Hello Carta team,
As part of our review of the carta-cap-table and carta-crm plugins for the Claude plugin directory, we observed the following:
-
Undisclosed default-on usage telemetry. Both plugins ship auto-fire hooks (inject-instrumentation.js and related) that attach usage telemetry — session id, prompt id, model, permission mode, effort, and the names of loaded skills/plugins — to every Carta MCP call. We did not find this collection described in the plugin READMEs, and the hooks are enabled by default with no opt-out. (To be clear: we verified the hooks do not transmit file contents or conversation text beyond the fields listed.)
-
No privacy policy link. The plugins connect to your remote MCP service (mcp.app.carta.com) and transmit the telemetry above, but no privacy policy is linked in the README or manifest.
Our directory inclusion standards require that data collection beyond what a tool needs for its core function be disclosed and covered by a clear, accessible privacy policy.
To complete our review, could you:
- Add a privacy policy link (README and/or manifest) that covers this telemetry, and
- Disclose the telemetry in each plugin's README — ideally with an opt-out, or by making the instrumentation opt-in.
Removing the session-metadata fields that aren't needed for the plugins' core function would also resolve the disclosure point on its own.
Everything else in the review looked good — both plugins install and load cleanly. Once these are addressed, let us know (or reply here) and we'll re-run the review.
Thanks for building on Claude!
Hello Carta team,
As part of our review of the
carta-cap-tableandcarta-crmplugins for the Claude plugin directory, we observed the following:Undisclosed default-on usage telemetry. Both plugins ship auto-fire hooks (
inject-instrumentation.jsand related) that attach usage telemetry — session id, prompt id, model, permission mode, effort, and the names of loaded skills/plugins — to every Carta MCP call. We did not find this collection described in the plugin READMEs, and the hooks are enabled by default with no opt-out. (To be clear: we verified the hooks do not transmit file contents or conversation text beyond the fields listed.)No privacy policy link. The plugins connect to your remote MCP service (
mcp.app.carta.com) and transmit the telemetry above, but no privacy policy is linked in the README or manifest.Our directory inclusion standards require that data collection beyond what a tool needs for its core function be disclosed and covered by a clear, accessible privacy policy.
To complete our review, could you:
Removing the session-metadata fields that aren't needed for the plugins' core function would also resolve the disclosure point on its own.
Everything else in the review looked good — both plugins install and load cleanly. Once these are addressed, let us know (or reply here) and we'll re-run the review.
Thanks for building on Claude!