{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-06-27","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Connects Claude to the Subscline LINE marketing CRM. Review audiences and campaign results, and create draft messages, groups, replies, coupons or menus. All new content stays draft, disabled or unpublished until a person activates it in the admin interface.","did":"29c7ea30-2404-4446-95ff-50ceae9afc96","documentation_url":"https://app.subscline.jp/manual/guide/mcp-connector/","editorial_description":{"extended_description":"Read customer-base summaries, subscription trends, billing context and sent-message reports. Creation tools also cover plans and step campaigns. The connector does not update or delete existing data or immediately publish or send to LINE. Each connection is scoped to one tenant with separate read and write permissions.","schema_version":1,"summary":"Connects Claude to the Subscline LINE marketing CRM.\nReview audiences and campaign results, and create draft messages, groups, replies, coupons or menus.\nAll new content stays draft, disabled or unpublished until a person activates it in the admin interface."},"homepage_url":"","icon":"","id":"29c7ea30-2404-4446-95ff-50ceae9afc96","installs":0,"last_scanned":"","license":"","long_description":"Read customer-base summaries, subscription trends, billing context and sent-message reports. Creation tools also cover plans and step campaigns. The connector does not update or delete existing data or immediately publish or send to LINE. Each connection is scoped to one tenant with separate read and write permissions.","manual_assessment":"medium","manual_review":{"all_findings":[{"evidence":"The inventory creates these resources, and the description explicitly says every write is a new draft, disabled or nonpublic item that a human must activate/publish/send in the admin UI.","reasoning":"Creating persistent drafts and groups is a Medium write; no connector tool sends or publishes them.","risk_type":"data_modification","severity":"medium","title":"Creates marketing configuration in safe draft/disabled state","triggering_tools_or_skills":["createAutomaticReply","createConditionalUserGroup","createCoupon","createPlanDraft","createRichMenuDraft","createSegmentDraft","createSegmentSeriesDraft","createUserGroup"]}],"assessment_status":"provisional","auth_and_scopes":"OAuth 2.1 with PKCE and per-tool read/write scopes is described as fixed to one tenant; all writes are described as draft, disabled or nonpublic creations.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"medium","evidence_completeness":"partial","manual_overall_risk":"medium","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/29c7ea30-2404-4446-95ff-50ceae9afc96.json","what_it_proves":"Candidate PR #125 record identity (name \"subscline\", publisher, type web_connector) and 14 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/29c7ea30-2404-4446-95ff-50ceae9afc96: complete tool_names inventory (14 tools), remote streamable-http endpoint https://api.subscline.jp/api/v1/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"subscline creates persistent but inactive/nonpublic marketing drafts and settings, with no direct send action.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:29c7ea30-2404-4446-95ff-50ceae9afc96","reviewed_at":"2026-10-10","reviewer_notes":"The official documentation URL was inaccessible, but the Directory description provides explicit state constraints. Runtime verification should confirm createAutomaticReply remains disabled and cannot trigger LINE messages.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":14,"tools_or_skills_total":14},"name":"subscline","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=29c7ea30-2404-4446-95ff-50ceae9afc96&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://subscline.com/privacy/","provisional_risk":null,"publication_recommendation":"accept","publisher":"株式会社サブスクライン (Subscline Inc.)","publisher_url":"https://subscline.com/","remote_url":"https://api.subscline.jp/api/v1/mcp","repository_url":"","risk":"medium","risk_severity":"medium","security_risks":[{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Creating persistent drafts and groups is a Medium write; no connector tool sends or publishes them.","evidence":"Creates marketing configuration in safe draft/disabled state: The inventory creates these resources, and the description explicitly says every write is a new draft, disabled or nonpublic item that a human must activate/publish/send in the admin UI.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Creates marketing configuration in safe draft/disabled state","triggering_tools":["createAutomaticReply","createConditionalUserGroup","createCoupon","createPlanDraft","createRichMenuDraft","createSegmentDraft","createSegmentSeriesDraft","createUserGroup"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://subscline.com/contact/","tags":["modifies_data","network_access","oauth_required","web_connector"],"tools":[{"description":"","name":"createAutomaticReply","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Creating persistent drafts and groups is a Medium write; no connector tool sends or publishes them."}},{"description":"","name":"createConditionalUserGroup","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Creating persistent drafts and groups is a Medium write; no connector tool sends or publishes them."}},{"description":"","name":"createCoupon","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Creating persistent drafts and groups is a Medium write; no connector tool sends or publishes them."}},{"description":"","name":"createPlanDraft","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Creating persistent drafts and groups is a Medium write; no connector tool sends or publishes them."}},{"description":"","name":"createRichMenuDraft","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Creating persistent drafts and groups is a Medium write; no connector tool sends or publishes them."}},{"description":"","name":"createSegmentDraft","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Creating persistent drafts and groups is a Medium write; no connector tool sends or publishes them."}},{"description":"","name":"createSegmentSeriesDraft","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Creating persistent drafts and groups is a Medium write; no connector tool sends or publishes them."}},{"description":"","name":"createUserGroup","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Creating persistent drafts and groups is a Medium write; no connector tool sends or publishes them."}},{"description":"","name":"getAudienceOverview"},{"description":"","name":"getBillingContext"},{"description":"","name":"getSegmentDraft"},{"description":"","name":"getSegmentReports"},{"description":"","name":"listSegmentDrafts"},{"description":"","name":"listUserGroups"}],"tools_count":14,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/29c7ea30-2404-4446-95ff-50ceae9afc96","uuid":"1bcf31c4-391f-5415-91b1-82beeb9b72ad","verification_tier":"community","version":""},"query_key":"subscline inc subscline","schema_version":1,"status":"match"}