a-4eff-931e-c7f6cac508e3","uuid":"9afc9fcc-d62c-5b0a-91e3-60d53f500aeb","verification_tier":"community","version":""},"query_key":"shoptet","schema_version":1,"status":"match"}