docs(visualization): note connector-backed live data in the artifact tier

[kyle-sexton]

Summary

The live artifacts doc (https://code.claude.com/docs/en/artifacts) now documents MCP-connector-backed published pages (Claude Code v2.1.209+): a published page can call declared MCP connectors at view time through claude.ai, via each viewer's own approved connector account; connector-backed pages can never be shared to a public link; on Team/Enterprise an org Owner "Enable artifact connectors" toggle gates the capability.

The visualization decision matrix presented published Artifacts as build-time snapshots with no path to outside data. This adds the capability note to the published-Artifact tier and grounds it in the sources section. The strict-CSP claim is unchanged and remains accurate: the page itself still makes no network call — connector calls are handed to claude.ai, which makes them.

Plugin version 0.1.1 → 0.1.2 with changelog entry.

No linked issue.

Related

• Doc-alignment roster row 57 (batch B3 escalation, solo re-dispatch); live page double-fetched 2026-08-04 with matching MD5s.
• Fresh-context Fable verifier: PASS 4/4 (capability verbatim-grounded, CSP untouched and reconciled, v2.1.209 exact, version/changelog consistent).

🤖 Generated with Claude Code

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[claude]

Claude finished @kyle-sexton's task in 28s —— View job

---

Security review complete

• Gather context (PR diff, custom instructions)
• Read changed files
• Review for security issues (injection, secrets, GitHub Actions risk, logic/authz flaws)
• Post findings

Scope reviewed: all 3 changed files per git diff origin/main...HEAD:

• plugins/visualization/.claude-plugin/plugin.json — version bump 0.1.1 → 0.1.2 only.
• plugins/visualization/CHANGELOG.md — new changelog entry (prose).
• plugins/visualization/skills/visualize/context/decision-matrix.md — documentation of connector-backed live data for published Artifacts, plus a sources-section update.

No security issues found.

This PR is a documentation-only change: it adds prose describing an existing Claude.ai platform capability (MCP-connector-backed published Artifacts) to a decision-matrix skill doc, updates the changelog, and bumps the plugin's semver patch version. There is:

• No code execution surface (no scripts, hooks, or commands added/modified).
• No GitHub Actions workflow touched, so no pull_request_target/workflow_run or permissions: changes to assess.
• No secrets, tokens, or credentials referenced or handled.
• No injection surfaces (command, SQL, path, template) — the changes are static markdown/JSON content with no interpolation or executable logic.
• No authorization/access-control logic in these files — the doc correctly describes (rather than implements) claude.ai's own connector-approval and org-toggle gating, which is enforced platform-side, not by this plugin.

Nothing else in this diff warrants a CRITICAL/IMPORTANT/SUGGESTION security finding.

[claude]

Claude finished @kyle-sexton's task in 2m 2s —— View job

---

Code Review

• Gather context (PR diff, CLAUDE.md/REVIEW.md guidelines)
• Read changed files
• Review for correctness, architecture, error handling, maintainability
• Post findings

Scope reviewed (per git diff origin/main...HEAD): plugins/visualization/.claude-plugin/plugin.json, plugins/visualization/CHANGELOG.md, plugins/visualization/skills/visualize/context/decision-matrix.md. Security-relevant findings are left to the security lane per REVIEW.md's scope split (this repo has a claude-security-review workflow, and that lane already posted above); this pass covers correctness, doc-internal consistency, and versioning/changelog hygiene.

No blocking issues found. This is a well-scoped, self-consistent documentation change:

• Version/changelog consistency: plugin.json bumps 0.1.1 → 0.1.2 (plugin.json#L4) and CHANGELOG.md adds a matching ## [0.1.2] entry under ### Changed (CHANGELOG.md#L6-L18), following the same header/style convention as the existing 0.1.1 entry.
• Sourcing discipline: the new connector bullet in decision-matrix.md (decision-matrix.md#L33-L39) is grounded in the sources section with a verification date (decision-matrix.md#L150-L153), consistent with the fresh-docs mandate in this repo's CLAUDE.md and the doc's own re-verification convention.
• Internal consistency: the addition correctly preserves the existing CSP claim ("the page itself makes no network call") rather than contradicting it, and I found no other doc in this plugin (README.md, SKILL.md) that still asserts published Artifacts are build-time-only snapshots with no path to outside data — no stale cross-references left behind.
• No other version fields (e.g. in SKILL.md) needed syncing to the bump.

Minor, non-blocking observation: the new capability is scoped only inside the "Published Artifact" bullet list; the separate "Availability gating" section (decision-matrix.md#L41-L51) — which lists conditions under which the Artifact surface itself is absent — doesn't mention the org-Owner "Enable artifact connectors" toggle. That's arguably correct as-is (the toggle gates the connector capability, not Artifact publishing itself, and is already stated inline in the new bullet), so I'm not flagging it as a fix, just noting it in case a future pass wants the two gating lists cross-referenced.

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.