{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-07","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Suger manages software sales through AWS, Azure, and Google Cloud marketplaces. Work with offers, buyers, entitlements, usage billing, revenue, and co-sell referrals. Actions follow your account permissions; changes ask for confirmation.","did":"effb7efc-cbf7-4fe6-b929-126922436d9a","documentation_url":"https://doc.suger.io/get-started/","editorial_description":{"extended_description":"Create or publish products and offers, adjust subscriptions or credits, report metered usage, and synchronize partner referrals. Tools also manage support tickets, notifications, and cancellation workflows.","schema_version":1,"summary":"Suger manages software sales through AWS, Azure, and Google Cloud marketplaces.\nWork with offers, buyers, entitlements, usage billing, revenue, and co-sell referrals.\nActions follow your account permissions; changes ask for confirmation."},"homepage_url":"","icon":"https://doc.suger.io/img/Suger_logo_2025_yellow.png","id":"effb7efc-cbf7-4fe6-b929-126922436d9a","installs":0,"last_scanned":"","license":"","long_description":"Create or publish products and offers, adjust subscriptions or credits, report metered usage, and synchronize partner referrals. Tools also manage support tickets, notifications, and cancellation workflows.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The listing says users create/update/publish public and private offers, manage credits, subscriptions and usage across AWS, Azure, and GCP marketplaces.","reasoning":"These actions can establish commercial terms, billing usage, credits, or subscription cancellation with direct financial consequences.","risk_type":"financial_transaction","severity":"high","title":"Marketplace offers, prices, credits, usage, and entitlements can be committed","triggering_tools_or_skills":["PublishProduct","CreateOffer","UpdateOfferPrice","AddEntitlementCredit","ReportUsageRecordGroup","ApproveEntitlement","CancelEntitlement"]},{"evidence":"The 137-tool inventory explicitly deletes marketplace products, offers, usage records, entitlement terms, and buyer wallets or closes credit wallets.","reasoning":"Destructive changes can disrupt active sales, billing, or customer entitlements.","risk_type":"data_deletion","severity":"high","title":"Products, offers, usage, and wallet records can be deleted or closed","triggering_tools_or_skills":["DeleteOffer","DeleteProduct","DeleteUsageRecordGroup","DeleteBuyerWallet","CloseCreditWallet"]},{"evidence":"Named tools notify offer recipients, invite Azure partner collaboration, and communicate in support tickets.","reasoning":"These actions contact external buyers, partners, or support staff as the authenticated organization.","risk_type":"messaging_as_user","severity":"high","title":"Offer notifications and partner invitations can be sent","triggering_tools_or_skills":["SendOfferNotifications","AzureInvitePartnerCollaboration","CreateSupportTicketComment"]},{"evidence":"The inventory exposes API-client records and updates notification and usage-metering configuration, plus partner revenue backfills.","reasoning":"These are account-level integration and billing controls requiring privileged authorization.","risk_type":"credential_admin","severity":"high","title":"API clients and notification/metering configuration are administered","triggering_tools_or_skills":["GetApiClient","ListApiClients","UpdateNotificationConfigInfo","UpdateUsageMeteringConfigInfo","POST__org_orgId_revenue_connection_partner_backfill"]}],"assessment_status":"provisional","auth_and_scopes":"OAuth grants broad Suger marketplace, buyer, entitlement, billing, and partner operations; exact administrator scopes are not stated.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/effb7efc-cbf7-4fe6-b929-126922436d9a.json","what_it_proves":"Candidate PR #125 record identity (name \"Suger\", publisher, type web_connector) and 80 stored tool names (truncated vs Directory); no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/effb7efc-cbf7-4fe6-b929-126922436d9a: complete tool_names inventory (137 tools), remote streamable-http endpoint https://apiv2.suger.cloud/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Suger can publish commercial offers, report billable usage, move credits, notify buyers, and delete marketplace resources.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:effb7efc-cbf7-4fe6-b929-126922436d9a","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 137 names; confirmation, cloud-marketplace propagation, and rollback behavior require runtime verification.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"true","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"true"},"tools_or_skills_reviewed":137,"tools_or_skills_total":137},"name":"Suger","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=effb7efc-cbf7-4fe6-b929-126922436d9a&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.suger.io/privacy/","provisional_risk":null,"publication_recommendation":"accept","publisher":"Suger Inc.","publisher_url":"https://www.suger.io/","remote_url":"https://apiv2.suger.cloud/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: These actions can establish commercial terms, billing usage, credits, or subscription cancellation with direct financial consequences.","evidence":"Marketplace offers, prices, credits, usage, and entitlements can be committed: The listing says users create/update/publish public and private offers, manage credits, subscriptions and usage across AWS, Azure, and GCP marketplaces.","manual_risk_type":"financial_transaction","remediation":{"block_tool_categories":["financial"],"steps":["Set provider-side spending limits and require approval for every financial action.","Use a dedicated low-balance account and review transaction logs."]},"risk_type":"spends_money","severity":"high","title":"Marketplace offers, prices, credits, usage, and entitlements can be committed","triggering_tools":["PublishProduct","CreateOffer","UpdateOfferPrice","AddEntitlementCredit","ReportUsageRecordGroup","ApproveEntitlement","CancelEntitlement"]},{"description":"This connector can permanently remove data or resources. Review findings: Destructive changes can disrupt active sales, billing, or customer entitlements.","evidence":"Products, offers, usage, and wallet records can be deleted or closed: The 137-tool inventory explicitly deletes marketplace products, offers, usage records, entitlement terms, and buyer wallets or closes credit wallets.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Products, offers, usage, and wallet records can be deleted or closed","triggering_tools":["DeleteOffer","DeleteProduct","DeleteUsageRecordGroup","DeleteBuyerWallet","CloseCreditWallet"]},{"description":"This connector can publish or send messages and content using the connected identity. Review findings: These actions contact external buyers, partners, or support staff as the authenticated organization.","evidence":"Offer notifications and partner invitations can be sent: Named tools notify offer recipients, invite Azure partner collaboration, and communicate in support tickets.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Offer notifications and partner invitations can be sent","triggering_tools":["SendOfferNotifications","AzureInvitePartnerCollaboration","CreateSupportTicketComment"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are account-level integration and billing controls requiring privileged authorization.","evidence":"API clients and notification/metering configuration are administered: The inventory exposes API-client records and updates notification and usage-metering configuration, plus partner revenue backfills.","manual_risk_type":"credential_admin","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"high","title":"API clients and notification/metering configuration are administered","triggering_tools":["GetApiClient","ListApiClients","UpdateNotificationConfigInfo","UpdateUsageMeteringConfigInfo","POST__org_orgId_revenue_connection_partner_backfill"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@suger.io","tags":["accesses_calendar","accesses_messaging","deletes_data","modifies_data","network_access","oauth_required","sends_messages_as_you","spends_money","web_connector"],"tools":[{"description":"","name":"AddContactToBuyer"},{"description":"","name":"AddContactToOffer"},{"description":"","name":"AddEntitlementCredit","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: These actions can establish commercial terms, billing usage, credits, or subscription cancellation with direct financial consequences."}},{"description":"","name":"AggregateUsageRecordGroups"},{"description":"","name":"AggregateUsageRecordReports"},{"description":"","name":"ApplyAddonToEntitlement"},{"description":"","name":"ApproveEntitlement","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: These actions can establish commercial terms, billing usage, credits, or subscription cancellation with direct financial consequences."}},{"description":"","name":"AzureInvitePartnerCollaboration","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: These actions contact external buyers, partners, or support staff as the authenticated organization."}},{"description":"","name":"BatchCreateContacts"},{"description":"","name":"BatchCreateCosellReferrals"},{"description":"","name":"BatchReportUsageRecordGroups"},{"description":"","name":"BatchValidateUsageRecordGroups"},{"description":"","name":"CancelEntitlement","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: These actions can establish commercial terms, billing usage, credits, or subscription cancellation with direct financial consequences."}},{"description":"","name":"CancelOffer"},{"description":"","name":"CloseCreditWallet","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Destructive changes can disrupt active sales, billing, or customer entitlements."}},{"description":"","name":"CloseSupportTicket"},{"description":"","name":"CreateBillableMetric"},{"description":"","name":"CreateBuyer"},{"description":"","name":"CreateContact"},{"description":"","name":"CreateCosellReferral"},{"description":"","name":"CreateCreditWallet"},{"description":"","name":"CreateEntitlement"},{"description":"","name":"CreateOffer","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: These actions can establish commercial terms, billing usage, credits, or subscription cancellation with direct financial consequences."}},{"description":"","name":"CreateOfferSet"},{"description":"","name":"CreateOrUpdateDraftOffer"},{"description":"","name":"CreateOrUpdateDraftProduct"},{"description":"","name":"CreateProduct"},{"description":"","name":"CreateSupportTicket"},{"description":"","name":"CreateSupportTicketAttachment"},{"description":"","name":"CreateSupportTicketComment","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: These actions contact external buyers, partners, or support staff as the authenticated organization."}},{"description":"","name":"DeleteBuyerWallet","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Destructive changes can disrupt active sales, billing, or customer entitlements."}},{"description":"","name":"DeleteEntitlementTerm"},{"description":"","name":"DeleteOffer","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Destructive changes can disrupt active sales, billing, or customer entitlements."}},{"description":"","name":"DeleteProduct","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Destructive changes can disrupt active sales, billing, or customer entitlements."}},{"description":"","name":"DeleteUsageRecordGroup","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Destructive changes can disrupt active sales, billing, or customer entitlements."}},{"description":"","name":"DivideEntitlementCommit"},{"description":"","name":"ExtendPrivateOfferExpiryDate"},{"description":"","name":"GET__org_orgId_revenue_connection_partner_health"},{"description":"","name":"GET__org_orgId_revenue_connections"},{"description":"","name":"GET__org_orgId_revenue_dashboard_metrics"},{"description":"","name":"GET__org_orgId_revenue_dashboard_summary"},{"description":"","name":"GET__org_orgId_revenue_record_partner_recordId"},{"description":"","name":"GET__org_orgId_revenue_record_partner_recordId_events"},{"description":"","name":"GET__org_orgId_revenue_records"},{"description":"","name":"GetApiClient","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are account-level integration and billing controls requiring privileged authorization."}},{"description":"","name":"GetBillableMetric"},{"description":"","name":"GetBuyer"},{"description":"","name":"GetContact"},{"description":"","name":"GetCosellDashboard"},{"description":"","name":"GetCosellReferral"},{"description":"","name":"GetEntitlement"},{"description":"","name":"GetEntitlementPdf"},{"description":"","name":"GetEntitlementTerm"},{"description":"","name":"GetNotificationConfigInfo"},{"description":"","name":"GetNotificationMessage"},{"description":"","name":"GetOffer"},{"description":"","name":"GetOfferByExternalId"},{"description":"","name":"GetOfferEula"},{"description":"","name":"GetOfferResellerEula"},{"description":"","name":"GetOfferSet"},{"description":"","name":"GetOperationV2"},{"description":"","name":"GetOrganizationLicensesAndServices"},{"description":"","name":"GetPartnerContacts"},{"description":"","name":"GetProduct"},{"description":"","name":"GetRevenueReport"},{"description":"","name":"GetSupportTicket"},{"description":"","name":"GetUsageMeteringConfigInfo"},{"description":"","name":"ListApiClients","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are account-level integration and billing controls requiring privileged authorization."}},{"description":"","name":"ListBillableMetrics"},{"description":"","name":"ListBuyerWallets"},{"description":"","name":"ListBuyers"},{"description":"","name":"ListContacts"},{"description":"","name":"ListCosellReferrals"},{"description":"","name":"ListDailyRevenueRecords"},{"description":"","name":"ListEntitlementCancellationRequests"},{"description":"","name":"ListEntitlementTerms"},{"description":"","name":"ListEntitlements"},{"description":"","name":"ListNotificationEvents"},{"description":"","name":"ListNotificationEventsByEntity"},{"description":"","name":"ListNotificationMessages"},{"description":"","name":"ListOfferSets"},{"description":"","name":"ListOffers"},{"description":"","name":"ListOperationHistoryV2"},{"description":"","name":"ListOperationsV2"},{"description":"","name":"ListOrganizations"},{"description":"","name":"ListProductMeteringDimensions"},{"description":"","name":"ListProducts"},{"description":"","name":"ListProductsByPartner"},{"description":"","name":"ListRevenueRecordDetails"},{"description":"","name":"ListRevenueRecords"},{"description":"","name":"ListSupportTickets"},{"description":"","name":"ListUsageMeteringDailyRecords"},{"description":"","name":"ListUsageRecordGroups"},{"description":"","name":"ListUsageRecordReports"},{"description":"","name":"POST__org_orgId_revenue_connection_partner_backfill","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are account-level integration and billing controls requiring privileged authorization."}},{"description":"","name":"PublishProduct","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: These actions can establish commercial terms, billing usage, credits, or subscription cancellation with direct financial consequences."}},{"description":"","name":"QueryAuditingEvents"},{"description":"","name":"QueryBuyers"},{"description":"","name":"QueryContacts"},{"description":"","name":"QueryEntitlements"},{"description":"","name":"QueryOffers"},{"description":"","name":"QueryProducts"},{"description":"","name":"RemoveContactFromBuyer"},{"description":"","name":"RemoveContactFromOffer"},{"description":"","name":"ReopenSupportTicket"},{"description":"","name":"ReportUsageRecordGroup","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: These actions can establish commercial terms, billing usage, credits, or subscription cancellation with direct financial consequences."}},{"description":"","name":"RetryUsageRecordGroup"},{"description":"","name":"ScheduleEntitlementCancellation"},{"description":"","name":"SearchKnowledge"},{"description":"","name":"SearchPartnerConnections"},{"description":"","name":"SendOfferNotifications","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: These actions contact external buyers, partners, or support staff as the authenticated organization."}},{"description":"","name":"SetBuyerDefaultWallet"},{"description":"","name":"SyncOffer"},{"description":"","name":"SyncSingleReferral"},{"description":"","name":"UnscheduleEntitlementCancellation"},{"description":"","name":"UpdateBillableMetric"},{"description":"","name":"UpdateBuyer"},{"description":"","name":"UpdateContact"},{"description":"","name":"UpdateContactTags"},{"description":"","name":"UpdateCosellReferral"},{"description":"","name":"UpdateCreditWallet"},{"description":"","name":"UpdateEntitlementMetaInfo"},{"description":"","name":"UpdateEntitlementName"},{"description":"","name":"UpdateEntitlementPriceModel"},{"description":"","name":"UpdateEntitlementSeat"},{"description":"","name":"UpdateNotificationConfigInfo","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are account-level integration and billing controls requiring privileged authorization."}},{"description":"","name":"UpdateOfferMetaInfo"},{"description":"","name":"UpdateOfferPrice","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: These actions can establish commercial terms, billing usage, credits, or subscription cancellation with direct financial consequences."}},{"description":"","name":"UpdateProduct"},{"description":"","name":"UpdateProductFulfillmentUrl"},{"description":"","name":"UpdateProductMetaInfo"},{"description":"","name":"UpdateProductPrice"},{"description":"","name":"UpdateProductPricing"},{"description":"","name":"UpdateSupportTicket"},{"description":"","name":"UpdateUsageMeteringConfigInfo","risk":{"category":"state_change","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are account-level integration and billing controls requiring privileged authorization."}},{"description":"","name":"ValidateReferral"},{"description":"","name":"WithdrawEntitlementCancellationRequest"}],"tools_count":137,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/effb7efc-cbf7-4fe6-b929-126922436d9a","uuid":"e06cc6d6-17db-5d23-984d-1a01737421e2","verification_tier":"community","version":""},"query_key":"suger inc suger","schema_version":1,"status":"match"}