Type: Connector disposition
Subject: Zoom Plugin (Claude plugin)
Decision requested: Approve the proposed disposition for Zoom Plugin (Claude plugin) across its 12 assessed actions
Inherent / residual: Critical / Moderate
Control owner: Claude Owner / Primary Owner (plugin marketplace) + Zoom Marketplace app owner (OAuth scopes) + IT / Endpoint Management (bearer token handling)
Context: 12 assessed actions. Runtime settings proposed: Needs Approval x6, Blocked x3. Administrative actions proposed: Permit with restrictions x8, Do not enable x4. Proposed for Blocked: Bearer tokens supplied as exported environment variables (ZOOM_MCP_ACCESS_TOKEN, ZOOM_DOCS_MCP_ACCESS_TOKEN, ZOOM_WHITEBOARD_MCP_ACCESS_TOKEN); get_recording_resource; Zoom Whiteboard MCP server (separate endpoint); Zoom Team Chat MCP server (separate surface, write-capable). Class: Claude plugin - bundled skills plus one or more MCP servers, installed from a marketplace or a local directory. Control point: Claude Organization settings > Plugins + Zoom Marketplace OAuth app scopes + endpoint credential handling for the exported bearer tokens. Control owner: Claude Owner / Primary Owner (plugin marketplace) + Zoom Marketplace app owner (OAuth scopes) + IT / Endpoint Management (bearer token handling).
Risks: R-11 [High inherent / Low residual] Substitution by unmanaged third-party MCP servers for the same services | R-20 [High inherent / High residual] Meeting recording and transcription consent | R-27 [Critical inherent / High residual] Aggregate outbound surface across the estate | R-40 [Critical inherent / Low residual] Bearer tokens persisted in plaintext on the endpoint (Zoom Plugin only) | R-41 [Critical inherent / High residual] Plugin skills are auto-loading instruction content, and the vendor does not verify plugin contents | R-43 [High inherent / High residual] A third path to meeting content, reaching recordings and transcripts directly | R-44 [High inherent / Low residual] Plugin governance is a separate admin surface from connector governance
Open verification: V-33 [Critical] Whether the Zoom plugin is installed, who holds exported bearer tokens, what scopes the Zoom Marketplace OAuth application actually grants, and whether the distribution bundles a Team Chat MCP server in addition to the three named in its README. | V-36 [High] Whether any Zoom bearer tokens have actually been exported on any endpoint, and whether the plugin is in use in skills-only mode. The vendor README confirms the skills function without the MCP servers, so skills-only is a supported configuration rather than a degraded one.
Ruling:
Amendment or condition: