{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Search historical books and their English translations with Source Library. Find passages by keyword or concept and explore individual books. Retrieve quotations linked to scanned source pages for research and citation.","did":"005aeb9a-a551-40d5-b3e9-77b860a48e06","documentation_url":"https://sourcelibrary.org/developers","editorial_description":{"extended_description":"The library provides book text, quotations, image search and stable citation links. Concept search complements searches within a particular book or across translations. A connected account is required.","schema_version":1,"summary":"Search historical books and their English translations with Source Library.\nFind passages by keyword or concept and explore individual books.\nRetrieve quotations linked to scanned source pages for research and citation."},"homepage_url":"","icon":"https://sourcelibrary.org/icon.svg","id":"005aeb9a-a551-40d5-b3e9-77b860a48e06","installs":0,"last_scanned":"","license":"","long_description":"The library provides book text, quotations, image search and stable citation links. Concept search complements searches within a particular book or across translations. A connected account is required.","manual_assessment":"low","manual_review":{"all_findings":[{"evidence":"Directory tool_names are search_/list_/get_ library tools; description: 'direct access to ~15,000 books translated to English'; developer page describes them as catalog search/read.","reasoning":"Read-only access to a public corpus; no user account data is involved.","risk_type":"public_data_read","severity":"low","title":"Search and read of a public translated-book corpus","triggering_tools_or_skills":["search_library","search_translations","search_concept","search_within_book","list_books","get_book","get_book_text","get_quote","search_images"]},{"evidence":"Developer page: submit_feedback 'Sends bug reports and feature requests to the team'.","reasoning":"Conversation-derived text leaves to Source Library staff; it does not modify catalog or user data and is not a message sent as the user to third parties.","risk_type":"third_party_data_forwarding","severity":"low","title":"submit_feedback sends user-composed text to the publisher","triggering_tools_or_skills":["submit_feedback"]},{"evidence":"get_book_text returns 50+ pages of OCR/translation per call (developer page).","reasoning":"Large volumes of third-party text enter the model context.","risk_type":"prompt_injection_exposure","severity":"low","title":"OCR/translated historical text returned into context","triggering_tools_or_skills":["get_book_text","get_quote","search_translations"]},{"evidence":"Directory: auth_required with 10 tools; developer page: no auth needed and lists list_editions, get_quotes, get_locus, share_findings, propose_collection not in the Directory inventory.","reasoning":"Catalog inventory/auth metadata appears stale; the extra submission tools are human-reviewed per docs and do not change the rating.","risk_type":"identity_discrepancy","severity":"low","title":"Auth posture and tool inventory differ between Directory and publisher docs","triggering_tools_or_skills":[]},{"evidence":"Directory remote.url is sourcelibrary.org/api/mcp; no pinned source or version is available for the server.","reasoning":"Tool behaviour can change server-side after review; ratings rest on the 2026-09-22 snapshot.","risk_type":"provenance_uncertainty","severity":"low","title":"Closed hosted MCP server for Source Library can change without notice","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"Directory lists auth_required, but the publisher developer page says basic use needs no auth (OAuth fields left empty) and a free API key only raises rate limits; no scopes documented.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"low","evidence_completeness":"partial","manual_overall_risk":"low","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/005aeb9a-a551-40d5-b3e9-77b860a48e06.json","what_it_proves":"Candidate PR #125 record identity (name \"Source Library\", publisher, type web_connector) and 10 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/005aeb9a-a551-40d5-b3e9-77b860a48e06: complete tool_names inventory (10 tools), remote streamable-http endpoint https://sourcelibrary.org/api/mcp, auth_posture auth_required, directory tier community"},{"accessed_at":"2026-10-10T20:27:20Z","url_or_path":"https://sourcelibrary.org/developers","what_it_proves":"Publisher developer page describes search/read tools over the public translated-book corpus, says submit_feedback sends bug reports/feature requests to the team, lists extra submission tools (share_findings, propose_collection) and states basic MCP use needs no authentication."}],"primary_reason":"All declared tools search or read a public book corpus; the only outbound action, submit_feedback, sends feedback text to the publisher.","provisional_risk":null,"publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:005aeb9a-a551-40d5-b3e9-77b860a48e06","reviewed_at":"2026-10-10","reviewer_notes":"Identity consistent (name, author URL, remote host all sourcelibrary.org). Reviewed all 10 tool names. submit_feedback treated as forwarding to the publisher, not data modification. Docs list 5 tools absent from the Directory snapshot (incl. share_findings/propose_collection, which the page says are human-reviewed) and say no auth is required, contradicting auth_required; recommend refreshing inventory/auth metadata (fix). persistent_credentials left unknown because of the auth contradiction.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"false","persistent_credentials":"unknown","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"false","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":10,"tools_or_skills_total":10},"name":"Source Library","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=005aeb9a-a551-40d5-b3e9-77b860a48e06&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://sourcelibrary.org/privacy","provisional_risk":null,"publication_recommendation":"fix","publisher":"Source Library","publisher_url":"https://Sourcelibrary.org","remote_url":"https://sourcelibrary.org/api/mcp","repository_url":"","risk":"low","risk_severity":"low","security_risks":[{"description":"This connector retrieves public or publisher-provided information and returns it to the AI. Review findings: Read-only access to a public corpus; no user account data is involved.","evidence":"Search and read of a public translated-book corpus: Directory tool_names are search_/list_/get_ library tools; description: 'direct access to ~15,000 books translated to English'; developer page describes them as catalog search/read.","manual_risk_type":"public_data_read","remediation":{"block_tool_categories":[],"steps":["Treat returned third-party content as untrusted input and verify consequential claims.","Do not assume public content is accurate, current, or free of embedded instructions."]},"risk_type":"reads_public_data","severity":"low","title":"Search and read of a public translated-book corpus","triggering_tools":["search_library","search_translations","search_concept","search_within_book","list_books","get_book","get_book_text","get_quote","search_images"]},{"description":"This connector can send caller-provided data to an external service or publisher. Review findings: Conversation-derived text leaves to Source Library staff; it does not modify catalog or user data and is not a message sent as the user to third parties.","evidence":"submit_feedback sends user-composed text to the publisher: Developer page: submit_feedback 'Sends bug reports and feature requests to the team'.","manual_risk_type":"third_party_data_forwarding","remediation":{"block_tool_categories":["sends_externally"],"steps":["Do not include secrets, regulated data, or customer information unless the destination is approved.","Review the recipient's retention and deletion policy before enabling the connector."]},"risk_type":"forwards_data_to_third_party","severity":"low","title":"submit_feedback sends user-composed text to the publisher","triggering_tools":["submit_feedback"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"derek@sourcelibrary.org","tags":["forwards_data_to_third_party","network_access","oauth_required","reads_public_data","web_connector"],"tools":[{"description":"","name":"search_library"},{"description":"","name":"search_translations"},{"description":"","name":"search_concept"},{"description":"","name":"search_within_book"},{"description":"","name":"list_books"},{"description":"","name":"get_book"},{"description":"","name":"get_book_text"},{"description":"","name":"get_quote"},{"description":"","name":"search_images"},{"description":"","name":"submit_feedback"}],"tools_count":10,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/005aeb9a-a551-40d5-b3e9-77b860a48e06","uuid":"03be1e78-3488-5a68-bec4-e1b797ab9041","verification_tier":"community","version":""},"query_key":"source library source library","schema_version":1,"status":"match"}