{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-21","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"high","description":"Manage website-trained customer-support chatbots in SiteGPT. Inspect chatbots, conversations, leads and analytics, or update knowledge and configuration. Writes require confirmation and remain limited by your OAuth role, scopes and chatbot restrictions.","did":"cce641d2-7324-4d54-b3f2-354143236be0","documentation_url":"https://sitegpt.ai/docs/cli/mcp-server","editorial_description":{"extended_description":"A searchable operation catalog helps locate the appropriate SiteGPT action. Separate read and write tools retrieve information or create chatbots, add knowledge and change prompts or settings. Connect through browser OAuth without managing an API key.","schema_version":1,"summary":"Manage website-trained customer-support chatbots in SiteGPT.\nInspect chatbots, conversations, leads and analytics, or update knowledge and configuration.\nWrites require confirmation and remain limited by your OAuth role, scopes and chatbot restrictions."},"homepage_url":"","icon":"https://sitegpt.ai/images/chat-icon.png","id":"cce641d2-7324-4d54-b3f2-354143236be0","installs":0,"last_scanned":"","license":"","long_description":"A searchable operation catalog helps locate the appropriate SiteGPT action. Separate read and write tools retrieve information or create chatbots, add knowledge and change prompts or settings. Connect through browser OAuth without managing an API key.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"Official docs name reply_to_conversation and send_chat_message as current write operations reachable by the remote server, though the packet lists only execute_write.","reasoning":"Sending customer-support messages externally as the user is High impact.","risk_type":"messaging_as_user","severity":"high","title":"Current remote MCP can reply to or start customer conversations","triggering_tools_or_skills":["execute_write"]},{"evidence":"Official docs say search discovers operations and execute_write reaches all API v2; approval groups include billing management, API tokens and integrations.","reasoning":"The fixed three-tool inventory hides broad server-defined write/admin operations whose full impact cannot be inferred from the names.","risk_type":"generic_gateway","severity":"high","title":"execute_write reaches all of API v2","triggering_tools_or_skills":["execute_write","search"]},{"evidence":"Official docs list conversation replies, chat messages, content, appearance, settings and preview tools in addition to the three API gateway tools.","reasoning":"The catalog must refresh/describe this dynamic surface and cannot present the three names as exhaustive.","risk_type":"identity_discrepancy","severity":"low","title":"Common current tools are missing from the Directory packet","triggering_tools_or_skills":[]},{"evidence":"The connector runs at https://sitegpt.ai/mcp without a pinned server implementation in the packet.","reasoning":"The hosted implementation can change independently of this catalog snapshot, requiring runtime verification and change monitoring.","risk_type":"provenance_uncertainty","severity":"low","title":"SiteGPT is a mutable remote service","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"OAuth inherits the SiteGPT dashboard role and approved scopes; users may choose read-only access, but full approval grants broad API v2 writes.","blocked_missing_evidence":null,"confidence":"high","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/cce641d2-7324-4d54-b3f2-354143236be0.json","what_it_proves":"Candidate PR #125 record identity (name \"SiteGPT\", publisher, type web_connector) and 3 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/cce641d2-7324-4d54-b3f2-354143236be0: complete tool_names inventory (3 tools), remote streamable-http endpoint https://sitegpt.ai/mcp, auth_posture auth_required, directory tier community"},{"accessed_at":"2026-10-10T21:04:12Z","url_or_path":"https://sitegpt.ai/docs/developers/mcp","what_it_proves":"SiteGPT documents that the three generic tools reach all API v2 and that current remote tools can reply/send conversations, add content, change settings and potentially manage billing, tokens and integrations by scope."}],"primary_reason":"SiteGPT can send customer messages and route arbitrary API v2 writes through a generic dispatcher.","provisional_risk":null,"publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:cce641d2-7324-4d54-b3f2-354143236be0","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 3 Directory tools and official current MCP documentation. Read-only consent is optional; rating reflects full requested permissions. Deletion/admin reach needs the exact operation catalog.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"unknown","deletes_data":"unknown","deployment_or_infrastructure":"false","dynamic_hidden_actions":"true","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":3,"tools_or_skills_total":3},"name":"SiteGPT","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=cce641d2-7324-4d54-b3f2-354143236be0&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://sitegpt.ai/privacy","provisional_risk":null,"publication_recommendation":"fix","publisher":"SiteGPT","publisher_url":"https://sitegpt.ai/","remote_url":"https://sitegpt.ai/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: Sending customer-support messages externally as the user is High impact.","evidence":"Current remote MCP can reply to or start customer conversations: Official docs name reply_to_conversation and send_chat_message as current write operations reachable by the remote server, though the packet lists only execute_write.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Current remote MCP can reply to or start customer conversations","triggering_tools":["execute_write"]},{"description":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: The fixed three-tool inventory hides broad server-defined write/admin operations whose full impact cannot be inferred from the names.","evidence":"execute_write reaches all of API v2: Official docs say search discovers operations and execute_write reaches all API v2; approval groups include billing management, API tokens and integrations.","manual_risk_type":"generic_gateway","remediation":{"block_tool_categories":["code_execution"],"steps":["Run only in a sandbox with least-privilege credentials and strict resource limits.","Disable generic execution gateways unless their reachable action set is fully understood.","Require approval before execution against production systems or sensitive data."]},"risk_type":"runs_code","severity":"high","title":"execute_write reaches all of API v2","triggering_tools":["execute_write","search"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@sitegpt.ai","tags":["network_access","oauth_required","runs_code","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"execute_read"},{"description":"","name":"execute_write","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: The fixed three-tool inventory hides broad server-defined write/admin operations whose full impact cannot be inferred from the names."}},{"description":"","name":"search","risk":{"category":"code_execution","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can execute code, commands, queries, or dynamically selected actions. Review findings: The fixed three-tool inventory hides broad server-defined write/admin operations whose full impact cannot be inferred from the names."}}],"tools_count":3,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/cce641d2-7324-4d54-b3f2-354143236be0","uuid":"5bc8f1af-bb36-529d-a3e9-d9bb38e4a015","verification_tier":"community","version":""},"query_key":"sitegpt sitegpt","schema_version":1,"status":"match"}