{ "schema": "varexis-index-delivery/1", "catalog_version": "2026-10-14T20:21:57.226Z", "route_id": "agentic_pack_agent_permissions_data_v1", "question": "Notion + Slack permissions?", "answer": "Compare Notion and Slack connector access before retrieving workspace content. This pack keeps their documented authentication, read/write permissions and data-sharing boundaries together, with unresolved client and workspace questions. Notion content may leave Notion through the connected client; Slack search and posting permissions are distinct. These are the existing 11 October 2026 documentation reviews, not tests of your configuration or current tool behaviour.", "records": [ { "record_id": "VXI-EXT-TOOL-TRUST-NOTION-01-v1", "url": "/varexis-index/records/notion-mcp-content-sharing-trust.json", "content_sha256": "b465e42e280f6667dbb8ee8a67764b505783dd2d93945eab3ea42b38af7e9659", "evidence": { "schema": "varexis-public-evidence-record/0.3", "generated_at_utc": "2026-10-11T21:09:20.344Z", "record_id": "VXI-EXT-TOOL-TRUST-NOTION-01-v1", "record_kind": "external_reference", "title": "Notion MCP: Content access and external sharing", "system": "Notion MCP", "evidence_family": "agent_tool_trust_review", "index_status": "PUBLIC_SAFE_SOURCE_REVIEW", "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY", "canonical_question": "Can an agent assume Notion content stays inside Notion when using its MCP connector?", "near_questions": [ "Does a workspace connector keep documents inside the workspace?", "Can Notion MCP send page content to another system?", "What can the official Notion MCP update?", "Does Notion OAuth establish a no-training guarantee?", "Which Notion user's access does an MCP connection use?", "Can a Notion page inject instructions into an agent?", "Who can revoke a Notion MCP connection?", "Does a trusted connector make every client trustworthy?", "What is missing before sharing private Notion documents?", "Can the Notion connector create databases?", "What should a saved Notion tool review record?", "Does this Notion profile verify our client policy?" ], "supported_claims": [ { "claim": "Notion documents a hosted OAuth connector that can read and update accessible content. Its security guidance explicitly warns that connected clients may send returned content outside Notion. Check the client and model data policy as well as workspace access. The connector's publisher and valid login do not establish a no-egress or no-training guarantee.", "reliance": "DOCUMENTED_CAPABILITY_ONLY" } ], "not_demonstrated_claims": [ "Verified buyer configuration or effective access rights", "Independent tool execution or security testing", "Vendor certification, guaranteed safety or no-training assurance" ], "public_summary": "Notion documents a hosted OAuth connector that can read and update accessible content. Its security guidance explicitly warns that connected clients may send returned content outside Notion. Check the client and model data policy as well as workspace access. The connector's publisher and valid login do not establish a no-egress or no-training guarantee.", "related_record_ids": [ "VXI-EXT-TOOL-TRUST-ATLASSIAN-01-v1", "VXI-EXT-TOOL-TRUST-LINEAR-01-v1" ], "source_review": { "source_type": "official_external_documentation", "source_title": "Notion MCP overview", "source_url": "https://developers.notion.com/guides/mcp/overview", "checked_on": "2026-10-11", "candidate_record_id": "VXI-EXT-TOOL-TRUST-NOTION-01-v1", "candidate_record_sha256": "4992d82877792199be2573a322c44703d17abb01cc9db5b9f9f82e856fec4acc", "method": "Primary documentation reviewed for the published bounded statement.", "deployment_tested_by_varexis": false, "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research." }, "answer_policy": { "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY", "bounded_answer": "Notion documents a hosted OAuth connector that can read and update accessible content. Its security guidance explicitly warns that connected clients may send returned content outside Notion. Check the client and model data policy as well as workspace access. The connector's publisher and valid login do not establish a no-egress or no-training guarantee.", "required_buyer_context": "Notion-hosted remote MCP; excludes locally hosted alternatives. Workspace, client and account entitlements must be checked separately. Client/model training and retention policy, effective connected-source access and the buyer's workspace restrictions.", "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state." }, "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.", "trust_profile": { "schema": "varexis-agent-tool-trust/1", "identity": { "tool": "Notion MCP", "variant": "Notion-hosted remote MCP; excludes locally hosted alternatives. Workspace, client and account entitlements must be checked separately." }, "review_status": "documentation_review_only", "checked_on": "2026-10-11", "version_scope": "Dated rolling documentation snapshot; no installed or hosted runtime version independently verified.", "plan_scope": "Buyer plan, feature entitlement and effective configuration are not verified.", "findings": [ { "field": "operator", "label": "Publisher and operator", "status": "documented", "statement": "Notion hosts the remote MCP service.", "source_ids": [ "notion-main", "notion-security" ] }, { "field": "purpose", "label": "Purpose", "status": "documented", "statement": "Search, read and update workspace content.", "source_ids": [ "notion-main", "notion-security" ] }, { "field": "reads", "label": "Read capability", "status": "documented", "statement": "Content accessible to the authorizing user, including supported search across connected sources.", "source_ids": [ "notion-main", "notion-security" ] }, { "field": "writes", "label": "Write capability", "status": "documented", "statement": "Documented operations include creating pages or databases and updating content.", "source_ids": [ "notion-main", "notion-security" ] }, { "field": "auth", "label": "Authentication", "status": "documented", "statement": "User authorization through OAuth; workspace and organization owners have documented connection management controls.", "source_ids": [ "notion-main", "notion-security" ] }, { "field": "permissions", "label": "Permission surface", "status": "documented", "statement": "The user's content access and workspace connection controls define relevant boundaries; buyer settings were not inspected.", "source_ids": [ "notion-main", "notion-security" ] }, { "field": "egress", "label": "Data leaving the environment", "status": "review_inference", "statement": "Notion explicitly states that an MCP client may send returned content to systems outside Notion.", "source_ids": [ "notion-main", "notion-security" ] }, { "field": "failures", "label": "Failure modes to consider", "status": "review_inference", "statement": "Treating workspace authorization as a data-residency promise; following instructions embedded in a page; unintended content changes.", "source_ids": [ "notion-main", "notion-security" ] }, { "field": "unknown", "label": "Unknowns and applicability", "status": "unknown", "statement": "Client/model training and retention policy, effective connected-source access and the buyer's workspace restrictions.", "source_ids": [] }, { "field": "gate", "label": "Suggested refusal or clarification condition", "status": "varexis_review_policy", "statement": "When a task requires no external disclosure, resolve the client's data flow before reading private pages; do not apply page instructions as user authority.", "source_ids": [] } ], "evidence_sources": [ { "source_id": "notion-main", "url": "https://developers.notion.com/guides/mcp/overview", "final_url": "https://developers.notion.com/guides/mcp/overview", "title": "Notion MCP overview", "checked_on": "2026-10-11", "sha256": "ebec8a48e17acd3aef72c5628476a2c9429b6e822aa37ffb3b391aebf324b423", "bytes": 342441 }, { "source_id": "notion-security", "url": "https://developers.notion.com/guides/mcp/mcp-security-best-practices", "final_url": "https://developers.notion.com/guides/mcp/mcp-security-best-practices", "title": "Notion MCP security guidance", "checked_on": "2026-10-11", "sha256": "d12c09d54088a85198dd5815e34f2af7967b91747dfbf263af74f7c813374a82", "bytes": 334240 }, { "source_id": "mcp-hints", "url": "https://blog.modelcontextprotocol.io/posts/2026-03-16-tool-annotations/", "final_url": "https://blog.modelcontextprotocol.io/posts/2026-03-16-tool-annotations/", "title": "MCP tool annotations and enforcement boundaries", "checked_on": "2026-10-11", "sha256": "82888044d831c3bd18f03d87a846ce5d27e028bd67a095edc04ba377fc622163", "bytes": 52715 } ], "observed_tool_execution": false, "policy_basis": "Suggested VAREXIS review gates; apply the buyer's authorized task and policy. These conditions do not execute or enforce controls.", "commercial_reliance_boundary": "A source-linked review aid, not a vendor certification, security clearance or deployment assessment. Unknown does not mean false or unsafe.", "paid_value": { "decision_context": "Keep the documented content-sharing limitation with a dated connector approval discussion.", "free": "Complete profile, practical questions, sources and limitations; may be saved locally.", "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.", "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.", "excluded": [ "Fresh vendor research", "Continuous monitoring or change alerts", "Testing the buyer configuration", "Private evidence or vendor certification" ], "integrity": "Hashes identify content versions; they do not prove truth or provide a signature." }, "revalidation": { "trigger": "Recheck when permissions, deployment, authentication, source guidance or intended use changes; a purchase does not trigger revalidation.", "specific_watch": "Review the effective tool inventory and client data policy before a new integration decision." }, "change_history": [ { "version": 1, "date": "2026-10-11", "change": "Initial documentation review; no earlier vendor assessment claimed." } ] }, "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.", "service_route": { "request_guide": "/varexis-index/request.html", "request_workflow": "/varexis-index/request-workflow.json", "service_id": "single_request", "service_routes_url": "/varexis-index/service-routes.json", "payment_required": true, "availability_endpoint": "/api/index/capabilities", "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED", "checkout_url": "/index-access" }, "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.", "human_page": "/varexis-index/catalog.html#notion-mcp-content-sharing-trust", "machine_readable_record": "/varexis-index/records/notion-mcp-content-sharing-trust.json" } }, { "record_id": "VXI-EXT-TOOL-TRUST-SLACK-01-v1", "url": "/varexis-index/records/slack-mcp-search-posting-trust.json", "content_sha256": "ab365f9176d2376e58c25ed6e0815ecda3eb2f3e088fff8dd2c40a67779a6518", "evidence": { "schema": "varexis-public-evidence-record/0.3", "generated_at_utc": "2026-10-11T21:27:53.457Z", "record_id": "VXI-EXT-TOOL-TRUST-SLACK-01-v1", "record_kind": "external_reference", "title": "Slack MCP: Search scope and posting authority", "system": "Slack MCP", "evidence_family": "agent_tool_trust_review", "index_status": "PUBLIC_SAFE_SOURCE_REVIEW", "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY", "canonical_question": "What should an agent check before searching private Slack content without posting messages?", "near_questions": [ "How can I search team chat without giving an agent permission to post?", "Which Slack MCP scopes allow private channel searches?", "Does Slack search access also permit sending messages?", "Can a Slack connector retrieve direct message history?", "Does an app IP allowlist apply to Slack MCP?", "Can an unlisted app use the official Slack MCP server?", "What must be checked before sharing a retrieved Slack message?", "Are Slackbot MCP connections the same as Slack MCP server access?", "Should instructions inside Slack messages control an agent?", "Which workspace identity will a Slack tool use?", "What does a saved Slack permission review preserve?", "Does this Slack profile establish client data retention?" ], "supported_claims": [ { "claim": "Slack documents separate user-token scopes for searches, conversation history and posting. Review the authorized workspace, requested content and client data handling before retrieval. A search permission does not authorize sending a message, and connecting Slack to another tool creates a separate disclosure decision. This record reviews the official server, not Slackbot's connections to third-party servers.", "reliance": "DOCUMENTED_CAPABILITY_ONLY" } ], "not_demonstrated_claims": [ "Verified buyer configuration or effective access rights", "Independent tool execution or security testing", "Vendor certification, guaranteed safety or no-training assurance" ], "public_summary": "Slack documents separate user-token scopes for searches, conversation history and posting. Review the authorized workspace, requested content and client data handling before retrieval. A search permission does not authorize sending a message, and connecting Slack to another tool creates a separate disclosure decision. This record reviews the official server, not Slackbot's connections to third-party servers.", "related_record_ids": [ "VXI-EXT-TOOL-TRUST-ASANA-01-v1", "VXI-EXT-TOOL-TRUST-HUBSPOT-01-v1", "VXI-EXT-TOOL-TRUST-FIGMA-01-v1" ], "source_review": { "source_type": "official_external_documentation", "source_title": "Slack MCP tools, scopes and client access", "source_url": "https://docs.slack.dev/ai/slack-mcp-server/", "checked_on": "2026-10-11", "candidate_record_id": "VXI-EXT-TOOL-TRUST-SLACK-01-v1", "candidate_record_sha256": "167d749a41ab098ea05f099f04c876ead01b1446479b5da1dbebb66a0d1a007a", "method": "Primary documentation reviewed for the published bounded statement.", "deployment_tested_by_varexis": false, "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research." }, "answer_policy": { "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY", "bounded_answer": "Slack documents separate user-token scopes for searches, conversation history and posting. Review the authorized workspace, requested content and client data handling before retrieval. A search permission does not authorize sending a message, and connecting Slack to another tool creates a separate disclosure decision. This record reviews the official server, not Slackbot's connections to third-party servers.", "required_buyer_context": "Slack's official hosted MCP server for external clients; not the Slackbot MCP client or a community Slack connector. Actual workspace grants, channel visibility, client recipients and retention.", "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state." }, "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.", "trust_profile": { "schema": "varexis-agent-tool-trust/1", "identity": { "tool": "Slack MCP", "variant": "Slack's official hosted MCP server for external clients; not the Slackbot MCP client or a community Slack connector." }, "review_status": "documentation_review_only", "checked_on": "2026-10-11", "version_scope": "Dated rolling documentation snapshot; no installed or hosted runtime version independently verified.", "plan_scope": "Buyer plan, feature entitlement and effective configuration are not verified.", "findings": [ { "field": "operator", "label": "Publisher and operator", "status": "documented", "statement": "Slack operates the official hosted server.", "source_ids": [ "slack-main" ] }, { "field": "purpose", "label": "Purpose", "status": "documented", "statement": "Retrieve workspace context and perform supported Slack actions.", "source_ids": [ "slack-overview" ] }, { "field": "reads", "label": "Read capability", "status": "documented", "statement": "Searches, files and conversation history require their respective user-token scopes.", "source_ids": [ "slack-main" ] }, { "field": "writes", "label": "Write capability", "status": "documented", "statement": "Posting, reactions, canvases and channel creation have separate write scopes.", "source_ids": [ "slack-main" ] }, { "field": "auth", "label": "Authentication", "status": "documented", "statement": "Confidential OAuth is documented for Marketplace or internal apps; unlisted apps are excluded.", "source_ids": [ "slack-main" ] }, { "field": "permissions", "label": "Permission surface", "status": "documented", "statement": "Scope grants and configured app IP allowlists apply to MCP requests.", "source_ids": [ "slack-main" ] }, { "field": "egress", "label": "Data leaving the environment", "status": "review_inference", "statement": "Slack content reaches the connected client; onward sharing depends on the client and other tools.", "source_ids": [ "slack-main" ] }, { "field": "failures", "label": "Failure modes to consider", "status": "review_inference", "statement": "Overbroad private-channel access, unintended posting, or following instructions inside retrieved messages.", "source_ids": [ "slack-main" ] }, { "field": "unknown", "label": "Unknowns and applicability", "status": "unknown", "statement": "Actual workspace grants, channel visibility, client recipients and retention.", "source_ids": [] }, { "field": "gate", "label": "Suggested refusal or clarification condition", "status": "varexis_review_policy", "statement": "For a search task, withhold posting and cross-tool sharing unless separately authorized.", "source_ids": [] } ], "evidence_sources": [ { "source_id": "slack-main", "url": "https://docs.slack.dev/ai/slack-mcp-server/", "final_url": "https://docs.slack.dev/ai/slack-mcp-server/", "title": "Slack MCP tools, scopes and client access", "checked_on": "2026-10-11", "sha256": "2974027071b91d6963a15f8c9365fd732daa864b87762d10beee746622653141", "bytes": 60455 }, { "source_id": "slack-overview", "url": "https://docs.slack.dev/ai/mcp-overview/", "final_url": "https://docs.slack.dev/ai/mcp-overview/", "title": "Slack MCP server and client distinction", "checked_on": "2026-10-11", "sha256": "59b1df50cfb0680feb7961ac67be0b1d5d5c39f9de04de317ec537bfae3dc0e1", "bytes": 40353 } ], "observed_tool_execution": false, "policy_basis": "Suggested VAREXIS review gates; apply the buyer's authorized task and policy. These conditions do not execute or enforce controls.", "commercial_reliance_boundary": "A source-linked review aid, not a vendor certification, security clearance or deployment assessment. Unknown does not mean false or unsafe.", "paid_value": { "decision_context": "Preserve the scope and disclosure questions used when approving a chat-search connector.", "free": "Complete profile, practical questions, sources and limitations; may be saved locally.", "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.", "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.", "excluded": [ "Fresh vendor research", "Continuous monitoring or change alerts", "Testing the buyer configuration", "Private evidence or vendor certification" ], "integrity": "Hashes identify content versions; they do not prove truth or provide a signature." }, "revalidation": { "trigger": "Recheck when permissions, deployment, authentication, source guidance or intended use changes; a purchase does not trigger revalidation.", "specific_watch": "Recheck user-token scopes, app distribution status and IP allowlists when the connection changes." }, "change_history": [ { "version": 1, "date": "2026-10-11", "change": "Initial documentation review; no earlier vendor assessment claimed." } ] }, "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.", "service_route": { "request_guide": "/varexis-index/request.html", "request_workflow": "/varexis-index/request-workflow.json", "service_id": "single_request", "service_routes_url": "/varexis-index/service-routes.json", "payment_required": true, "availability_endpoint": "/api/index/capabilities", "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED", "checkout_url": "/index-access" }, "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.", "human_page": "/varexis-index/catalog.html#slack-mcp-search-posting-trust", "machine_readable_record": "/varexis-index/records/slack-mcp-search-posting-trust.json" } } ], "basis": "A frozen compilation of existing public documentation reviews and their source bindings. No new source review, tool execution, independent experiment or buyer assessment was performed for this package.", "boundary": "Public answers remain free. Payment provides automatic retrieval, version binding and a saved delivery. It does not upgrade evidence or disclose protected material. The saved pack is not continually refreshed. Hashes bind its contents; the optional delivery receipt is unsigned.", "pack": { "schema": "varexis-index-evidence-pack/1", "pack_id": "agent-permissions-data", "version": "1.0.0", "title": "Agent Tool Permissions & Data Handling — Notion + Slack", "prepared_at_utc": "2026-10-15T21:24:49.820Z", "review_status": "documentation_review_only", "source_checked_on": [ "2026-10-11" ], "source_capture_date": null, "source_capture_boundary": "Existing dated review and upstream hash metadata are preserved. No new source bytes were acquired for this compilation; separate capture timestamps and independently tested runtime versions are not established.", "summary_markdown": "# Agent Tool Permissions & Data Handling — Notion + Slack\n\nUse this package when reviewing a workspace-search workflow spanning Notion and Slack. Keep access scope and onward disclosure as separate decisions. The comparison preserves publisher statements, VAREXIS review considerations and unknowns without treating them as equivalent evidence.\n\n## Notion MCP: Content access and external sharing\nNotion documents a hosted OAuth connector that can read and update accessible content. Its security guidance explicitly warns that connected clients may send returned content outside Notion. Check the client and model data policy as well as workspace access. The connector's publisher and valid login do not establish a no-egress or no-training guarantee.\n\nRequired context: Notion-hosted remote MCP; excludes locally hosted alternatives. Workspace, client and account entitlements must be checked separately. Client/model training and retention policy, effective connected-source access and the buyer's workspace restrictions.\n\nEvidence still needed: A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state.\n\n## Slack MCP: Search scope and posting authority\nSlack documents separate user-token scopes for searches, conversation history and posting. Review the authorized workspace, requested content and client data handling before retrieval. A search permission does not authorize sending a message, and connecting Slack to another tool creates a separate disclosure decision. This record reviews the official server, not Slackbot's connections to third-party servers.\n\nRequired context: Slack's official hosted MCP server for external clients; not the Slackbot MCP client or a community Slack connector. Actual workspace grants, channel visibility, client recipients and retention.\n\nEvidence still needed: A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state.\n\n## What payment adds\nThe complete package is free to inspect or save locally. Single Request saves this version-bound JSON as one retrievable result. Evidence Receipt also adds the existing unsigned delivery receipt. Eligible subscriptions use one query for the whole pack; retries retain the original request reference and do not consume another query. Keep the access key to recover the saved result.\n\n## Scope\nThe included reviews retain their original dates, findings, unresolved questions and suggested refusal conditions. No fresh research, buyer configuration review, legal conclusion, certification, continual refresh or permanent-retention commitment is included.\n", "comparison": [ { "record_id": "VXI-EXT-TOOL-TRUST-NOTION-01-v1", "tool": "Notion MCP", "review_status": "documentation_review_only", "checked_on": "2026-10-11", "findings": [ { "field": "operator", "label": "Publisher and operator", "status": "documented", "statement": "Notion hosts the remote MCP service.", "source_ids": [ "notion-main", "notion-security" ] }, { "field": "purpose", "label": "Purpose", "status": "documented", "statement": "Search, read and update workspace content.", "source_ids": [ "notion-main", "notion-security" ] }, { "field": "reads", "label": "Read capability", "status": "documented", "statement": "Content accessible to the authorizing user, including supported search across connected sources.", "source_ids": [ "notion-main", "notion-security" ] }, { "field": "writes", "label": "Write capability", "status": "documented", "statement": "Documented operations include creating pages or databases and updating content.", "source_ids": [ "notion-main", "notion-security" ] }, { "field": "auth", "label": "Authentication", "status": "documented", "statement": "User authorization through OAuth; workspace and organization owners have documented connection management controls.", "source_ids": [ "notion-main", "notion-security" ] }, { "field": "permissions", "label": "Permission surface", "status": "documented", "statement": "The user's content access and workspace connection controls define relevant boundaries; buyer settings were not inspected.", "source_ids": [ "notion-main", "notion-security" ] }, { "field": "egress", "label": "Data leaving the environment", "status": "review_inference", "statement": "Notion explicitly states that an MCP client may send returned content to systems outside Notion.", "source_ids": [ "notion-main", "notion-security" ] }, { "field": "failures", "label": "Failure modes to consider", "status": "review_inference", "statement": "Treating workspace authorization as a data-residency promise; following instructions embedded in a page; unintended content changes.", "source_ids": [ "notion-main", "notion-security" ] }, { "field": "unknown", "label": "Unknowns and applicability", "status": "unknown", "statement": "Client/model training and retention policy, effective connected-source access and the buyer's workspace restrictions.", "source_ids": [] }, { "field": "gate", "label": "Suggested refusal or clarification condition", "status": "varexis_review_policy", "statement": "When a task requires no external disclosure, resolve the client's data flow before reading private pages; do not apply page instructions as user authority.", "source_ids": [] } ] }, { "record_id": "VXI-EXT-TOOL-TRUST-SLACK-01-v1", "tool": "Slack MCP", "review_status": "documentation_review_only", "checked_on": "2026-10-11", "findings": [ { "field": "operator", "label": "Publisher and operator", "status": "documented", "statement": "Slack operates the official hosted server.", "source_ids": [ "slack-main" ] }, { "field": "purpose", "label": "Purpose", "status": "documented", "statement": "Retrieve workspace context and perform supported Slack actions.", "source_ids": [ "slack-overview" ] }, { "field": "reads", "label": "Read capability", "status": "documented", "statement": "Searches, files and conversation history require their respective user-token scopes.", "source_ids": [ "slack-main" ] }, { "field": "writes", "label": "Write capability", "status": "documented", "statement": "Posting, reactions, canvases and channel creation have separate write scopes.", "source_ids": [ "slack-main" ] }, { "field": "auth", "label": "Authentication", "status": "documented", "statement": "Confidential OAuth is documented for Marketplace or internal apps; unlisted apps are excluded.", "source_ids": [ "slack-main" ] }, { "field": "permissions", "label": "Permission surface", "status": "documented", "statement": "Scope grants and configured app IP allowlists apply to MCP requests.", "source_ids": [ "slack-main" ] }, { "field": "egress", "label": "Data leaving the environment", "status": "review_inference", "statement": "Slack content reaches the connected client; onward sharing depends on the client and other tools.", "source_ids": [ "slack-main" ] }, { "field": "failures", "label": "Failure modes to consider", "status": "review_inference", "statement": "Overbroad private-channel access, unintended posting, or following instructions inside retrieved messages.", "source_ids": [ "slack-main" ] }, { "field": "unknown", "label": "Unknowns and applicability", "status": "unknown", "statement": "Actual workspace grants, channel visibility, client recipients and retention.", "source_ids": [] }, { "field": "gate", "label": "Suggested refusal or clarification condition", "status": "varexis_review_policy", "statement": "For a search task, withhold posting and cross-tool sharing unless separately authorized.", "source_ids": [] } ] } ], "members": [ { "schema": "varexis-index-delivery/1", "catalog_version": "2026-10-14T20:21:57.226Z", "route_id": "agentic_reviewed_notion_mcp_content_sharing_trust", "question": "Can an agent assume Notion content stays inside Notion when using its MCP connector?", "answer": "Notion documents a hosted OAuth connector that can read and update accessible content. Its security guidance explicitly warns that connected clients may send returned content outside Notion. Check the client and model data policy as well as workspace access. The connector's publisher and valid login do not establish a no-egress or no-training guarantee.", "basis": "A saved snapshot of the reviewed public route and source records. No fresh source review, independent experiment, deployment assessment or bespoke claim analysis is performed by this delivery.", "boundary": "Public answers remain free. Payment provides automatic retrieval, version binding and a saved delivery. It does not upgrade evidence or disclose protected material.", "snapshot_sha256": "4546c08bd555f3f7bc775752165eae07261d5e6215e3dbd6444a2e0bc3d9f4fd", "record_ids": [ "VXI-EXT-TOOL-TRUST-NOTION-01-v1" ] }, { "schema": "varexis-index-delivery/1", "catalog_version": "2026-10-14T20:21:57.226Z", "route_id": "agentic_reviewed_slack_mcp_search_posting_trust", "question": "What should an agent check before searching private Slack content without posting messages?", "answer": "Slack documents separate user-token scopes for searches, conversation history and posting. Review the authorized workspace, requested content and client data handling before retrieval. A search permission does not authorize sending a message, and connecting Slack to another tool creates a separate disclosure decision. This record reviews the official server, not Slackbot's connections to third-party servers.", "basis": "A saved snapshot of the reviewed public route and source records. No fresh source review, independent experiment, deployment assessment or bespoke claim analysis is performed by this delivery.", "boundary": "Public answers remain free. Payment provides automatic retrieval, version binding and a saved delivery. It does not upgrade evidence or disclose protected material.", "snapshot_sha256": "c240ad6fcb406a2580157e1388b6a394b87bb127caf161a3ca4dd84c2a194e51", "record_ids": [ "VXI-EXT-TOOL-TRUST-SLACK-01-v1" ] } ], "rights_review": { "reviewed_on": "2026-10-15", "scope": "This exact public compilation of VAREXIS-authored review prose, factual identifiers, source links, dates and hashes.", "included": "Existing public VAREXIS review records and their limitations; an attributed comparison using the same documented findings.", "excluded": "Upstream documentation bodies, source code, screenshots, logos, private operator templates and protected evidence.", "redistribution_boundary": "Source links and hashes identify upstream material; they do not grant rights to redistribute that material. This package includes no upstream document bodies or code. Existing VAREXIS service terms apply to the supplied compilation.", "terms_url": "https://varexis.tech/checkout-terms", "independent_testing": false }, "delivery_unit": { "kind": "one_published_route", "member_count": 2, "developer_query_units": 1, "research_query_units": 1, "extra_member_purchases": false, "automatic_refresh": false } }, "snapshot_sha256": "b76f7ccadbcd99a60ac2082809b8ef9aba487a5b41a1c4a4ac0a57c9fccc8a01" }