Claude security directory

Craft.io

Published by Craft.io

High risk

Craft.io is a product management platform that gives Claude persistent, structured context about your product - work items, customer feedback, and strategic OKRs - so it can reason about your product from high-level strategy down to granular execution, across every conversation. With the Craft.io MCP server, Claude works with full awareness of your product context: it can query and manage backlog items, draft PRDs grounded in real customer evidence, and prioritize work across workspaces and portfolios - all without leaving your AI workflow. Capabilities include: Backlog management: Create, update, and prioritize work items across all your workspaces, including statuses, priorities, sprints, labels, and custom fields. Specs: Draft PRDs and break them into user stories with full awareness of your feedback, OKRs, and existing work items. Feedback triage: Submit, update and analyze customer feedback to surface feature requests, cluster themes, and connect insights directly to work items. Strategy: Align tactical work with high-level strategy by managing portfolios, initiatives, objectives, and key results. Execution planning: Build data-driven roadmaps, plan sprints against team capacity, and map dependencies between items.

Security assessment

Plutonium assessed this web connector for permissions, capabilities, and security-relevant behavior.

  • Can permanently delete data: This connector can erase records, files, or accounts. Once deleted the data may be unrecoverable - even an accidental request can cause permanent loss.
  • Can change or update your information: This connector can edit, rename, overwrite, or otherwise modify records in the connected service. If a request gets manipulated, your data could be altered without you noticing.
  • Reads your private information: This connector can read data the connected service holds about you - documents, messages, contact lists, source code, customer records, or saved profile details - and pass it back to the AI.
  • Sends your data to outside companies: Anything you share with this connector flows through one or more third-party services. Those companies see, store, and may use the data according to their own policies.

Available capabilities

This add-on exposes 31 tools or capabilities.

  • add_feedback_comment
  • add_item_comment
  • bulk_create_items
  • bulk_manage_feedback_connections
  • bulk_update_feedback_items
  • bulk_update_items
  • create_feedback
  • create_item
  • delete_item
  • get_feedback_item
  • get_item
  • get_portal_categories
  • get_portal_companies
  • get_portal_custom_fields
  • get_portal_forms
  • get_portal_importances
  • get_portfolio_fields
  • get_portfolio_item
  • get_portfolio_terminology
  • get_workspace_custom_fields
  • get_workspace_terminology
  • list_feedback_items
  • list_feedback_portals
  • list_items

The interactive security report will load automatically.