{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-14","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"SocialAPI manages social publishing, inbox messages, comments, and reviews through Claude. Draft, schedule, publish, moderate, reply, and inspect engagement across connected accounts. Features vary by platform; a SocialAPI account and connected social account are required, with your own developer credentials needed for X.","did":"56eb2f13-a6fa-4c16-a1e4-1f3a8e28a38a","documentation_url":"https://docs.social-api.ai/","editorial_description":{"extended_description":"Supported platforms named in the source include Instagram, Facebook, Threads, TikTok, YouTube, LinkedIn, Google Business Profile, X, Telegram, WhatsApp, and Zalo. Tools also manage brands, client invitations, media, content limits, webhooks, and delivery retries.","schema_version":1,"summary":"SocialAPI manages social publishing, inbox messages, comments, and reviews through Claude.\nDraft, schedule, publish, moderate, reply, and inspect engagement across connected accounts.\nFeatures vary by platform; a SocialAPI account and connected social account are required, with your own developer credentials needed for X."},"homepage_url":"","icon":"","id":"56eb2f13-a6fa-4c16-a1e4-1f3a8e28a38a","installs":0,"last_scanned":"","license":"","long_description":"Supported platforms named in the source include Instagram, Facebook, Threads, TikTok, YouTube, LinkedIn, Google Business Profile, X, Telegram, WhatsApp, and Zalo. Tools also manage brands, client invitations, media, content limits, webhooks, and delivery retries.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"Tools explicitly communicate on social networks.","reasoning":"External messaging is High.","risk_type":"messaging_as_user","severity":"high","title":"Publishes posts and sends replies/DMs","triggering_tools_or_skills":["social_api_publish_post","social_api_send_dm","social_api_reply_to_comment","social_api_reply_to_review"]},{"evidence":"Tools delete meaningful public/account data.","reasoning":"Deletion is High.","risk_type":"data_deletion","severity":"high","title":"Deletes posts/comments/media/webhooks","triggering_tools_or_skills":["social_api_delete_post","social_api_delete_comment","social_api_delete_media","social_api_delete_webhook"]},{"evidence":"These are powerful credential/access administration actions.","reasoning":"Credential/admin actions are High.","risk_type":"credential_admin","severity":"high","title":"Manages OAuth, keys, invites, accounts, and webhooks","triggering_tools_or_skills":["social_api_exchange_oauth","social_api_revoke_key","social_api_create_invite","social_api_disconnect_account"]},{"evidence":"Remote hosted implementation is unpinned.","reasoning":"Runtime capability may drift.","risk_type":"provenance_uncertainty","severity":"low","title":"Hosted implementation is mutable","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"OAuth/account authorization required; exact scopes are not documented.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/56eb2f13-a6fa-4c16-a1e4-1f3a8e28a38a.json","what_it_proves":"Candidate PR #125 record identity (name \"SocialAPI\", publisher, type web_connector) and 79 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/56eb2f13-a6fa-4c16-a1e4-1f3a8e28a38a: complete tool_names inventory (79 tools), remote streamable-http endpoint https://api.social-api.ai/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"SocialAPI publishes/sends social content, deletes resources, and administers OAuth, keys, invites, webhooks, and accounts.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:56eb2f13-a6fa-4c16-a1e4-1f3a8e28a38a","reviewed_at":"2026-10-10","reviewer_notes":"All declared tool names were reviewed; schemas were unavailable.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"true","deletes_data":"true","deployment_or_infrastructure":"true","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":79,"tools_or_skills_total":79},"name":"SocialAPI","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=56eb2f13-a6fa-4c16-a1e4-1f3a8e28a38a&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://social-api.ai/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"SocialAPI","publisher_url":"https://social-api.ai/","remote_url":"https://api.social-api.ai/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: External messaging is High.","evidence":"Publishes posts and sends replies/DMs: Tools explicitly communicate on social networks.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Publishes posts and sends replies/DMs","triggering_tools":["social_api_publish_post","social_api_send_dm","social_api_reply_to_comment","social_api_reply_to_review"]},{"description":"This connector can permanently remove data or resources. Review findings: Deletion is High.","evidence":"Deletes posts/comments/media/webhooks: Tools delete meaningful public/account data.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Deletes posts/comments/media/webhooks","triggering_tools":["social_api_delete_post","social_api_delete_comment","social_api_delete_media","social_api_delete_webhook"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Credential/admin actions are High.","evidence":"Manages OAuth, keys, invites, accounts, and webhooks: These are powerful credential/access administration actions.","manual_risk_type":"credential_admin","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"high","title":"Manages OAuth, keys, invites, accounts, and webhooks","triggering_tools":["social_api_exchange_oauth","social_api_revoke_key","social_api_create_invite","social_api_disconnect_account"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@social-api.ai","tags":["accesses_calendar","accesses_messaging","deletes_data","modifies_data","network_access","oauth_required","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"social_api_connect_account"},{"description":"","name":"social_api_create_brand"},{"description":"","name":"social_api_create_export"},{"description":"","name":"social_api_create_invite","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Credential/admin actions are High."}},{"description":"","name":"social_api_create_post"},{"description":"","name":"social_api_create_webhook"},{"description":"","name":"social_api_delete_brand"},{"description":"","name":"social_api_delete_comment","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion is High."}},{"description":"","name":"social_api_delete_media","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion is High."}},{"description":"","name":"social_api_delete_post","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion is High."}},{"description":"","name":"social_api_delete_review_reply"},{"description":"","name":"social_api_delete_webhook","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion is High."}},{"description":"","name":"social_api_disconnect_account","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Credential/admin actions are High."}},{"description":"","name":"social_api_events_summary"},{"description":"","name":"social_api_exchange_oauth","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Credential/admin actions are High."}},{"description":"","name":"social_api_get_account_limits"},{"description":"","name":"social_api_get_comment_replies"},{"description":"","name":"social_api_get_constraints"},{"description":"","name":"social_api_get_conversation"},{"description":"","name":"social_api_get_creator_info"},{"description":"","name":"social_api_get_export"},{"description":"","name":"social_api_get_export_videos"},{"description":"","name":"social_api_get_me"},{"description":"","name":"social_api_get_media_upload_url"},{"description":"","name":"social_api_get_mentions"},{"description":"","name":"social_api_get_post"},{"description":"","name":"social_api_get_post_metrics"},{"description":"","name":"social_api_get_reviews"},{"description":"","name":"social_api_get_storage_usage"},{"description":"","name":"social_api_get_usage"},{"description":"","name":"social_api_get_webhook"},{"description":"","name":"social_api_get_webhook_delivery"},{"description":"","name":"social_api_hide_comment"},{"description":"","name":"social_api_like_comment"},{"description":"","name":"social_api_list_account_pages"},{"description":"","name":"social_api_list_accounts"},{"description":"","name":"social_api_list_brands"},{"description":"","name":"social_api_list_conversations"},{"description":"","name":"social_api_list_events"},{"description":"","name":"social_api_list_exports"},{"description":"","name":"social_api_list_inbox_posts"},{"description":"","name":"social_api_list_instagram_stories"},{"description":"","name":"social_api_list_invites"},{"description":"","name":"social_api_list_keys"},{"description":"","name":"social_api_list_media"},{"description":"","name":"social_api_list_messages"},{"description":"","name":"social_api_list_pending_profiles"},{"description":"","name":"social_api_list_post_comments"},{"description":"","name":"social_api_list_posts"},{"description":"","name":"social_api_list_review_accounts"},{"description":"","name":"social_api_list_webhook_deliveries"},{"description":"","name":"social_api_list_webhooks"},{"description":"","name":"social_api_mark_conversation_read"},{"description":"","name":"social_api_moderate_comment"},{"description":"","name":"social_api_patch_me"},{"description":"","name":"social_api_private_reply_to_comment"},{"description":"","name":"social_api_publish_post","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: External messaging is High."}},{"description":"","name":"social_api_reply_to_comment","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: External messaging is High."}},{"description":"","name":"social_api_reply_to_mention"},{"description":"","name":"social_api_reply_to_review","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: External messaging is High."}},{"description":"","name":"social_api_retry_post"},{"description":"","name":"social_api_retry_webhook_delivery"},{"description":"","name":"social_api_revoke_invite"},{"description":"","name":"social_api_revoke_key","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Credential/admin actions are High."}},{"description":"","name":"social_api_select_pending_profile"},{"description":"","name":"social_api_send_dm","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: External messaging is High."}},{"description":"","name":"social_api_send_feedback"},{"description":"","name":"social_api_test_webhook"},{"description":"","name":"social_api_unhide_comment"},{"description":"","name":"social_api_unlike_comment"},{"description":"","name":"social_api_unpublish_post"},{"description":"","name":"social_api_update_account_page"},{"description":"","name":"social_api_update_brand"},{"description":"","name":"social_api_update_conversation"},{"description":"","name":"social_api_update_post"},{"description":"","name":"social_api_update_review_reply"},{"description":"","name":"social_api_update_webhook"},{"description":"","name":"social_api_validate_post"},{"description":"","name":"social_api_verify_media_upload"}],"tools_count":79,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/56eb2f13-a6fa-4c16-a1e4-1f3a8e28a38a","uuid":"4efcef76-6fa3-5359-8c36-5649ee711ef8","verification_tier":"community","version":""},"query_key":"socialapi socialapi","schema_version":1,"status":"match"}