{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-08","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Interactive Connector","confidence":"medium","description":"Plans Iceland travel with local conditions, operator search and booking tools. Check weather, roads, alerts, transport and activity or accommodation availability. Book with connected operators, then pay on their own payment page.","did":"b64f59a2-b68a-4a6a-9bd1-b5888ce5a6d1","documentation_url":"https://soley.travel/docs/mcp","editorial_description":{"extended_description":"Retrieve quotes, booking status and operator replies, or cancel a booking. Travel data also includes aurora forecasts, avalanche conditions, flights, buses, fuel prices and news. Messages go directly to local operators; not every listed operator supports booking.","schema_version":1,"summary":"Plans Iceland travel with local conditions, operator search and booking tools.\nCheck weather, roads, alerts, transport and activity or accommodation availability.\nBook with connected operators, then pay on their own payment page."},"homepage_url":"","icon":"https://soley.travel/icon-1024.png","id":"b64f59a2-b68a-4a6a-9bd1-b5888ce5a6d1","installs":0,"last_scanned":"","license":"","long_description":"Retrieve quotes, booking status and operator replies, or cancel a booking. Travel data also includes aurora forecasts, avalanche conditions, flights, buses, fuel prices and news. Messages go directly to local operators; not every listed operator supports booking.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The inventory names create_booking, cancel_booking and get_payment_link; the listing says users reserve with an operator and pay on that operator's page.","reasoning":"Creating a real travel reservation can form a financial commitment, while cancellation can alter that commitment; payment itself occurs off-connector but the booking action remains High impact.","risk_type":"financial_transaction","severity":"high","title":"Creates and cancels travel bookings","triggering_tools_or_skills":["create_booking","cancel_booking","get_payment_link"]},{"evidence":"The declared send_message_to_operator tool sends a message to the selected local operator and the listing says replies return to chat.","reasoning":"Sending external content as the user is a High messaging capability.","risk_type":"messaging_as_user","severity":"high","title":"Messages travel operators","triggering_tools_or_skills":["send_message_to_operator"]},{"evidence":"Tools ingest operator replies, news and operator listings into the conversation.","reasoning":"Third-party text can contain adversarial or misleading instructions that reach the model context.","risk_type":"prompt_injection_exposure","severity":"low","title":"Returns operator replies and live-source content","triggering_tools_or_skills":["check_operator_replies","get_iceland_news","search_operators"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication is required; the listing says the user books directly with a local operator and pays on the operator's page, but connector scopes and booking-cancellation authorization are not documented.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/b64f59a2-b68a-4a6a-9bd1-b5888ce5a6d1.json","what_it_proves":"Candidate PR #125 record identity (name \"Sóley — Iceland travel and direct booking\", publisher, type interactive_connector) and 30 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/b64f59a2-b68a-4a6a-9bd1-b5888ce5a6d1: complete tool_names inventory (30 tools), remote streamable-http endpoint https://api.soley.travel/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Sóley can create or cancel operator bookings and send messages to external travel operators.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:b64f59a2-b68a-4a6a-9bd1-b5888ce5a6d1","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 30 tools. Public travel lookups are read-only, but booking and messaging tools are independently High. Runtime verification should confirm whether create_booking is held, immediately confirmed, or chargeable and what cancellation safeguards apply.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"true"},"tools_or_skills_reviewed":30,"tools_or_skills_total":30},"name":"Sóley — Iceland travel and direct booking","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=b64f59a2-b68a-4a6a-9bd1-b5888ce5a6d1&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://soley.travel/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Sóley (operated by Cognia ehf)","publisher_url":"https://soley.travel/","remote_url":"https://api.soley.travel/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Creating a real travel reservation can form a financial commitment, while cancellation can alter that commitment; payment itself occurs off-connector but the booking action remains High impact.","evidence":"Creates and cancels travel bookings: The inventory names create_booking, cancel_booking and get_payment_link; the listing says users reserve with an operator and pay on that operator's page.","manual_risk_type":"financial_transaction","remediation":{"block_tool_categories":["financial"],"steps":["Set provider-side spending limits and require approval for every financial action.","Use a dedicated low-balance account and review transaction logs."]},"risk_type":"spends_money","severity":"high","title":"Creates and cancels travel bookings","triggering_tools":["create_booking","cancel_booking","get_payment_link"]},{"description":"This connector can publish or send messages and content using the connected identity. Review findings: Sending external content as the user is a High messaging capability.","evidence":"Messages travel operators: The declared send_message_to_operator tool sends a message to the selected local operator and the listing says replies return to chat.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Messages travel operators","triggering_tools":["send_message_to_operator"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@soley.travel","tags":["accesses_calendar","accesses_messaging","interactive_connector","network_access","oauth_required","sends_messages_as_you","spends_money"],"tools":[{"description":"","name":"cancel_booking","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Creating a real travel reservation can form a financial commitment, while cancellation can alter that commitment; payment itself occurs off-connector but the booking action remains High impact."}},{"description":"","name":"check_availability"},{"description":"","name":"check_operator_replies"},{"description":"","name":"create_booking","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Creating a real travel reservation can form a financial commitment, while cancellation can alter that commitment; payment itself occurs off-connector but the booking action remains High impact."}},{"description":"","name":"get_about_soley"},{"description":"","name":"get_air_quality"},{"description":"","name":"get_aurora_forecast"},{"description":"","name":"get_avalanche_conditions"},{"description":"","name":"get_booking_status"},{"description":"","name":"get_bus_routes"},{"description":"","name":"get_bus_schedule"},{"description":"","name":"get_earthquakes"},{"description":"","name":"get_exchange_rates"},{"description":"","name":"get_flights"},{"description":"","name":"get_fuel_prices"},{"description":"","name":"get_iceland_news"},{"description":"","name":"get_live_buses"},{"description":"","name":"get_nearest_bus_stop"},{"description":"","name":"get_payment_link","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Creating a real travel reservation can form a financial commitment, while cancellation can alter that commitment; payment itself occurs off-connector but the booking action remains High impact."}},{"description":"","name":"get_price_quote"},{"description":"","name":"get_property_info"},{"description":"","name":"get_road_conditions"},{"description":"","name":"get_safety_alerts"},{"description":"","name":"get_services"},{"description":"","name":"get_weather"},{"description":"","name":"search_itineraries"},{"description":"","name":"search_licensed_operators"},{"description":"","name":"search_operators"},{"description":"","name":"search_operators_near_itinerary"},{"description":"","name":"send_message_to_operator","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Sending external content as the user is a High messaging capability."}}],"tools_count":30,"transport":"streamable-http","type":"interactive_connector","url":"https://claude.ai/directory/b64f59a2-b68a-4a6a-9bd1-b5888ce5a6d1","uuid":"b9ba0dcf-01dd-5504-8ebe-888ee7fd7a6d","verification_tier":"community","version":""},"query_key":"soley iceland travel and direct booking","schema_version":1,"status":"match"}