{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-20","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Investigate radar-detected hail and wind events in the continental U.S. Use Swath API to map footprints and inspect potentially exposed properties. Create territory alerts and check your account's remaining credits.","did":"08dd3a2d-07a0-4872-a534-8bdc4b39d970","documentation_url":"https://swathapi.com/docs","editorial_description":{"extended_description":"Property reports include radar-derived hail information, exposure scores, building age, estimated roof age, occupancy status and assessed value. The source excludes homeowner names and contact information. Data is based on detected events rather than forecasts; it does not itself confirm physical damage at an individual property. An account is required.","schema_version":1,"summary":"Investigate radar-detected hail and wind events in the continental U.S.\nUse Swath API to map footprints and inspect potentially exposed properties.\nCreate territory alerts and check your account's remaining credits."},"homepage_url":"","icon":"https://swathapi.com/assets/icon-512.png","id":"08dd3a2d-07a0-4872-a534-8bdc4b39d970","installs":0,"last_scanned":"","license":"","long_description":"Property reports include radar-derived hail information, exposure scores, building age, estimated roof age, occupancy status and assessed value. The source excludes homeowner names and contact information. Data is based on detected events rather than forecasts; it does not itself confirm physical damage at an individual property. An account is required.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The Directory description says created standing watches send email alerts and signed webhooks when storms are verified.","reasoning":"Creating a monitor schedules future external communications under the account.","risk_type":"messaging_as_user","severity":"high","title":"Storm monitors trigger email and webhook alerts","triggering_tools_or_skills":["create_monitor"]},{"evidence":"The product description states the free tier includes 100 monthly credits and paid plans increase allowances.","reasoning":"Data calls can irreversibly deplete a limited account balance with monetary value.","risk_type":"financial_transaction","severity":"high","title":"Calls consume metered credits","triggering_tools_or_skills":["find_storms","get_swath_report","lookup_property","show_swath_map"]},{"evidence":"The tool creates a standing territory monitor stored in the user's account.","reasoning":"It persistently changes alert configuration.","risk_type":"data_modification","severity":"medium","title":"Persistent monitoring watches can be created","triggering_tools_or_skills":["create_monitor"]},{"evidence":"Standing watches can deliver signed callbacks to configured webhook destinations.","reasoning":"Webhook URLs require validation to prevent arbitrary or internal network targeting.","risk_type":"arbitrary_network_access","severity":"low","title":"Signed webhooks target external endpoints","triggering_tools_or_skills":["create_monitor"]}],"assessment_status":"provisional","auth_and_scopes":"Email sign-in to a Swath API account; property, monitor, webhook, email-alert, and credit scopes are not documented in the packet.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/08dd3a2d-07a0-4872-a534-8bdc4b39d970.json","what_it_proves":"Candidate PR #125 record identity (name \"Swath API\", publisher, type web_connector) and 7 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/08dd3a2d-07a0-4872-a534-8bdc4b39d970: complete tool_names inventory (7 tools), remote streamable-http endpoint https://swathapi.com/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Monitor creation sends future alerts and data operations consume limited credits.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:08dd3a2d-07a0-4872-a534-8bdc4b39d970","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all seven names. Runtime checks should verify credit cost per tool, webhook URL controls, recipient confirmation, monitor deletion path, and property-data authorization.","risk_domains":{"arbitrary_network_access":"true","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"true"},"tools_or_skills_reviewed":7,"tools_or_skills_total":7},"name":"Swath API","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=08dd3a2d-07a0-4872-a534-8bdc4b39d970&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://swathapi.com/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"VIBECODEBEAST","publisher_url":"https://vibecodebeast.ai/","remote_url":"https://swathapi.com/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: Creating a monitor schedules future external communications under the account.","evidence":"Storm monitors trigger email and webhook alerts: The Directory description says created standing watches send email alerts and signed webhooks when storms are verified.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Storm monitors trigger email and webhook alerts","triggering_tools":["create_monitor"]},{"description":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Data calls can irreversibly deplete a limited account balance with monetary value.","evidence":"Calls consume metered credits: The product description states the free tier includes 100 monthly credits and paid plans increase allowances.","manual_risk_type":"financial_transaction","remediation":{"block_tool_categories":["financial"],"steps":["Set provider-side spending limits and require approval for every financial action.","Use a dedicated low-balance account and review transaction logs."]},"risk_type":"spends_money","severity":"high","title":"Calls consume metered credits","triggering_tools":["find_storms","get_swath_report","lookup_property","show_swath_map"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: It persistently changes alert configuration.","evidence":"Persistent monitoring watches can be created: The tool creates a standing territory monitor stored in the user's account.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Persistent monitoring watches can be created","triggering_tools":["create_monitor"]},{"description":"This connector can send caller-provided data to an external service or publisher. Review findings: Webhook URLs require validation to prevent arbitrary or internal network targeting.","evidence":"Signed webhooks target external endpoints: Standing watches can deliver signed callbacks to configured webhook destinations.","manual_risk_type":"arbitrary_network_access","remediation":{"block_tool_categories":["sends_externally"],"steps":["Do not include secrets, regulated data, or customer information unless the destination is approved.","Review the recipient's retention and deletion policy before enabling the connector."]},"risk_type":"forwards_data_to_third_party","severity":"low","title":"Signed webhooks target external endpoints","triggering_tools":["create_monitor"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"build@vibecodebeast.com","tags":["forwards_data_to_third_party","modifies_data","network_access","oauth_required","sends_messages_as_you","spends_money","web_connector"],"tools":[{"description":"","name":"create_monitor","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Creating a monitor schedules future external communications under the account."}},{"description":"","name":"find_storms","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Data calls can irreversibly deplete a limited account balance with monetary value."}},{"description":"","name":"get_swath_report","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Data calls can irreversibly deplete a limited account balance with monetary value."}},{"description":"","name":"get_usage"},{"description":"","name":"list_monitors"},{"description":"","name":"lookup_property","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Data calls can irreversibly deplete a limited account balance with monetary value."}},{"description":"","name":"show_swath_map","risk":{"category":"financial","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can spend money, consume paid credits, or change financially consequential resources. Review findings: Data calls can irreversibly deplete a limited account balance with monetary value."}}],"tools_count":7,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/08dd3a2d-07a0-4872-a534-8bdc4b39d970","uuid":"0306cf2f-e2d7-51f0-9033-e3c782656a02","verification_tier":"community","version":""},"query_key":"swath api","schema_version":1,"status":"match"}