{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-17","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Interactive Connector","confidence":"medium","description":"Manage Superlist tasks and shared lists from Claude. Capture to-dos, set due dates, assign teammates and review Today or Inbox views. Organize, complete or delete work in your live account.","did":"c4b83491-85cb-47b7-a7ac-62be18ab1fb5","documentation_url":"https://help.superlist.com/en/articles/658028-superlist-mcp-server","editorial_description":{"extended_description":"Create tasks from notes or conversations, including recurring work and due dates in your local timezone. Search before updating, move tasks between lists, manage labels and share or unshare lists with collaborators. Changes affect the connected Superlist workspace.","schema_version":1,"summary":"Manage Superlist tasks and shared lists from Claude.\nCapture to-dos, set due dates, assign teammates and review Today or Inbox views.\nOrganize, complete or delete work in your live account."},"homepage_url":"","icon":"","id":"c4b83491-85cb-47b7-a7ac-62be18ab1fb5","installs":0,"last_scanned":"","license":"","long_description":"Create tasks from notes or conversations, including recurring work and due dates in your local timezone. Search before updating, move tasks between lists, manage labels and share or unshare lists with collaborators. Changes affect the connected Superlist workspace.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The tools explicitly delete stored work records.","reasoning":"These are destructive.","risk_type":"data_deletion","severity":"high","title":"Deletes lists and tasks","triggering_tools_or_skills":["delete_list","delete_task"]},{"evidence":"The connector can share a list with another user.","reasoning":"Sharing exposes content/communicates as the user.","risk_type":"messaging_as_user","severity":"high","title":"Shares lists externally","triggering_tools_or_skills":["share_list"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication covers a Superlist workspace; sharing and assignment scopes are undocumented.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/c4b83491-85cb-47b7-a7ac-62be18ab1fb5.json","what_it_proves":"Candidate PR #125 record identity (name \"Superlist\", publisher, type interactive_connector) and 22 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/c4b83491-85cb-47b7-a7ac-62be18ab1fb5: complete tool_names inventory (22 tools), remote streamable-http endpoint https://app.superlist.com/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Superlist deletes tasks/lists and shares or unshares lists with others.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:c4b83491-85cb-47b7-a7ac-62be18ab1fb5","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 22 names; runtime verification should confirm share recipients.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":22,"tools_or_skills_total":22},"name":"Superlist","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=c4b83491-85cb-47b7-a7ac-62be18ab1fb5&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.superlist.com/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Superlist","publisher_url":"https://www.superlist.com/","remote_url":"https://app.superlist.com/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can permanently remove data or resources. Review findings: These are destructive.","evidence":"Deletes lists and tasks: The tools explicitly delete stored work records.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Deletes lists and tasks","triggering_tools":["delete_list","delete_task"]},{"description":"This connector can publish or send messages and content using the connected identity. Review findings: Sharing exposes content/communicates as the user.","evidence":"Shares lists externally: The connector can share a list with another user.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Shares lists externally","triggering_tools":["share_list"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://help.superlist.com","tags":["deletes_data","interactive_connector","network_access","oauth_required","sends_messages_as_you"],"tools":[{"description":"","name":"add_label"},{"description":"","name":"add_list"},{"description":"","name":"add_task"},{"description":"","name":"assign_task"},{"description":"","name":"complete_task"},{"description":"","name":"delete_list","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These are destructive."}},{"description":"","name":"delete_task","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: These are destructive."}},{"description":"","name":"fetch"},{"description":"","name":"get_list"},{"description":"","name":"get_lists"},{"description":"","name":"get_task"},{"description":"","name":"inbox"},{"description":"","name":"move_task"},{"description":"","name":"remove_label"},{"description":"","name":"search"},{"description":"","name":"share_list","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Sharing exposes content/communicates as the user."}},{"description":"","name":"today"},{"description":"","name":"unassign_task"},{"description":"","name":"unshare_list"},{"description":"","name":"update_list"},{"description":"","name":"update_task"},{"description":"","name":"whoami"}],"tools_count":22,"transport":"streamable-http","type":"interactive_connector","url":"https://claude.ai/directory/c4b83491-85cb-47b7-a7ac-62be18ab1fb5","uuid":"085aee1a-9379-532a-bfe9-021e0b4c5400","verification_tier":"community","version":""},"query_key":"superlist superlist","schema_version":1,"status":"match"}