MSP Claude Plugins

Skills Reference

Skills provide domain knowledge that teaches Claude about MSP platforms, terminology, and best practices. There are 336 per-vendor skills across all plugins, plus 5 cross-cutting shared skills.

Cross-cutting / Shared Skills

Vendor-agnostic skills distributed via the shared-skills plugin. Install with /plugin install shared-skills after adding the marketplace.

Skill Description
billing-reconciliation Reconciling cloud marketplace subscriptions (Pax8) against accounting invoices (Xero, QuickBooks Online): the matching strategy, billing gaps, unbilled subscriptions, and margin discrepancy analysis.
incident-correlation Vendor-agnostic cross-tool incident correlation: combining PSA tickets, RMM device state, documentation-platform assets, and configuration- monitoring changes into a unified incident summary across Kaseya, ConnectWise, HaloPSA, Syncro, Atera, and similar MSP stacks.
msp-terminology MSP industry terminology: acronyms, roles, contract and billing concepts, and the vocabulary used across PSA, RMM, documentation, and security platforms.
ticket-triage Vendor-agnostic PSA ticket triage: priority determination, categorization, routing, and initial response practices applicable to Autotask, ConnectWise, HaloPSA, and other platforms.
wyre-gateway-troubleshooting WYRE MCP Gateway diagnostics: missing vendor tools, OAuth failures, "Failed to update tool access" errors, expired credentials, and the request flow through mcp-remote to gateway to vendor container to external API.

What are Skills?

Skills are markdown documents that contain structured information about specific domains. When you ask Claude about MSP topics, it automatically references relevant skills to provide accurate, platform-specific answers.

You can also invoke skills directly:

/skill autotask:tickets

What ticket statuses are available?

Skills by Category

Ticket Management

Skills for creating, searching, and managing service tickets.

Skill Plugin Description
atera:tickets Atera Atera service desk tickets: ticket fields, statuses, priorities, comments, work hours, and billing duration.
autotask:tickets Autotask PSA Autotask ticket lifecycle: status/priority codes and transition rules, the ticket field schema, SLA calculation and clock behavior, escalation rules, ticket metrics, and the MCP tool surface (create, update, search, history, notes) for MSP service desk operations.
connectwise-psa:tickets ConnectWise PSA ConnectWise PSA ticket management: ticket fields, service boards, statuses, priorities, SLAs, ticket notes, and workflow automation.
halopsa:tickets HaloPSA HaloPSA service desk tickets: ticket fields, statuses, priorities and ticket types, actions (notes and time entries), attachments, SLA behaviour, and the creation and status-transition workflows with their validation rules.
ninjaone-rmm:tickets NinjaOne (NinjaRMM) NinjaOne's built-in ticketing system, which integrates with device monitoring: ticket creation and updates, core/status/metadata fields, status and priority values with SLA targets, log entry types, device linkage, tagging patterns, and error codes.
superops:tickets SuperOps.ai SuperOps.ai service desk ticketing: ticket fields, status and priority enums, client/site/requester/assignee associations, notes, time entries, and the GraphQL mutations and queries behind them.
syncro:tickets Syncro MSP Syncro MSP tickets: ticket fields, statuses, priorities, problem types, timer operations, workflow automations, and the validation, time-tracking, and reporting logic around them.
hubspot:tickets HubSpot CRM HubSpot support tickets: core fields, default pipeline stages, priority levels, MSP ticket categories, SLA timestamp properties, and associating tickets with contacts, companies, and deals.

Customer/Client Management

Skills for managing customers, companies, contacts, and organizations.

Skill Plugin Description
atera:customers Atera Atera customers and contacts: customer records and fields, contact management, custom fields, and customer lifecycle operations.
autotask:crm Autotask PSA Autotask CRM entities - companies (accounts), contacts, and sites/locations - including field references, company type classifications, and how these records underpin tickets, contracts, and projects for MSP account management.
connectwise-automate:clients ConnectWise Automate ConnectWise Automate client management: client CRUD, client identifiers, locations, client hierarchy, groups, extra data fields (EDFs), and client-level settings.
connectwise-psa:companies ConnectWise PSA ConnectWise PSA company/account management: company types, statuses, sites/locations, custom fields, and company relationships.
connectwise-psa:contacts ConnectWise PSA ConnectWise PSA contact management: contact records, contact types, communication items (email, phone), portal access, and relationships to companies.
halopsa:clients HaloPSA HaloPSA CRM data model: client records and their billing/contact fields, sites (locations), contacts (Users), client classification, and parent-child client hierarchy.
hudu:companies Hudu Hudu companies (clients/organizations): company field reference, parent/child hierarchy, PSA integration matching via id_in_integration, the /api/v1/companies CRUD plus archive/unarchive endpoints, onboarding and offboarding workflows, and how companies scope assets, passwords, articles, and websites.
huntress:organizations Huntress Huntress organizations as the multi-tenant boundary: org structure, the organization key used for agent deployment, full CRUD operations, client onboarding and offboarding workflows, and the duplicate-key and active-agent deletion errors.
it-glue:contacts IT Glue IT Glue contacts — the people (clients, vendors, partners) associated with an organization.
it-glue:organizations IT Glue IT Glue organizations (companies/clients): the foundational entity all documentation, configurations, contacts, passwords, and flexible assets attach to.
ninjaone-rmm:organizations NinjaOne (NinjaRMM) NinjaOne organizations — the top-level container for devices, representing MSP clients: creation and listing, locations, node approval modes, policy mappings and node role IDs, custom fields, tags, cursor pagination, and error codes.
pax8:companies Pax8 Pax8 companies (MSP clients): company records and fields, contact management, billing and order-approval settings, and cross-referencing companies with subscriptions and orders.
quickbooks-online:customers QuickBooks Online QuickBooks Online Customer entity: the parent/sub-customer (job) hierarchy, contact, address, billing and hierarchy fields, payment terms, balance and BalanceWithJobs tracking, sparse updates, deactivation, query syntax, error codes, and PSA cross-referencing patterns for MSP client records.
sherweb:customers Sherweb Sherweb customer records: the distributor > service provider > customer hierarchy and its API scoping consequences, customer lifecycle stages, core address and contact fields, accounts-receivable data with aging buckets, and cross-referencing customers with PSA, subscription, and billing data.
superops:clients SuperOps.ai SuperOps.ai client (account) management: stage and status enums, core/business/ address fields, client CRUD mutations, site and contact (requester) management, custom fields, soft vs. hard delete, and onboarding workflows.
syncro:customers Syncro MSP Syncro MSP customers: customer fields, contacts, sites and locations, and customer create, update, and search operations.
threatlocker:organizations Threatlocker The ThreatLocker MSP multi-tenant model: enumerating child organizations, retrieving per-org auth keys, and identifying valid move targets when relocating computers between tenants.
hubspot:companies HubSpot CRM HubSpot company records: core fields, industry classification values, lifecycle stages, domain-based deduplication and automatic contact-company matching, and cross-referencing associated contacts, deals, and tickets.
hubspot:contacts HubSpot CRM HubSpot contact records: core and MSP-relevant custom fields, lifecycle stages, lead status values, contact ownership, CRM search filter patterns, and associations to companies and deals.
xero:contacts Xero Xero contacts (customers and suppliers): contact fields, addresses and phones, contact groups, status values and read-only balances, plus MSP client onboarding, offboarding, and PSA cross-referencing patterns.
alternative-payments:customers Alternative Payments Alternative Payments customers and their users: customer fields and status, the customer/user relationship, MSP client onboarding, and the destructive archive operation that requires confirmation.
ncentral:organizations Ncentral N-central org units: the service organization -> customer -> site hierarchy, the org-unit vs customer distinction, agent registration tokens (credential-sensitive), and custom properties at both org and device level.
clio:contacts Clio Clio contacts -- the people and companies connected to matters: person vs. company contact types, and how a contact relates to the matters they are party to (client, opposing party, witness, and other roles).

Asset & Device Management

Skills for managing devices, computers, configurations, and assets.

Skill Plugin Description
atera:agents Atera Atera RMM agents: agent records and fields, online/offline status, endpoint search and monitoring, PowerShell and script execution, and agent lifecycle.
atera:devices Atera Atera device monitors: HTTP, SNMP, and TCP monitor types for network devices, services, and applications, plus monitor configuration, thresholds, and polling behavior.
auvik:devices Auvik Auvik device records: device types, manageStatus and onlineStatus, lifecycle and warranty fields, and choosing between the v1 list endpoint and the detailed device endpoints.
blumira:agents Blumira Blumira agents (sensors) and the devices they run on: device inventory and filtering, agent health via last-seen timestamps, and agent deployment keys.
connectwise-automate:computers ConnectWise Automate ConnectWise Automate computer/endpoint management: computer identifiers (ComputerID, Name, ComputerGUID, MAC), status values, OS types, hardware/software inventory, disk, patch, and antivirus status, plus remote management operations.
datto-rmm:devices Datto RMM Datto RMM device management: identifiers (UID, hostname, MAC), device types and statuses, user-defined fields (UDF1-30), warranty data, and device lookup/update/delete operations.
domotz:agents Domotz Domotz agents (collectors/probes) as the per-site entry point for all device and network operations: agent types, lifecycle, ONLINE/OFFLINE status, the list/get tools and their license and last-seen fields, and fleet health, site inventory, and capacity-planning workflows.
domotz:devices Domotz Domotz device inventory: how agents discover and classify devices, the identification attributes (IP, MAC, hostname, display name, vendor), the ONLINE/OFFLINE/UNKNOWN status model, the five device tools — list, get, uptime, history, inventory metadata — and why device lookup is a client-side match rather than a server-side search.
halopsa:agents HaloPSA HaloPSA agents (technicians) and teams as a read-only MCP surface: listing technicians, retrieving agent detail, listing team structures, and the inactive-agent filter.
halopsa:assets HaloPSA HaloPSA asset/CMDB data model: asset (configuration item) fields, device types and statuses, links to clients, sites, users, tickets, and contracts, plus parent-child asset relationships.
hudu:assets Hudu Hudu assets and asset layouts: the layout-as-template model, custom field types, the `custom_fields` key/value array shape, archiving vs deletion, company scoping, and filter patterns across /api/v1/assets and /api/v1/asset_layouts.
huntress:agents Huntress Huntress endpoint agents: the agent lifecycle, organization and platform filters, health signals such as `last_seen_at` and version, fleet-audit workflows, and the errors returned for missing or empty agent results.
it-glue:configurations IT Glue IT Glue configurations (assets) — servers, workstations, network devices, and other infrastructure: configuration types and statuses, network interfaces, related items, warranty/lifecycle fields, and PSA/RMM integration fields.
ninjaone-rmm:devices NinjaOne (NinjaRMM) NinjaOne device management: device details and updates, Windows service control, inventory, maintenance windows, reboot modes, and health-check workflows for Windows, Mac, and Linux endpoints running the NinjaRMM agent.
rocketcyber:agents RocketCyber RocketCyber agent (RocketAgent) deployment, communication status, health monitoring, and troubleshooting: agent installation, online/offline status, agent-to-account mapping, and platform support.
runzero:assets Runzero The runZero asset inventory: searching and browsing assets, asset attributes, OS fingerprinting, hardware details, and network interfaces.
superops:assets SuperOps.ai SuperOps.ai RMM asset inventory: asset status and platform enums, hardware, network, OS and association fields, software inventory, disk usage, patch status, activity history, and the GraphQL queries and script-execution mutations behind them.
syncro:assets Syncro MSP Syncro MSP assets: asset records and fields for hardware, software, and devices, RMM integration, patch management data, and asset search and update operations.
threatlocker:computers Threatlocker ThreatLocker-protected endpoints: fleet inventory, identifying offline agents, a single computer's check-in history, and correlating computers across organizations and groups.
meraki:devices Meraki Cisco Meraki device inventory and lifecycle: serial-based identity, the MX/MS/MR/MV/MG/MT product lines, org inventory vs network assignment, reboot and removal, and device/uplink status via meraki_raw_request.
ncentral:devices Ncentral N-central device records: listing with saved device filters (filterId), asset and warranty lookups, lifecycle reads and updates, and service-monitor status triage on a single device.

Monitoring & Alerts

Skills for alert handling, monitoring, and device status.

Skill Plugin Description
atera:alerts Atera Atera alerts: alert types, severity levels, alert sources, the acknowledge/resolve lifecycle, and alert-to-ticket conversion.
auvik:alerts Auvik Auvik alerts: severity tiers, status lifecycle, dismissal semantics, and the common alertName patterns that show up in MSP NOC queues.
betterstack:monitors BetterStack Better Stack uptime monitors: check types, monitor fields, heartbeat monitors, monitor groups, and create/update/pause/delete operations.
cipp:alerts CIPP CIPP's read-only alerting and audit surface: the cross-tenant alert queue, tenant-scoped M365 unified audit log queries, the audit operations worth filtering on during a compromise investigation, and audit lag/retention behavior.
connectwise-automate:alerts ConnectWise Automate ConnectWise Automate alert management: alert sources (monitors, scripts, events), severity levels, lifecycle states, acknowledgment, resolution, history tracking, and PSA ticket creation from alerts.
connectwise-automate:monitors ConnectWise Automate ConnectWise Automate monitor management: monitor types (internal, remote, agent, SNMP, script), categories, threshold configuration, templates, assignment methods (computer/group/client), and status evaluation.
datto-rmm:alerts Datto RMM Datto RMM alert structure, priorities, and the 25+ alert context types (antivirus_ctx, eventlog_ctx, perf_disk_usage_ctx, ransomware_ctx, and more), each with its own type-specific fields.
domotz:alerts Domotz Domotz alerting configuration: what an alert profile defines, the two tools that read profiles and their per-device bindings, monitoring coverage audits, and the important limit — this server exposes alert configuration only, never fired alerts.
ninjaone-rmm:alerts NinjaOne (NinjaRMM) NinjaOne alerts and the conditions behind them: retrieving device alerts, dismissing individual alerts and bulk resets, alert summaries, severity and priority levels, common hardware/service/security/connectivity alert types and thresholds, alert webhooks, and triage workflows.
pagerduty:alerts PagerDuty PagerDuty alerts: the alert-vs-incident model, alert statuses, grouping modes, event rules for routing and suppression, dedup_key deduplication, and the Events API v2 trigger/acknowledge/resolve payloads.
rootly:alerts Rootly Rootly's alerting layer between monitoring tools and incident management: alert sources and integrations (Datadog, PagerDuty, New Relic, Grafana), routing rules, escalation policies and their acknowledgement windows, suppression, and the conditions under which an alert auto-creates an incident.
sentinelone:alerts SentinelOne SentinelOne's read-only unified alert surface: the list/search/get alert tools plus notes and history, severity levels, status values, view types, GraphQL filter syntax, and cursor-based pagination.
superops:alerts SuperOps.ai SuperOps.ai RMM alerting: alert types, severity levels, status lifecycle and valid transitions, asset/client/monitor associations, and the GraphQL operations for listing, acknowledging, resolving, and converting alerts into tickets.

Automation & Scripts

Skills for running scripts, jobs, and automation workflows.

Skill Plugin Description
connectwise-automate:scripts ConnectWise Automate ConnectWise Automate script management: script types (PowerShell, batch, VBScript, Shell), script folders, script execution on computers, parameter handling and validation, execution status polling, and result/history retrieval.
datto-rmm:jobs Datto RMM Datto RMM job execution: quick jobs vs. scheduled vs. policy jobs, the job status lifecycle, component scripts and their variables, and stdout/stderr/exit-code result handling.
superops:runbooks SuperOps.ai SuperOps.ai RMM script automation: script types and OS targeting, run-as contexts, execution priority, parameterized arguments, single-asset and batch execution, recurring schedules, execution status polling, and exit-code interpretation.

API Patterns

Skills covering authentication, pagination, rate limiting, and error handling.

Skill Plugin Description
abnormal-security:api-patterns Abnormal Security Abnormal Security REST API fundamentals: Bearer token authentication, base URLs, rate limiting, pagination, OData filtering, request/response formats, and error handling.
atera:api-patterns Atera Atera REST API fundamentals: X-API-KEY header authentication, OData-style pagination, the 700 requests/minute rate limit, endpoint conventions, and error handling.
auvik:api-patterns Auvik Auvik MCP fundamentals: the JSON:API envelope shape, basic-auth credential model, region routing, cursor-based pagination, rate-limit handling, and the v1 vs v2 device API distinction.
autotask:api-patterns Autotask PSA Autotask REST API fundamentals: header-based authentication, zone detection, the query/filter DSL (14 operators, logical grouping, includes), pagination, rate limits, and CRUD conventions across the 215+ entity PSA.
kaseya-quote-manager:api-patterns Kaseya Quote Manager Kaseya Quote Manager (Datto Commerce) API fundamentals: API-key auth and the gateway's header translation, the read-only `kqm_<entity>_list`/`_get` tool surface across the sales, procurement, catalog, CRM, and org domains, page/pageSize/modifiedAfter pagination, rate limits, and error codes.
betterstack:api-patterns BetterStack Better Stack MCP and API surface across Uptime, Telemetry (Logtail), and Error Tracking: available tools, Bearer token authentication, API structure, cursor-based pagination, rate limiting, and error handling.
blumira:api-patterns Blumira Blumira REST API fundamentals: JWT authentication, the dual `/org/*` vs `/msp/*` path structure, suffix-based filter operators, pagination parameters and response metadata, the stateful MCP navigation tools, and HTTP error causes.
checkpoint-avanan:api-patterns Checkpoint Avanan Shape of the Checkpoint Harmony Email (Avanan) `hec_*` tool surface: the thirteen tools and what each reaches, the event/entity split that governs which tool accepts which id, the `responseEnvelope`/`responseData` result shape, `scrollId` pagination, and the auth, regional-routing and farm-scope behaviour behind every call.
freshdesk:api-patterns Freshdesk Freshdesk MCP tool surface and REST API v2 fundamentals: header-based authentication via `X-Freshdesk-Domain` and `X-Freshdesk-Api-Key` (which the MCP server translates into upstream HTTP Basic `apikey:X` auth), the `/api/v2` base URL, `page`/`per_page` pagination and the `link` header, per-minute rate limits, the search query language and its 300-result cap, and the status/priority/source integer encodings.
inforcer:api-patterns Inforcer Inforcer MCP fundamentals: the gateway X-Inforcer-Region / X-Inforcer-Api-Key headers, the region-based base URL and upstream Inf-Api-Key header, the /beta/ route prefix, the {success,message,errors,data} response envelope, continuationToken pagination, and the integer Client Tenant ID vs Azure AD GUID gotcha.
connectwise-automate:api-patterns ConnectWise Automate ConnectWise Automate REST API fundamentals: integrator and user+2FA authentication, token lifecycle, pagination, OData-style filtering, rate limiting, and error handling patterns for API integration.
connectwise-cpq:api-patterns ConnectWise CPQ ConnectWise CPQ (Sell/Quosal) API fundamentals: three-part Basic auth built from an access key plus an API key pair, the versioned content type, the flat 25-tool `cpq_*` surface, Manage-style `conditions` filtering, `includeFields` trimming of the 200+ property views, page/pageSize paging over bare arrays, RFC 6902 JSON Patch updates, and the endpoints CPQ deliberately does not expose.
connectwise-psa:api-patterns ConnectWise PSA ConnectWise PSA REST API fundamentals: public/private key + clientId authentication, page/pageSize pagination, the conditions query syntax, rate limiting (60/min), and error-response handling.
datto-rmm:api-patterns Datto RMM Datto RMM REST API v2 fundamentals: OAuth 2.0 client-credentials-style authentication, the 6 regional platforms (Pinotage, Merlot, Concord, Vidal, Zinfandel, Syrah), token lifecycle, cursor-based pagination, rate limiting, Unix-millisecond timestamps, and error handling.
domotz:api-patterns Domotz Domotz API and MCP fundamentals: X-Api-Key header authentication, the region-selected base URL (us-east-1 / eu-central-1), the full 21-tool MCP catalog by domain, the agent-scoped call shape, why there are no pagination arguments, rate limiting, and HTTP error codes.
halopsa:api-patterns HaloPSA HaloPSA REST API fundamentals: OAuth 2.0 client-credentials authentication, authorization vs. resource server URLs, the tenant query parameter, filtering and pagination conventions, array-wrapped POST bodies, rate-limit behavior, scopes, and error codes.
hudu:api-patterns Hudu Hudu REST API fundamentals: x-api-key authentication, base URL and /api/v1/ structure, granular API key permission levels, UI-vs-API resource naming differences, query-parameter filtering, page-based pagination, the 300 req/min rate limit, and HTTP status/error semantics.
huntress:api-patterns Huntress Huntress MCP fundamentals: HTTP Basic Auth via API key/secret headers, the full MCP tool catalog, token-based pagination, the 60 req/min rate limit, and the common HTTP error codes with their causes.
it-glue:api-patterns IT Glue IT Glue REST API fundamentals: JSON:API request/response structure, x-api-key authentication across regional endpoints (US/EU/AU), filter and sort syntax, pagination, sideloading with includes, rate limits, CRUD operations, and error handling.
knowbe4:api-patterns Knowbe4 KnowBe4 REST API fundamentals: Bearer token authentication, multi-region base URLs (US, EU, CA, UK, DE), pagination, rate limiting, error handling, and response formats.
m365:api-patterns Microsoft 365 Microsoft Graph fundamentals shared by every M365 skill: Entra token scopes and the per-request Bearer model, OData query operators and filter syntax, @odata.nextLink pagination, delta queries for incremental sync, 429 throttling and retry behavior, JSON batching, and the common Graph error codes.
ninjaone-rmm:api-patterns NinjaOne (NinjaRMM) NinjaOne Public API fundamentals shared by every other NinjaOne skill: regional base URLs, OAuth 2.0 client-credentials auth and scopes, request shapes, cursor-based pagination, rate-limit headers and 429 handling, HTTP status codes and error response format, and webhook configuration.
pagerduty:api-patterns PagerDuty PagerDuty API and hosted MCP fundamentals: US/EU MCP endpoints, the `Token token=` auth header and token types, the complete 66-tool reference across 13 categories (incidents, on-call, schedules, escalation policies, services, event orchestrations, status pages, teams, users, and more), offset pagination, common filter parameters, rate limits, and error codes.
pandadoc:api-patterns PandaDoc PandaDoc hosted MCP server and API fundamentals: API-key authentication and which operations work without a key, the complete MCP tool catalog (documents, templates, recipients, docs search, code samples), page-based pagination, document and template filters, rate limits per plan, and error codes.
warmly:api-patterns Warmly Warmly's remote MCP server: WorkOS AuthKit OAuth 2.0 + PKCE authentication, RFC 9728 protected-resource metadata, multi-organization scoping, the stateful Streamable HTTP session model, the three read-only visitor-intelligence tools and their fields, credit semantics, error codes, and rate-limit guidance.
pax8:api-patterns Pax8 Pax8 MCP fundamentals: the official hosted MCP server connection, all 15 Pax8 MCP tools and their parameters, pagination, sorting, filtering, response shapes, rate limiting, and error handling.
proofpoint:api-patterns Proofpoint Proofpoint API fundamentals: HTTP Basic Auth with service principal and secret, base URLs and versioning across TAP SIEM, People, Quarantine, Forensics, and URL Defense APIs, rate limits, pagination patterns, and error handling.
quickbooks-online:api-patterns QuickBooks Online QuickBooks Online API fundamentals: OAuth2 authentication and token lifecycle, REST structure and base URLs, the Intuit query language, pagination, minor version headers, SyncToken optimistic locking, rate limits, webhooks, and the Fault error object format.
rocketcyber:api-patterns RocketCyber RocketCyber REST API v3 fundamentals: Bearer token authentication, regional base URL selection, pagination, rate limiting, error handling, and account hierarchy navigation.
rootly:api-patterns Rootly The Rootly hosted MCP server and the JSON:API REST surface behind it: Global vs.
runzero:api-patterns Runzero runZero API fundamentals: the available MCP tools, Bearer-token authentication, the Export API for bulk retrieval, pagination, rate-limit headers, error codes, and the runZero query language.
salesbuildr:api-patterns SalesBuildr Salesbuildr API fundamentals: api-key header authentication, offset-based from/size pagination, error handling, and the 500 requests per 10 minutes rate limit.
sentinelone:api-patterns SentinelOne The SentinelOne Purple MCP server and the APIs behind it: uvx installation and transport modes, Service User token levels, the 23 read-only tools organized by domain, and the dual GraphQL (cursor pagination) / REST (offset pagination) architecture with its differing filter syntaxes, rate limits, and error causes.
sherweb:api-patterns Sherweb Sherweb Partner API fundamentals: OAuth 2.0 client-credentials auth, token caching, subscription-key header, scopes and base URLs, endpoint and MCP tool catalog, page-based pagination, Accept-Language localization, rate limits, and error codes.
superops:api-patterns SuperOps.ai SuperOps.ai GraphQL API fundamentals: Bearer token plus CustomerSubDomain header auth, region-specific endpoints, request/variable structure, cursor pagination, the 800 req/min rate limit, filter operators, UTC date handling, error codes, and null-reset semantics.
syncro:api-patterns Syncro MSP Syncro MSP REST API fundamentals: API key setup and authentication, request and response patterns, pagination, rate limiting, and error handling.
blackpoint:api-patterns Blackpoint Blackpoint Cyber (CompassOne) MCP fundamentals: API-token header auth and its internal Bearer forwarding, the partner-tenant-asset hierarchy, navigation tools, which tool domains are functional versus stubbed, pagination, and HTTP error causes.
saas-alerts:api-patterns Saas Alerts SaaS Alerts MCP fundamentals: API-key authentication via the gateway header, the MSP → customer → account → user hierarchy, navigation and functional tool naming, event filter parameters, cursor pagination, and HTTP error codes.
crewhu:api-patterns Crewhu Crewhu MCP fundamentals: token authentication via the `X-Crewhu-Api-Token` header and its gateway env-var mapping, the flat 18-tool surface across the surveys, users, badges, and prizes domains (only `crewhu_badges_update_contest` writes), pagination, and error codes.
immybot:api-patterns Immybot ImmyBot MCP fundamentals: Entra ID OAuth 2.0 client-credentials auth (four fields), the `immybot_<domain>_<action>` tool naming and domain list, the two-step desired-state deployment model, the four destructive operations that need explicit confirmation, task/session polling cadence, and HTTP error codes.
timezest:api-patterns Timezest TimeZest MCP fundamentals: Bearer token authentication, the navigation pattern, scheduling-request payloads that carry PSA associated_entities (ConnectWise / Autotask / Halo ticket IDs), and the polling-only update model (no webhooks).
threatlocker:api-patterns Threatlocker ThreatLocker Portal API fundamentals: raw-key authentication (no Bearer prefix), multi-tenant routing via the organizationId header, POST-based "GetByParameters" list endpoints, pagination shape, and child-organization fan-out patterns.
kaseya-vsa:api-patterns Kaseya Vsa Kaseya VSA REST API fundamentals: two-step token-based authentication, the /api/v1.0 surface, pagination ($skip/$top) and filtering ($filter), the request/response envelope, error codes, and Kaseya One SSO bearer-token auth for unified-login tenants.
datto-bcdr:api-patterns Datto Bcdr Datto BCDR (Backup Portal) REST API fundamentals: public/private key HMAC-SHA256 request signing, the /v1 endpoint surface, pagination, appliance/agent hierarchy, and screenshot verification retrieval.
kaseya-bms:api-patterns Kaseya Bms Kaseya BMS PSA REST API v2 fundamentals: tenant subdomain routing, API-token bearer auth, Kaseya One SSO bridging, ticket and account workflows, and OData-style pagination.
datto-saas-protection:api-patterns Datto Saas Protection Datto SaaS Protection (formerly Backupify) REST API fundamentals: regional base URLs, bearer-token auth, the seat/tenant object model, backup status queries, and restore operations.
unitrends:api-patterns Unitrends Unitrends Backup REST API fundamentals: session-token login exchange, the appliance-vs-asset hierarchy, backup job status queries, recovery point listing, and replication state.
spanning:api-patterns Spanning Spanning Cloud Backup REST API fundamentals: admin-email + API-token auth, the per-platform endpoint surface (M365, Google Workspace, Salesforce), the user/license model, backup status queries, and restore operations.
hubspot:api-patterns HubSpot CRM HubSpot's official remote MCP server and the CRM Search API behind it: the complete MCP tool catalog, OAuth 2.0 + PKCE connection over Streamable HTTP, automatic scope derivation, sensitive-data (PHI) exclusion, filter/sort/ pagination syntax, plan-tier rate limits, and error handling.
spamtitan:api-patterns Spamtitan SpamTitan MCP fundamentals: the available tool catalog and its exact parameters, API-key header authentication, API structure, pagination, rate limiting, and error handling.
xero:api-patterns Xero Xero Accounting API fundamentals: OAuth2 Custom Connection (client credentials) auth and scopes, the xero-tenant-id header, where-clause filter syntax, page-based pagination, rate limits, the two date formats, validation-error shape, and batch operations.
alternative-payments:api-patterns Alternative Payments Alternative Payments API fundamentals: OAuth2 client-credentials token minting and bearer auth, scopes, REST endpoint structure, cursor pagination, the 5 req/sec rate limit, idempotency, error handling, and the read + safe-write capability posture that deliberately excludes direct payment creation.
ironscales:api-patterns Ironscales Ironscales MCP fundamentals: API-key plus company-ID header authentication and the per-tenant scoping that follows from it, the nine tools this server registers and what each one actually changes, offset/limit pagination without a total count, rate-limit behavior, and how API failures surface to the model.
mimecast:api-patterns Mimecast Mimecast MCP fundamentals: the available tool catalog, OAuth 2.0 client-credentials authentication, regional API endpoints, pagination, rate limiting, and error handling.
meraki:api-patterns Meraki Cisco Meraki MCP fundamentals: the full tool catalog, gateway header authentication, Dashboard API v1 structure, Link-header cursor pagination, per-org rate limiting, the read-only / confirm_destructive_action safety model, the meraki_raw_request escape hatch, and error handling.
ncentral:api-patterns Ncentral N-central MCP fundamentals: User-API Token (JWT) authentication through Conduit, 1-based pagination with the totalItems/totalPages envelope, rate-limit behavior, preview-endpoint caveats, and on-prem server specifics.
clio:api-patterns Clio Clio Manage MCP fundamentals: OAuth 2.0 Authorization Code connection via Conduit, region selection, the matters-as-hub data model, decision-tree tool navigation, pagination, and the deliberate v1 scope limits (no delete anywhere, documents metadata-only, communications/calendar/bills read-only).
scalepad:api-patterns Scalepad ScalePad MCP fundamentals: API-key authentication via the `X-ScalePad-Api-Key` header, tool discovery across the five product domains, cursor pagination, the 50-requests-per-5-seconds rate limit, and 402 subscription errors.

All Skills by Plugin

Abnormal Security

Skill Description
cases Abnormal Security abuse mailbox cases: user-reported email submissions, case statuses and judgments, the case lifecycle, bulk and remediation actions, and phishing simulation handling.
messages Abnormal Security message analysis: message retrieval, email header inspection, attachments, sender reputation, delivery context, and SPF/DKIM/DMARC authentication results.
threats Abnormal Security threat detection: threat types (BEC, phishing, malware, socially-engineered attacks, spam, graymail, credential theft), attack vectors, severity assessment, remediation actions, and investigation workflows.
api-patterns Abnormal Security REST API fundamentals: Bearer token authentication, base URLs, rate limiting, pagination, OData filtering, request/response formats, and error handling.

Atera

Skill Description
agents Atera RMM agents: agent records and fields, online/offline status, endpoint search and monitoring, PowerShell and script execution, and agent lifecycle.
alerts Atera alerts: alert types, severity levels, alert sources, the acknowledge/resolve lifecycle, and alert-to-ticket conversion.
customers Atera customers and contacts: customer records and fields, contact management, custom fields, and customer lifecycle operations.
devices Atera device monitors: HTTP, SNMP, and TCP monitor types for network devices, services, and applications, plus monitor configuration, thresholds, and polling behavior.
tickets Atera service desk tickets: ticket fields, statuses, priorities, comments, work hours, and billing duration.
api-patterns Atera REST API fundamentals: X-API-KEY header authentication, OData-style pagination, the 700 requests/minute rate limit, endpoint conventions, and error handling.

Auvik

Skill Description
alerts Auvik alerts: severity tiers, status lifecycle, dismissal semantics, and the common alertName patterns that show up in MSP NOC queues.
devices Auvik device records: device types, manageStatus and onlineStatus, lifecycle and warranty fields, and choosing between the v1 list endpoint and the detailed device endpoints.
networks Auvik network and interface entities: the network entity model, IP-range scoping, interface-to-device relationships, and adminStatus vs operStatus.
api-patterns Auvik MCP fundamentals: the JSON:API envelope shape, basic-auth credential model, region routing, cursor-based pagination, rate-limit handling, and the v1 vs v2 device API distinction.

Autotask PSA

Skill Description
billing Autotask billing item retrieval, approval-level workflows, and invoice search — covering billing item types, approval status filtering, and reconciliation of billable work against invoices for MSP finance teams.
configuration-items Autotask Configuration Item (CI) asset management: CI types and categories, lifecycle status codes, the CI field schema, related-item relationships, DNS records, notes, and contract/billing associations for MSP infrastructure tracking.
contracts Autotask contract and service agreement management - contract types (recurring services, block hours, time & materials, fixed price, retainer), service/service bundle associations, SLAs, and how contracts drive billing for MSP account managers.
crm Autotask CRM entities - companies (accounts), contacts, and sites/locations - including field references, company type classifications, and how these records underpin tickets, contracts, and projects for MSP account management.
expenses Autotask expense report and expense item structure - the report/item parent-child relationship, approval status workflow, expense categories, payment types, and the billable vs reimbursable distinction for MSP operational expenses.
picklists Autotask picklist and reference-data lookups — queues, ticket statuses, ticket priorities, and project phases — the instance-specific configured values required before creating or filtering tickets and other entities.
product-catalog Autotask product catalog structure - Products, Services, and Service Bundles - and how Price Lists override default unit pricing.
projects Autotask project structure - projects, phases, tasks, and milestones - including project and task fields, status values, resource assignment, and how project work links to contract billing for MSP project managers.
quotes Autotask quote structure and line items - quote item types (product, service, service bundle, labor, expense, shipping), the mutually-exclusive catalog reference rules, and the three discount mechanisms (unit, line, percentage) used to build customer proposals.
service-calls Autotask Service Call data model - the ServiceCall / ServiceCallTicket / ServiceCallTicketResource three-layer structure - covering fields, status codes, and how tickets and technicians (resources) are linked to scheduled work.
ticket-notes-attachments Autotask ticket notes, attachments, and charges — the secondary entities attached to tickets: retrieving/searching notes and attachments, and creating, updating, or searching ticket charges for labor and expenses billed directly to a ticket.
tickets Autotask ticket lifecycle: status/priority codes and transition rules, the ticket field schema, SLA calculation and clock behavior, escalation rules, ticket metrics, and the MCP tool surface (create, update, search, history, notes) for MSP service desk operations.
time-entries Autotask time entry structure: approval status codes and workflow, the time entry field schema, the billing rate hierarchy, budget and contract-limit validation, utilization analytics, and the MSP business rules for rounding and minimum billing increments.
tool-discovery The Autotask MCP lazy-loading pattern - four meta-tools (list_categories, list_category_tools, execute_tool, router) that expose the full 39+ tool catalog progressively instead of loading every tool schema upfront, plus the natural-language router for intent-based tool lookup.
api-patterns Autotask REST API fundamentals: header-based authentication, zone detection, the query/filter DSL (14 operators, logical grouping, includes), pagination, rate limits, and CRUD conventions across the 215+ entity PSA.

Kaseya Quote Manager

Skill Description
purchasing Kaseya Quote Manager procurement data: purchase orders with their lines and costs, the suppliers they are placed with, and product-supplier records mapping catalog products to supplier SKUs and pricing.
quotes Kaseya Quote Manager quoting data: the quote → section → line item hierarchy, and the sales orders, order lines, and payments a quote becomes once accepted.
api-patterns Kaseya Quote Manager (Datto Commerce) API fundamentals: API-key auth and the gateway's header translation, the read-only `kqm_<entity>_list`/`_get` tool surface across the sales, procurement, catalog, CRM, and org domains, page/pageSize/modifiedAfter pagination, rate limits, and error codes.

BetterStack

Skill Description
incidents Better Stack incidents: incident records raised by uptime monitors or reported manually, and the triage, acknowledgment, and resolution lifecycle.
logging Better Stack log management (Logtail): log sources, structured log search and query syntax, log-based alerting, and log analysis workflows.
monitors Better Stack uptime monitors: check types, monitor fields, heartbeat monitors, monitor groups, and create/update/pause/delete operations.
oncall Better Stack on-call: on-call calendars and rotations, escalation and notification policies, alert routing, and determining who is currently on call.
status-pages Better Stack status pages: status page configuration, resources and components, maintenance windows, and public service-status communication.
api-patterns Better Stack MCP and API surface across Uptime, Telemetry (Logtail), and Error Tracking: available tools, Bearer token authentication, API structure, cursor-based pagination, rate limiting, and error handling.

Blumira

Skill Description
agents Blumira agents (sensors) and the devices they run on: device inventory and filtering, agent health via last-seen timestamps, and agent deployment keys.
findings The Blumira finding lifecycle: status and severity codes, resolution types, list filtering, enriched detail retrieval, assignment, and comment threads.
msp Blumira's MSP path group (`/msp/*`): managed-account enumeration, cross-account and per-account finding queries, per-account device, agent-key and user management, and how MSP paths differ from org paths.
resolutions Blumira resolution types (Valid, Not Applicable, False Positive): how to choose between them, their effect on security metrics and detection tuning, and the org- and MSP-level resolve calls.
users Blumira organization users: listing and filtering users, user roles, and looking up the user IDs required for finding assignment and access audits.
api-patterns Blumira REST API fundamentals: JWT authentication, the dual `/org/*` vs `/msp/*` path structure, suffix-based filter operators, pagination parameters and response metadata, the stateful MCP navigation tools, and HTTP error causes.

Checkpoint Avanan

Skill Description
exceptions The Checkpoint Harmony Email (Avanan) whitelist and blacklist surface: the match fields and matching modes an exception accepts, the defaults that widen an entry beyond what was typed, the id mismatch between listing and editing, and the standing security consequence of a detection bypass.
quarantine Finding and acting on mail in Checkpoint Harmony Email (Avanan): the `hec_search_emails` attribute-filter syntax, what an entity payload carries, the asynchronous quarantine and restore actions and their task polling, and the judgement a restore requires because delivery cannot be undone.
threats The Checkpoint Harmony Email (Avanan) security-event surface: the event type, state, severity and SaaS enums accepted by `hec_query_events`, what a detection record does and does not carry, how `availableEventActions` governs what you can do next, and phishing, BEC and malware triage built on those fields.
api-patterns Shape of the Checkpoint Harmony Email (Avanan) `hec_*` tool surface: the thirteen tools and what each reaches, the event/entity split that governs which tool accepts which id, the `responseEnvelope`/`responseData` result shape, `scrollId` pagination, and the auth, regional-routing and farm-scope behaviour behind every call.

CIPP

Skill Description
alerts CIPP's read-only alerting and audit surface: the cross-tenant alert queue, tenant-scoped M365 unified audit log queries, the audit operations worth filtering on during a compromise investigation, and audit lag/retention behavior.
groups Tenant-scoped Entra/M365 group enumeration and creation in CIPP, the four group types (Security, Microsoft 365, Distribution, Mail-Enabled Security) and when to pick each, and the boundary where CIPP's group surface ends and Graph/M365 takes over.
licenses Read-only M365 license visibility through CIPP: per-tenant SKU purchase vs. consumption, portfolio-wide CSP license commitments, common SKU part numbers and their friendly names, and the license-mix red flags that drive rightsizing and billing reconciliation.
mailboxes The four Exchange Online mailbox operations CIPP exposes — mailbox inventory, delegate/full-access permission audit, out-of-office, and email forwarding — plus the BEC-remediation, offboarding, and leave-coverage sequences built from them.
ops CIPP's own operational layer rather than the tenants it manages: GDAP role definitions and pending invites, the CIPP scheduler, and the ping/version/log endpoints used to diagnose why other CIPP tools fail silently.
security Read-only access to a tenant's Conditional Access policy graph and named locations through CIPP: policy state semantics, the findings that matter in a CA review, portfolio drift detection, and why CA writes are absent from the MCP surface.
standards CIPP's tenant-baseline enforcement model: the Report/Alert/Remediate standards modes and how to roll them out, on-demand standards evaluation, Best Practice Analyser reports, and SPF/DKIM/DMARC domain health results with their remediation actions.
tenants The top-level CIPP scope: enumerating managed M365 tenants, retrieving tenant detail, and the accepted `tenantFilter` identifier formats (default domain, custom domain, GUID, `allTenants`).
users The full multi-tenant M365 user lifecycle in CIPP: create/edit/disable, password and MFA resets, session revocation, the bundled offboarding call, BEC investigation reports, MFA gap reporting, and device/group lookups — plus the ordering constraints that make each sequence correct.

Freshdesk

Skill Description
contacts-companies Freshdesk contacts and companies: contact fields and the required contact-channel rule, contact CRUD plus merge and make_agent, company fields and domain-based auto-association, search and autocomplete lookups, and the MSP workflow of resolving a ticket requester to a contact and then to its parent company through the Freshdesk REST API v2.
knowledge-base Freshdesk Solutions knowledge base: the three-level categories -> folders -> articles hierarchy, article fields and draft/published status, finding an article by walking that tree (there is no KB search tool), and the MSP workflow of suggesting relevant KB articles to deflect or resolve a ticket, through the Freshdesk REST API v2.
sla-business-hours Freshdesk SLA policies and business-hours calendars: policy and calendar fields, per-priority respond_within / resolve_within targets, how the business-hours vs 24x7 clock computes a ticket's fr_due_by and due_by, and breach / at-risk detection through the Freshdesk REST API v2.
ticketing Freshdesk ticket operations: list, get, search, create, update, reply, notes, and conversation threads.
api-patterns Freshdesk MCP tool surface and REST API v2 fundamentals: header-based authentication via `X-Freshdesk-Domain` and `X-Freshdesk-Api-Key` (which the MCP server translates into upstream HTTP Basic `apikey:X` auth), the `/api/v2` base URL, `page`/`per_page` pagination and the `link` header, per-minute rate limits, the search query language and its 300-result cap, and the status/priority/source integer encodings.

Inforcer

Skill Description
assessments Inforcer assessments: listing a tenant's assessments (read-only) and triggering an assessment run — the one mutating action in the entire Inforcer surface.
audit-events Inforcer's read-only record of changes and activity: searching and filtering auditEvents by type and date window (the search is account-wide — there is no tenant filter), enumerating the event-type catalog to build valid filters, and the continuationToken paging audit searches require.
baseline-alignment Inforcer's core drift-detection surface: baseline templates, tenant alignment scores, alignment details (the per-policy breakdown of a tenant against its assigned baseline), and reading deployed tenant policy state.
compliance-reporting Inforcer compliance and posture reporting: per-tenant Microsoft 365 secure scores, combining them with alignment scores, and the alignedThreshold / semiAlignedThreshold settings that classify each tenant or policy as aligned, semi-aligned, or drifted.
identity-governance Inforcer's read-only identity inventory for a managed Microsoft 365 tenant: users, groups, and role assignments.
tenant-management Inforcer's managed Microsoft 365 tenant list and the resolution step that turns a friendly name, DNS domain, or Azure AD GUID into the integer Client Tenant ID.
api-patterns Inforcer MCP fundamentals: the gateway X-Inforcer-Region / X-Inforcer-Api-Key headers, the region-based base URL and upstream Inf-Api-Key header, the /beta/ route prefix, the {success,message,errors,data} response envelope, continuationToken pagination, and the integer Client Tenant ID vs Azure AD GUID gotcha.

ConnectWise Automate

Skill Description
alerts ConnectWise Automate alert management: alert sources (monitors, scripts, events), severity levels, lifecycle states, acknowledgment, resolution, history tracking, and PSA ticket creation from alerts.
clients ConnectWise Automate client management: client CRUD, client identifiers, locations, client hierarchy, groups, extra data fields (EDFs), and client-level settings.
computers ConnectWise Automate computer/endpoint management: computer identifiers (ComputerID, Name, ComputerGUID, MAC), status values, OS types, hardware/software inventory, disk, patch, and antivirus status, plus remote management operations.
monitors ConnectWise Automate monitor management: monitor types (internal, remote, agent, SNMP, script), categories, threshold configuration, templates, assignment methods (computer/group/client), and status evaluation.
scripts ConnectWise Automate script management: script types (PowerShell, batch, VBScript, Shell), script folders, script execution on computers, parameter handling and validation, execution status polling, and result/history retrieval.
api-patterns ConnectWise Automate REST API fundamentals: integrator and user+2FA authentication, token lifecycle, pagination, OData-style filtering, rate limiting, and error handling patterns for API integration.

ConnectWise CPQ

Skill Description
quote-items ConnectWise CPQ line items and the tabs that hold them: searching items by quote or tab, the tab requirement on every create, the pricing and margin fields, bundle and optional-line flags, recurring-revenue and PSA mapping fields, JSON Patch updates, and why there is no product catalog to search.
quotes The ConnectWise CPQ quote lifecycle over the real tool surface: searching quotes, the GUID-vs-quoteNumber dual addressing, versions, creating quotes by copying a template (the API's only create path), patching quote fields, the per-quote customer records and payment/financing terms, tabs as the section structure, and the deletes that cascade.
api-patterns ConnectWise CPQ (Sell/Quosal) API fundamentals: three-part Basic auth built from an access key plus an API key pair, the versioned content type, the flat 25-tool `cpq_*` surface, Manage-style `conditions` filtering, `includeFields` trimming of the 200+ property views, page/pageSize paging over bare arrays, RFC 6902 JSON Patch updates, and the endpoints CPQ deliberately does not expose.

ConnectWise PSA

Skill Description
companies ConnectWise PSA company/account management: company types, statuses, sites/locations, custom fields, and company relationships.
contacts ConnectWise PSA contact management: contact records, contact types, communication items (email, phone), portal access, and relationships to companies.
product-catalog ConnectWise PSA product catalog: catalog items (SKUs), categories, subcategories, manufacturers, and their use on quotes, opportunities, agreements, and tickets.
projects ConnectWise PSA project management: project lifecycle and status/type values, phases, templates, resource/team allocation, budgeting, billing methods, and project tickets.
tickets ConnectWise PSA ticket management: ticket fields, service boards, statuses, priorities, SLAs, ticket notes, and workflow automation.
time-entries ConnectWise PSA time entry management: charge-to types (tickets, projects, charge codes), billable vs non-billable time, work types and work roles, time sheets, and the time entry approval workflow.
api-patterns ConnectWise PSA REST API fundamentals: public/private key + clientId authentication, page/pageSize pagination, the conditions query syntax, rate limiting (60/min), and error-response handling.

Datto RMM

Skill Description
alerts Datto RMM alert structure, priorities, and the 25+ alert context types (antivirus_ctx, eventlog_ctx, perf_disk_usage_ctx, ransomware_ctx, and more), each with its own type-specific fields.
audit Datto RMM audit data structure covering hardware inventory (CPU, RAM, disks, motherboard, BIOS), software inventory, network interfaces, and ESXi/printer audits, along with audit collection cadence and data freshness semantics.
devices Datto RMM device management: identifiers (UID, hostname, MAC), device types and statuses, user-defined fields (UDF1-30), warranty data, and device lookup/update/delete operations.
jobs Datto RMM job execution: quick jobs vs. scheduled vs. policy jobs, the job status lifecycle, component scripts and their variables, and stdout/stderr/exit-code result handling.
sites Datto RMM site management: site hierarchy and identifiers, proxy and patch-window settings, site-scoped device/alert queries, and create/update/delete operations for client locations.
variables Datto RMM account-level and site-level variables: scoping and inheritance (site overrides account), naming conventions and reserved prefixes, CRUD operations, and referencing variables from component scripts.
api-patterns Datto RMM REST API v2 fundamentals: OAuth 2.0 client-credentials-style authentication, the 6 regional platforms (Pinotage, Merlot, Concord, Vidal, Zinfandel, Syrah), token lifecycle, cursor-based pagination, rate limiting, Unix-millisecond timestamps, and error handling.

Domotz

Skill Description
agents Domotz agents (collectors/probes) as the per-site entry point for all device and network operations: agent types, lifecycle, ONLINE/OFFLINE status, the list/get tools and their license and last-seen fields, and fleet health, site inventory, and capacity-planning workflows.
alerts Domotz alerting configuration: what an alert profile defines, the two tools that read profiles and their per-device bindings, monitoring coverage audits, and the important limit — this server exposes alert configuration only, never fired alerts.
devices Domotz device inventory: how agents discover and classify devices, the identification attributes (IP, MAC, hostname, display name, vendor), the ONLINE/OFFLINE/UNKNOWN status model, the five device tools — list, get, uptime, history, inventory metadata — and why device lookup is a client-side match rather than a server-side search.
network Domotz network observation: the collector's topology graph, its own interfaces, detected IP conflicts, and the two SNMP surfaces — polled variables and custom sensors — with their history endpoints and the tools and error modes for each.
power Domotz PDU and smart-outlet control: listing outlets and their power state, and the one non-GET tool the Domotz server exposes — switching an outlet on, off, or cycling it.
api-patterns Domotz API and MCP fundamentals: X-Api-Key header authentication, the region-selected base URL (us-east-1 / eu-central-1), the full 21-tool MCP catalog by domain, the agent-scoped call shape, why there are no pagination arguments, rate limiting, and HTTP error codes.

HaloPSA

Skill Description
agents HaloPSA agents (technicians) and teams as a read-only MCP surface: listing technicians, retrieving agent detail, listing team structures, and the inactive-agent filter.
assets HaloPSA asset/CMDB data model: asset (configuration item) fields, device types and statuses, links to clients, sites, users, tickets, and contracts, plus parent-child asset relationships.
clients HaloPSA CRM data model: client records and their billing/contact fields, sites (locations), contacts (Users), client classification, and parent-child client hierarchy.
contracts HaloPSA contract management: contract types (recurring, prepaid hours, ad-hoc, project, warranty), statuses, billing and coverage fields, recurring invoice items, prepaid hour balances and deduction, SLA association, renewal and billing-reconciliation workflows.
invoices HaloPSA invoices as a read-only MCP surface: listing by client or date range, filtering by payment and send status, retrieving line-item detail on a single invoice, and the reporting and reconciliation workflows built on them.
tickets HaloPSA service desk tickets: ticket fields, statuses, priorities and ticket types, actions (notes and time entries), attachments, SLA behaviour, and the creation and status-transition workflows with their validation rules.
api-patterns HaloPSA REST API fundamentals: OAuth 2.0 client-credentials authentication, authorization vs. resource server URLs, the tenant query parameter, filtering and pagination conventions, array-wrapped POST bodies, rate-limit behavior, scopes, and error codes.

Hudu

Skill Description
articles Hudu knowledge base articles: HTML content format, company-scoped vs global articles, article folders (including nesting), drafts vs published, the /api/v1/articles endpoint surface, and search, templating, and documentation-health patterns.
assets Hudu assets and asset layouts: the layout-as-template model, custom field types, the `custom_fields` key/value array shape, archiving vs deletion, company scoping, and filter patterns across /api/v1/assets and /api/v1/asset_layouts.
companies Hudu companies (clients/organizations): company field reference, parent/child hierarchy, PSA integration matching via id_in_integration, the /api/v1/companies CRUD plus archive/unarchive endpoints, onboarding and offboarding workflows, and how companies scope assets, passwords, articles, and websites.
passwords Hudu secure credential storage: the /api/v1/asset_passwords endpoint (the UI calls these "Passwords"), company scoping and password folders, TOTP secrets, per-API-key password permissions, activity-log auditing, rotation workflows, and output-safety rules for handling plaintext credential values.
websites Hudu website records: CRUD via /api/v1/websites, monitoring and pause/disable fields, SSL/TLS certificate tracking, email security status (DMARC, DKIM, SPF), DNS record fields, company linkage, and website validation errors.
api-patterns Hudu REST API fundamentals: x-api-key authentication, base URL and /api/v1/ structure, granular API key permission levels, UI-vs-API resource naming differences, query-parameter filtering, page-based pagination, the 300 req/min rate limit, and HTTP status/error semantics.

Huntress

Skill Description
agents Huntress endpoint agents: the agent lifecycle, organization and platform filters, health signals such as `last_seen_at` and version, fleet-audit workflows, and the errors returned for missing or empty agent results.
billing Huntress billing and summary reports: what each report type contains, the list/get tools for both, and the monthly reconciliation, QBR security summary, and cost-analysis workflows an MSP builds from them.
escalations Huntress SOC escalations: how an escalation differs from an incident, escalation priority levels, the list/get/resolve tools, escalation-to-incident correlation, and the already-resolved and not-found error cases.
incidents Huntress incidents and the remediation lifecycle: querying incidents by organization and status, SOC-recommended remediation details, individual and bulk approve/reject, remediation execution status, and the ordering constraint that incidents resolve only after all remediations are processed.
organizations Huntress organizations as the multi-tenant boundary: org structure, the organization key used for agent deployment, full CRUD operations, client onboarding and offboarding workflows, and the duplicate-key and active-agent deletion errors.
signals Huntress security signals: how signals differ from incidents, the signal types, listing and filtering by organization, and the threat-hunting and pattern-analysis workflows built on signal data.
api-patterns Huntress MCP fundamentals: HTTP Basic Auth via API key/secret headers, the full MCP tool catalog, token-based pagination, the 60 req/min rate limit, and the common HTTP error codes with their causes.

IT Glue

Skill Description
configurations IT Glue configurations (assets) — servers, workstations, network devices, and other infrastructure: configuration types and statuses, network interfaces, related items, warranty/lifecycle fields, and PSA/RMM integration fields.
contacts IT Glue contacts — the people (clients, vendors, partners) associated with an organization.
documents IT Glue documents: rich-HTML documentation records scoped to an organization, including document folders, multi-section content via the Document Sections API, embedded passwords/configurations/images, and related-item links to other IT Glue resources.
flexible-assets IT Glue flexible assets: custom, instance-specific asset types with defined field schemas (text, tag, password, upload, etc.), traits-based instances, and tag fields that cross-link to configurations, contacts, and other IT Glue resources for structured, filterable documentation.
organizations IT Glue organizations (companies/clients): the foundational entity all documentation, configurations, contacts, passwords, and flexible assets attach to.
passwords IT Glue passwords: secure, organization-scoped credential storage with categories, folders, restricted-access flags, OTP secrets, and embedding into documents and flexible assets.
api-patterns IT Glue REST API fundamentals: JSON:API request/response structure, x-api-key authentication across regional endpoints (US/EU/AU), filter and sort syntax, pagination, sideloading with includes, rate limits, CRUD operations, and error handling.

Knowbe4

Skill Description
phishing KnowBe4 phishing simulations: campaign creation and lifecycle, security test management, recipient interaction tracking (sent, opened, clicked, reported), phish-prone percentage calculation, template selection, landing pages, and click tracking.
reporting KnowBe4 security awareness reporting: phishing summary statistics, training completion rates, risk score overviews, trend analysis, organizational benchmarks, and executive dashboards, including how to interpret metrics and communicate posture to stakeholders.
training KnowBe4 training campaign management: campaign lifecycle, enrollment workflows, completion tracking, training module and content library browsing, store purchases, and compliance deadline monitoring.
users KnowBe4 user and group management: user lifecycle and status, group creation and membership, risk scores and risk score history, user event tracking, provisioning, and group-based targeting for campaigns.
api-patterns KnowBe4 REST API fundamentals: Bearer token authentication, multi-region base URLs (US, EU, CA, UK, DE), pagination, rate limiting, error handling, and response formats.

Liongard

Skill Description
detections Liongard's change and anomaly detection layer: detections generated by inspection-to-inspection comparison, detection types/severities/status lifecycle, configurable alert rules and notification channels, custom metrics with JMESPath expressions and threshold evaluation, and the platform timeline audit trail.
environments Liongard environments — the per-customer containers that own all agents, launchpoints, systems, detections, and metrics.
inspections Liongard's inspection pipeline: inspector templates and their credential and agent requirements, launchpoint configuration that binds inspector + environment + agent + credentials + cron schedule, on-demand inspection runs and their status lifecycle, and the failure modes behind failed runs.
overview Liongard platform fundamentals: the entity model (environments, agents, inspectors, launchpoints, systems, detections, metrics, timeline, dataprints, asset inventory), X-ROAR-API-KEY authentication against instance-scoped URLs, the split between the v1 and v2 APIs, and the shared pagination, filtering, and rate-limit conventions.
systems Liongard systems — the assets discovered by inspections — plus their detail data (raw configuration JSON with historical snapshots), dataprint extraction via JMESPath expressions, and the v2 Asset Inventory identity and device profiles that correlate one entity across multiple inspectors.

Microsoft 365

Skill Description
calendar Exchange Online calendars through Microsoft Graph: event retrieval and date-range queries, free/busy and availability lookup, meeting and Teams-meeting creation, room and equipment resource bookings, calendar permissions, and the Graph scopes and error causes involved.
files OneDrive personal storage and SharePoint document libraries, both reached through the shared Microsoft Graph `/drives` endpoint: drive and item addressing, sharing permissions, storage quotas, file search, and the offboarding file-transfer workflow.
licensing The M365 subscription → SKU → service-plan model, seat availability versus consumption, assigning and removing licenses through Graph, the audit workflow for finding unused or misallocated seats, common SKU GUIDs, and licensing error causes.
mailboxes Exchange Online mailboxes through Microsoft Graph: the four mailbox types and how they differ, message listing and search, inbox rules, out-of-office and forwarding, mailbox size and quota, shared-mailbox access management, and mail flow diagnostics.
security The M365 tenant security checks that distinguish a secure tenant from a vulnerable one: per-user authentication-method inspection for real MFA enrollment, sign-in risk and risky users, suspicious inbox rules, legacy authentication exposure, conditional access coverage, Secure Score, and the indicator set for a compromised account.
teams Microsoft Teams through Microsoft Graph: the Team/Channel/Member/Meeting/Tab object model, team and channel enumeration, membership and ownership changes, online meetings, usage reporting, and the causes behind Teams access failures.
users The Entra ID user object as M365's central identity: key properties and their MSP relevance, account status values, the license assignment model, Graph patterns for listing/searching/creating/disabling users, MFA status checking, and the onboarding and offboarding sequences.
api-patterns Microsoft Graph fundamentals shared by every M365 skill: Entra token scopes and the per-request Bearer model, OData query operators and filter syntax, @odata.nextLink pagination, delta queries for incremental sync, 429 throttling and retry behavior, JSON batching, and the common Graph error codes.

NinjaOne (NinjaRMM)

Skill Description
alerts NinjaOne alerts and the conditions behind them: retrieving device alerts, dismissing individual alerts and bulk resets, alert summaries, severity and priority levels, common hardware/service/security/connectivity alert types and thresholds, alert webhooks, and triage workflows.
devices NinjaOne device management: device details and updates, Windows service control, inventory, maintenance windows, reboot modes, and health-check workflows for Windows, Mac, and Linux endpoints running the NinjaRMM agent.
organizations NinjaOne organizations — the top-level container for devices, representing MSP clients: creation and listing, locations, node approval modes, policy mappings and node role IDs, custom fields, tags, cursor pagination, and error codes.
tickets NinjaOne's built-in ticketing system, which integrates with device monitoring: ticket creation and updates, core/status/metadata fields, status and priority values with SLA targets, log entry types, device linkage, tagging patterns, and error codes.
api-patterns NinjaOne Public API fundamentals shared by every other NinjaOne skill: regional base URLs, OAuth 2.0 client-credentials auth and scopes, request shapes, cursor-based pagination, rate-limit headers and 429 handling, HTTP status codes and error response format, and webhook configuration.

PagerDuty

Skill Description
alerts PagerDuty alerts: the alert-vs-incident model, alert statuses, grouping modes, event rules for routing and suppression, dedup_key deduplication, and the Events API v2 trigger/acknowledge/resolve payloads.
analytics PagerDuty Analytics: MTTA/MTTR/MTTE/MTTS definitions, incident and interruption counts, aggregation levels (account, service, team, escalation policy), time-range constraints, and benchmark tables for interpreting the numbers.
incidents PagerDuty incident lifecycle (triggered/acknowledged/resolved), urgency vs. priority, alerts-to-incident grouping, the 14 incident MCP tools, incident fields, notes, log entries, past-incident similarity search, merge and snooze semantics, and cross-vendor PSA ticket correlation for MSPs.
oncall PagerDuty on-call model: schedules with rotation layers, restrictions, the computed final schedule, and overrides; escalation policy tiers and timeouts; on-call entry fields; and the schedule, escalation policy, and team MCP tools.
services PagerDuty service catalog: service statuses, integrations and integration keys as event sources, alert grouping modes, upstream/downstream service dependencies, and maintenance windows.
api-patterns PagerDuty API and hosted MCP fundamentals: US/EU MCP endpoints, the `Token token=` auth header and token types, the complete 66-tool reference across 13 categories (incidents, on-call, schedules, escalation policies, services, event orchestrations, status pages, teams, users, and more), offset pagination, common filter parameters, rate limits, and error codes.

PandaDoc

Skill Description
documents PandaDoc document lifecycle end to end: creating documents from templates, sending for e-signature, status checks and PDF downloads, the full document status enum, MSP document types, content tokens, pricing-table structure, document and recipient fields, and status-transition errors.
proposals MSP proposal workflows in PandaDoc: proposal types and typical values (MSA, SOW, hardware quote, project proposal, security assessment, cloud migration), the standard MSP content-token set, managed-services and hardware pricing-table structures, mapping document statuses to sales-pipeline stages, and pipeline and stale-proposal tracking.
recipients PandaDoc recipients and e-signature mechanics: recipient roles (signer, approver, viewer, CC), signing-order behavior, multi-party MSP signing scenarios, completion tracking via `has_completed`, recipient fields, and the document statuses that restrict adding or changing recipients.
templates PandaDoc template library and structure: layout, content blocks, tokens, interactive fields, signature fields, pricing tables, and recipient roles, plus the MSP template set (MSAs, SOWs, proposals, quotes, NDAs, change orders, QBRs), template versioning, tags, and the template field reference.
api-patterns PandaDoc hosted MCP server and API fundamentals: API-key authentication and which operations work without a key, the complete MCP tool catalog (documents, templates, recipients, docs search, code samples), page-based pagination, document and template filters, rate limits per plan, and error codes.

Warmly

Skill Description
visitor-intelligence Acting on Warmly's identified website visitors and account-level engagement: choosing between list_warm_visitors, list_warm_accounts, and get_credits_remaining; ICP filtering, engagement-depth scoring, CRM-intersection routing, credit-burn checks, MSP-specific outreach plays, and the limits of visitor identification as an intent signal.
api-patterns Warmly's remote MCP server: WorkOS AuthKit OAuth 2.0 + PKCE authentication, RFC 9728 protected-resource metadata, multi-organization scoping, the stateful Streamable HTTP session model, the three read-only visitor-intelligence tools and their fields, credit semantics, error codes, and rate-limit guidance.

Pax8

Skill Description
companies Pax8 companies (MSP clients): company records and fields, contact management, billing and order-approval settings, and cross-referencing companies with subscriptions and orders.
invoices Pax8 invoices and billing: invoice retrieval, invoice line items, usage-based billing summaries, the MSP billing cycle, and reconciling Pax8 costs against client charges.
orders Pax8 orders: order retrieval, order line items, provisioning status and timelines, billing terms, and the order-to-subscription workflow.
products The Pax8 product catalog: cloud software SKUs, vendors, pricing tiers and margins, and provisioning details across Microsoft 365, Azure, security tools, and backup products.
subscriptions Pax8 subscriptions: license and seat counts, the full subscription lifecycle and its states, change history, filtering by company or product, and quantity management for license optimization.
api-patterns Pax8 MCP fundamentals: the official hosted MCP server connection, all 15 Pax8 MCP tools and their parameters, pagination, sorting, filtering, response shapes, rate limiting, and error handling.

Proofpoint

Skill Description
forensics Proofpoint Forensics and Threat Response (TRAP) fundamentals: auto-pull and search-and-destroy remediation actions, evidence collection, message trace, and post-delivery incident response workflows for email-borne threats.
people Proofpoint People-Centric Security fundamentals: Very Attacked People (VAP) reports, attack index scoring, click susceptibility, top clickers, and user risk categorization for targeting security controls and training.
quarantine Proofpoint quarantine management fundamentals: quarantine reasons and folders, message states, search/filter parameters, and release/delete workflows for admin and end-user quarantine.
tap Proofpoint Targeted Attack Protection (TAP) fundamentals: threat events across URL, attachment, and message-level vectors, click tracking, message disposition, SIEM integration feeds, and campaign correlation.
threat-intel Proofpoint Threat Intelligence fundamentals: campaign tracking, threat families and actors, indicators of compromise (IOCs), and how campaign/IOC data enriches individual TAP threat events.
url-defense Proofpoint URL Defense fundamentals: URL rewriting (v2/v3 formats), click-time analysis and verdicts, and manual/API decoding of rewritten URLs back to their originals.
api-patterns Proofpoint API fundamentals: HTTP Basic Auth with service principal and secret, base URLs and versioning across TAP SIEM, People, Quarantine, Forensics, and URL Defense APIs, rate limits, pagination patterns, and error handling.

QuickBooks Online

Skill Description
customers QuickBooks Online Customer entity: the parent/sub-customer (job) hierarchy, contact, address, billing and hierarchy fields, payment terms, balance and BalanceWithJobs tracking, sparse updates, deactivation, query syntax, error codes, and PSA cross-referencing patterns for MSP client records.
expenses QuickBooks Online expense entities: Purchase (check, cash, credit card), Bill for accounts payable, BillPayment, and Vendor.
invoices QuickBooks Online Invoice entity: invoice lifecycle and statuses, line item detail types, service items, payment terms, email delivery and PDF retrieval, invoice numbering, void vs delete semantics, query syntax, error codes, and MSP billing patterns such as monthly managed services, project, and time-and-materials invoicing.
payments QuickBooks Online payment handling: recording customer payments and applying them to invoices, partial and multi-invoice application, unapplied amounts and overpayments, credit memos and refund receipts, payment methods, deposit accounts, voiding, and reconciliation.
reports QuickBooks Online financial reporting: the report catalog (Profit & Loss, Balance Sheet, A/R and A/P Aging, General Ledger, Customer Sales, Cash Flow, Tax Summary), report parameters, date macros, column customization, the nested row response structure, and MSP analysis patterns like client profitability and aged receivables for collections.
api-patterns QuickBooks Online API fundamentals: OAuth2 authentication and token lifecycle, REST structure and base URLs, the Intuit query language, pagination, minor version headers, SyncToken optimistic locking, rate limits, webhooks, and the Fault error object format.

RocketCyber

Skill Description
accounts RocketCyber's provider/customer account hierarchy: sub-account navigation, account CRUD operations, account settings, security policy configuration, and multi-tenant MSP patterns.
agents RocketCyber agent (RocketAgent) deployment, communication status, health monitoring, and troubleshooting: agent installation, online/offline status, agent-to-account mapping, and platform support.
apps RocketCyber application inventory: detecting, categorizing, and monitoring applications across managed endpoints, including approved-vs-unapproved software, app-level threat detection, and software compliance reporting.
incidents RocketCyber security incident lifecycle: severity levels, verdicts (Malicious/Suspicious/Benign), status transitions, SOC analyst triage patterns, and cross-vendor PSA ticket correlation.
api-patterns RocketCyber REST API v3 fundamentals: Bearer token authentication, regional base URL selection, pagination, rate limiting, error handling, and account hierarchy navigation.

Rootly

Skill Description
alerts Rootly's alerting layer between monitoring tools and incident management: alert sources and integrations (Datadog, PagerDuty, New Relic, Grafana), routing rules, escalation policies and their acknowledgement windows, suppression, and the conditions under which an alert auto-creates an incident.
incidents Incidents, Rootly's primary resource: the incident lifecycle and status transitions, severity levels, the incident field reference, AI-assisted analysis via find_related_incidents and suggest_solutions, action items, alert attachment, and cross-vendor PSA ticket correlation.
oncall Rootly on-call visibility built on the get_oncall_handoff_summary, get_oncall_shift_metrics, get_shift_incidents, and check_oncall_health_risk tools: schedule and rotation coverage, structured shift handoffs, per-shift incident scoping, shift metric fields, and the burnout risk signals.
postmortems Rootly postmortems as structured post-incident retrospectives: the postmortem lifecycle, templates and automatic timeline import, action item creation and tracking through to project-management tools, and the blameless review practices Rootly's model assumes.
services The Rootly service catalog: tier classification by business criticality, the ownership attributes attached to each service (team, Slack channel, escalation policy, runbooks), upstream/downstream dependency modeling for blast-radius analysis, service CRUD, and how services link back to incidents and alerts.
workflows Rootly's incident-response automation model: the trigger / condition / action structure, the full catalog of trigger, action, and condition types, workflow CRUD and enable/disable, and the failure modes behind stale, over-firing, or circularly chained workflows.
api-patterns The Rootly hosted MCP server and the JSON:API REST surface behind it: Global vs.

Runzero

Skill Description
assets The runZero asset inventory: searching and browsing assets, asset attributes, OS fingerprinting, hardware details, and network interfaces.
services runZero discovered services: listing services, filtering by port or protocol, identifying vulnerabilities, and auditing exposed services across sites.
sites runZero sites: creating and managing organization sites, defining scan scope and exclusions, deploying explorers, and organizing assets by location or client.
tasks runZero scan tasks: creating scans, scheduling recurring scans, managing explorers, configuring scan parameters, and reviewing scan results.
wireless runZero wireless network discovery: discovered wireless networks, rogue access point identification, wireless security configuration analysis, and SSID auditing.
api-patterns runZero API fundamentals: the available MCP tools, Bearer-token authentication, the Export API for bulk retrieval, pagination, rate-limit headers, error codes, and the runZero query language.

SalesBuildr

Skill Description
companies-contacts Salesbuildr companies and contacts: company search, contact filtering by company, and contact creation with its required fields.
opportunities Salesbuildr opportunities: pipeline search, opportunity creation, stage updates, and deal values, plus how opportunities link companies and contacts to potential revenue.
products Salesbuildr product catalog: product search, pricing lookup, category browsing, and how products become quote line items.
quotes Salesbuildr quotes: quote creation with product line items, quote search, and retrieving quote details, plus how quotes link to companies, contacts, and opportunities.
api-patterns Salesbuildr API fundamentals: api-key header authentication, offset-based from/size pagination, error handling, and the 500 requests per 10 minutes rate limit.

SentinelOne

Skill Description
alerts SentinelOne's read-only unified alert surface: the list/search/get alert tools plus notes and history, severity levels, status values, view types, GraphQL filter syntax, and cursor-based pagination.
inventory SentinelOne's unified asset inventory across four surface types — agent-managed endpoints, AWS/Azure/GCP cloud resources, AD/Entra identities, and Ranger-discovered network devices.
misconfigurations Cloud security posture findings from SentinelOne's XSPM module across AWS, Azure, GCP, Kubernetes, identity providers, and infrastructure-as-code.
purple-ai The `purple_ai` tool — SentinelOne's natural language investigation assistant over the full Singularity telemetry model.
threat-hunting PowerQuery against the Singularity Data Lake: the Scalyr-based pipeline syntax (distinct from SPL, SQL, KQL, and Elasticsearch DSL), the powerquery, get_timestamp_range, and iso_to_unix_timestamp tools, time-range and row-limit handling, common hunting scenarios, and the Purple AI generation path.
vulnerabilities CVE tracking through SentinelOne's XSPM module: the read-only vulnerability tools, EPSS scores and exploit-maturity values and why they outrank raw CVSS severity for prioritization, status values and their transitions, the vulnerability field reference, and patch-prioritization and reporting workflows.
api-patterns The SentinelOne Purple MCP server and the APIs behind it: uvx installation and transport modes, Service User token levels, the 23 read-only tools organized by domain, and the dual GraphQL (cursor pagination) / REST (offset pagination) architecture with its differing filter syntaxes, rate limits, and error causes.

Sherweb

Skill Description
billing Sherweb distributor billing: explicit billing date ranges, Setup/Recurring/Usage charge types, billing cycles (OneTime, Monthly, Yearly), the pricing breakdown (listPrice, netPrice, prorated, subTotal), promotional and performance deductions, fees, taxes, and MSP margin calculation.
customers Sherweb customer records: the distributor > service provider > customer hierarchy and its API scoping consequences, customer lifecycle stages, core address and contact fields, accounts-receivable data with aging buckets, and cross-referencing customers with PSA, subscription, and billing data.
subscriptions Sherweb subscription management: the subscription lifecycle and its states, seat/license quantity rules (absolute values, minimums, proration, commitment restrictions), the quantity-change workflow, subscription and change-response fields, and state-transition errors.
api-patterns Sherweb Partner API fundamentals: OAuth 2.0 client-credentials auth, token caching, subscription-key header, scopes and base URLs, endpoint and MCP tool catalog, page-based pagination, Accept-Language localization, rate limits, and error codes.

SuperOps.ai

Skill Description
alerts SuperOps.ai RMM alerting: alert types, severity levels, status lifecycle and valid transitions, asset/client/monitor associations, and the GraphQL operations for listing, acknowledging, resolving, and converting alerts into tickets.
assets SuperOps.ai RMM asset inventory: asset status and platform enums, hardware, network, OS and association fields, software inventory, disk usage, patch status, activity history, and the GraphQL queries and script-execution mutations behind them.
clients SuperOps.ai client (account) management: stage and status enums, core/business/ address fields, client CRUD mutations, site and contact (requester) management, custom fields, soft vs. hard delete, and onboarding workflows.
runbooks SuperOps.ai RMM script automation: script types and OS targeting, run-as contexts, execution priority, parameterized arguments, single-asset and batch execution, recurring schedules, execution status polling, and exit-code interpretation.
tickets SuperOps.ai service desk ticketing: ticket fields, status and priority enums, client/site/requester/assignee associations, notes, time entries, and the GraphQL mutations and queries behind them.
api-patterns SuperOps.ai GraphQL API fundamentals: Bearer token plus CustomerSubDomain header auth, region-specific endpoints, request/variable structure, cursor pagination, the 800 req/min rate limit, filter operators, UTC date handling, error codes, and null-reset semantics.

Syncro MSP

Skill Description
assets Syncro MSP assets: asset records and fields for hardware, software, and devices, RMM integration, patch management data, and asset search and update operations.
customers Syncro MSP customers: customer fields, contacts, sites and locations, and customer create, update, and search operations.
invoices Syncro MSP invoices: invoice fields, line items, payment processing, and billing workflows.
tickets Syncro MSP tickets: ticket fields, statuses, priorities, problem types, timer operations, workflow automations, and the validation, time-tracking, and reporting logic around them.
api-patterns Syncro MSP REST API fundamentals: API key setup and authentication, request and response patterns, pagination, rate limiting, and error handling.

Blackpoint

Skill Description
asset-inventory Blackpoint Cyber (CompassOne) asset data: the six asset classes, listing and paginating assets per class, cross-class search, asset detail, and walking parent/child/sibling relationships to build a blast-radius or topology view.
incident-response Blackpoint Cyber (CompassOne) detection investigation: the read-only tool surface across tenants, assets, detections, and vulnerabilities, the tenant → asset → detection → vulnerability drill-down, asset relationship maps, dark-web and external-exposure cross-references, and which tool domains are stubs.
multi-tenant-operations Partner-level Blackpoint Cyber (CompassOne) operations: the partner-tenant hierarchy, enumerating customer tenants, sweeping detections and vulnerabilities across all of them, spotting volume anomalies, and building per-tenant scorecards.
vulnerability-management Blackpoint Cyber (CompassOne) exposure data across four lenses: host vulnerability findings and the filters that matter (CVE, severity, patch and exploit availability), scan history, dark-web credential and data leaks, and internet-facing external exposures — plus how to combine them into a prioritized remediation view.
api-patterns Blackpoint Cyber (CompassOne) MCP fundamentals: API-token header auth and its internal Bearer forwarding, the partner-tenant-asset hierarchy, navigation tools, which tool domains are functional versus stubbed, pagination, and HTTP error causes.

Saas Alerts

Skill Description
triage Triaging the SaaS Alerts queue across managed M365 / Google Workspace tenants: the triage tool surface, the critical-first sweep, per-customer summary and cross-tenant pattern workflows, the low/medium/critical severity model and its default dispositions, and the edge cases — legitimately empty results, time-window sensitivity, whitelist suppression, and per-partner rate limits.
api-patterns SaaS Alerts MCP fundamentals: API-key authentication via the gateway header, the MSP → customer → account → user hierarchy, navigation and functional tool naming, event filter parameters, cursor pagination, and HTTP error codes.

Crewhu

Skill Description
surveys Crewhu CSAT/NPS survey data: the list/search/get tools and the detractor/promoter sentiment slices, the trend, detractor-follow-up, promoter-recognition and per-tech roll-up workflows, and the edge cases that skew scores — sparse response counts, comment-only feedback, and tenant-local timestamps.
api-patterns Crewhu MCP fundamentals: token authentication via the `X-Crewhu-Api-Token` header and its gateway env-var mapping, the flat 18-tool surface across the surveys, users, badges, and prizes domains (only `crewhu_badges_update_contest` writes), pagination, and error codes.

Immybot

Skill Description
endpoint-management ImmyBot computers/endpoints and their tenant grouping: the computer tool surface, workflows for surveying a tenant fleet, locating a device, auditing inventory against desired state, onboarding a new computer record, and forcing an agent check-in, plus the filtering caveats around online status and serials.
maintenance-sessions ImmyBot maintenance sessions — the reconciliation engine that brings endpoints into their desired state: the session tool surface, start parameters (computer vs tenant scope, type, priority, reboot flag), pause/resume/cancel semantics, polling to a terminal state, failure investigation, and reboot-spanning and queued-vs-running edge cases.
script-execution ImmyBot's PowerShell script library and its SYSTEM-context execution model: the script tool surface, the find → validate → confirm target → approve → execute → review workflow, parameter/timeout/execution-context options, and the safety rules governing this destructive, highly privileged operation.
software-deployment ImmyBot's desired-state software deployment model end-to-end: the software catalog, deployment, maintenance-session and computer tool surfaces; the canonical select → scope → assert → reconcile → verify workflow; and the pinned-vs-latest, conflicting-deployment, and reboot edge cases.
tenant-compliance ImmyBot tenants (client organizations) and fleet-wide reporting: the tenant and background-task tool surfaces, the per-tenant compliance scorecard and fleet task-queue audit procedures, and how to assemble a client QBR report from stats, compliance, software inventory, and failed-task history.
api-patterns ImmyBot MCP fundamentals: Entra ID OAuth 2.0 client-credentials auth (four fields), the `immybot_<domain>_<action>` tool naming and domain list, the two-step desired-state deployment model, the four destructive operations that need explicit confirmation, task/session polling cadence, and HTTP error codes.

Timezest

Skill Description
agents-and-teams TimeZest agents (individual technicians) and teams (round-robin / shared availability pools): listing each, fetching detail for a named resource, and the criteria for booking an agent versus a team.
appointment-types TimeZest appointment types: the types configured for a tenant, each type's duration, and how to match a type to the work described on a ConnectWise / Autotask / Halo ticket.
psa-integration Wiring a TimeZest scheduling request into a PSA: the associatedEntities payload shapes for ConnectWise, Autotask, and Halo tickets, the difference between the pod and generate_url trigger modes, and the causes of bookings that complete but never update the PSA ticket.
resources TimeZest's combined resource pool — the unified list of agents and teams available for scheduling — including filtering by resource type and surveying what is bookable before drilling into a specific agent or team.
scheduling The TimeZest scheduling-request lifecycle: resolving the right agent and appointment type, creating a request against a ConnectWise / Autotask / Halo ticket, polling its status through to booking, and canceling.
api-patterns TimeZest MCP fundamentals: Bearer token authentication, the navigation pattern, scheduling-request payloads that carry PSA associated_entities (ConnectWise / Autotask / Halo ticket IDs), and the polling-only update model (no webhooks).

Threatlocker

Skill Description
approval-requests ThreatLocker application approval request triage: pulling the pending queue, grouping requests by application and hash, signed-publisher and path heuristics, and approve/deny recommendations with audit-friendly reasoning.
audit-log The ThreatLocker Action Log (the API name is "audit"): incident timelines, tracing a file's history across endpoints, repeated-denial detection, and correlating policy bypasses or audit-only matches with user and computer context.
computer-groups ThreatLocker computer groups — the policy-scoping boundary that determines which allow/deny rules apply to which endpoints.
computers ThreatLocker-protected endpoints: fleet inventory, identifying offline agents, a single computer's check-in history, and correlating computers across organizations and groups.
organizations The ThreatLocker MSP multi-tenant model: enumerating child organizations, retrieving per-org auth keys, and identifying valid move targets when relocating computers between tenants.
api-patterns ThreatLocker Portal API fundamentals: raw-key authentication (no Bearer prefix), multi-tenant routing via the organizationId header, POST-based "GetByParameters" list endpoints, pagination shape, and child-organization fan-out patterns.

Kaseya Vsa

Skill Description
api-patterns Kaseya VSA REST API fundamentals: two-step token-based authentication, the /api/v1.0 surface, pagination ($skip/$top) and filtering ($filter), the request/response envelope, error codes, and Kaseya One SSO bearer-token auth for unified-login tenants.

Datto Bcdr

Skill Description
api-patterns Datto BCDR (Backup Portal) REST API fundamentals: public/private key HMAC-SHA256 request signing, the /v1 endpoint surface, pagination, appliance/agent hierarchy, and screenshot verification retrieval.

Kaseya Bms

Skill Description
api-patterns Kaseya BMS PSA REST API v2 fundamentals: tenant subdomain routing, API-token bearer auth, Kaseya One SSO bridging, ticket and account workflows, and OData-style pagination.

Datto Saas Protection

Skill Description
api-patterns Datto SaaS Protection (formerly Backupify) REST API fundamentals: regional base URLs, bearer-token auth, the seat/tenant object model, backup status queries, and restore operations.

Unitrends

Skill Description
api-patterns Unitrends Backup REST API fundamentals: session-token login exchange, the appliance-vs-asset hierarchy, backup job status queries, recovery point listing, and replication state.

Spanning

Skill Description
api-patterns Spanning Cloud Backup REST API fundamentals: admin-email + API-token auth, the per-platform endpoint surface (M365, Google Workspace, Salesforce), the user/license model, backup status queries, and restore operations.

HubSpot CRM

Skill Description
activities HubSpot tasks, notes, and associations: task priority and status values, notes-vs-tasks semantics, the association type matrix linking contacts, companies, deals, and tickets, and engagement-history workflows.
companies HubSpot company records: core fields, industry classification values, lifecycle stages, domain-based deduplication and automatic contact-company matching, and cross-referencing associated contacts, deals, and tickets.
contacts HubSpot contact records: core and MSP-relevant custom fields, lifecycle stages, lead status values, contact ownership, CRM search filter patterns, and associations to companies and deals.
deals HubSpot deal records and sales pipelines: deal fields, default and custom pipeline stages, deal amount conventions (MRR vs.
tickets HubSpot support tickets: core fields, default pipeline stages, priority levels, MSP ticket categories, SLA timestamp properties, and associating tickets with contacts, companies, and deals.
api-patterns HubSpot's official remote MCP server and the CRM Search API behind it: the complete MCP tool catalog, OAuth 2.0 + PKCE connection over Streamable HTTP, automatic scope derivation, sensitive-data (PHI) exclusion, filter/sort/ pagination syntax, plan-tier rate limits, and error handling.

Spamtitan

Skill Description
lists SpamTitan sender allowlists and blocklists: the add/remove/list action parameter, entry types, allowlisting trusted senders to prevent false positives, blocking unwanted senders and domains, and the scoping limit — neither manage tool takes a domain parameter.
quarantine SpamTitan quarantine queue: quarantine types, release vs. delete semantics, message aging, email flow statistics, and the tenant-isolation limit — the queue listing accepts no domain filter, so on a multi-tenant appliance it spans every customer.
api-patterns SpamTitan MCP fundamentals: the available tool catalog and its exact parameters, API-key header authentication, API structure, pagination, rate limiting, and error handling.

Xero

Skill Description
accounts Xero chart of accounts: account classes and types, account codes, tax settings, system accounts, and how MSP revenue, cost-of-sales, and expense categories map to the general ledger.
contacts Xero contacts (customers and suppliers): contact fields, addresses and phones, contact groups, status values and read-only balances, plus MSP client onboarding, offboarding, and PSA cross-referencing patterns.
invoices Xero sales invoices (ACCREC) and supplier bills (ACCPAY): status lifecycle, invoice numbering, line items and tracking categories, tax handling, credit notes, batch creation, validation-error shapes, and recurring managed-services billing for MSPs.
payments Xero payments: recording AR and AP payments, partial payments, payment allocation, overpayments and prepayments, batch payment creation, and outstanding-balance and aging tracking for MSP billing and reconciliation.
reports Xero Reports API: Profit and Loss, Balance Sheet, Aged Receivables and Payables, Trial Balance, Bank Summary and other management reports.
api-patterns Xero Accounting API fundamentals: OAuth2 Custom Connection (client credentials) auth and scopes, the xero-tenant-id header, where-clause filter syntax, page-based pagination, rate limits, the two date formats, validation-error shape, and batch operations.

Alternative Payments

Skill Description
customers Alternative Payments customers and their users: customer fields and status, the customer/user relationship, MSP client onboarding, and the destructive archive operation that requires confirmation.
invoicing Alternative Payments invoices and hosted payment requests: invoice status and line-item fields, hosted payment links and signed PDF links, archiving, and payment-request creation and retrieval.
payments Alternative Payments transactions and payouts: transaction types, statuses, and the customer/invoice/payment-method filters; payout objects and the transactions that compose them for reconciliation.
api-patterns Alternative Payments API fundamentals: OAuth2 client-credentials token minting and bearer auth, scopes, REST endpoint structure, cursor pagination, the 5 req/sec rate limit, idempotency, error handling, and the read + safe-write capability posture that deliberately excludes direct payment creation.

Ironscales

Skill Description
incidents Ironscales phishing incidents end to end: incident statuses and severities, the five remediation actions and which of them are irreversible, the stateless AI email-classification tool and the message content it exports, allowlist entries for email/domain/IP, daily-triage and campaign workflows, and the failure modes — already-closed incidents, partial remediation, and allowlist scope.
api-patterns Ironscales MCP fundamentals: API-key plus company-ID header authentication and the per-tenant scoping that follows from it, the nine tools this server registers and what each one actually changes, offset/limit pagination without a total count, rate-limit behavior, and how API failures surface to the model.

Mimecast

Skill Description
message-tracking Mimecast message tracing: searching by sender, recipient, or subject; message states and message IDs; retrieving message metadata and headers; and holding or releasing messages.
queue-management Mimecast email delivery queues: inbound and outbound queue types, queue message states, retry behavior, and the signals that identify stuck messages, delivery delays, and backlog conditions.
threat-intelligence Mimecast threat data: Targeted Threat Protection logs for URL clicks, attachment analysis, and impersonation attempts; threat remediation incidents; and audit events.
api-patterns Mimecast MCP fundamentals: the available tool catalog, OAuth 2.0 client-credentials authentication, regional API endpoints, pagination, rate limiting, and error handling.

Wyre Gateway

Skill Description

Microsoft Graph

Skill Description
connection Connecting the Microsoft Graph MCP Server for Enterprise (public preview) through the Wyre gateway: BYOC multi-tenant Entra app registration, the tenantId/clientId/clientSecret triple, the delegated MCP.* permissions and the per-tenant admin consent that must be granted out of band, plus the read-only design, the 100 calls/min/user limit, licensing implications, and a symptom-to-cause troubleshooting table.
querying The RAG query loop for the Microsoft Graph MCP Server for Enterprise — microsoft_graph_suggest_queries to retrieve vetted candidate Graph calls, microsoft_graph_get to execute them, microsoft_graph_list_properties for entity schema — with worked identity and directory examples, result-presentation guidance, and the read-only, RBAC-scoped, rate-limited constraints on what comes back.

Azure Mcp

Skill Description
connection Onboarding the azure-mcp connector in the WYRE MCP Gateway: Azure service-principal registration, the tenantId/clientId/clientSecret triple, least-privilege Reader-tier RBAC assignments, the gateway's read-only namespace allowlist, and connection verification and failure modes (expired secret, missing role assignment).
cost-and-capacity The read-only cost and capacity half of the azure-mcp connector — the pricing, quota, subscription, and group namespaces: retail meter-rate lookups, quota and usage headroom, subscription and resource-group inventory, and the retail-versus- actual-billing distinction that shapes every estimate.
observability The read-only observability half of the azure-mcp connector — the monitor, resourcehealth, applens, and advisor namespaces: Azure Monitor metrics, Log Analytics KQL, alert-rule state, platform health states, AppLens detectors, and Advisor recommendation categories, plus the degraded-resource investigation order.

Stripe

Skill Description

Slack

Skill Description

Meraki

Skill Description
devices Cisco Meraki device inventory and lifecycle: serial-based identity, the MX/MS/MR/MV/MG/MT product lines, org inventory vs network assignment, reboot and removal, and device/uplink status via meraki_raw_request.
security-appliance Cisco Meraki MX security appliance: the L3 outbound firewall rule model and the full-ruleset replacement semantics of meraki_appliance_firewall_l3_update, plus Auto VPN site-to-site peer status via meraki_appliance_vpn_status_get.
troubleshooting Hands-on Cisco Meraki diagnostics: the async live-tools pattern (ping, cable test, throughput, wake-on-LAN, ARP/MAC tables) that rides the meraki_raw_request passthrough because live tools are not curated tools, plus device reboots and uplink/connectivity checks.
api-patterns Cisco Meraki MCP fundamentals: the full tool catalog, gateway header authentication, Dashboard API v1 structure, Link-header cursor pagination, per-org rate limiting, the read-only / confirm_destructive_action safety model, the meraki_raw_request escape hatch, and error handling.

Ncentral

Skill Description
devices N-central device records: listing with saved device filters (filterId), asset and warranty lookups, lifecycle reads and updates, and service-monitor status triage on a single device.
monitoring-tasks N-central monitoring and automation: active-issue triage per customer or site, job statuses, the scheduled task -> status -> per-device details drill-down, and the safety rules for direct-support task execution.
organizations N-central org units: the service organization -> customer -> site hierarchy, the org-unit vs customer distinction, agent registration tokens (credential-sensitive), and custom properties at both org and device level.
api-patterns N-central MCP fundamentals: User-API Token (JWT) authentication through Conduit, 1-based pagination with the totalItems/totalPages envelope, rate-limit behavior, preview-endpoint caveats, and on-prem server specifics.

Ops Pack

Skill Description
board-hygiene Board-wide ticket maintenance, distinct from working any single ticket: stale-ticket detection with per-status staleness thresholds, the Waiting-on-Client rot case and its three valid resolutions, duplicate/related-ticket detection signals and safe linking, and technician queue-balance assessment weighted by more than raw ticket count.
dispatch-prioritization Priority scoring and assignment for an unassigned PSA ticket queue: the scoring factors (SLA proximity, client tier, ticket age, technician load, skill/category match), how to combine them into an explainable ranked order rather than a black-box formula, and the tool-discovery pattern for finding which PSA and RMM connectors are actually live before calling any vendor's tools.
sla-escalation-playbooks A cross-PSA escalation framework for SLA pressure: how each PSA family (Autotask, HaloPSA, ConnectWise Manage, Syncro, Kaseya BMS) models SLA/priority state and where breach risk lives in each, a normalized breach-risk state model (healthy, at risk, breached-response, breached-resolution) with the default escalation action per state, how notification audience shifts by contract tier, and the evidence to gather before paging anyone.

Secops Pack

Skill Description
alert-severity-normalization A common Critical/High/Medium/Low normalized severity model for security alerts, incidents, and findings, with the judgment axes (confidence, mitigation state, blast radius) that place a record in a tier and the mapping from each vendor's native terminology — Huntress incident status, SentinelOne threat confidence, Blumira finding priority, CIPP alert queue severity, Blackpoint Cyber SOC severity, SaaS Alerts risk level — plus how to discover which security vendors are actually connected.
bec-response Business Email Compromise detection and first response: the signals that reveal it in CIPP/M365 audit logs, mailbox and forwarding rules, and connected email security vendor alerts; the order-dependent response sequence (session revocation, forwarding-rule audit, mailbox rule and delegate cleanup, password reset, MFA re-enrollment, lateral-spread check, recipient notification); and what a defensible incident timeline must capture for insurance or bank-fraud claims.
containment-playbooks Ordered first-response containment sequences for the most common MSP incident classes — compromised account, malware/ransomware detection, business email compromise, and exposed credential — including why the order matters, which connected tool family (RMM, EDR, CIPP/Entra, PSA, documentation) handles each step, and the evidence-preservation principles that apply across all of them.

Finance Pack

Skill Description
agreement-reconciliation Reconciling PSA contract/agreement entitlements (seats, hours, recurring services) against invoiced reality in an accounting platform, across any combination of PSA (Autotask, HaloPSA, ConnectWise, Syncro) and accounting platform (QuickBooks Online, Xero).
license-true-up Three-way seat reconciliation per client per SKU: seats provisioned in a cloud marketplace (Pax8, Sherweb) vs. seats billed in accounting or PSA billing vs. seats actually deployed in the tenant (microsoft-graph or CIPP).
margin-analysis Per-client and per-service-line margin computation for an MSP: revenue from PSA billing or accounting invoices, cost of goods from Pax8/Sherweb wholesale pricing, and estimated labor from PSA time entries × a loaded technician rate.

Compliance Pack

Skill Description
evidence-mapping Tracing a compliance control (CIS, SOC 2, HIPAA, or a cyber-insurance questionnaire line item) to concrete, retrievable tool evidence: which vendor family can observe what — CIPP for live M365/Entra configuration, Liongard for point-in-time infrastructure state, IT Glue/Hudu for documentation — a representative control-to-tool-call map, and the evidentiary weights that separate Configured from Documented, Contradicted, and Unable to Verify.
insurance-questionnaires Drafting tool-verified answers to cyber-insurance renewal, new-business, and underwriter security questionnaires: the standard recurring question set (MFA everywhere including privileged accounts, EDR coverage ratio, tested and immutable backups, documented and tested IR plan, security awareness training), which connected tools actually answer each one, and the evidence-backed / documented-only / unable-to-verify labeling discipline that keeps an answer defensible during a claim investigation.
standards-drift Detecting configuration drift against an established baseline: CIPP standards checks and Best Practice Analyser results, Liongard change detections and inspection timelines, the three conditions that make a diff real drift rather than noise, the signals that separate intentional or authorized change from unauthorized weakening (ticket correlation, reversion pattern, direction of change), and the priority order for ranking several drift findings at once.

Sales Pack

Skill Description
pipeline-health CRM pipeline health assessment against whatever CRM is discovered through the gateway: stage-velocity norms derived from closed-won deals, activity-based stalled-deal detection, raw and quality-adjusted pipeline coverage against a revenue target, and the CRM-less degradation rule (report nothing rather than fabricate figures).
quote-to-close-tracking The quote-to-close handoff chain — a Pax8/Sherweb/Kaseya Quote Manager quote or SalesBuildr proposal, through a PandaDoc document's sent/viewed/signed status, to a closed-won CRM deal — and the four distinct stall points along it (quote built with no proposal document, proposal sent but not opened, viewed but not signed, signed but the CRM deal never marked closed-won), including cross-system record matching and what to report when only part of the chain is connected.
warm-lead-routing Lead-warmth scoring from intent and engagement signals — Warmly website-visitor identification, CRM form fills and email engagement, and Calendly booking activity — using an explainable Hot/Warm/Warm-Cool/Cool tiering, plus routing recommendations based on owner continuity, CRM routing rules, or rep capacity, and the degradation path to CRM-only signals when intent tools aren't connected.

Devops Pack

Skill Description
error-budget-tracking Error-budget and burn-rate assessment from whatever observability tools (Sentry, Datadog, Grafana, BetterStack) are connected: SLI, SLO, error budget, and burn rate applied practically, how to compute burn rate from available SLI data and the thresholds that make it actionable, what separates a budget-threatening trend from noise, and the fallback to raw trend reporting against a trailing baseline when no formal SLO is defined.
incident-postmortem Assembling a blameless postmortem grounded in systems of record: timeline reconstruction merging the incident tool's event log with correlated observability anomalies (Sentry error spikes, Datadog/Grafana metric anomalies, including precursor signal that predates formal detection) and deploy history from connected platform connectors, all normalized to one stated timezone; the root-cause versus contributing-factor distinction and the test for telling them apart; and how to label a root cause that is still only a hypothesis.
oncall-handoff Assembling an on-call shift handoff from whatever incident-management tool (Rootly, PagerDuty, BetterStack) is connected, plus corroborating observability signal where available: the four handoff categories in priority order (currently paging, escalated without an owner, last-shift history, known-flaky watch list), why an empty open-incidents list is not an empty handoff, and the bar for calling an alert known-flaky rather than simply resolved.

Cloudops Pack

Skill Description
cloud-capacity-planning Right-sizing and capacity forecasting for cloud resources on whatever platforms (Azure, DigitalOcean) are connected: the per-platform over-provisioned and under-provisioned signals, growth-trend-based forecasting toward a projected exhaustion window, and the discipline that separates a genuine capacity risk from normal variance — require a trend not a spike, distinguish burst-tolerant from sustained-critical resources, and always state the observation window behind a forecast.
cloud-cost-management Cloud spend anomaly detection and reclaimable-spend hunting on whatever platforms (Azure, DigitalOcean) are connected: the signals that make a spend increase an anomaly rather than expected cost, the per-platform orphaned/idle resource catalog (unattached storage, idle load balancers, stopped-but-not-deallocated compute, idle managed databases, orphaned network resources), and how to build a monthly cost trend view — or a clearly labeled inventory-and-list-pricing estimate when a platform exposes no billing data.
network-health-sweep A normalized device and network health sweep across whatever network-monitoring tools (Auvik, Meraki, Domotz) are connected: each vendor family's data model and native status fields mapped into one Down/Degraded/Unknown/Healthy taxonomy, default interface error and utilization thresholds, topology-change detection, and why an offline Domotz collector renders its devices "unknown" rather than "down".

Awareness Pack

Skill Description
phishing-simulation-analysis Phishing-simulation campaign analysis: click-rate trend direction across campaigns, repeat-clicker identification with remedial-training cross-reference, and optional enrichment that correlates simulated failures with real-world phishing incidents from a connected email-security tool as a compounding risk signal.
risk-scoring Explainable per-user and per-org human risk scoring from training-completion status, phishing-simulation failure history, and optional real-world click/attack-targeting signal: the weighted factor table, three-tier bucketing, per-org rollup as a distribution rather than a blended number, and graceful degradation when only some inputs are connected.
training-completion-tracking Security-awareness training completion across whatever training/awareness platform is connected: assignment-overdue versus cadence-overdue detection, per-campaign and per-org completion-rate calculation, ranking clients that have fallen behind a contracted cadence, and the unmeasured-versus-0% distinction.

Backup Pack

Skill Description
backup-job-health Portfolio-wide backup job health across whatever BCDR and SaaS-backup tools are connected: the two structurally different job models (image-based appliance backup vs.
restore-test-verification Whether a backup is actually recoverable rather than merely present: the ranked hierarchy of restore evidence (actual restore performed, full boot/virtualization verification, screenshot verification, spot-check restore drill, no evidence at all), adequate test cadence per data-criticality tier, and why a never-tested backup is the highest-priority finding — outranking even an actively failing job.
retention-rpo-compliance Comparing configured backup retention and cadence against contracted retention windows and RPO (recovery point objective) targets: the two distinct retention gap types (configured-shorter-than-contracted vs. storage-forced truncation), why achievable RPO must be derived from actual job success history rather than the nominal schedule, where the contracted side of the comparison actually lives, and why "no documented requirement" is its own finding rather than an automatic pass.

Assets Pack

Skill Description
eol-eos-flagging End-of-life versus end-of-support risk for devices, OS versions, and firmware: combining RMM inventory (make, model, OS version, firmware) with general lifecycle knowledge, the mandatory verify-against-vendor-lifecycle caveat, what qualifies as a finding versus merely "old", and criticality-first prioritization of the resulting risk list.
refresh-cycle-planning Forward-looking hardware refresh planning: combining warranty expiration, EOL/EOS timing, and device age from whatever RMM and documentation platforms are connected into replace-now / plan-this-year / monitor tiers, laying those tiers onto a dated calendar, surfacing replacement clusters, and keeping an explicit insufficient-data bucket.
warranty-tracking Endpoint hardware warranty status across whatever RMM platforms (Datto RMM, NinjaOne, N-central, Kaseya VSA, ConnectWise Automate, Atera, SuperOps, Syncro, Action1, ImmyBot) and documentation tools (IT Glue, Hudu) are connected: the reliability spread between OEM-resolved and hand-entered warranty fields, serial/asset-tag cross-referencing when RMM data is missing or stale, and the expired / expiring-soon / covered / unknown bucketing.

Clio

Skill Description
contacts Clio contacts -- the people and companies connected to matters: person vs. company contact types, and how a contact relates to the matters they are party to (client, opposing party, witness, and other roles).
matters Clio matters -- the case/client-file object that almost everything else in Clio hangs off of: the matter status lifecycle, linking a matter to a client contact, practice areas, custom fields, and matter numbering.
time-billing Clio time and expense activities logged against a matter: the activities domain's create-only lifecycle, the billing-read / time-entry-write split, and why billing mutations are out of scope for v1.
api-patterns Clio Manage MCP fundamentals: OAuth 2.0 Authorization Code connection via Conduit, region selection, the matters-as-hub data model, decision-tree tool navigation, pagination, and the deliberate v1 scope limits (no delete anywhere, documents metadata-only, communications/calendar/bills read-only).

Scalepad

Skill Description
backup-radar ScalePad Backup Radar, the read-only backup monitoring surface: per-client backup health records and backup device inventory, in regions us and eu.
controlmap ScalePad ControlMap per-client compliance management: risk registers, control libraries, evidence collection, policies and procedures, framework objectives, assessments, and remediation action items across regions us, eu, ca, and au.
core The ScalePad Core API — the read-only, US-only unified data layer over clients, contacts, members, sites, opportunities, hardware and SaaS assets, the product catalog, service contracts, tickets, and integration configurations.
lifecycle-manager ScalePad Lifecycle Manager, the engagement and roadmap workflow product: initiatives, goals, meetings, action items, assessments, deliverables, budget forecasting, contracts, notes, hardware lifecycle records, and warranty pricing.
quoter Quoter through ScalePad: building and publishing quotes, managing the catalog (items, item groups, tiers, options, manufacturers), quote contacts, suppliers and datafeeds, and the OAuth helpers for the standalone api.quoter.com path.
api-patterns ScalePad MCP fundamentals: API-key authentication via the `X-ScalePad-Api-Key` header, tool discovery across the five product domains, cursor pagination, the 50-requests-per-5-seconds rate limit, and 402 subscription errors.

Using Skills Effectively

Automatic Usage

Claude automatically references relevant skills when you ask about MSP topics. Just ask naturally: 

How do I handle SLA breaches in ConnectWise?

Claude will reference the connectwise-psa:tickets skill to provide accurate information.

Direct Invocation

For specific questions, invoke skills directly:

/skill it-glue:passwords

What security measures should I follow when using the password API?

Combining Skills

For complex workflows, Claude can combine knowledge from multiple skills: 

I need to create a ticket in Autotask and link it to the asset in IT Glue.
How should I structure this workflow?

Claude will reference both autotask:tickets and it-glue:configurations to provide a comprehensive answer.

Was this page helpful? See our roadmap.

Give Feedback Request a Feature Report a Problem