{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-13","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Turns conversation datasets into hosted Sprucely.io dashboards. Create charts or tables, append new rows and retrieve a persistent dashboard link. Dashboards start private; public sharing requires explicit confirmation and can be revoked.","did":"c138bd42-3fea-4d6b-b39a-a94c53a939e9","documentation_url":"https://www.sprucely.io/resources/mcp-api/","editorial_description":{"extended_description":"Data is stored in your Sprucely.io account, with plan-dependent storage and dashboard limits. Tools inspect schemas, storage and existing dashboards and generate embed snippets. Optional run identifiers prevent duplicate appends on retries, and disabling sharing revokes earlier link revisions.","schema_version":1,"summary":"Turns conversation datasets into hosted Sprucely.io dashboards.\nCreate charts or tables, append new rows and retrieve a persistent dashboard link.\nDashboards start private; public sharing requires explicit confirmation and can be revoked."},"homepage_url":"","icon":"","id":"c138bd42-3fea-4d6b-b39a-a94c53a939e9","installs":0,"last_scanned":"","license":"","long_description":"Data is stored in your Sprucely.io account, with plan-dependent storage and dashboard limits. Tools inspect schemas, storage and existing dashboards and generate embed snippets. Optional run identifiers prevent duplicate appends on retries, and disabling sharing revokes earlier link revisions.","manual_assessment":"medium","manual_review":{"all_findings":[{"evidence":"The listing says it saves dashboards, appends rows and returns links that can be shared with unauthenticated readers.","reasoning":"These tools persist user-supplied data and alter its exposure settings.","risk_type":"data_modification","severity":"medium","title":"Creates, appends and shares hosted dashboards","triggering_tools_or_skills":["create_dashboard","add_data","set_sharing"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication binds a Sprucely account; sharing visibility and data-retention scopes are not documented.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"medium","evidence_completeness":"partial","manual_overall_risk":"medium","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/c138bd42-3fea-4d6b-b39a-a94c53a939e9.json","what_it_proves":"Candidate PR #125 record identity (name \"Sprucely.io\", publisher, type web_connector) and 8 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/c138bd42-3fea-4d6b-b39a-a94c53a939e9: complete tool_names inventory (8 tools), remote streamable-http endpoint https://www.sprucely.io/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Sprucely persists datasets/dashboards and can expose them through public sharing or embed links.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:c138bd42-3fea-4d6b-b39a-a94c53a939e9","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 8 names. Official page fetch failed; runtime verification should confirm set_sharing defaults and public-link revocation.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":8,"tools_or_skills_total":8},"name":"Sprucely.io","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=c138bd42-3fea-4d6b-b39a-a94c53a939e9&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.sprucely.io/privacy-policy/","provisional_risk":null,"publication_recommendation":"accept","publisher":"Emergence Software Pte. Ltd.","publisher_url":"https://www.emergence.com.sg/","remote_url":"https://www.sprucely.io/mcp","repository_url":"","risk":"medium","risk_severity":"medium","security_risks":[{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These tools persist user-supplied data and alter its exposure settings.","evidence":"Creates, appends and shares hosted dashboards: The listing says it saves dashboards, appends rows and returns links that can be shared with unauthenticated readers.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Creates, appends and shares hosted dashboards","triggering_tools":["create_dashboard","add_data","set_sharing"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://www.sprucely.io/resources/support/","tags":["modifies_data","network_access","oauth_required","web_connector"],"tools":[{"description":"","name":"add_data","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These tools persist user-supplied data and alter its exposure settings."}},{"description":"","name":"create_dashboard","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These tools persist user-supplied data and alter its exposure settings."}},{"description":"","name":"get_dashboard"},{"description":"","name":"get_dataset_schema"},{"description":"","name":"get_embed_code"},{"description":"","name":"list_dashboards"},{"description":"","name":"set_sharing","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These tools persist user-supplied data and alter its exposure settings."}},{"description":"","name":"storage_status"}],"tools_count":8,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/c138bd42-3fea-4d6b-b39a-a94c53a939e9","uuid":"b4e6265b-4539-57c8-b8ce-c329b92fc43d","verification_tier":"community","version":""},"query_key":"sprucely io","schema_version":1,"status":"match"}