Community Gmail server with auto-auth: search, read and send email via MCP.
Nothing to run from here
Conecto Newsletters is installed from its publisher's own source and answers where it runs, so this marketplace is not in the path of a single call. There is no address here to send one to, and a panel that pretended otherwise would be showing you an answer we made up. Install it and call it from your own client — the Installation tab has the entry for each one.
93/100
tool-list score
43
tools declared
remote
at its publisher
—
calls last 7d
What it does
Newsletters with double opt-in, an archive and click counts. Pay per action.
Quickstart
# 1 — add it to Claude Code
claude mcp add --scope user --transport http conecto-newsletters-mcp https://api.conecto.chat/mcp/newsletters
# 2 — ask your agent for something these tools do
# newsletters_connect_service, newsletters_remove_service, newsletters_create and 40 more
Its address takes API_KEY (Your Conecto key, sent as Bearer conecto_sk_... One POST to https://api.conecto.chat/v1/signup returns a key with $1 of free credit. Chat apps that sign in…) in the Authorization header: add it to the entry your client keeps for it.
Conecto Newsletters costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.
Publishernot claimed
COAll 11 servers
conecto11 servers
7 categories
Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.
Installation
Where are you running it?
Every route below installs the same thing and ends at the same approval screen. Nothing here runs on your machine and nothing runs on ours: this server answers at its publisher’s own address, and what you install is the connection straight to it.
Claude Codedeclared by this listing
This is a public server: it answers at its publisher’s own address and this marketplace is not in the path. Claude Code registers it in one command; --scope user makes it available in every project. The transport below is http, as the publisher's own manifest declares it. Its publisher asks you to sign in with OAuth: run /mcp in Claude Code and pick this server, and it opens a browser for that once.
claude mcp add --scope user --transport http conecto-newsletters-mcp https://api.conecto.chat/mcp/newslettersReconnect, or start a new session, and the tools appear in the model’s tool list.
Free on mcprush, and it answers at its publisher’s own address: this marketplace is not in the path, so there is no key of ours to hold and no card to add — the only sign-in is its publisher’s own, with OAuth.
What it asks of you
It reaches a system of yours, so it needs your own credential rather than the publisher’s: Authorization header — Your Conecto key, sent as Bearer conecto_sk_... One POST to https://api.conecto.chat/v1/signup returns a key with $1 of free credit. Chat apps that sign in with OAuth add https://api.conecto.chat/v1/mcp instead: one connection for every area.. You set it in your own client’s config, on your machine — this marketplace never holds it.
What it writes
One config entry pointing straight at the publisher’s own address — this marketplace is not in the path, and nothing from this listing executes on your machine.
What you approve
43 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.
Tool surface
What the model actually sees. Descriptions are diffed on every release — see version history.
Newsletters go out through the business's own email service, from an address on its own domain: any service that takes mail over SMTP, such as Brevo, Amazon SES, Mailgun, Postmark, SendGrid, Mailchimp Transactional or the web host. Give its SMTP server, login and the from address. Called without password, it answers with a link for the owner, who types the SMTP password or key on a Conecto page, s
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | The SMTP server, e.g. smtp-relay.brevo.com or email-smtp.eu-west-1.amazonaws.com. |
| port | integer | no | 587 (STARTTLS) or 465 (SSL/TLS). Port 25 is blocked on Conecto's servers. |
| security | string | no | starttls or ssl. Left out: ssl on port 465, starttls otherwise. |
| username | string | yes | The SMTP login (for Brevo the SMTP login, for SendGrid "apikey"). |
| password | string | no | The SMTP password or key (for Brevo an SMTP key, not the account password). Leave it out to get the link instead. |
| from_email | string | yes | The address issues come from, on a domain the service lets the business send from, e.g. news@halversoncycle.com. |
| per_day | integer | no | The service's own daily limit, if it has one (Brevo's free plan: 300). Issues then go out over several days. |
| test_to | string | no | Also send a short test email to this address. |
Forget the business's email service and its password. Until another is connected, newsletters take no sign-ups, send no invitations, and issues going out wait. Free.
No parameter schema on file.
A newsletter people join on its own page (cncto.co/n/<name>) by confirming their address, like Buttondown or listmonk. Issues go out through the business's own email service (connect it first with newsletters_connect_service); every issue carries postal_address (the law in the US and the EU asks for one) and a one-click unsubscribe. Free. Free.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| name | string | yes | e.g. "Halverson Ride Notes". |
| postal_address | string | yes | The business's postal address, shown at the foot of every issue. |
| description | string | no | One or two lines on its page: what it is and how often it comes. |
| public_archive | boolean | no | Show past issues on its page. |
Rename it, or change its description, postal address or archive. Give only what changes. Free.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| newsletter | string | yes | The newsletter's slug (from newsletters_list) or its exact name. |
| name | string | no | — |
| postal_address | string | no | — |
| description | string | no | — |
| public_archive | boolean | no | — |
This account's newsletters with their pages and subscriber counts, and the email service they go out through. Free.
No parameter schema on file.
Email each person a request to confirm their subscription: only those who press Confirm ever get an issue. For people who asked to hear from the business. Skips anyone already in, invited in the last day, unsubscribed or undeliverable. At most 20 invitations a day per account. Free: they go out through the business's own email service. Free.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| newsletter | string | yes | The newsletter's slug (from newsletters_list) or its exact name. |
| people | array | yes | — |
| how_they_asked | string | yes | How these people asked to hear from the business, like "they signed up at the counter" or "they asked for it by email". The invitations are checked first: people who never asked are cold outreach, and |
Who is on a newsletter, newest first: active (confirmed), pending (not yet confirmed), unsubscribed, bounced or complained. Free.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| newsletter | string | yes | The newsletter's slug (from newsletters_list) or its exact name. |
| status | string | no | — |
| query | string | no | — |
| limit | integer | no | — |
| offset | integer | no | — |
Delete someone from a newsletter for good, with their history (for example when they ask to be forgotten). To only stop their issues, they unsubscribe themselves. Free.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| newsletter | string | yes | The newsletter's slug (from newsletters_list) or its exact name. |
| string | yes | — |
A draft issue in Markdown. Look at it with newsletters_send_test, then send it with newsletters_send_issue. Free.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| newsletter | string | yes | The newsletter's slug (from newsletters_list) or its exact name. |
| subject | string | yes | — |
| body | string | yes | Markdown: headings, lists, links, bold, quotes, tables and https images. |
| preheader | string | no | The line mail apps show after the subject. |
Change a draft's subject, body or preheader. Give only what changes. Free.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| issue_id | string | yes | The issue_id newsletters_write_issue returned. |
| subject | string | no | — |
| body | string | no | Markdown: headings, lists, links, bold, quotes, tables and https images. |
| preheader | string | no | — |
Email an issue as subscribers will see it to up to 5 addresses (the owner, a colleague), with "[Test]" before the subject, through the business's own email service. Links are not counted and nothing is numbered. Free.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| issue_id | string | yes | The issue_id newsletters_write_issue returned. |
| to | array | yes | — |
Send a draft to everyone who confirmed, now or at send_at, through the business's own email service. It goes out in batches, within the service's daily limit when one is set; newsletters_get_issue shows how far it got. It is checked first: one that looks like cold outreach isn't sent. Free. Free.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| issue_id | string | yes | The issue_id newsletters_write_issue returned. |
| send_at | string | no | When, as ISO 8601 with a time zone, e.g. 2026-10-20T09:00:00+02:00. Now if left out. |
Stop a scheduled issue, or one still going out. Whatever went out already stays sent. Free.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| issue_id | string | yes | The issue_id newsletters_write_issue returned. |
One issue: its text, where it stands (with what holds it up, if anything), and once sent how many it reached, bounced, unsubscribed and clicked, link by link. Free.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| issue_id | string | yes | The issue_id newsletters_write_issue returned. |
A newsletter's issues, newest first. Free.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| newsletter | string | yes | The newsletter's slug (from newsletters_list) or its exact name. |
| status | string | no | — |
The account balance, how much of it is credit bought (AI visibility and the phone run only on that) and how much free and bonus credit, what running calls are holding, this key's daily budget, the auto-reload state, and how much of this month's free reads and downloads is used. Free.
No parameter schema on file.
One call by id: its status (queued, running, succeeded, failed), cost and result. Use it to poll a background call until it finishes. Free.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| call_id | string | yes | — |
Recent calls on this account, newest first, optionally only failed or succeeded ones, or one area's. Free.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| status | string | no | — |
| area | string | no | — |
| limit | integer | no | — |
Refund a top-up paid in the last 24 hours that none of has been used yet: its credit, with the first top-up's bonus, leaves the balance, and the card gets the credit back with its tax. The service fee is kept. Without topup_id, the newest top-up (GET /v1/topups lists them with their ids). Free. Free.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| topup_id | integer | no | — |
When the account was made without the owner's email: send that person a link to confirm they own it. Once they confirm, the owner gets the account's warnings and approval requests, and only the owner raises limits. Nothing changes until they open the link. Free. Free.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| string | yes | — |
A link that signs the business owner into their Conecto page, with no password: the balance, adding credit, auto-reload, limits, what the bots did, people, rentals and keys. page opens it where the owner is needed, like people for a role only the owner gives, or settings for joining by email domain. It works once, within 30 minutes; hand it to the owner. Free.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| page | string | no | — |
A one-time link to a page showing one area as it is when the page opens, for when the person you work for asks to see it themselves: a recruiter looks at the applicants, a bookkeeper at what is due. Do the work and answer with the area's own tools first; a link never replaces that. When an answer would be a long list they would rather look through, offer a link and make it once they say yes. The p
| Parameter | Type | Required | Notes |
|---|---|---|---|
| area | string | yes | — |
The limits a business can ask Conecto to raise (calls a minute, new email addresses a day, phone numbers and more): each one's standard and current value and the most that can be asked for, and the business's requests with their answers. Free.
No parameter schema on file.
Ask Conecto to raise one of the business's limits: which one (or other, saying which), the number it needs, and why, in 40 to 2,000 characters. Conecto reviews it and approves (maybe with less) or declines; the answer comes as the account.limit_request_answered event and by email to the owner, who is also told now. For an account that has topped up; one request per limit at a time, five in 30 days
| Parameter | Type | Required | Notes |
|---|---|---|---|
| limit | string | yes | The limit, as account_get_limits names it, or other. |
| amount | integer | yes | The number the business needs, in the limit's unit (5000 calls a minute). |
| reason | string | yes | What the business does that needs it, and why the current limit is too low. |
| other | string | no | With limit other: which limit, like "rows in one table". |
What happened in this account that someone outside the bot did, oldest first: applications, bookings, form responses, signatures, replies, emails received, goals reached on the website; and the custom events bots sent with account_emit_event. Kept 30 days. Poll with after = the last event_id you saw. Free.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| after | integer | no | Only events after this event_id. |
| kinds | array | no | Event names or areas ("hiring.*"); all when left out. |
| limit | integer | no | — |
Send an event you name, custom.<name> (custom.lead_qualified, custom.order_shipped), to every channel subscribed to it (notify_subscribe with "custom.*" or its name: Slack, Teams, a webhook to Zapier, Make, n8n or the business's own systems) and to account_events, where another team's bot can pick it up. data is any JSON object (up to 10 KB); sent_by is added with this bot's name and team. $0.005
| Parameter | Type | Required | Notes |
|---|---|---|---|
| kind | string | yes | custom. and a name of lowercase letters, digits, dots, dashes and _. |
| title | string | yes | — |
| text | string | no | — |
| data | object | no | — |
| link | string | no | — |
One search over what this account holds: what its files say (PDFs, Word, Excel, PowerPoint, text), table rows, help center articles, CRM contacts, companies and deals, emails, tickets, quotes and invoices, book entries, stock items and project tasks. Every word must appear (any case); titles rank first, then the newest. Each result says which tool opens it. Narrow it with areas. Free.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| query | string | yes | — |
| areas | array | no | — |
| limit | integer | no | — |
The name, logo, colour and footer line the business's emails and published pages carry. Free.
No parameter schema on file.
The business's name as the sender, its logo (a PNG, JPEG, WebP or GIF from the file store), its colour and a footer line (an address, a legal line), on every email to its customers (bookings, applications, tests, signatures, invoices, newsletters, replies) and on its published pages (forms, booking, careers, newsletters, status, views). Only what you pass changes; an empty string clears it. Mail f
| Parameter | Type | Required | Notes |
|---|---|---|---|
| sender_name | string | no | — |
| logo_file_id | string | no | — |
| remove_logo | boolean | no | — |
| colour | string | no | Hex, like #1a73e8; empty for none. |
| footer | string | no | — |
Every email Conecto sends to the business's customers (bookings, applications, interviews, tests, signatures, invoices and quotes, newsletter sign-ups), with when it goes out and its subject, headline and opening words as they are now, and the {variables} each can use. Free.
No parameter schema on file.
Change an email's subject, headline or opening words in the business's own voice, with {variables} from account_list_email_templates (like {name} or {when}). The facts under them (times, places, amounts, links and buttons) stay as they are. Only what you pass changes; an empty string brings back the original words. Plain text; a blank line starts a new paragraph. Costs $0.001 per call; nothing if
| Parameter | Type | Required | Notes |
|---|---|---|---|
| string | yes | Like booking_booked or invoice_sent. | |
| subject | string | no | — |
| headline | string | no | — |
| opening | string | no | — |
Everything this account holds, in ZIP files of up to 24 MB saved to its file store: every record of every area as JSON Lines, and the stored files themselves, with a README saying what is where. Credentials are left out. Runs in the background: poll the call with account_get_call; the result has a download link for each part. The parts open only for this key and for the owner's and admins' own key
No parameter schema on file.
The account's admin and security actions, newest first: keys made and revoked, limits and auto-reload, the owner's sign-ins, connectors, exports, vault reads and writes, credentials set and everything deleted. Ordinary work is in the call log (account_list_calls). verify: true also checks the hash chain, which breaks where an entry was changed or removed. Free.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| action | string | no | Only actions starting with this, like "key." or "tool.vault_". |
| since | string | no | — |
| limit | integer | no | — |
| verify | boolean | no | — |
A department, location or project group of the account, like Support, Finance or the Hamburg shop. Its keys (POST /v1/keys with "team") can only work in its areas, only read when read_only is on, and spend against its budget (monthly_budget_usd per budget_period: a month, a fiscal quarter or year, or a project total): a hard budget refuses the call that would pass it, a soft one only warns. At ale
| Parameter | Type | Required | Notes |
|---|---|---|---|
| name | string | yes | — |
| new_name | string | no | Renames the team; its keys, spend and budget stay with it. |
| areas | array/null | no | The areas its keys may work in (account tools always); null for every area. |
| read_only | boolean | no | Its keys only read, and get links that act for whoever opens them as "[redacted]". |
| monthly_budget_usd | number/null | no | null counts the spend without a cap. |
| budget | string | no | hard refuses calls past the budget; soft only warns. |
| alert_percent | integer | no | — |
| erp_code | string/null | no | — |
| drafts_only | boolean | no | Every write of its keys waits for a person, and they get links that act for whoever opens them as "[redacted]". |
| mailboxes | array/null | no | The Microsoft 365 or Google mailboxes its keys may act as; null for every mailbox the connection lists. |
| budget_period | string | no | What the budget is for: a month, a quarter or a year of the account's fiscal calendar, or a project total until budget_ends_on. |
| budget_ends_on | string/null | no | The last day of a project budget, like 2026-12-31. |
| sees_sensitive | boolean | no | false hides suppliers' bank details and HR notes and contracts from its keys; only the owner turns it on. |
The account's teams, the company-wide one first: each with its areas, whether it only reads, its budget (hard or soft, and its period) and alert line, this period's spend, its ERP code, whether it is paused, its keys, and its people with who manages it. A person's own assistant works within their teams. Free.
No parameter schema on file.
Stops every key of a team at once, this one too if it is the team's: their calls are refused until the owner starts the team again on their account page. For a bot that misbehaves or a team that spends too fast. Free. Free.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| team | string | yes | — |
Move a form, a meeting type, a job, an inbox, a phone number, a newsletter, the website chat, a rental, a pipeline, a table or a website to a team. What happens through it is charged to that team from now on (a form's responses, a number's calls, an inbox's tickets), and its rental moves with it. Something a bot makes already belongs to the bot's team. Only a key of the company-wide team without l
| Parameter | Type | Required | Notes |
|---|---|---|---|
| kind | string | yes | — |
| id | string | no | Its id, slug, name, address or number; not needed for the chat. |
| team | string | yes | — |
Make a tool wait for a person: every call of it, those whose argument is over a number (like invoices_create_credit_note when amount is over 500), or those whose argument is one of some values (like connect_call when method is POST, PUT, PATCH or DELETE). A held call answers approval_required with an approval_id and asks the approver; when they approve, call again with the same arguments, once (a
| Parameter | Type | Required | Notes |
|---|---|---|---|
| tool | string | yes | — |
| argument | string | no | An argument of the tool (or total, for purchasing_create_bill). |
| over | number | no | Calls with argument over this are held. |
| values | array | no | Calls with argument equal to one of these (any case) are held. |
| approver_email | string | no | — |
| approver_channel | string | no | A saved notify channel. |
| approver_team | string | no | A team (account_list_teams). |
| approvers | string | no | Who in approver_team approves. |
| two_people_over | number | no | Calls whose argument is over this need two people; higher than over. |
The tools that wait for a person's approval, with their thresholds and approvers. Free.
No parameter schema on file.
Every record this account holds about one person, by their email address or phone number, across every area: CRM, chats, emails, tickets, forms, bookings, calls, applications, invoices, orders, newsletters, HR and the call log, with their chats and CRM history. For a person who asks what the business keeps about them (GDPR Art. 15). Shows each kind with its count and ids; account_export_person giv
| Parameter | Type | Required | Notes |
|---|---|---|---|
| string | no | The person's email address. | |
| phone | string | no | Their phone number in international format, like +1 503 555 0145. |
Everything account_find_person finds about one person in one ZIP in the file store: their records as JSON Lines (credentials left out) and the files those records point to, like a CV. Give the person the download link when they ask for a copy of their data (GDPR Art. 15 and 20), once you know it is them. The ZIP opens only for this key and for the owner's and admins' own keys that neither only rea
| Parameter | Type | Required | Notes |
|---|---|---|---|
| string | no | The person's email address. | |
| phone | string | no | Their phone number in international format, like +1 503 555 0145. |
Erases one person across every area when they ask (GDPR Art. 17), once you know it is them (they wrote from that address, or confirmed it). Their CRM contact, chat visitor, past meetings and calls are anonymised, so deals stay without them, and a meeting they were only a guest at drops them; their chats, CRM history, form and routing form answers, job applications with the CV, newsletter subscript
| Parameter | Type | Required | Notes |
|---|---|---|---|
| string | no | The person's email address. | |
| phone | string | no | Their phone number in international format, like +1 503 555 0145. |
| correspondence | boolean | no | Also delete their emails and tickets, when no law requires keeping them. |
Where each area's data is stored and processed: the company that runs each place, the country or region, and what it holds. Every area keeps its records in the database and runs on Conecto's servers; some also use a service named here (email, phone, PDFs, search). For the business's records of processing and its transfer assessments (GDPR Art. 30 and 44). Free.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| areas | array | no | Areas to show, like ["email", "phone"]; all when left out. |
Free
$0 forever
- Every tool — any call limit is its publisher’s, not ours
- No card, and mcprush charges nothing for it
- Runs at its publisher’s own address — this marketplace is not in the path
- Nothing to cap, because mcprush bills nothing
What counts against your monthly calls
| Tool | Unit | Calls used | Out of the allowance |
|---|
Nothing here is billable: mcprush charges nothing to install Conecto Newsletters or to call it, at any volume.
Call allowance · this installenforced at the gateway
Monthly allowance, in calls
—
—
Alert at 80% · then the tool returns a normal MCP error
Used this month: —
ATool-list grade · score 93 / 100
Release 1.0.0 · scanned 3 Nov 2026
Graded from the tools this server lists, not from its source code.
Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.
Threat score100
Client score93
Findings0 threat · 2 capability
Capabilitymoderate
Coveragemanifest
Verificationnot in this report
Surface digest22d1097455d386791e4e7852eea5b619101698a8b477522f087b1896b3f35002
Score vectorthreat 100 → client 93
| Term | Level | What it prices | Points |
|---|---|---|---|
| capability-exposure | moderate | capability blast radius (moderate) — client exposure if the model is manipulated | −3 |
| coverage-honesty | manifest | inspection depth (manifest) — how much of the target the scan could see | −4 |
score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.
What the scan could actually read
A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.
The scan read each tool’s name, description, input schema and annotations exactly as the server listed them the last time it answered us; no code was reviewed. We ask the server again about once a month, and a list that changed is graded again.
Tool surfaceread
Implementation sourcenot available
Package metadatanot available
Live transportnot available
The implementation source was not read — this reflects the declared tool metadata only.
Capability — what it could do if the model were manipulated
Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. moderate is the level these add up to.
| Tool | Capability tags | Why the tag was assigned |
|---|---|---|
| newsletters_connect_service | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| newsletters_remove_service | state-write | state-write: declares readOnlyHint: false, destructiveHint: true |
| newsletters_create | state-write | state-write: declares readOnlyHint: false |
| newsletters_update | state-write | state-write: declares readOnlyHint: false |
| newsletters_list | no tags | |
| newsletters_invite | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| newsletters_subscribers | no tags | |
| newsletters_remove_subscriber | state-write | state-write: declares readOnlyHint: false, destructiveHint: true |
| newsletters_write_issue | state-write | state-write: declares readOnlyHint: false |
| newsletters_update_issue | state-write | state-write: declares readOnlyHint: false |
| newsletters_send_test | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| newsletters_send_issue | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| newsletters_cancel_issue | state-write | state-write: declares readOnlyHint: false, destructiveHint: true |
| newsletters_get_issue | no tags | |
| newsletters_list_issues | no tags | |
| account_balance | no tags | |
| account_get_call | no tags | |
| account_list_calls | no tags | |
| account_refund_topup | state-write | state-write: declares readOnlyHint: false, destructiveHint: true |
| account_set_owner_email | state-write | state-write: declares readOnlyHint: false |
| account_owner_link | no tags | |
| account_dashboard_link | no tags | |
| account_get_limits | no tags | |
| account_request_limit | state-write | state-write: declares readOnlyHint: false |
| account_events | no tags | |
| account_emit_event | external-sinkstate-write | external-sink: keyword "webhook"; state-write: declares readOnlyHint: false |
| account_search | no tags | |
| account_get_brand | no tags | |
| account_set_brand | state-write | state-write: declares readOnlyHint: false |
| account_list_email_templates | no tags | |
| account_set_email_template | state-write | state-write: declares readOnlyHint: false |
| account_export_all | untrusted-inputstate-write | untrusted-input: keyword "download"; state-write: declares readOnlyHint: false |
| account_audit_log | no tags | |
| account_save_team | state-write | state-write: declares readOnlyHint: false |
| account_list_teams | no tags | |
| account_pause_team | state-write | state-write: declares readOnlyHint: false |
| account_assign_team | state-write | state-write: declares readOnlyHint: false |
| account_add_approval_rule | state-write | state-write: declares readOnlyHint: false |
| account_list_approval_rules | no tags | |
| account_find_person | no tags | |
| account_export_person | untrusted-inputstate-write | untrusted-input: keyword "download"; state-write: declares readOnlyHint: false |
| account_erase_person | state-write | state-write: declares readOnlyHint: false, destructiveHint: true |
| account_data_locations | no tags |
Toxic-flow graph
The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.
flow-1
Untrusted input can drive an external action even though no sensitive source is exposed.
Supply chain and provenance
Integrityfirst-seen
Surface digest22d1097455d38679
Scanned2026-11-03
This is the first scan of this surface here, so there is nothing yet to compare it against.
Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.
Release history
This is an address its publisher runs: which release it serves is theirs to choose, so there is nothing here to pin. The history below is for reading; the current release on file is 1.0.0.
1.0.0
undated
latestNo release note was published with this version.
—
no reviews yet
Who can review
One review per account, from a signed-in account that does not publish this listing. Nothing else is asked — you can say what you think before you install it. Publishers can reply once per review, and a review can be edited or deleted by whoever wrote it.
Sign in to write one
Any signed-in account that does not publish Conecto Newsletters can review it, once — before installing it or after. A review from an account that has installed it is marked as one.
No reviews yet
Nobody has reviewed this listing. The rating on the card is the mean of the reviews written here and nothing else, so there is no rating until somebody writes the first — which takes a signed-in account that does not publish it, and nothing else.