{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-08","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","catalog_reconciliation":{"basis":"Documented actions on the identified catalog surface; not an execution test.","confidence":"medium","evidence_completeness":"partial","previous":{"confidence":"low","detail_sha256":"bb9b41ca3dea6b0ce91ab1dff926c921eb898a580f77619d0e199356b52e5da5","risk":"high"},"proposal_file":"parent-proposals.json","rationale":"High without High; raised Low->High at manual review solely because execute_endpoint's endpoint set is undocumented. The official Google doc (inaccessible to the prior review) was read via text export: it describes Tastewise as an MCP-native food/beverage analytics service over aggregated menus, social, panels and licensed datasets. No user-private data store, sending, payments or admin operations are evidenced. Generic tool names do not establish arbitrary execution. Low, with the endpoint list as the remaining unknown.","review_key":"claudesec:103e891a-c161-4aab-8178-3059aafd8ce9","reviewed_at":"2026-10-12","runtime_verified":false,"sources":["https://docs.google.com/document/d/1xqQVthI69y53F6zpomQDN1LJNcvjeAZ9QZ3NWmkaOXo/export?format=txt","https://api.anthropic.com/api/directory/servers (snapshot claude-directory-all-tiers-2026-09-22.json)"],"status":"resolved"},"category":"Web Connector","confidence":"low","description":"Research food and beverage trends using Tastewise in Claude. Explore ingredients, dishes, consumer motivations and regional market differences. Use findings from menus, recipes, social content and research to inform product or marketing work.","did":"103e891a-c161-4aab-8178-3059aafd8ce9","documentation_url":"https://docs.google.com/document/d/1xqQVthI69y53F6zpomQDN1LJNcvjeAZ9QZ3NWmkaOXo/edit?usp=sharing","editorial_description":{"extended_description":"The connector discovers and queries Tastewise endpoints through an active account. Its described data includes U.S., U.K. and other available markets. Coverage and results depend on the connected platform rather than every possible food-trend question.","schema_version":1,"summary":"Research food and beverage trends using Tastewise in Claude.\nExplore ingredients, dishes, consumer motivations and regional market differences.\nUse findings from menus, recipes, social content and research to inform product or marketing work."},"homepage_url":"","icon":"https://tastewise-public-bucket.s3.eu-central-1.amazonaws.com/TW+icon.png","id":"103e891a-c161-4aab-8178-3059aafd8ce9","installs":0,"last_scanned":"","license":"","long_description":"The connector discovers and queries Tastewise endpoints through an active account. Its described data includes U.S., U.K. and other available markets. Coverage and results depend on the connected platform rather than every possible food-trend question.","manual_assessment":"unassessed","manual_review":{"all_findings":[{"evidence":"The inventory exposes endpoint discovery plus execute_endpoint, but provides neither the endpoint list nor action schemas.","reasoning":"Capabilities are loaded dynamically and cannot be bounded from names alone.","risk_type":"generic_gateway","severity":"low","title":"Discovers and executes unspecified endpoints","triggering_tools_or_skills":["execute_endpoint","find_endpoints","get_endpoint_detail","get_endpoints"]},{"evidence":"The listing says results draw from millions of restaurant menus, recipes and social posts.","reasoning":"External text returned into the model can contain adversarial content.","risk_type":"prompt_injection_exposure","severity":"low","title":"Food intelligence incorporates external web and social content","triggering_tools_or_skills":["execute_endpoint","fetch","search"]},{"evidence":"The supplied official Google document could not be opened by the documentation fetcher, leaving execute_endpoint and fetch semantics unresolved.","reasoning":"Without endpoint definitions or schemas, Medium and High capabilities cannot be excluded.","risk_type":"evidence_gap","severity":"low","title":"Official connector documentation was unavailable","triggering_tools_or_skills":["execute_endpoint","fetch"]}],"assessment_status":"provisional","auth_and_scopes":"An active Tastewise account is required, but the allowed endpoint catalogue, execute_endpoint input constraints and account scopes are not available.","blocked_missing_evidence":"An official list of every endpoint reachable by execute_endpoint and fetch, including methods, input schemas, side effects, pricing effects and authorization scopes.","confidence":"low","displayed_risk":"high","evidence_completeness":"insufficient","manual_overall_risk":"unassessed","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/103e891a-c161-4aab-8178-3059aafd8ce9.json","what_it_proves":"Candidate PR #125 record identity (name \"Tastewise\", publisher, type web_connector) and 6 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/103e891a-c161-4aab-8178-3059aafd8ce9: complete tool_names inventory (6 tools), remote streamable-http endpoint https://ai-gateway.tastewise.io/mcp/mcp/v2, auth_posture auth_required, directory tier community"}],"primary_reason":"Dynamic endpoint discovery and execution hide the connector's reachable action set, so a conservative High ceiling remains.","provisional_risk":"high","publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:103e891a-c161-4aab-8178-3059aafd8ce9","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 6 names. The official Google Docs URL was attempted but inaccessible and is not cited; the marketing description emphasizes analysis but cannot prove every discovered endpoint is read-only.","risk_domains":{"arbitrary_network_access":"unknown","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"unknown","deletes_data":"unknown","deployment_or_infrastructure":"unknown","dynamic_hidden_actions":"true","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"unknown","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"unknown","sends_messages_as_user":"unknown","spends_or_moves_money":"unknown"},"tools_or_skills_reviewed":6,"tools_or_skills_total":6},"name":"Tastewise","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=103e891a-c161-4aab-8178-3059aafd8ce9&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://tastewise.io/privacy-policy","provisional_risk":"high","publication_recommendation":"fix","publisher":"Tastewise","publisher_url":"https://tastewise.io/","remote_url":"https://ai-gateway.tastewise.io/mcp/mcp/v2","repository_url":"","risk":"low","risk_severity":"low","security_risks":[{"description":"Tastewise searches and analyzes aggregated menus, social trends and licensed market datasets. The execute_endpoint tool calls the analytics API; it is not a host command runner.","evidence":"https://docs.google.com/document/d/1xqQVthI69y53F6zpomQDN1LJNcvjeAZ9QZ3NWmkaOXo (txt export)\nMCP-native; endpoint ai-gateway.tastewise.io/mcp; data foundation: menus, social, consumer panels, licensed datasets\n\nhttps://api.anthropic.com/api/directory/servers (snapshot claude-directory-all-tiers-2026-09-22.json)\ntool_names","risk_type":"reads_public_data","severity":"low","title":"Queries food and beverage market intelligence"}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@tastewise.io ","tags":["reads_public_data"],"tools":[{"description":"","name":"execute_endpoint"},{"description":"","name":"fetch"},{"description":"","name":"find_endpoints"},{"description":"","name":"get_endpoint_detail"},{"description":"","name":"get_endpoints"},{"description":"","name":"search"}],"tools_count":6,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/103e891a-c161-4aab-8178-3059aafd8ce9","uuid":"46ee70e7-3f1e-59f7-801d-988c7c3975e1","verification_tier":"community","version":""},"query_key":"tastewise","schema_version":1,"status":"match"}