{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-16","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"high","description":"Squad AI connects product decisions with customer feedback and company knowledge. Search signals, insights, actions, goals, and documents, or generate evidence-linked decision briefs. Capture new feedback and update the workspace's knowledge and planning records.","did":"5fb27e70-7f56-4b8b-b2c5-99de1d3d1fc5","documentation_url":"https://docs.meetsquad.ai/","editorial_description":{"extended_description":"Inspect clusters and action context, find similar signals, review recent activity, and create or update goals and documents. Short entity IDs help reference evidence. Records can also be dismissed or deleted where supported.","schema_version":1,"summary":"Squad AI connects product decisions with customer feedback and company knowledge.\nSearch signals, insights, actions, goals, and documents, or generate evidence-linked decision briefs.\nCapture new feedback and update the workspace's knowledge and planning records."},"homepage_url":"","icon":"","id":"5fb27e70-7f56-4b8b-b2c5-99de1d3d1fc5","installs":0,"last_scanned":"","license":"","long_description":"Inspect clusters and action context, find similar signals, review recent activity, and create or update goals and documents. Short entity IDs help reference evidence. Records can also be dismissed or deleted where supported.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The current official MCP guide lists delete as a typical action for knowledge, feedback and insight tool families, while the packet’s 30 names omit those operations.","reasoning":"Deleting product research, customer feedback or derived insights destroys meaningful workspace data.","risk_type":"data_deletion","severity":"high","title":"Official docs expose deletion omitted from Directory inventory","triggering_tools_or_skills":["knowledge_delete","feedback_delete","insight_delete"]},{"evidence":"Official documentation advertises reachable delete tools beyond the complete Directory inventory supplied in the packet.","reasoning":"Capability drift causes the candidate to understate the destructive surface and requires an inventory refresh.","risk_type":"identity_discrepancy","severity":"low","title":"Directory tool inventory is incomplete","triggering_tools_or_skills":["knowledge_delete","feedback_delete","insight_delete"]},{"evidence":"The declared tools create documents/goals, ingest customer signals and update workspace strategy records.","reasoning":"These operations persistently modify product-management and customer-feedback data.","risk_type":"data_modification","severity":"medium","title":"Creates and updates strategy artifacts","triggering_tools_or_skills":["create_document","create_goal","ingest_signal","update_document","update_goal","update_workspace"]}],"assessment_status":"provisional","auth_and_scopes":"OAuth is required and scoped to the signed-in Squad account; the official guide says sessions are revocable but does not enumerate fine-grained scopes.","blocked_missing_evidence":null,"confidence":"high","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/5fb27e70-7f56-4b8b-b2c5-99de1d3d1fc5.json","what_it_proves":"Candidate PR #125 record identity (name \"Squad AI\", publisher, type web_connector) and 30 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/5fb27e70-7f56-4b8b-b2c5-99de1d3d1fc5: complete tool_names inventory (30 tools), remote streamable-http endpoint https://mcp.meetsquad.ai/mcp, auth_posture auth_required, directory tier community"},{"accessed_at":"2026-10-10T20:45:33Z","url_or_path":"https://docs.meetsquad.ai/guides/squad-mcp","what_it_proves":"Squad’s official MCP guide documents create/update operations and additional knowledge, feedback and insight deletion tools not present in the Directory inventory."}],"primary_reason":"Current Squad documentation exposes destructive knowledge, feedback and insight actions missing from the Directory tool list.","provisional_risk":null,"publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:5fb27e70-7f56-4b8b-b2c5-99de1d3d1fc5","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 30 Directory names and the official MCP guide. The documented union, not the stale Directory list alone, drives the High rating; refresh the inventory and verify exact current delete tool names before publication.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":30,"tools_or_skills_total":30},"name":"Squad AI","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=5fb27e70-7f56-4b8b-b2c5-99de1d3d1fc5&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://meetsquad.ai/privacy-policy","provisional_risk":null,"publication_recommendation":"fix","publisher":"Squad AI","publisher_url":"https://meetsquad.ai/","remote_url":"https://mcp.meetsquad.ai/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can permanently remove data or resources. Review findings: Deleting product research, customer feedback or derived insights destroys meaningful workspace data.","evidence":"Official docs expose deletion omitted from Directory inventory: The current official MCP guide lists delete as a typical action for knowledge, feedback and insight tool families, while the packet’s 30 names omit those operations.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Official docs expose deletion omitted from Directory inventory","triggering_tools":["knowledge_delete","feedback_delete","insight_delete"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These operations persistently modify product-management and customer-feedback data.","evidence":"Creates and updates strategy artifacts: The declared tools create documents/goals, ingest customer signals and update workspace strategy records.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Creates and updates strategy artifacts","triggering_tools":["create_document","create_goal","ingest_signal","update_document","update_goal","update_workspace"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"hello@meetsquad.ai","tags":["deletes_data","modifies_data","network_access","oauth_required","web_connector"],"tools":[{"description":"","name":"create_document","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These operations persistently modify product-management and customer-feedback data."}},{"description":"","name":"create_goal","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These operations persistently modify product-management and customer-feedback data."}},{"description":"","name":"dismiss_signal"},{"description":"","name":"find_similar_signals"},{"description":"","name":"generate_brief"},{"description":"","name":"get_action_context"},{"description":"","name":"get_activity"},{"description":"","name":"get_cluster"},{"description":"","name":"get_entity"},{"description":"","name":"get_workspace_overview"},{"description":"","name":"ingest_signal","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These operations persistently modify product-management and customer-feedback data."}},{"description":"","name":"list_actions"},{"description":"","name":"list_clusters"},{"description":"","name":"list_documents"},{"description":"","name":"list_goals"},{"description":"","name":"list_insights"},{"description":"","name":"list_integrations"},{"description":"","name":"list_members"},{"description":"","name":"list_one_pagers"},{"description":"","name":"list_signals"},{"description":"","name":"list_workspaces"},{"description":"","name":"search"},{"description":"","name":"select_workspace"},{"description":"","name":"update_action"},{"description":"","name":"update_action_status"},{"description":"","name":"update_document","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These operations persistently modify product-management and customer-feedback data."}},{"description":"","name":"update_goal","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These operations persistently modify product-management and customer-feedback data."}},{"description":"","name":"update_insight"},{"description":"","name":"update_one_pager_status"},{"description":"","name":"update_workspace","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These operations persistently modify product-management and customer-feedback data."}},{"description":"","name":"knowledge_delete","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deleting product research, customer feedback or derived insights destroys meaningful workspace data."}},{"description":"","name":"feedback_delete","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deleting product research, customer feedback or derived insights destroys meaningful workspace data."}},{"description":"","name":"insight_delete","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deleting product research, customer feedback or derived insights destroys meaningful workspace data."}}],"tools_count":33,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/5fb27e70-7f56-4b8b-b2c5-99de1d3d1fc5","uuid":"62c15277-011a-5d66-8958-94b0440ea898","verification_tier":"community","version":""},"query_key":"squad ai","schema_version":1,"status":"match"}