{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-18","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"TandemFit gives Claude read-only access to your training records. Review workouts, exercise progress, personal records, programs, and saved templates. Nutrition is off by default and requires separate consent; the connector cannot edit training, meals, or account settings.","did":"5765b41b-20e0-4315-bd15-04d844d680a8","documentation_url":"https://tandemfit.app/features/ai-connectors","editorial_description":{"extended_description":"A TandemFit account must be created in the mobile app. Results use UTC dates, bounded date ranges, and pagination. The source describes optional access to logged meals, nutrition totals, and targets when granted; disconnection is available in Connected AI apps.","schema_version":1,"summary":"TandemFit gives Claude read-only access to your training records.\nReview workouts, exercise progress, personal records, programs, and saved templates.\nNutrition is off by default and requires separate consent; the connector cannot edit training, meals, or account settings."},"homepage_url":"","icon":"","id":"5765b41b-20e0-4315-bd15-04d844d680a8","installs":0,"last_scanned":"","license":"","long_description":"A TandemFit account must be created in the mobile app. Results use UTC dates, bounded date ranges, and pagination. The source describes optional access to logged meals, nutrition totals, and targets when granted; disconnection is available in Connected AI apps.","manual_assessment":"low","manual_review":{"all_findings":[{"evidence":"Complete inventory consists only of get/list actions and description says read-only.","reasoning":"Private health/fitness reads are Low.","risk_type":"private_data_read","severity":"low","title":"Reads workout and personal-record history","triggering_tools_or_skills":["get_training_summary","get_workout","get_personal_records"]},{"evidence":"Remote hosted implementation is unpinned.","reasoning":"Runtime capability may drift.","risk_type":"provenance_uncertainty","severity":"low","title":"Hosted implementation is mutable","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"OAuth/account authorization required; exact scopes are not documented.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"low","evidence_completeness":"partial","manual_overall_risk":"low","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/5765b41b-20e0-4315-bd15-04d844d680a8.json","what_it_proves":"Candidate PR #125 record identity (name \"TandemFit\", publisher, type web_connector) and 8 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/5765b41b-20e0-4315-bd15-04d844d680a8: complete tool_names inventory (8 tools), remote streamable-http endpoint https://api.tandemfit.app/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"TandemFit exposes only read-only personal training records.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:5765b41b-20e0-4315-bd15-04d844d680a8","reviewed_at":"2026-10-10","reviewer_notes":"All declared tool names were reviewed; schemas were unavailable.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"false","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":8,"tools_or_skills_total":8},"name":"TandemFit","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=5765b41b-20e0-4315-bd15-04d844d680a8&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://tandemfit.app/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"TandemFit","publisher_url":"https://tandemfit.app/","remote_url":"https://api.tandemfit.app/mcp","repository_url":"","risk":"low","risk_severity":"low","security_risks":[{"description":"This connector can read information available to the connected account and return it to the AI. Review findings: Private health/fitness reads are Low.","evidence":"Reads workout and personal-record history: Complete inventory consists only of get/list actions and description says read-only.","manual_risk_type":"private_data_read","remediation":{"block_tool_categories":["data_exfiltration"],"steps":["Use a least-privilege account limited to the information required by the workflow.","Restrict folders, projects, tenants, and other data scopes wherever the provider allows it.","Review access logs for unexpected reads or bulk retrieval."]},"risk_type":"reads_private_data","severity":"low","title":"Reads workout and personal-record history","triggering_tools":["get_training_summary","get_workout","get_personal_records"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://tandemfit.app/support","tags":["network_access","oauth_required","reads_private_data","web_connector"],"tools":[{"description":"","name":"get_current_program"},{"description":"","name":"get_personal_records"},{"description":"","name":"get_training_progress"},{"description":"","name":"get_training_summary"},{"description":"","name":"get_workout"},{"description":"","name":"get_workout_template"},{"description":"","name":"list_workout_templates"},{"description":"","name":"list_workouts"}],"tools_count":8,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/5765b41b-20e0-4315-bd15-04d844d680a8","uuid":"a54a206d-2cc3-5455-9da9-488a86e56043","verification_tier":"community","version":""},"query_key":"tandemfit","schema_version":1,"status":"match"}