Skills Reference

Skills provide domain knowledge that teaches Claude about MSP platforms, terminology, and best practices. There are 481 per-vendor skills across all plugins, plus 5 cross-cutting shared skills.

Cross-cutting / Shared Skills

Vendor-agnostic skills distributed via the shared-skills plugin. Install with /plugin install shared-skills after adding the marketplace.

Skill	Description
`billing-reconciliation`	Reconciling cloud marketplace subscriptions (Pax8) against accounting invoices (Xero, QuickBooks Online): the matching strategy, billing gaps, unbilled subscriptions, and margin discrepancy analysis.
`incident-correlation`	Vendor-agnostic cross-tool incident correlation: combining PSA tickets, RMM device state, documentation-platform assets, and configuration- monitoring changes into a unified incident summary across Kaseya, ConnectWise, HaloPSA, Syncro, Atera, and similar MSP stacks.
`msp-terminology`	MSP industry terminology: acronyms, roles, contract and billing concepts, and the vocabulary used across PSA, RMM, documentation, and security platforms.
`ticket-triage`	Vendor-agnostic PSA ticket triage: priority determination, categorization, routing, and initial response practices applicable to Autotask, ConnectWise, HaloPSA, and other platforms.
`wyre-gateway-troubleshooting`	WYRE MCP Gateway diagnostics: missing vendor tools, OAuth failures, "Failed to update tool access" errors, expired credentials, and the request flow through mcp-remote to gateway to vendor container to external API.

What are Skills?

Skills are markdown documents that contain structured information about specific domains. When you ask Claude about MSP topics, it automatically references relevant skills to provide accurate, platform-specific answers.

You can also invoke skills directly:

/skill autotask:tickets

What ticket statuses are available?

Skills by Category

Ticket Management

Skills for creating, searching, and managing service tickets.

Skill	Plugin	Description
`atera:tickets`	Atera	Atera service desk tickets: ticket fields, statuses, priorities, comments, work hours, and billing duration.
`autotask:tickets`	Autotask PSA	Autotask ticket lifecycle: status/priority codes and transition rules, the ticket field schema, SLA calculation and clock behavior, escalation rules, ticket metrics, and the MCP tool surface (create, update, search, history, notes) for MSP service desk operations.
`connectwise-psa:tickets`	ConnectWise PSA	ConnectWise PSA ticket management: ticket fields, service boards, statuses, priorities, SLAs, ticket notes, and workflow automation.
`halopsa:tickets`	HaloPSA	HaloPSA service desk tickets: ticket fields, statuses, priorities and ticket types, actions (notes and time entries), attachments, SLA behaviour, and the creation and status-transition workflows with their validation rules.
`ninjaone:tickets`	NinjaOne	NinjaOne's built-in ticketing system, which integrates with device monitoring: ticket creation and updates, core/status/metadata fields, status and priority values with SLA targets, log entry types, device linkage, tagging patterns, and error codes.
`superops:tickets`	SuperOps.ai	SuperOps.ai service desk ticketing: ticket fields, status and priority enums, client/site/requester/assignee associations, notes, time entries, and the GraphQL mutations and queries behind them.
`syncro:tickets`	Syncro MSP	Syncro MSP tickets: ticket fields, statuses, priorities, problem types, timer operations, workflow automations, and the validation, time-tracking, and reporting logic around them.
`hubspot:tickets`	HubSpot CRM	HubSpot support tickets: core fields, default pipeline stages, priority levels, MSP ticket categories, SLA timestamp properties, and associating tickets with contacts, companies, and deals.

Customer/Client Management

Skills for managing customers, companies, contacts, and organizations.

Skill	Plugin	Description
`atera:customers`	Atera	Atera customers and contacts: customer records and fields, contact management, custom fields, and customer lifecycle operations.
`autotask:crm`	Autotask PSA	Autotask CRM entities - companies (accounts), contacts, and sites/locations - including field references, company type classifications, and how these records underpin tickets, contracts, and projects for MSP account management.
`connectwise-automate:clients`	ConnectWise Automate	ConnectWise Automate client management: client CRUD, client identifiers, locations, client hierarchy, groups, extra data fields (EDFs), and client-level settings.
`connectwise-psa:companies`	ConnectWise PSA	ConnectWise PSA company/account management: company types, statuses, sites/locations, custom fields, and company relationships.
`connectwise-psa:contacts`	ConnectWise PSA	ConnectWise PSA contact management: contact records, contact types, communication items (email, phone), portal access, and relationships to companies.
`halopsa:clients`	HaloPSA	HaloPSA CRM data model: client records and their billing/contact fields, sites (locations), contacts (Users), client classification, and parent-child client hierarchy.
`hudu:companies`	Hudu	Hudu companies (clients/organizations): company field reference, parent/child hierarchy, PSA integration matching via id_in_integration, the /api/v1/companies CRUD plus archive/unarchive endpoints, onboarding and offboarding workflows, and how companies scope assets, passwords, articles, and websites.
`huntress:organizations`	Huntress	Huntress organizations as the multi-tenant boundary: org structure, the organization key used for agent deployment, full CRUD operations, client onboarding and offboarding workflows, and the duplicate-key and active-agent deletion errors.
`itglue:contacts`	IT Glue	IT Glue contacts — the people (clients, vendors, partners) associated with an organization.
`itglue:organizations`	IT Glue	IT Glue organizations (companies/clients): the foundational entity all documentation, configurations, contacts, passwords, and flexible assets attach to.
`ninjaone:organizations`	NinjaOne	NinjaOne organizations — the top-level container for devices, representing MSP clients: creation and listing, locations, node approval modes, policy mappings and node role IDs, custom fields, tags, cursor pagination, and error codes.
`pax8:companies`	Pax8	Pax8 companies (MSP clients): company records and fields, contact management, billing and order-approval settings, and cross-referencing companies with subscriptions and orders.
`qbo:customers`	QuickBooks Online	QuickBooks Online Customer entity: the parent/sub-customer (job) hierarchy, contact, address, billing and hierarchy fields, payment terms, balance and BalanceWithJobs tracking, sparse updates, deactivation, query syntax, error codes, and PSA cross-referencing patterns for MSP client records.
`sherweb:customers`	Sherweb	Sherweb customer records: the distributor > service provider > customer hierarchy and its API scoping consequences, customer lifecycle stages, core address and contact fields, accounts-receivable data with aging buckets, and cross-referencing customers with PSA, subscription, and billing data.
`superops:clients`	SuperOps.ai	SuperOps.ai client (account) management: stage and status enums, core/business/ address fields, client CRUD mutations, site and contact (requester) management, custom fields, soft vs. hard delete, and onboarding workflows.
`syncro:customers`	Syncro MSP	Syncro MSP customers: customer fields, contacts, sites and locations, and customer create, update, and search operations.
`threatlocker:organizations`	Threatlocker	The ThreatLocker MSP multi-tenant model: enumerating child organizations, retrieving per-org auth keys, and identifying valid move targets when relocating computers between tenants.
`hubspot:companies`	HubSpot CRM	HubSpot company records: core fields, industry classification values, lifecycle stages, domain-based deduplication and automatic contact-company matching, and cross-referencing associated contacts, deals, and tickets.
`hubspot:contacts`	HubSpot CRM	HubSpot contact records: core and MSP-relevant custom fields, lifecycle stages, lead status values, contact ownership, CRM search filter patterns, and associations to companies and deals.
`xero:contacts`	Xero	Xero contacts (customers and suppliers): contact fields, addresses and phones, contact groups, status values and read-only balances, plus MSP client onboarding, offboarding, and PSA cross-referencing patterns.
`alternative-payments:customers`	Alternative Payments	Alternative Payments customers and their users: customer fields and status, the customer/user relationship, MSP client onboarding, and the destructive archive operation that requires confirmation.
`ncentral:organizations`	Ncentral	N-central org units: the service organization -> customer -> site hierarchy, the org-unit vs customer distinction, agent registration tokens (credential-sensitive), and custom properties at both org and device level.
`clio:contacts`	Clio	Clio contacts -- the people and companies connected to matters: person vs. company contact types, and how a contact relates to the matters they are party to (client, opposing party, witness, and other roles).
`axcient:clients`	Axcient	Axcient x360Recover clients: the health_status model, client_code, the three-way protected-system counter breakdown (appliance_based, d2c, cloud_archive), and minting direct-to-cloud agent enrollment tokens.

Asset & Device Management

Skills for managing devices, computers, configurations, and assets.

Skill	Plugin	Description
`atera:agents`	Atera	Atera RMM agents: agent records and fields, online/offline status, endpoint search and monitoring, PowerShell and script execution, and agent lifecycle.
`atera:devices`	Atera	Atera device monitors: HTTP, SNMP, and TCP monitor types for network devices, services, and applications, plus monitor configuration, thresholds, and polling behavior.
`auvik:devices`	Auvik	Auvik device records: device types, manageStatus and onlineStatus, lifecycle and warranty fields, and choosing between the v1 list endpoint and the detailed device endpoints.
`blumira:agents`	Blumira	Blumira agents (sensors) and the devices they run on: device inventory and filtering, agent health via last-seen timestamps, and agent deployment keys.
`connectwise-automate:computers`	ConnectWise Automate	ConnectWise Automate computer/endpoint management: computer identifiers (ComputerID, Name, ComputerGUID, MAC), status values, OS types, hardware/software inventory, disk, patch, and antivirus status, plus remote management operations.
`datto-rmm:devices`	Datto RMM	Datto RMM device management: identifiers (UID, hostname, MAC), device types and statuses, user-defined fields (UDF1-30), warranty data, and device lookup/update/delete operations.
`domotz:agents`	Domotz	Domotz agents (collectors/probes) as the per-site entry point for all device and network operations: agent types, lifecycle, ONLINE/OFFLINE status, the list/get tools and their license and last-seen fields, and fleet health, site inventory, and capacity-planning workflows.
`domotz:devices`	Domotz	Domotz device inventory: how agents discover and classify devices, the identification attributes (IP, MAC, hostname, display name, vendor), the ONLINE/OFFLINE/UNKNOWN status model, the five device tools — list, get, uptime, history, inventory metadata — and why device lookup is a client-side match rather than a server-side search.
`halopsa:agents`	HaloPSA	HaloPSA agents (technicians) and teams as a read-only MCP surface: listing technicians, retrieving agent detail, listing team structures, and the inactive-agent filter.
`halopsa:assets`	HaloPSA	HaloPSA asset/CMDB data model: asset (configuration item) fields, device types and statuses, links to clients, sites, users, tickets, and contracts, plus parent-child asset relationships.
`hudu:assets`	Hudu	Hudu assets and asset layouts: the layout-as-template model, custom field types, the `custom_fields` key/value array shape, archiving vs deletion, company scoping, and filter patterns across /api/v1/assets and /api/v1/asset_layouts.
`huntress:agents`	Huntress	Huntress endpoint agents: the agent lifecycle, organization and platform filters, health signals such as `last_seen_at` and version, fleet-audit workflows, and the errors returned for missing or empty agent results.
`itglue:configurations`	IT Glue	IT Glue configurations (assets) — servers, workstations, network devices, and other infrastructure: configuration types and statuses, network interfaces, related items, warranty/lifecycle fields, and PSA/RMM integration fields.
`ninjaone:devices`	NinjaOne	NinjaOne device management: device details and updates, Windows service control, inventory, maintenance windows, reboot modes, and health-check workflows for Windows, Mac, and Linux endpoints running the NinjaRMM agent.
`rocketcyber:agents`	RocketCyber	RocketCyber agent (RocketAgent) deployment, communication status, health monitoring, and troubleshooting: agent installation, online/offline status, agent-to-account mapping, and platform support.
`runzero:assets`	Runzero	The runZero asset inventory: searching and browsing assets, asset attributes, OS fingerprinting, hardware details, and network interfaces.
`superops:assets`	SuperOps.ai	SuperOps.ai RMM asset inventory: asset status and platform enums, hardware, network, OS and association fields, software inventory, disk usage, patch status, activity history, and the GraphQL queries and script-execution mutations behind them.
`syncro:assets`	Syncro MSP	Syncro MSP assets: asset records and fields for hardware, software, and devices, RMM integration, patch management data, and asset search and update operations.
`threatlocker:computers`	Threatlocker	ThreatLocker-protected endpoints: fleet inventory, identifying offline agents, a single computer's check-in history, and correlating computers across organizations and groups.
`meraki:devices`	Meraki	Cisco Meraki device inventory and status through the hosted Meraki MCP: serial-based identity, the MX/MS/MR/MV/MG/MT product lines, org inventory versus network assignment, availability and its change history, uplink addresses, provisioning, end-of-life (EOX) and firmware status.
`ncentral:devices`	Ncentral	N-central device records: listing with saved device filters (filterId), asset and warranty lookups, lifecycle reads and updates, and service-monitor status triage on a single device.
`axcient:devices`	Axcient	Axcient x360Recover protected devices (servers and workstations): SERVER/WORKSTATION typing, the current/previous health-status model, local vs vault vs cloud usage and recovery-point timestamps, AutoVerify screenshot verification, and restore points.

Monitoring & Alerts

Skills for alert handling, monitoring, and device status.

Skill	Plugin	Description
`atera:alerts`	Atera	Atera alerts: alert types, severity levels, alert sources, the acknowledge/resolve lifecycle, and alert-to-ticket conversion.
`auvik:alerts`	Auvik	Auvik alerts: severity tiers, status lifecycle, dismissal semantics, and the common alertName patterns that show up in MSP NOC queues.
`betterstack:monitors`	BetterStack	Better Stack uptime monitors: check types, monitor fields, heartbeat monitors, monitor groups, and create/update/pause/delete operations.
`cipp:alerts`	CIPP	CIPP's read-only alerting and audit surface: the cross-tenant alert queue, tenant-scoped M365 unified audit log queries, the audit operations worth filtering on during a compromise investigation, and audit lag/retention behavior.
`connectwise-automate:alerts`	ConnectWise Automate	ConnectWise Automate alerts through Conduit: the read-only cwautomate_alerts_list and cwautomate_alerts_get tools, filtering by computer, client and severity, alert sources and severity levels, and triage workflows that hand follow-up to the PSA.
`connectwise-automate:monitors`	ConnectWise Automate	ConnectWise Automate monitor management: monitor types (internal, remote, agent, SNMP, script), categories, threshold configuration, templates, assignment methods (computer/group/client), and status evaluation.
`datto-rmm:alerts`	Datto RMM	Datto RMM alert structure, priorities, and the 25+ alert context types (antivirus_ctx, eventlog_ctx, perf_disk_usage_ctx, ransomware_ctx, and more), each with its own type-specific fields.
`domotz:alerts`	Domotz	Domotz alerting configuration: what an alert profile defines, the two tools that read profiles and their per-device bindings, monitoring coverage audits, and the important limit — this server exposes alert configuration only, never fired alerts.
`ninjaone:alerts`	NinjaOne	NinjaOne alerts and the conditions behind them: retrieving device alerts, dismissing individual alerts and bulk resets, alert summaries, severity and priority levels, common hardware/service/security/connectivity alert types and thresholds, alert webhooks, and triage workflows.
`pagerduty:alerts`	PagerDuty	PagerDuty alerts: the alert-vs-incident model, alert statuses, grouping modes, event rules for routing and suppression, dedup_key deduplication, and the Events API v2 trigger/acknowledge/resolve payloads.
`rootly:alerts`	Rootly	Rootly's alerting layer between monitoring tools and incident management: alert sources (`alerts_source`) and their webhook/email intake, alert routing rules, alert groups (deduplication/noise reduction), alert urgencies, escalation policies, and the acknowledge/resolve actions on an individual alert.
`sentinelone:alerts`	SentinelOne	SentinelOne's read-only unified alert surface: the list/search/get alert tools plus notes and history, severity levels, status values, view types, GraphQL filter syntax, and cursor-based pagination.
`superops:alerts`	SuperOps.ai	SuperOps.ai RMM alerting: alert types, severity levels, status lifecycle and valid transitions, asset/client/monitor associations, the GraphQL operations for listing and resolving alerts, and the hand-offs for acknowledging them (console) and ticketing them (superops_tickets_create).

Automation & Scripts

Skills for running scripts, jobs, and automation workflows.

Skill	Plugin	Description
`connectwise-automate:scripts`	ConnectWise Automate	ConnectWise Automate script management: script types (PowerShell, batch, VBScript, Shell), script folders, script execution on computers, parameter handling and validation, execution status polling, and result/history retrieval.
`datto-rmm:jobs`	Datto RMM	Datto RMM job execution: quick jobs vs. scheduled vs. policy jobs, the job status lifecycle, component scripts and their variables, and stdout/stderr/exit-code result handling.
`superops:runbooks`	SuperOps.ai	SuperOps.ai RMM script automation: finding scripts in the library (all, or by OS), their run-time variables, running one script on one asset with runScriptOnAsset through the admin-tier GraphQL passthrough, and what the API cannot do (batch runs, schedules, reading execution results back).
`axcient:jobs`	Axcient	Axcient x360Recover backup jobs: the BRC vs Replibit job-type split, per-job protection thresholds, and job run history with its starttime_begin pagination floor.

API Patterns

Skills covering authentication, pagination, rate limiting, and error handling.

Skill	Plugin	Description
`3cx:api-patterns`	3CX	3CX's native PBX MCP server: the per-PBX endpoint shape (every PBX is its own FQDN and its own OAuth authorization server — there is no shared mcp.3cx.com), how Conduit's catalog connects one anyway, the Admin Console + client setup flow, the permission model (fully inherited from the 3CX account that approved the connection), and how to discover the live tool surface since 3CX has not published exact tool-name strings.
`abnormal-security:api-patterns`	Abnormal Security	Abnormal Security REST API fundamentals: Bearer token authentication, base URLs, rate limiting, pagination, OData filtering, request/response formats, and error handling.
`atera:api-patterns`	Atera	Atera REST API fundamentals: X-API-KEY header authentication, OData-style pagination, the 700 requests/minute rate limit, endpoint conventions, and error handling.
`auvik:api-patterns`	Auvik	Auvik MCP fundamentals: the JSON:API envelope shape, basic-auth credential model, region routing, cursor-based pagination, rate-limit handling, and the v1 vs v2 device API distinction.
`autotask:api-patterns`	Autotask PSA	Autotask REST API fundamentals: header-based authentication, zone detection, the query/filter DSL (14 operators, logical grouping, includes), pagination, rate limits, and CRUD conventions across the 215+ entity PSA.
`kaseya-quote-manager:api-patterns`	Kaseya Quote Manager	Kaseya Quote Manager (Datto Commerce) API fundamentals: API-key auth and the gateway's header translation, the read-only `kqm_<entity>_list`/`_get` tool surface across the sales, procurement, catalog, CRM, and org domains, page/pageSize/modifiedAfter pagination, rate limits, and error codes.
`betterstack:api-patterns`	BetterStack	Better Stack MCP and API surface across Uptime, Telemetry (Logtail), and Error Tracking: available tools, Bearer token authentication, API structure, cursor-based pagination, rate limiting, and error handling.
`blumira:api-patterns`	Blumira	Blumira REST API fundamentals: JWT authentication, the dual `/org/` vs `/msp/` path structure, suffix-based filter operators, pagination parameters and response metadata, the stateful MCP navigation tools, and HTTP error causes.
`avanan:api-patterns`	Checkpoint Harmony Email (Avanan)	Shape of the Checkpoint Harmony Email (Avanan) `hec_*` tool surface: the thirteen tools and what each reaches, the event/entity split that governs which tool accepts which id, the `responseEnvelope`/`responseData` result shape, `scrollId` pagination, and the auth, regional-routing and farm-scope behaviour behind every call.
`freshdesk:api-patterns`	Freshdesk	Freshdesk MCP tool surface and REST API v2 fundamentals: header-based authentication via `X-Freshdesk-Domain` and `X-Freshdesk-Api-Key` (which the MCP server translates into upstream HTTP Basic `apikey:X` auth), the `/api/v2` base URL, `page`/`per_page` pagination and the `link` header, per-minute rate limits, the search query language and its 300-result cap, and the status/priority/source integer encodings.
`inforcer:api-patterns`	Inforcer	Inforcer MCP fundamentals: the gateway X-Inforcer-Region / X-Inforcer-Api-Key headers, the region-based base URL and upstream Inf-Api-Key header, the /beta/ route prefix, the {success,message,errors,data} response envelope, continuationToken pagination, and the integer Client Tenant ID vs Azure AD GUID gotcha.
`connectwise-automate:api-patterns`	ConnectWise Automate	ConnectWise Automate REST API fundamentals: integrator and user+2FA authentication, token lifecycle, pagination, OData-style filtering, rate limiting, and error handling patterns for API integration.
`connectwise-cpq:api-patterns`	ConnectWise CPQ	ConnectWise CPQ (Sell/Quosal) API fundamentals: three-part Basic auth built from an access key plus an API key pair, the versioned content type, the flat 25-tool `cpq_*` surface, Manage-style `conditions` filtering, `includeFields` trimming of the 200+ property views, page/pageSize paging over bare arrays, RFC 6902 JSON Patch updates, and the endpoints CPQ deliberately does not expose.
`connectwise-psa:api-patterns`	ConnectWise PSA	ConnectWise PSA REST API fundamentals: public/private key + clientId authentication, page/pageSize pagination, the conditions query syntax, rate limiting (60/min), and error-response handling.
`datto-rmm:api-patterns`	Datto RMM	Datto RMM REST API v2 fundamentals: OAuth 2.0 client-credentials-style authentication, the 6 regional platforms (Pinotage, Merlot, Concord, Vidal, Zinfandel, Syrah), token lifecycle, cursor-based pagination, rate limiting, Unix-millisecond timestamps, and error handling.
`domotz:api-patterns`	Domotz	Domotz API and MCP fundamentals: X-Api-Key header authentication, the region-selected base URL (us-east-1 / eu-central-1), the full 21-tool MCP catalog by domain, the agent-scoped call shape, why there are no pagination arguments, rate limiting, and HTTP error codes.
`halopsa:api-patterns`	HaloPSA	HaloPSA REST API fundamentals: OAuth 2.0 client-credentials authentication, authorization vs. resource server URLs, the tenant query parameter, filtering and pagination conventions, array-wrapped POST bodies, rate-limit behavior, scopes, and error codes.
`hudu:api-patterns`	Hudu	Hudu REST API fundamentals: x-api-key authentication, base URL and /api/v1/ structure, granular API key permission levels, UI-vs-API resource naming differences, query-parameter filtering, page-based pagination, the 300 req/min rate limit, and HTTP status/error semantics.
`huntress:api-patterns`	Huntress	Huntress MCP fundamentals: HTTP Basic Auth via API key/secret headers, the full MCP tool catalog, token-based pagination, the 60 req/min rate limit, and the common HTTP error codes with their causes.
`itglue:api-patterns`	IT Glue	IT Glue REST API fundamentals: JSON:API request/response structure, x-api-key authentication across regional endpoints (US/EU/AU), filter and sort syntax, pagination, sideloading with includes, rate limits, CRUD operations, and error handling.
`keeper:api-patterns`	Keeper Secrets Manager	The Keeper Secrets Manager tool surface as exposed through Conduit: the nine read-only tools and their access tiers, the ten blocked tools and whether each is withheld by policy or broken upstream, the arguments stripped from `generate_password`, how the KSM application bounds everything the connection can see, the `configBase64` credential, and the error vocabulary.
`knowbe4:api-patterns`	Knowbe4	KnowBe4 REST API fundamentals: Bearer token authentication, multi-region base URLs (US, EU, CA, UK, DE), pagination, rate limiting, error handling, and response formats.
`m365:api-patterns`	Microsoft 365	Microsoft Graph fundamentals shared by every M365 skill: Entra token scopes and the per-request Bearer model, OData query operators and filter syntax, @odata.nextLink pagination, delta queries for incremental sync, 429 throttling and retry behavior, JSON batching, and the common Graph error codes.
`ninjaone:api-patterns`	NinjaOne	NinjaOne Public API fundamentals shared by every other NinjaOne skill: regional base URLs, OAuth 2.0 client-credentials auth and scopes, request shapes, cursor-based pagination, rate-limit headers and 429 handling, HTTP status codes and error response format, and webhook configuration.
`pagerduty:api-patterns`	PagerDuty	PagerDuty API and hosted MCP fundamentals: US/EU MCP endpoints, the `Token token=` auth header and token types, the complete 66-tool reference across 13 categories (incidents, on-call, schedules, escalation policies, services, event orchestrations, status pages, teams, users, and more), offset pagination, common filter parameters, rate limits, and error codes.
`pandadoc:api-patterns`	PandaDoc	PandaDoc hosted MCP server and API fundamentals: API-key authentication and which operations work without a key, the complete MCP tool catalog (documents, templates, recipients, docs search, code samples), page-based pagination, document and template filters, rate limits per plan, and error codes.
`warmly:api-patterns`	Warmly	Warmly's remote MCP server: WorkOS AuthKit OAuth 2.0 + PKCE authentication, RFC 9728 protected-resource metadata, multi-organization scoping, the stateful Streamable HTTP session model, the three read-only visitor-intelligence tools and their fields, credit semantics, error codes, and rate-limit guidance.
`pax8:api-patterns`	Pax8	Pax8 MCP fundamentals: the official hosted MCP server connection, all 15 Pax8 MCP tools and their parameters, pagination, sorting, filtering, response shapes, rate limiting, and error handling.
`posthog:api-patterns`	Posthog	PostHog API fundamentals for this plugin: personal API key auth brokered through Conduit (no local key), the resource:action scope model, generic REST error handling, and why this plugin's read-only posture rests on the key's own scopes alone — Conduit has no gateway-side fallback for this vendor.
`proofpoint:api-patterns`	Proofpoint	Proofpoint API fundamentals: HTTP Basic Auth with service principal and secret, base URLs and versioning across TAP SIEM, People, Quarantine, Forensics, and URL Defense APIs, rate limits, pagination patterns, and error handling.
`proofpoint-essentials:api-patterns`	Proofpoint Essentials	Proofpoint Essentials API fundamentals: X-User/X-Password header authentication with org-admin credentials, regional pod resolution via the endpoint discovery API, base URL construction, batch-create 207 multi-status handling, and error codes.
`netsuite:api-patterns`	Netsuite	NetSuite MCP fundamentals for this plugin: OAuth 2.0 Client Credentials (JWT-bearer) machine-to-machine auth brokered through Conduit, the per-tenant vendor-hosted MCP endpoint model, generic error handling, and how NetSuite's own role-based permissions — not this plugin — enforce the read-only posture.
`qbo:api-patterns`	QuickBooks Online	QuickBooks Online API fundamentals: OAuth2 authentication and token lifecycle, REST structure and base URLs, the Intuit query language, pagination, minor version headers, SyncToken optimistic locking, rate limits, webhooks, and the Fault error object format.
`rocketcyber:api-patterns`	RocketCyber	RocketCyber REST API v3 fundamentals: Bearer token authentication, regional base URL selection, pagination, rate limiting, error handling, and account hierarchy navigation.
`rootly:api-patterns`	Rootly	The Rootly hosted MCP server and the JSON:API REST surface behind it: Global vs. Team token types and how the gateway injects credentials, the catalog of roughly 253 dynamically generated tools by category, page-number pagination and relationship includes, filter syntax, rate limits, and error handling.
`runzero:api-patterns`	Runzero	runZero API fundamentals: the available MCP tools, Bearer-token authentication, the Export API for bulk retrieval, pagination, rate-limit headers, error codes, and the runZero query language.
`salesbuildr:api-patterns`	SalesBuildr	Salesbuildr API fundamentals: api-key header authentication, offset-based from/size pagination, error handling, and the 500 requests per 10 minutes rate limit.
`sentinelone:api-patterns`	SentinelOne	The SentinelOne Purple MCP server and the APIs behind it: uvx installation and transport modes, Service User token levels, the 23 read-only tools organized by domain, and the dual GraphQL (cursor pagination) / REST (offset pagination) architecture with its differing filter syntaxes, rate limits, and error causes.
`sherweb:api-patterns`	Sherweb	Sherweb Partner API fundamentals: OAuth 2.0 client-credentials auth, token caching, subscription-key header, scopes and base URLs, endpoint and MCP tool catalog, page-based pagination, Accept-Language localization, rate limits, and error codes.
`superops:api-patterns`	SuperOps.ai	SuperOps.ai GraphQL API fundamentals: Bearer token plus CustomerSubDomain header auth, region-specific endpoints, request/variable structure, offset (page/pageSize) pagination, the 800 req/min rate limit, filter operators, UTC date handling, error codes, and null-reset semantics.
`syncro:api-patterns`	Syncro MSP	Syncro MSP REST API fundamentals: API key setup and authentication, request and response patterns, pagination, rate limiting, and error handling.
`blackpoint:api-patterns`	Blackpoint	Blackpoint Cyber (CompassOne) MCP fundamentals: API-token header auth and its internal Bearer forwarding, the partner-tenant-asset hierarchy, navigation tools, which tool domains are functional versus stubbed, pagination, and HTTP error causes.
`saas-alerts:api-patterns`	Saas Alerts	SaaS Alerts MCP fundamentals: API-key authentication via the gateway header, the MSP → customer → account → user hierarchy, navigation and functional tool naming, event filter parameters, cursor pagination, and HTTP error codes.
`crewhu:api-patterns`	Crewhu	Crewhu MCP fundamentals: token authentication via the `X-Crewhu-Api-Token` header and its gateway env-var mapping, the flat 18-tool surface across the surveys, users, badges, and prizes domains (only `crewhu_badges_update_contest` writes), pagination, and error codes.
`immybot:api-patterns`	Immybot	ImmyBot MCP fundamentals: Entra ID OAuth 2.0 client-credentials auth (four fields), the `immybot_<domain>_<action>` tool naming and domain list, the two-step desired-state deployment model, the four destructive operations that need explicit confirmation, task/session polling cadence, and HTTP error codes.
`timezest:api-patterns`	Timezest	TimeZest MCP fundamentals: Bearer token authentication, the navigation pattern, scheduling-request payloads that carry PSA associated_entities (ConnectWise / Autotask / Halo ticket IDs), and the polling-only update model (no webhooks).
`threatlocker:api-patterns`	Threatlocker	ThreatLocker Portal API fundamentals: raw-key authentication (no Bearer prefix), multi-tenant routing via the organizationId header, POST-based "GetByParameters" list endpoints, pagination shape, and child-organization fan-out patterns.
`kaseya-vsa:api-patterns`	Kaseya Vsa	Kaseya VSA REST API fundamentals: two-step token-based authentication, the /api/v1.0 surface, pagination ($skip/$top) and filtering ($filter), the request/response envelope, error codes, and Kaseya One SSO bearer-token auth for unified-login tenants.
`datto-bcdr:api-patterns`	Datto Bcdr	Datto BCDR (Backup Portal) REST API fundamentals: public/private key HMAC-SHA256 request signing, the /v1 endpoint surface, pagination, appliance/agent hierarchy, and screenshot verification retrieval.
`kaseya-bms:api-patterns`	Kaseya Bms	Kaseya BMS PSA REST API v2 fundamentals: tenant subdomain routing, API-token bearer auth, Kaseya One SSO bridging, ticket and account workflows, and OData-style pagination.
`datto-saas-protection:api-patterns`	Datto Saas Protection	Datto SaaS Protection (formerly Backupify) through Conduit: the six datto_saas_* tools, the customer/domain/seat object model, Basic-auth key pair, seat types and states, and the confirm-gated bulk seat change.
`unitrends:api-patterns`	Unitrends	Unitrends Backup REST API fundamentals: session-token login exchange, the appliance-vs-asset hierarchy, backup job status queries, recovery point listing, and replication state.
`spanning:api-patterns`	Spanning	Spanning Cloud Backup REST API fundamentals: admin-email + API-token auth, the per-platform endpoint surface (M365, Google Workspace, Salesforce), the user/license model, backup status queries, and restore operations.
`hubspot:api-patterns`	HubSpot CRM	HubSpot's official remote MCP server (brokered by Conduit) and the CRM Search API behind it: the live tool catalog (search_crm_objects, get_crm_objects, manage_crm_objects, properties and owners), OAuth via the Conduit connect flow, scopes, sensitive-data (PHI) exclusion, filter/sort/ pagination syntax, plan-tier rate limits, and error handling.
`spamtitan:api-patterns`	Spamtitan	SpamTitan MCP fundamentals: the available tool catalog and its exact parameters, API-key header authentication, API structure, pagination, rate limiting, and error handling.
`xero:api-patterns`	Xero	Xero Accounting API fundamentals: OAuth2 Custom Connection (client credentials) auth and scopes, the xero-tenant-id header, where-clause filter syntax, page-based pagination, rate limits, the two date formats, validation-error shape, and batch operations.
`alternative-payments:api-patterns`	Alternative Payments	Alternative Payments API fundamentals: OAuth2 client-credentials token minting and bearer auth, scopes, REST endpoint structure, cursor pagination, the 5 req/sec rate limit, idempotency, error handling, and the read + safe-write capability posture that deliberately excludes direct payment creation.
`ironscales:api-patterns`	Ironscales	Ironscales MCP fundamentals: API-key plus company-ID header authentication and the per-tenant scoping that follows from it, the nine tools this server registers and what each one actually changes, offset/limit pagination without a total count, rate-limit behavior, and how API failures surface to the model.
`mimecast:api-patterns`	Mimecast	Mimecast MCP fundamentals: the available tool catalog, OAuth 2.0 client-credentials authentication, regional API endpoints, pagination, rate limiting, and error handling.
`mailprotector:api-patterns`	Mailprotector	Mailprotector MCP fundamentals: gateway header authentication (`X-Mailprotector-Api-Key` / `X-Mailprotector-Reseller-Id`) and its translation to the upstream Bearer token, the Provider → Reseller → Customer → Domain → User Group → User entity hierarchy, the router-pattern tool surface with `mailprotector_execute_tool` for the long tail, scope/scope_id consolidation, field-based list filtering, `page` pagination (max 50 on messages), and error handling.
`meraki:api-patterns`	Meraki	How to work with Cisco's hosted Meraki MCP server: its two tools (semantic_search and execute_api), the getOrganizations to getOrganizationNetworks to capability flow, passing parameters, single-page results, the per-organization rate limit, Conduit access tiers, error handling, and a table of verified read-only Dashboard API capability IDs.
`ncentral:api-patterns`	Ncentral	N-central MCP fundamentals: User-API Token (JWT) authentication through Conduit, 1-based pagination with the totalItems/totalPages envelope, rate-limit behavior, preview-endpoint caveats, and on-prem server specifics.
`nutanix:api-patterns`	Nutanix	Nutanix MCP fundamentals: the discovery-driven tool surface (4 discovery tools plus one `<namespace>_execute` tool per v4 API namespace — not per-entity CRUD tools), the listOperations → getOperationSchema → execute workflow, Conduit gateway credential configuration for Prism Central, OData query parameters, the read-only enforcement mode, and namespace availability rules.
`clio:api-patterns`	Clio	Clio Manage MCP fundamentals: OAuth 2.0 Authorization Code connection via Conduit, region selection, the matters-as-hub data model, decision-tree tool navigation, pagination, and the deliberate v1 scope limits (no delete anywhere, documents metadata-only, communications/calendar/bills read-only).
`scalepad:api-patterns`	Scalepad	ScalePad MCP fundamentals: API-key authentication via the `X-ScalePad-Api-Key` header, tool discovery across the five product domains, cursor pagination, the 50-requests-per-5-seconds rate limit, and 402 subscription errors.
`axcient:api-patterns`	Axcient	Axcient x360Recover API and MCP fundamentals: x-api-key header authentication, the single production base URL, the full 20-tool MCP catalog by domain, why most list endpoints return bare arrays with no pagination, and the five distinct error response shapes the upstream API actually returns.
`kpn:api-patterns`	KPN	How the KPN tool surface behaves through Conduit: the Grexx (IRMA) wholesale interface behind the kpn_grexx_* tools, the client-ID/secret credential pair and the optional Grexx URL fields, the IRMA customer/order model, the one write tool, and common errors.
`ai-org-admin:api-patterns`	Ai Org Admin	Anthropic Admin MCP fundamentals: the Conduit X-Anthropic-Admin-Key header and the sk-ant-admin key it carries, one key = one Anthropic organization, the 19 read-only tools and which three are admin-gated in Conduit, the two pagination styles (ID cursors and page tokens), response truncation, the cents-not-dollars cost units, time-range limits, and how vendor errors and 429s come back.
`openai-admin:api-patterns`	Openai Admin	OpenAI Admin MCP fundamentals: the Admin key sent as the `X-OpenAI-Admin-Key` header through Conduit, the 30-tool read-only surface and which five tools Conduit admin-gates, the two pagination styles (object cursors for lists, page tokens for usage and cost reports), Unix-second time ranges, truncated pages, and the error and 429 shapes the server returns.
`jamf:api-patterns`	Jamf	Jamf Pro MCP fundamentals through Conduit: the three X-Jamf-* credential headers and the API client they come from, the read/write/admin tool tiers and how Conduit and the sidecar each gate them, zero-based paging and RSQL filters on the Jamf Pro API tools, contains/limit on the Classic API list tools, inventory sections, response caps, and the error and rate-limit messages the sidecar returns.
`acronis:api-patterns`	Acronis	Acronis Cyber Protect Cloud MCP fundamentals through Conduit: the three `X-Acronis-*` headers (data center URL, API client ID and secret), the partner → customer → unit tenant hierarchy and what an API client can see, the 37-tool surface (34 reads plus 3 writes that are off by default, one of them admin-only in Conduit), the `path` / `query` / `body` argument shape, the different pagination styles per API family, filter operator syntax, nanosecond alert timestamps, response size caps, and the error shape.
`bitwarden:api-patterns`	Bitwarden	Bitwarden MCP fundamentals: the organization API key passed through Conduit as X-Bitwarden-Client-Id / X-Bitwarden-Client-Secret / X-Bitwarden-Region, the 12 read-only tools and which one is admin-gated, full-list responses versus the paged event log, response truncation, the member role and status enums, error and rate-limit handling, and what the Public API can never return.
`1password:api-patterns`	1password	1Password MCP fundamentals through Conduit: the region plus two independent credential halves (Events Reporting token, Users API client) and their X-OnePassword-* headers, which of the six read-only tools needs which half, which three are admin-gated in Conduit, cursor paging on the Events feeds, page-token paging on users, time windows and 120-day retention, rate limits, and how vendor errors come back.
`zabbix:api-patterns`	Zabbix	Zabbix MCP fundamentals through Conduit: the X-Zabbix-Base-Url and X-Zabbix-Api-Token headers, version-dependent token auth, the read-only 18-tool surface (one admin-gated tool, three opt-in tools Conduit does not list), the shared JSON-RPC get parameters (output, filter, search, tags, sortfield, limit), keyset paging by event ID or time range, the 500-row cap, output truncation and redaction, and the error types the sidecar returns.
`lastpass:api-patterns`	Lastpass	The LastPass Business and MSP admin tool surface as exposed through Conduit: the 23 read-only tools and their Conduit tier, Business key versus MSP key scope, the `X-LastPass-API-Key` header, `max_results` / `page_token` pagination, wildcard and `[from:to]` range filters, the users LastPass silently omits from lists, the user record fields, and the error vocabulary (401 early access, 403 wrong key type, 429 shared limits, oversize pages).
`moovila:api-patterns`	Moovila	The Moovila tool surface as exposed through Conduit: the 19 read-only report tools and their tiers, the bring-your-own-client OAuth connection and the X-Moovila-Access-Token header Conduit injects, offset/limit paging with the 100-record cap and truncation notes, lastChangedDate incremental pulls, GUID validation, the record shapes (Project, ProjectBudget, Task, TimeEntry, User, labor type), and the error vocabulary.
`webroot:api-patterns`	Webroot	Webroot Unity API fundamentals through Conduit: the five X-Webroot-* headers and the console-user password grant behind them, the GSM key bound to the connection, the 25 read-only tools and which four Conduit admin-gates, the three paging styles (PageNr/TotalAvailable, PageNr/MoreAvailable, ContinuationToken), siteId vs. site keycode, date-range defaults, error statuses, and response size limits.
`cove:api-patterns`	Cove	How the Cove Data Protection MCP tools talk to N-able's JSON-RPC API through Conduit: the three X-Cove-* headers and the API user behind them, the 15-minute visa session, finding partner (customer) IDs, statistics column codes and units, paging and truncation, Cove error numbers, and which tool is admin-gated in Conduit.
`unitrends-uniview:api-patterns`	Unitrends Uniview	Unitrends UniView MCP fundamentals: the two Conduit credential headers and the OAuth2 client_credentials exchange behind them, the flat 12-tool read-only surface, the {data, paging} response shape, page_number/page_size paging and truncation, parameter validation (enums, UUIDs, ISO 8601, include objects), error and 429 handling, and which tools return personal data.
`gogetssl:api-patterns`	Gogetssl	GoGetSSL MCP fundamentals: the username plus API-password credential pair Conduit sends as X-GoGetSSL-* headers, the sidecar's cached auth-key login, the flat 20-tool read-only surface (none admin-gated), the single reseller account model with no client scoping, which list tools page and which do not, response-size limits, and GoGetSSL's error envelope.
`smileback:api-patterns`	Smileback	The SmileBack tool surface as exposed through Conduit: the 12 read-only tools over the Data Replication API v3, the five-header credential (OAuth2 password grant run by the server), the US/EU region, Conduit access tiers (all read, none admin-gated), limit/offset pagination, response truncation, client-side filtering because the API has no per-company or date-range filter, the error vocabulary, and the personal data the responses carry.
`myitprocess:api-patterns`	Myitprocess	myITprocess MCP fundamentals: the single X-MyITprocess-Api-Key header Conduit sends (forwarded upstream as MITP-API-KEY), the nine read-only list tools and their shared page / page_size / filters / sort parameters, the {page, pageSize, totalCount, items} response shape, the 50 requests per minute account-wide rate limit, and the error messages the server returns.
`alga-psa:api-patterns`	Alga Psa	Alga PSA MCP fundamentals through Conduit: the X-Alga-Instance-Url / X-Alga-Api-Key / X-Alga-Tenant-Id headers, the 42-tool read-only surface (no writes, nothing admin-gated), the four pagination styles (page/limit, limit-only search, offset, cursor), response truncation, error messages, concurrency and retry limits, and the untrusted-content envelope.
`dubber:api-patterns`	Dubber	How the Dubber tool surface behaves through Conduit: the five X-Dubber-* credential headers and the password-grant token they mint, region selection, the account/group/Dub.Point/recording hierarchy, how dubber_recordings_list pages and filters, which list tools return a single page, the error and rate-limit behaviour, the confirm_destructive_action flow, and which tools Conduit treats as read, write or admin.
`mspcfo:api-patterns`	Mspcfo	MSPCFO MCP fundamentals for this plugin: OAuth 2.0 + PKCE browser sign-in brokered by Conduit (no API key, no headers), the admin-only tool gate while MSPCFO's tools are unclassified in Conduit, discovering tool names at runtime because MSPCFO does not publish them, report parameters and result size, error handling, and data-freshness caveats.
`marketsharp:api-patterns`	MarketSharp	The MarketSharp tool surface as exposed through Conduit: the 25 read-only tools over the MarketSharp REST API, the Conduit connection fields (Company ID, API key, API secret, optional Employee ID), which tools need the Employee ID or a MarketSharp permission, read-tier access, page-size and record caps, the 200,000-character response cap and how an oversized page is cut, the appointment default on inquiries, date formats, untrusted-content wrapping, retries and errors.

All Skills by Plugin

3CX

Skill	Description
`calls-queues`	3CX's live-operations surface: read-only visibility into active calls, recordings, voicemail, department and queue membership, and forwarding/presence profiles, plus the write actions that change live call routing — dropping a call, switching a profile, and logging a queue agent in or out.
`directory`	3CX's read-only directory surface: resolving a caller by email or by exact extension, searching the PBX's own phonebooks, searching contacts synced from an integrated CRM, and listing PBX users/extensions.
`pbx-admin`	3CX's system-and-configuration surface: server time, PBX event log and application log search, service status, database schema and the read-only SELECT-only Query tool, DIDs, IP and phone blocklists, SIP trunks, call flow apps, and the configuration write/delete actions that change what calls the PBX accepts or how they route.
`api-patterns`	3CX's native PBX MCP server: the per-PBX endpoint shape (every PBX is its own FQDN and its own OAuth authorization server — there is no shared mcp.3cx.com), how Conduit's catalog connects one anyway, the Admin Console + client setup flow, the permission model (fully inherited from the 3CX account that approved the connection), and how to discover the live tool surface since 3CX has not published exact tool-name strings.

Abnormal Security

Skill	Description
`cases`	Abnormal Security abuse mailbox cases: user-reported email submissions, case statuses and judgments, the case lifecycle, bulk and remediation actions, and phishing simulation handling.
`messages`	Abnormal Security message analysis: message retrieval, email header inspection, attachments, sender reputation, delivery context, and SPF/DKIM/DMARC authentication results.
`threats`	Abnormal Security threat detection: threat types (BEC, phishing, malware, socially-engineered attacks, spam, graymail, credential theft), attack vectors, severity assessment, remediation actions, and investigation workflows.
`api-patterns`	Abnormal Security REST API fundamentals: Bearer token authentication, base URLs, rate limiting, pagination, OData filtering, request/response formats, and error handling.

Advanced Workflows

Skill	Description
`chat-delivery-adapters`	The delivery-adapter contract every advanced-workflow skill uses to post its finished report somewhere a human will see it — Slack, an IT Glue document, or (blocked) Microsoft Teams.
`psa-tool-map`	Maps abstract PSA/ticketing operations (list new tickets, get ticket detail, update priority + status, list statuses, list priorities) to concrete Conduit tool names for Autotask, HaloPSA, and ConnectWise PSA.
`ticket-triage-agent`	Build (or run once) a ticket-triage agent that classifies new PSA tickets by priority, advances them to In Progress, and posts a summary to the connected chat tool.

Atera

Skill	Description
`agents`	Atera RMM agents: agent records and fields, online/offline status, endpoint search and monitoring, PowerShell and script execution, and agent lifecycle.
`alerts`	Atera alerts: alert types, severity levels, alert sources, the acknowledge/resolve lifecycle, and alert-to-ticket conversion.
`customers`	Atera customers and contacts: customer records and fields, contact management, custom fields, and customer lifecycle operations.
`devices`	Atera device monitors: HTTP, SNMP, and TCP monitor types for network devices, services, and applications, plus monitor configuration, thresholds, and polling behavior.
`tickets`	Atera service desk tickets: ticket fields, statuses, priorities, comments, work hours, and billing duration.
`api-patterns`	Atera REST API fundamentals: X-API-KEY header authentication, OData-style pagination, the 700 requests/minute rate limit, endpoint conventions, and error handling.

Auvik

Skill	Description
`alerts`	Auvik alerts: severity tiers, status lifecycle, dismissal semantics, and the common alertName patterns that show up in MSP NOC queues.
`devices`	Auvik device records: device types, manageStatus and onlineStatus, lifecycle and warranty fields, and choosing between the v1 list endpoint and the detailed device endpoints.
`networks`	Auvik network and interface entities: the network entity model, IP-range scoping, interface-to-device relationships, and adminStatus vs operStatus.
`api-patterns`	Auvik MCP fundamentals: the JSON:API envelope shape, basic-auth credential model, region routing, cursor-based pagination, rate-limit handling, and the v1 vs v2 device API distinction.

Autotask PSA

Skill	Description
`billing`	Autotask billing item retrieval, approval-level workflows, and invoice search — covering billing item types, approval status filtering, and reconciliation of billable work against invoices for MSP finance teams.
`configuration-items`	Autotask Configuration Item (CI) asset management: CI types and categories, lifecycle status codes, the CI field schema, related-item relationships, DNS records, notes, and contract/billing associations for MSP infrastructure tracking.
`contract-services`	The recurring-billing side of Autotask contracts: service and bundle lines (autotask_search_contract_services, autotask_search_contract_service_bundles), the billed unit rows behind them (autotask_search_contract_service_units, autotask_search_contract_service_bundle_units), the per-contract monthly recurring-revenue roll-up (autotask_get_contract_recurring_lines), and writing service lines and onboarding contract shells.
`contracts`	Autotask contract and service agreement management - contract types (recurring services, block hours, time & materials, fixed price, retainer), service/service bundle associations, SLAs, and how contracts drive billing for MSP account managers.
`crm`	Autotask CRM entities - companies (accounts), contacts, and sites/locations - including field references, company type classifications, and how these records underpin tickets, contracts, and projects for MSP account management.
`expenses`	Autotask expense report and expense item structure - the report/item parent-child relationship, approval status workflow, expense categories, payment types, and the billable vs reimbursable distinction for MSP operational expenses.
`picklists`	Autotask picklist and reference-data lookups — queues, ticket statuses, ticket priorities, and project phases — the instance-specific configured values required before creating or filtering tickets and other entities.
`product-catalog`	Autotask product catalog structure - Products, Services, and Service Bundles - and how Price Lists override default unit pricing.
`projects`	Autotask project structure - projects, phases, tasks, and milestones - including project and task fields, status values, resource assignment, and how project work links to contract billing for MSP project managers.
`quotes`	Autotask quote structure and line items - quote item types (product, service, service bundle, labor, expense, shipping), the mutually-exclusive catalog reference rules, and the three discount mechanisms (unit, line, percentage) used to build customer proposals.
`service-calls`	Autotask Service Call data model - the ServiceCall / ServiceCallTicket / ServiceCallTicketResource three-layer structure - covering fields, status codes, and how tickets and technicians (resources) are linked to scheduled work.
`ticket-notes-attachments`	Autotask ticket notes, attachments, and charges — the secondary entities attached to tickets: retrieving/searching notes and attachments, and creating, updating, or searching ticket charges for labor and expenses billed directly to a ticket.
`tickets`	Autotask ticket lifecycle: status/priority codes and transition rules, the ticket field schema, SLA calculation and clock behavior, escalation rules, ticket metrics, and the MCP tool surface (create, update, search, history, notes) for MSP service desk operations.
`time-entries`	Autotask time entry structure: approval status codes and workflow, the time entry field schema, the billing rate hierarchy, budget and contract-limit validation, utilization analytics, and the MSP business rules for rounding and minimum billing increments.
`tool-discovery`	The Autotask MCP lazy-loading pattern - four meta-tools (list_categories, list_category_tools, execute_tool, router) that expose the full 39+ tool catalog progressively instead of loading every tool schema upfront, plus the natural-language router for intent-based tool lookup.
`api-patterns`	Autotask REST API fundamentals: header-based authentication, zone detection, the query/filter DSL (14 operators, logical grouping, includes), pagination, rate limits, and CRUD conventions across the 215+ entity PSA.

Kaseya Quote Manager

Skill	Description
`purchasing`	Kaseya Quote Manager procurement data: purchase orders with their lines and costs, the suppliers they are placed with, and product-supplier records mapping catalog products to supplier SKUs and pricing.
`quotes`	Kaseya Quote Manager quoting data: the quote → section → line item hierarchy, and the sales orders, order lines, and payments a quote becomes once accepted.
`api-patterns`	Kaseya Quote Manager (Datto Commerce) API fundamentals: API-key auth and the gateway's header translation, the read-only `kqm_<entity>_list`/`_get` tool surface across the sales, procurement, catalog, CRM, and org domains, page/pageSize/modifiedAfter pagination, rate limits, and error codes.

BetterStack

Skill	Description
`incidents`	Better Stack incidents: incident records raised by uptime monitors or reported manually, and the triage, acknowledgment, and resolution lifecycle.
`logging`	Better Stack log management (Logtail): log sources, structured log search and query syntax, log-based alerting, and log analysis workflows.
`monitors`	Better Stack uptime monitors: check types, monitor fields, heartbeat monitors, monitor groups, and create/update/pause/delete operations.
`oncall`	Better Stack on-call: on-call calendars and rotations, escalation and notification policies, alert routing, and determining who is currently on call.
`status-pages`	Better Stack status pages: status page configuration, resources and components, maintenance windows, and public service-status communication.
`api-patterns`	Better Stack MCP and API surface across Uptime, Telemetry (Logtail), and Error Tracking: available tools, Bearer token authentication, API structure, cursor-based pagination, rate limiting, and error handling.

Blumira

Skill	Description
`agents`	Blumira agents (sensors) and the devices they run on: device inventory and filtering, agent health via last-seen timestamps, and agent deployment keys.
`findings`	The Blumira finding lifecycle: status and severity codes, resolution types, list filtering, enriched detail retrieval, assignment, and comment threads.
`msp`	Blumira's MSP path group (`/msp/*`): managed-account enumeration, cross-account and per-account finding queries, per-account device, agent-key and user management, and how MSP paths differ from org paths.
`resolutions`	Blumira resolution types (Valid, Not Applicable, False Positive): how to choose between them, their effect on security metrics and detection tuning, and the org- and MSP-level resolve calls.
`users`	Blumira organization users: listing and filtering users, user roles, and looking up the user IDs required for finding assignment and access audits.
`api-patterns`	Blumira REST API fundamentals: JWT authentication, the dual `/org/` vs `/msp/` path structure, suffix-based filter operators, pagination parameters and response metadata, the stateful MCP navigation tools, and HTTP error causes.

Checkpoint Harmony Email (Avanan)

Skill	Description
`exceptions`	The Checkpoint Harmony Email (Avanan) whitelist and blacklist surface: the match fields and matching modes an exception accepts, the defaults that widen an entry beyond what was typed, the id mismatch between listing and editing, and the standing security consequence of a detection bypass.
`quarantine`	Finding and acting on mail in Checkpoint Harmony Email (Avanan): the `hec_search_emails` attribute-filter syntax, what an entity payload carries, the asynchronous quarantine and restore actions and their task polling, and the judgement a restore requires because delivery cannot be undone.
`threats`	The Checkpoint Harmony Email (Avanan) security-event surface: the event type, state, severity and SaaS enums accepted by `hec_query_events`, what a detection record does and does not carry, how `availableEventActions` governs what you can do next, and phishing, BEC and malware triage built on those fields.
`api-patterns`	Shape of the Checkpoint Harmony Email (Avanan) `hec_*` tool surface: the thirteen tools and what each reaches, the event/entity split that governs which tool accepts which id, the `responseEnvelope`/`responseData` result shape, `scrollId` pagination, and the auth, regional-routing and farm-scope behaviour behind every call.

CIPP

Skill	Description
`alerts`	CIPP's read-only alerting and audit surface: the cross-tenant alert queue, tenant-scoped M365 unified audit log queries, the audit operations worth filtering on during a compromise investigation, and audit lag/retention behavior.
`groups`	Tenant-scoped Entra/M365 group enumeration and creation in CIPP, the four group types (Security, Microsoft 365, Distribution, Mail-Enabled Security) and when to pick each, and the boundary where CIPP's group surface ends and Graph/M365 takes over.
`licenses`	Read-only M365 license visibility through CIPP: per-tenant SKU purchase vs. consumption, portfolio-wide CSP license commitments, common SKU part numbers and their friendly names, and the license-mix red flags that drive rightsizing and billing reconciliation.
`mailboxes`	The four Exchange Online mailbox operations CIPP exposes — mailbox inventory, delegate/full-access permission audit, out-of-office, and email forwarding — plus the BEC-remediation, offboarding, and leave-coverage sequences built from them.
`ops`	CIPP's own operational layer rather than the tenants it manages: GDAP role definitions and pending invites, the CIPP scheduler, and the ping/version/log endpoints used to diagnose why other CIPP tools fail silently.
`secure-score`	Microsoft Secure Score through CIPP: the live per-tenant score and its history (cipp_get_secure_score), the recommendation catalog behind it (cipp_list_secure_score_controls), and how to turn the two into a ranked, client-ready improvement plan.
`security`	Read-only access to a tenant's Conditional Access policy graph and named locations through CIPP: policy state semantics, the findings that matter in a CA review, portfolio drift detection, and why CA writes are absent from the MCP surface.
`standards`	CIPP's tenant-baseline enforcement model: the Report/Alert/Remediate standards modes and how to roll them out, on-demand standards evaluation, Best Practice Analyser reports, and SPF/DKIM/DMARC domain health results with their remediation actions.
`tenants`	The top-level CIPP scope: enumerating managed M365 tenants, retrieving tenant detail, and the accepted `tenantFilter` identifier formats (default domain, custom domain, GUID, `allTenants`).
`users`	The full multi-tenant M365 user lifecycle in CIPP: create/edit/disable, password and MFA resets, session revocation, the bundled offboarding call, BEC investigation reports, MFA gap reporting, and device/group lookups — plus the ordering constraints that make each sequence correct.

Freshdesk

Skill	Description
`contacts-companies`	Freshdesk contacts and companies: contact fields and the required contact-channel rule, contact CRUD plus merge and make_agent, company fields and domain-based auto-association, search and autocomplete lookups, and the MSP workflow of resolving a ticket requester to a contact and then to its parent company through the Freshdesk REST API v2.
`knowledge-base`	Freshdesk Solutions knowledge base: the three-level categories -> folders -> articles hierarchy, article fields and draft/published status, finding an article by walking that tree (there is no KB search tool), and the MSP workflow of suggesting relevant KB articles to deflect or resolve a ticket, through the Freshdesk REST API v2.
`sla-business-hours`	Freshdesk SLA policies and business-hours calendars: policy and calendar fields, per-priority respond_within / resolve_within targets, how the business-hours vs 24x7 clock computes a ticket's fr_due_by and due_by, and breach / at-risk detection through the Freshdesk REST API v2.
`ticketing`	Freshdesk ticket operations: list, get, search, create, update, reply, notes, and conversation threads.
`api-patterns`	Freshdesk MCP tool surface and REST API v2 fundamentals: header-based authentication via `X-Freshdesk-Domain` and `X-Freshdesk-Api-Key` (which the MCP server translates into upstream HTTP Basic `apikey:X` auth), the `/api/v2` base URL, `page`/`per_page` pagination and the `link` header, per-minute rate limits, the search query language and its 300-result cap, and the status/priority/source integer encodings.

Inforcer

Skill	Description
`assessments`	Inforcer assessments: listing a tenant's assessments (read-only) and triggering an assessment run — the one mutating action in the entire Inforcer surface.
`audit-events`	Inforcer's read-only record of changes and activity: searching and filtering auditEvents by type and date window (the search is account-wide — there is no tenant filter), enumerating the event-type catalog to build valid filters, and the continuationToken paging audit searches require.
`baseline-alignment`	Inforcer's core drift-detection surface: baseline templates, tenant alignment scores, alignment details (the per-policy breakdown of a tenant against its assigned baseline), and reading deployed tenant policy state.
`compliance-reporting`	Inforcer compliance and posture reporting: per-tenant Microsoft 365 secure scores, combining them with alignment scores, and the alignedThreshold / semiAlignedThreshold settings that classify each tenant or policy as aligned, semi-aligned, or drifted.
`identity-governance`	Inforcer's read-only identity inventory for a managed Microsoft 365 tenant: users, groups, and role assignments.
`tenant-management`	Inforcer's managed Microsoft 365 tenant list and the resolution step that turns a friendly name, DNS domain, or Azure AD GUID into the integer Client Tenant ID.
`api-patterns`	Inforcer MCP fundamentals: the gateway X-Inforcer-Region / X-Inforcer-Api-Key headers, the region-based base URL and upstream Inf-Api-Key header, the /beta/ route prefix, the {success,message,errors,data} response envelope, continuationToken pagination, and the integer Client Tenant ID vs Azure AD GUID gotcha.

ConnectWise Automate

Skill	Description
`alerts`	ConnectWise Automate alerts through Conduit: the read-only cwautomate_alerts_list and cwautomate_alerts_get tools, filtering by computer, client and severity, alert sources and severity levels, and triage workflows that hand follow-up to the PSA.
`clients`	ConnectWise Automate client management: client CRUD, client identifiers, locations, client hierarchy, groups, extra data fields (EDFs), and client-level settings.
`computers`	ConnectWise Automate computer/endpoint management: computer identifiers (ComputerID, Name, ComputerGUID, MAC), status values, OS types, hardware/software inventory, disk, patch, and antivirus status, plus remote management operations.
`monitors`	ConnectWise Automate monitor management: monitor types (internal, remote, agent, SNMP, script), categories, threshold configuration, templates, assignment methods (computer/group/client), and status evaluation.
`scripts`	ConnectWise Automate script management: script types (PowerShell, batch, VBScript, Shell), script folders, script execution on computers, parameter handling and validation, execution status polling, and result/history retrieval.
`api-patterns`	ConnectWise Automate REST API fundamentals: integrator and user+2FA authentication, token lifecycle, pagination, OData-style filtering, rate limiting, and error handling patterns for API integration.

ConnectWise CPQ

Skill	Description
`quote-items`	ConnectWise CPQ line items and the tabs that hold them: searching items by quote or tab, the tab requirement on every create, the pricing and margin fields, bundle and optional-line flags, recurring-revenue and PSA mapping fields, JSON Patch updates, and why there is no product catalog to search.
`quotes`	The ConnectWise CPQ quote lifecycle over the real tool surface: searching quotes, the GUID-vs-quoteNumber dual addressing, versions, creating quotes by copying a template (the API's only create path), patching quote fields, the per-quote customer records and payment/financing terms, tabs as the section structure, and the deletes that cascade.
`api-patterns`	ConnectWise CPQ (Sell/Quosal) API fundamentals: three-part Basic auth built from an access key plus an API key pair, the versioned content type, the flat 25-tool `cpq_*` surface, Manage-style `conditions` filtering, `includeFields` trimming of the 200+ property views, page/pageSize paging over bare arrays, RFC 6902 JSON Patch updates, and the endpoints CPQ deliberately does not expose.

ConnectWise PSA

Skill	Description
`companies`	ConnectWise PSA company/account management: company types, statuses, sites/locations, custom fields, and company relationships.
`contacts`	ConnectWise PSA contact management: contact records, contact types, communication items (email, phone), portal access, and relationships to companies.
`procurement`	ConnectWise PSA procurement and stock through Conduit: purchase orders and their line items, sales orders and their products, procurement product items placed on tickets/projects/opportunities, warehouses and bins, inventory on hand, and the three-step inventory adjustment (cw_create_adjustment, cw_add_adjustment_detail, cw_close_adjustment).
`product-catalog`	ConnectWise PSA product catalog: catalog items (SKUs), categories, subcategories, manufacturers, and their use on quotes, opportunities, agreements, and tickets.
`projects`	ConnectWise PSA project management: project lifecycle and status/type values, phases, templates, resource/team allocation, budgeting, billing methods, and project tickets.
`scheduling`	ConnectWise PSA schedule entries through Conduit: booking a member's time against a service ticket, project ticket or activity (cw_create_schedule_entry), finding and moving bookings (cw_search_schedule_entries, cw_update_schedule_entry), schedule types and statuses, UTC date handling, and the difference between a booking and a time entry.
`tickets`	ConnectWise PSA ticket management: ticket fields, service boards, statuses, priorities, SLAs, ticket notes, and workflow automation.
`time-entries`	ConnectWise PSA time entry management: charge-to types (tickets, projects, charge codes), billable vs non-billable time, work types and work roles, time sheets, and the time entry approval workflow.
`api-patterns`	ConnectWise PSA REST API fundamentals: public/private key + clientId authentication, page/pageSize pagination, the conditions query syntax, rate limiting (60/min), and error-response handling.

Datto RMM

Skill	Description
`alerts`	Datto RMM alert structure, priorities, and the 25+ alert context types (antivirus_ctx, eventlog_ctx, perf_disk_usage_ctx, ransomware_ctx, and more), each with its own type-specific fields.
`audit`	Datto RMM audit data structure covering hardware inventory (CPU, RAM, disks, motherboard, BIOS), software inventory, network interfaces, and ESXi/printer audits, along with audit collection cadence and data freshness semantics.
`devices`	Datto RMM device management: identifiers (UID, hostname, MAC), device types and statuses, user-defined fields (UDF1-30), warranty data, and device lookup/update/delete operations.
`jobs`	Datto RMM job execution: quick jobs vs. scheduled vs. policy jobs, the job status lifecycle, component scripts and their variables, and stdout/stderr/exit-code result handling.
`sites`	Datto RMM site management: site hierarchy and identifiers, proxy and patch-window settings, site-scoped device/alert queries, and create/update/delete operations for client locations.
`variables`	Datto RMM account-level and site-level variables: scoping and inheritance (site overrides account), naming conventions and reserved prefixes, CRUD operations, and referencing variables from component scripts.
`api-patterns`	Datto RMM REST API v2 fundamentals: OAuth 2.0 client-credentials-style authentication, the 6 regional platforms (Pinotage, Merlot, Concord, Vidal, Zinfandel, Syrah), token lifecycle, cursor-based pagination, rate limiting, Unix-millisecond timestamps, and error handling.

Domotz

Skill	Description
`agents`	Domotz agents (collectors/probes) as the per-site entry point for all device and network operations: agent types, lifecycle, ONLINE/OFFLINE status, the list/get tools and their license and last-seen fields, and fleet health, site inventory, and capacity-planning workflows.
`alerts`	Domotz alerting configuration: what an alert profile defines, the two tools that read profiles and their per-device bindings, monitoring coverage audits, and the important limit — this server exposes alert configuration only, never fired alerts.
`devices`	Domotz device inventory: how agents discover and classify devices, the identification attributes (IP, MAC, hostname, display name, vendor), the ONLINE/OFFLINE/UNKNOWN status model, the five device tools — list, get, uptime, history, inventory metadata — and why device lookup is a client-side match rather than a server-side search.
`network`	Domotz network observation: the collector's topology graph, its own interfaces, detected IP conflicts, and the two SNMP surfaces — polled variables and custom sensors — with their history endpoints and the tools and error modes for each.
`power`	Domotz PDU and smart-outlet control: listing outlets and their power state, and the one non-GET tool the Domotz server exposes — switching an outlet on, off, or cycling it.
`api-patterns`	Domotz API and MCP fundamentals: X-Api-Key header authentication, the region-selected base URL (us-east-1 / eu-central-1), the full 21-tool MCP catalog by domain, the agent-scoped call shape, why there are no pagination arguments, rate limiting, and HTTP error codes.

HaloPSA

Skill	Description
`agents`	HaloPSA agents (technicians) and teams as a read-only MCP surface: listing technicians, retrieving agent detail, listing team structures, and the inactive-agent filter.
`assets`	HaloPSA asset/CMDB data model: asset (configuration item) fields, device types and statuses, links to clients, sites, users, tickets, and contracts, plus parent-child asset relationships.
`clients`	HaloPSA CRM data model: client records and their billing/contact fields, sites (locations), contacts (Users), client classification, and parent-child client hierarchy.
`contracts`	HaloPSA contract management: contract types (recurring, prepaid hours, ad-hoc, project, warranty), statuses, billing and coverage fields, recurring invoice items, prepaid hour balances and deduction, SLA association, renewal and billing-reconciliation workflows.
`invoices`	HaloPSA invoices as a read-only MCP surface: listing by client or date range, filtering by payment and send status, retrieving line-item detail on a single invoice, and the reporting and reconciliation workflows built on them.
`tickets`	HaloPSA service desk tickets: ticket fields, statuses, priorities and ticket types, actions (notes and time entries), attachments, SLA behaviour, and the creation and status-transition workflows with their validation rules.
`api-patterns`	HaloPSA REST API fundamentals: OAuth 2.0 client-credentials authentication, authorization vs. resource server URLs, the tenant query parameter, filtering and pagination conventions, array-wrapped POST bodies, rate-limit behavior, scopes, and error codes.

Hudu

Skill	Description
`articles`	Hudu knowledge base articles: HTML content format, company-scoped vs global articles, article folders (including nesting), drafts vs published, the /api/v1/articles endpoint surface, and search, templating, and documentation-health patterns.
`assets`	Hudu assets and asset layouts: the layout-as-template model, custom field types, the `custom_fields` key/value array shape, archiving vs deletion, company scoping, and filter patterns across /api/v1/assets and /api/v1/asset_layouts.
`companies`	Hudu companies (clients/organizations): company field reference, parent/child hierarchy, PSA integration matching via id_in_integration, the /api/v1/companies CRUD plus archive/unarchive endpoints, onboarding and offboarding workflows, and how companies scope assets, passwords, articles, and websites.
`passwords`	Hudu secure credential storage: the /api/v1/asset_passwords endpoint (the UI calls these "Passwords"), company scoping and password folders, TOTP secrets, per-API-key password permissions, activity-log auditing, rotation workflows, and output-safety rules for handling plaintext credential values.
`websites`	Hudu website records: CRUD via /api/v1/websites, monitoring and pause/disable fields, SSL/TLS certificate tracking, email security status (DMARC, DKIM, SPF), DNS record fields, company linkage, and website validation errors.
`api-patterns`	Hudu REST API fundamentals: x-api-key authentication, base URL and /api/v1/ structure, granular API key permission levels, UI-vs-API resource naming differences, query-parameter filtering, page-based pagination, the 300 req/min rate limit, and HTTP status/error semantics.

Huntress

Skill	Description
`agents`	Huntress endpoint agents: the agent lifecycle, organization and platform filters, health signals such as `last_seen_at` and version, fleet-audit workflows, and the errors returned for missing or empty agent results.
`billing`	Huntress billing and summary reports: what each report type contains, the list/get tools for both, and the monthly reconciliation, QBR security summary, and cost-analysis workflows an MSP builds from them.
`escalations`	Huntress SOC escalations: how an escalation differs from an incident, escalation priority levels, the list/get/resolve tools, escalation-to-incident correlation, and the already-resolved and not-found error cases.
`incidents`	Huntress incidents and the remediation lifecycle: querying incidents by organization and status, SOC-recommended remediation details, individual and bulk approve/reject, remediation execution status, and the ordering constraint that incidents resolve only after all remediations are processed.
`organizations`	Huntress organizations as the multi-tenant boundary: org structure, the organization key used for agent deployment, full CRUD operations, client onboarding and offboarding workflows, and the duplicate-key and active-agent deletion errors.
`signals`	Huntress security signals: how signals differ from incidents, the signal types, listing and filtering by organization, and the threat-hunting and pattern-analysis workflows built on signal data.
`api-patterns`	Huntress MCP fundamentals: HTTP Basic Auth via API key/secret headers, the full MCP tool catalog, token-based pagination, the 60 req/min rate limit, and the common HTTP error codes with their causes.

IT Glue

Skill	Description
`configurations`	IT Glue configurations (assets) — servers, workstations, network devices, and other infrastructure: configuration types and statuses, network interfaces, related items, warranty/lifecycle fields, and PSA/RMM integration fields.
`contacts`	IT Glue contacts — the people (clients, vendors, partners) associated with an organization.
`documents`	IT Glue documents: rich-HTML documentation records scoped to an organization, including document folders, multi-section content via the Document Sections API, embedded passwords/configurations/images, and related-item links to other IT Glue resources.
`flexible-assets`	IT Glue flexible assets: custom, instance-specific asset types with defined field schemas (text, tag, password, upload, etc.), traits-based instances, and tag fields that cross-link to configurations, contacts, and other IT Glue resources for structured, filterable documentation.
`organizations`	IT Glue organizations (companies/clients): the foundational entity all documentation, configurations, contacts, passwords, and flexible assets attach to.
`passwords`	IT Glue passwords: secure, organization-scoped credential storage with categories, folders, restricted-access flags, OTP secrets, and embedding into documents and flexible assets.
`api-patterns`	IT Glue REST API fundamentals: JSON:API request/response structure, x-api-key authentication across regional endpoints (US/EU/AU), filter and sort syntax, pagination, sideloading with includes, rate limits, CRUD operations, and error handling.

Keeper Secrets Manager

Skill	Description
`application-setup`	Building the Keeper Secrets Manager application that a Conduit connection authenticates as: what an application, a share and a client device are, how folder and record grants bound everything the connection can ever see, read-only vs editable shares, generating the base64 device configuration in the Vault UI or Keeper Commander, verifying the realised scope from the client side, and rotating or revoking a device.
`finding-secrets`	Locating the right Keeper record without reading any of them: the metadata returned by `list_secrets`, `search_secrets` and `list_folders`, how record UIDs, titles and folders relate, what `search_secrets` actually matches on (and what it silently does not), the query strings its validator rejects, and why an empty result set usually means scope rather than absence.
`notation-queries`	The KSM notation string grammar accepted by `get_field`: the three-part `<record>/<type>/<field-path>` shape, the four field-path forms (plain, indexed, property, indexed-property), `field` vs `custom_field` vs `file` selectors, how the record segment is classified as a UID or a title, which characters the validator rejects outright, and how the returned value is masked.
`retrieving-credentials`	Reading credential material out of Keeper safely: what `get_secret` returns and exactly which parts of it masking covers, the `fields` parameter, `unmask` semantics under a container deployment with no confirmation prompt, why a record's field list is not guaranteed complete, `get_totp_code` versus unmasking a TOTP seed, and the handling rules for secret material once it is in an agent transcript.
`api-patterns`	The Keeper Secrets Manager tool surface as exposed through Conduit: the nine read-only tools and their access tiers, the ten blocked tools and whether each is withheld by policy or broken upstream, the arguments stripped from `generate_password`, how the KSM application bounds everything the connection can see, the `configBase64` credential, and the error vocabulary.

Knowbe4

Skill	Description
`phishing`	KnowBe4 phishing simulations: campaign creation and lifecycle, security test management, recipient interaction tracking (sent, opened, clicked, reported), phish-prone percentage calculation, template selection, landing pages, and click tracking.
`reporting`	KnowBe4 security awareness reporting: phishing summary statistics, training completion rates, risk score overviews, trend analysis, organizational benchmarks, and executive dashboards, including how to interpret metrics and communicate posture to stakeholders.
`training`	KnowBe4 training campaign management: campaign lifecycle, enrollment workflows, completion tracking, training module and content library browsing, store purchases, and compliance deadline monitoring.
`users`	KnowBe4 user and group management: user lifecycle and status, group creation and membership, risk scores and risk score history, user event tracking, provisioning, and group-based targeting for campaigns.
`api-patterns`	KnowBe4 REST API fundamentals: Bearer token authentication, multi-region base URLs (US, EU, CA, UK, DE), pagination, rate limiting, error handling, and response formats.

Liongard

Skill	Description
`detections`	Liongard's change and anomaly detection layer: detections generated by inspection-to-inspection comparison, detection types/severities/status lifecycle, configurable alert rules and notification channels, custom metrics with JMESPath expressions and threshold evaluation, and the platform timeline audit trail.
`environments`	Liongard environments — the per-customer containers that own all agents, launchpoints, systems, detections, and metrics.
`inspections`	Liongard's inspection pipeline: inspector templates and their credential and agent requirements, launchpoint configuration that binds inspector + environment + agent + credentials + cron schedule, on-demand inspection runs and their status lifecycle, and the failure modes behind failed runs.
`overview`	Liongard platform fundamentals: the entity model (environments, agents, inspectors, launchpoints, systems, detections, metrics, timeline, dataprints, asset inventory), X-ROAR-API-KEY authentication against instance-scoped URLs, the split between the v1 and v2 APIs, and the shared pagination, filtering, and rate-limit conventions.
`systems`	Liongard systems — the assets discovered by inspections — plus their detail data (raw configuration JSON with historical snapshots), dataprint extraction via JMESPath expressions, and the v2 Asset Inventory identity and device profiles that correlate one entity across multiple inspectors.

Microsoft 365

Skill	Description
`calendar`	Exchange Online calendars through Microsoft Graph: event retrieval and date-range queries, free/busy and availability lookup, meeting and Teams-meeting creation, room and equipment resource bookings, calendar permissions, and the Graph scopes and error causes involved.
`files`	OneDrive personal storage and SharePoint document libraries, both reached through the shared Microsoft Graph `/drives` endpoint: drive and item addressing, sharing permissions, storage quotas, file search, and the offboarding file-transfer workflow.
`licensing`	The M365 subscription → SKU → service-plan model, seat availability versus consumption, assigning and removing licenses through Graph, the audit workflow for finding unused or misallocated seats, common SKU GUIDs, and licensing error causes.
`mailboxes`	Exchange Online mailboxes through Microsoft Graph: the four mailbox types and how they differ, message listing and search, inbox rules, out-of-office and forwarding, mailbox size and quota, shared-mailbox access management, and mail flow diagnostics.
`security`	The M365 tenant security checks that distinguish a secure tenant from a vulnerable one: per-user authentication-method inspection for real MFA enrollment, sign-in risk and risky users, suspicious inbox rules, legacy authentication exposure, conditional access coverage, Secure Score, and the indicator set for a compromised account.
`teams`	Microsoft Teams through Microsoft Graph: the Team/Channel/Member/Meeting/Tab object model, team and channel enumeration, membership and ownership changes, online meetings, usage reporting, and the causes behind Teams access failures.
`users`	The Entra ID user object as M365's central identity: key properties and their MSP relevance, account status values, the license assignment model, Graph patterns for listing/searching/creating/disabling users, MFA status checking, and the onboarding and offboarding sequences.
`api-patterns`	Microsoft Graph fundamentals shared by every M365 skill: Entra token scopes and the per-request Bearer model, OData query operators and filter syntax, @odata.nextLink pagination, delta queries for incremental sync, 429 throttling and retry behavior, JSON batching, and the common Graph error codes.

NinjaOne

Skill	Description
`alerts`	NinjaOne alerts and the conditions behind them: retrieving device alerts, dismissing individual alerts and bulk resets, alert summaries, severity and priority levels, common hardware/service/security/connectivity alert types and thresholds, alert webhooks, and triage workflows.
`custom-fields`	Reading and writing NinjaOne device and organization custom fields through ninjaone_devices_get_custom_fields, ninjaone_devices_update_custom_fields, ninjaone_organizations_get_custom_fields and ninjaone_organizations_update_custom_fields: field-name keys, partial updates, and safe write practice.
`devices`	NinjaOne device management: device details and updates, Windows service control, inventory, maintenance windows, reboot modes, and health-check workflows for Windows, Mac, and Linux endpoints running the NinjaRMM agent.
`organizations`	NinjaOne organizations — the top-level container for devices, representing MSP clients: creation and listing, locations, node approval modes, policy mappings and node role IDs, custom fields, tags, cursor pagination, and error codes.
`tickets`	NinjaOne's built-in ticketing system, which integrates with device monitoring: ticket creation and updates, core/status/metadata fields, status and priority values with SLA targets, log entry types, device linkage, tagging patterns, and error codes.
`api-patterns`	NinjaOne Public API fundamentals shared by every other NinjaOne skill: regional base URLs, OAuth 2.0 client-credentials auth and scopes, request shapes, cursor-based pagination, rate-limit headers and 429 handling, HTTP status codes and error response format, and webhook configuration.

PagerDuty

Skill	Description
`alerts`	PagerDuty alerts: the alert-vs-incident model, alert statuses, grouping modes, event rules for routing and suppression, dedup_key deduplication, and the Events API v2 trigger/acknowledge/resolve payloads.
`analytics`	PagerDuty Analytics: MTTA/MTTR/MTTE/MTTS definitions, incident and interruption counts, aggregation levels (account, service, team, escalation policy), time-range constraints, and benchmark tables for interpreting the numbers.
`incidents`	PagerDuty incident lifecycle (triggered/acknowledged/resolved), urgency vs. priority, alerts-to-incident grouping, the 14 incident MCP tools, incident fields, notes, log entries, past-incident similarity search, merge and snooze semantics, and cross-vendor PSA ticket correlation for MSPs.
`oncall`	PagerDuty on-call model: schedules with rotation layers, restrictions, the computed final schedule, and overrides; escalation policy tiers and timeouts; on-call entry fields; and the schedule, escalation policy, and team MCP tools.
`services`	PagerDuty service catalog: service statuses, integrations and integration keys as event sources, alert grouping modes, upstream/downstream service dependencies, and maintenance windows.
`api-patterns`	PagerDuty API and hosted MCP fundamentals: US/EU MCP endpoints, the `Token token=` auth header and token types, the complete 66-tool reference across 13 categories (incidents, on-call, schedules, escalation policies, services, event orchestrations, status pages, teams, users, and more), offset pagination, common filter parameters, rate limits, and error codes.

PandaDoc

Skill	Description
`documents`	PandaDoc document lifecycle end to end: creating documents from templates, sending for e-signature, status checks and PDF downloads, the full document status enum, MSP document types, content tokens, pricing-table structure, document and recipient fields, and status-transition errors.
`proposals`	MSP proposal workflows in PandaDoc: proposal types and typical values (MSA, SOW, hardware quote, project proposal, security assessment, cloud migration), the standard MSP content-token set, managed-services and hardware pricing-table structures, mapping document statuses to sales-pipeline stages, and pipeline and stale-proposal tracking.
`recipients`	PandaDoc recipients and e-signature mechanics: recipient roles (signer, approver, viewer, CC), signing-order behavior, multi-party MSP signing scenarios, completion tracking via `has_completed`, recipient fields, and the document statuses that restrict adding or changing recipients.
`templates`	PandaDoc template library and structure: layout, content blocks, tokens, interactive fields, signature fields, pricing tables, and recipient roles, plus the MSP template set (MSAs, SOWs, proposals, quotes, NDAs, change orders, QBRs), template versioning, tags, and the template field reference.
`api-patterns`	PandaDoc hosted MCP server and API fundamentals: API-key authentication and which operations work without a key, the complete MCP tool catalog (documents, templates, recipients, docs search, code samples), page-based pagination, document and template filters, rate limits per plan, and error codes.

Warmly

Skill	Description
`visitor-intelligence`	Acting on Warmly's identified website visitors and account-level engagement: choosing between list_warm_visitors, list_warm_accounts, and get_credits_remaining; ICP filtering, engagement-depth scoring, CRM-intersection routing, credit-burn checks, MSP-specific outreach plays, and the limits of visitor identification as an intent signal.
`api-patterns`	Warmly's remote MCP server: WorkOS AuthKit OAuth 2.0 + PKCE authentication, RFC 9728 protected-resource metadata, multi-organization scoping, the stateful Streamable HTTP session model, the three read-only visitor-intelligence tools and their fields, credit semantics, error codes, and rate-limit guidance.

Pax8

Skill	Description
`companies`	Pax8 companies (MSP clients): company records and fields, contact management, billing and order-approval settings, and cross-referencing companies with subscriptions and orders.
`invoices`	Pax8 invoices and billing: invoice retrieval, invoice line items, usage-based billing summaries, the MSP billing cycle, and reconciling Pax8 costs against client charges.
`orders`	Pax8 orders: order retrieval, order line items, provisioning status and timelines, billing terms, and the order-to-subscription workflow.
`products`	The Pax8 product catalog: cloud software SKUs, vendors, pricing tiers and margins, and provisioning details across Microsoft 365, Azure, security tools, and backup products.
`subscriptions`	Pax8 subscriptions: license and seat counts, the full subscription lifecycle and its states, change history, filtering by company or product, and quantity management for license optimization.
`api-patterns`	Pax8 MCP fundamentals: the official hosted MCP server connection, all 15 Pax8 MCP tools and their parameters, pagination, sorting, filtering, response shapes, rate limiting, and error handling.

Posthog

Skill	Description
`cohorts-and-events`	PostHog cohorts (saved user/group segments), raw analytics events, and timeline annotations.
`feature-flags-and-experiments`	Read-only lookups of PostHog early-access feature flags and experiments — rollout status, targeting, and configuration.
`insights-and-dashboards`	PostHog saved insights (trends, funnels, retention, and similar analytics queries) and the dashboards that group them into a single view.
`api-patterns`	PostHog API fundamentals for this plugin: personal API key auth brokered through Conduit (no local key), the resource:action scope model, generic REST error handling, and why this plugin's read-only posture rests on the key's own scopes alone — Conduit has no gateway-side fallback for this vendor.

Proofpoint

Skill	Description
`forensics`	Proofpoint Forensics and Threat Response (TRAP) fundamentals: auto-pull and search-and-destroy remediation actions, evidence collection, message trace, and post-delivery incident response workflows for email-borne threats.
`people`	Proofpoint People-Centric Security fundamentals: Very Attacked People (VAP) reports, attack index scoring, click susceptibility, top clickers, and user risk categorization for targeting security controls and training.
`quarantine`	Proofpoint quarantine management fundamentals: quarantine reasons and folders, message states, search/filter parameters, and release/delete workflows for admin and end-user quarantine.
`tap`	Proofpoint Targeted Attack Protection (TAP) fundamentals: threat events across URL, attachment, and message-level vectors, click tracking, message disposition, SIEM integration feeds, and campaign correlation.
`threat-intel`	Proofpoint Threat Intelligence fundamentals: campaign tracking, threat families and actors, indicators of compromise (IOCs), and how campaign/IOC data enriches individual TAP threat events.
`url-defense`	Proofpoint URL Defense fundamentals: URL rewriting (v2/v3 formats), click-time analysis and verdicts, and manual/API decoding of rewritten URLs back to their originals.
`api-patterns`	Proofpoint API fundamentals: HTTP Basic Auth with service principal and secret, base URLs and versioning across TAP SIEM, People, Quarantine, Forensics, and URL Defense APIs, rate limits, pagination patterns, and error handling.

Proofpoint Essentials

Skill	Description
`org-management`	Proofpoint Essentials organization lifecycle: get an org and its domains, activate/deactivate, delete, manage domains, toggle features, adjust licensing allocation, change package/subscription tier, and mint an Odin-based SSO token for console handoff.
`reporting`	Proofpoint Essentials inbound and outbound email flow reporting: time-series mail volume and disposition metrics for a customer org, how to interpret them, and how to build recurring MSP status reports from them.
`user-management`	Proofpoint Essentials mailbox user management within a customer org: list, get, create (including batch create), update, and delete mailbox-protected users.
`api-patterns`	Proofpoint Essentials API fundamentals: X-User/X-Password header authentication with org-admin credentials, regional pod resolution via the endpoint discovery API, base URL construction, batch-create 207 multi-status handling, and error codes.

Netsuite

Skill	Description
`records-and-metadata`	Retrieving individual NetSuite records by type and internal ID, and discovering a record type's available fields via record-type metadata.
`reports-and-saved-searches`	Running NetSuite's standard and custom reports and saved searches, plus the filter-lookup helpers (accounting books, accounting contexts, nexuses, subsidiaries) many of them need.
`suiteql-queries`	Running read-only SuiteQL queries against NetSuite data and discovering queryable fields and joins via SuiteQL metadata.
`api-patterns`	NetSuite MCP fundamentals for this plugin: OAuth 2.0 Client Credentials (JWT-bearer) machine-to-machine auth brokered through Conduit, the per-tenant vendor-hosted MCP endpoint model, generic error handling, and how NetSuite's own role-based permissions — not this plugin — enforce the read-only posture.

QuickBooks Online

Skill	Description
`customers`	QuickBooks Online Customer entity: the parent/sub-customer (job) hierarchy, contact, address, billing and hierarchy fields, payment terms, balance and BalanceWithJobs tracking, sparse updates, deactivation, query syntax, error codes, and PSA cross-referencing patterns for MSP client records.
`expenses`	QuickBooks Online expense entities: Purchase (check, cash, credit card), Bill for accounts payable, BillPayment, and Vendor.
`invoices`	QuickBooks Online Invoice entity: invoice lifecycle and statuses, line item detail types, service items, payment terms, email delivery and PDF retrieval, invoice numbering, void vs delete semantics, query syntax, error codes, and MSP billing patterns such as monthly managed services, project, and time-and-materials invoicing.
`payments`	QuickBooks Online payment handling: recording customer payments and applying them to invoices, partial and multi-invoice application, unapplied amounts and overpayments, credit memos and refund receipts, payment methods, deposit accounts, voiding, and reconciliation.
`reports`	QuickBooks Online financial reporting: the report catalog (Profit & Loss, Balance Sheet, A/R and A/P Aging, General Ledger, Customer Sales, Cash Flow, Tax Summary), report parameters, date macros, column customization, the nested row response structure, and MSP analysis patterns like client profitability and aged receivables for collections.
`api-patterns`	QuickBooks Online API fundamentals: OAuth2 authentication and token lifecycle, REST structure and base URLs, the Intuit query language, pagination, minor version headers, SyncToken optimistic locking, rate limits, webhooks, and the Fault error object format.

RocketCyber

Skill	Description
`accounts`	RocketCyber's provider/customer account hierarchy: sub-account navigation, account CRUD operations, account settings, security policy configuration, and multi-tenant MSP patterns.
`agents`	RocketCyber agent (RocketAgent) deployment, communication status, health monitoring, and troubleshooting: agent installation, online/offline status, agent-to-account mapping, and platform support.
`apps`	RocketCyber application inventory: detecting, categorizing, and monitoring applications across managed endpoints, including approved-vs-unapproved software, app-level threat detection, and software compliance reporting.
`incidents`	RocketCyber security incident lifecycle: severity levels, verdicts (Malicious/Suspicious/Benign), status transitions, SOC analyst triage patterns, and cross-vendor PSA ticket correlation.
`api-patterns`	RocketCyber REST API v3 fundamentals: Bearer token authentication, regional base URL selection, pagination, rate limiting, error handling, and account hierarchy navigation.

Rootly

Skill	Description
`alerts`	Rootly's alerting layer between monitoring tools and incident management: alert sources (`alerts_source`) and their webhook/email intake, alert routing rules, alert groups (deduplication/noise reduction), alert urgencies, escalation policies, and the acknowledge/resolve actions on an individual alert.
`incidents`	Incidents, Rootly's primary resource: the incident lifecycle and status transitions, severity levels, the incident field reference, AI-assisted analysis via find_related_incidents and suggest_solutions, action items, alert attachment, and cross-vendor PSA ticket correlation.
`oncall`	Rootly on-call visibility built on the get_oncall_handoff_summary, get_oncall_shift_metrics, get_shift_incidents, get_oncall_schedule_summary and check_responder_availability tools: schedule and rotation coverage, structured shift handoffs, per-shift incident scoping, shift metric fields, and the burnout risk signals.
`postmortems`	Rootly postmortems as structured post-incident retrospectives: Rootly's retrospective process/step model (there is no standalone "postmortem" object), per-step status tracking through to completion, action item creation and tracking, and the blameless review practices Rootly's model assumes.
`services`	The Rootly service catalog: the real service record (ownership via owner teams/users, Slack channels, dependency modeling via linked service IDs, and third-party links to PagerDuty/Opsgenie/Cortex/Backstage/GitHub/GitLab), service CRUD, incident/uptime charts per service, and how services link back to incidents and alerts.
`workflows`	Rootly's incident-response automation model: workflow tasks (each with a concrete `task_type` like `create_slack_channel` or `page_rootly_on_call_responders`), the trigger-type/`triggers`-event structure (incident, post_mortem, action_item, alert, pulse, simple), the ID-list based condition/matching fields, and the `enabled` flag used to turn a workflow on or off (there is no separate enable/disable tool).
`api-patterns`	The Rootly hosted MCP server and the JSON:API REST surface behind it: Global vs. Team token types and how the gateway injects credentials, the catalog of roughly 253 dynamically generated tools by category, page-number pagination and relationship includes, filter syntax, rate limits, and error handling.

Runzero

Skill	Description
`assets`	The runZero asset inventory: searching and browsing assets, asset attributes, OS fingerprinting, hardware details, and network interfaces.
`services`	runZero discovered services: listing services, filtering by port or protocol, identifying vulnerabilities, and auditing exposed services across sites.
`sites`	runZero sites: creating and managing organization sites, defining scan scope and exclusions, deploying explorers, and organizing assets by location or client.
`tasks`	runZero scan tasks: creating scans, scheduling recurring scans, managing explorers, configuring scan parameters, and reviewing scan results.
`wireless`	runZero wireless network discovery: discovered wireless networks, rogue access point identification, wireless security configuration analysis, and SSID auditing.
`api-patterns`	runZero API fundamentals: the available MCP tools, Bearer-token authentication, the Export API for bulk retrieval, pagination, rate-limit headers, error codes, and the runZero query language.

SalesBuildr

Skill	Description
`companies-contacts`	Salesbuildr companies and contacts: company search, contact filtering by company, and contact creation with its required fields.
`opportunities`	Salesbuildr opportunities: pipeline search, opportunity creation, stage updates, and deal values, plus how opportunities link companies and contacts to potential revenue.
`products`	Salesbuildr product catalog: product search, pricing lookup, category browsing, and how products become quote line items.
`quotes`	Salesbuildr quotes: quote creation with product line items, quote search, and retrieving quote details, plus how quotes link to companies, contacts, and opportunities.
`api-patterns`	Salesbuildr API fundamentals: api-key header authentication, offset-based from/size pagination, error handling, and the 500 requests per 10 minutes rate limit.

SentinelOne

Skill	Description
`alerts`	SentinelOne's read-only unified alert surface: the list/search/get alert tools plus notes and history, severity levels, status values, view types, GraphQL filter syntax, and cursor-based pagination.
`inventory`	SentinelOne's unified asset inventory across four surface types — agent-managed endpoints, AWS/Azure/GCP cloud resources, AD/Entra identities, and Ranger-discovered network devices.
`misconfigurations`	Cloud security posture findings from SentinelOne's XSPM module across AWS, Azure, GCP, Kubernetes, identity providers, and infrastructure-as-code.
`purple-ai`	The `purple_ai` tool — SentinelOne's natural language investigation assistant over the full Singularity telemetry model.
`threat-hunting`	PowerQuery against the Singularity Data Lake: the Scalyr-based pipeline syntax (distinct from SPL, SQL, KQL, and Elasticsearch DSL), the powerquery, get_timestamp_range, and iso_to_unix_timestamp tools, time-range and row-limit handling, common hunting scenarios, and the Purple AI generation path.
`threat-intel`	The SentinelOne sidecar's enrichment tools: VirusTotal / Google Threat Intelligence lookups by hash, IP, domain and URL (threat_intel_*), sandbox behaviour and file relationships, advanced VirusTotal search, and the CVE database (cve_search_by_id, cve_search_by_vendor, cve_database_status).
`vulnerabilities`	CVE tracking through SentinelOne's XSPM module: the read-only vulnerability tools, EPSS scores and exploit-maturity values and why they outrank raw CVSS severity for prioritization, status values and their transitions, the vulnerability field reference, and patch-prioritization and reporting workflows.
`api-patterns`	The SentinelOne Purple MCP server and the APIs behind it: uvx installation and transport modes, Service User token levels, the 23 read-only tools organized by domain, and the dual GraphQL (cursor pagination) / REST (offset pagination) architecture with its differing filter syntaxes, rate limits, and error causes.

Sherweb

Skill	Description
`billing`	Sherweb distributor billing: explicit billing date ranges, Setup/Recurring/Usage charge types, billing cycles (OneTime, Monthly, Yearly), the pricing breakdown (listPrice, netPrice, prorated, subTotal), promotional and performance deductions, fees, taxes, and MSP margin calculation.
`customers`	Sherweb customer records: the distributor > service provider > customer hierarchy and its API scoping consequences, customer lifecycle stages, core address and contact fields, accounts-receivable data with aging buckets, and cross-referencing customers with PSA, subscription, and billing data.
`subscriptions`	Sherweb subscription management: the subscription lifecycle and its states, seat/license quantity rules (absolute values, minimums, proration, commitment restrictions), the quantity-change workflow, subscription and change-response fields, and state-transition errors.
`api-patterns`	Sherweb Partner API fundamentals: OAuth 2.0 client-credentials auth, token caching, subscription-key header, scopes and base URLs, endpoint and MCP tool catalog, page-based pagination, Accept-Language localization, rate limits, and error codes.

SuperOps.ai

Skill	Description
`alerts`	SuperOps.ai RMM alerting: alert types, severity levels, status lifecycle and valid transitions, asset/client/monitor associations, the GraphQL operations for listing and resolving alerts, and the hand-offs for acknowledging them (console) and ticketing them (superops_tickets_create).
`assets`	SuperOps.ai RMM asset inventory: asset status and platform enums, hardware, network, OS and association fields, software inventory, disk usage, patch status, activity history, and the GraphQL queries and script-execution mutations behind them.
`clients`	SuperOps.ai client (account) management: stage and status enums, core/business/ address fields, client CRUD mutations, site and contact (requester) management, custom fields, soft vs. hard delete, and onboarding workflows.
`runbooks`	SuperOps.ai RMM script automation: finding scripts in the library (all, or by OS), their run-time variables, running one script on one asset with runScriptOnAsset through the admin-tier GraphQL passthrough, and what the API cannot do (batch runs, schedules, reading execution results back).
`tickets`	SuperOps.ai service desk ticketing: ticket fields, status and priority enums, client/site/requester/assignee associations, notes, time entries, and the GraphQL mutations and queries behind them.
`api-patterns`	SuperOps.ai GraphQL API fundamentals: Bearer token plus CustomerSubDomain header auth, region-specific endpoints, request/variable structure, offset (page/pageSize) pagination, the 800 req/min rate limit, filter operators, UTC date handling, error codes, and null-reset semantics.

Syncro MSP

Skill	Description
`assets`	Syncro MSP assets: asset records and fields for hardware, software, and devices, RMM integration, patch management data, and asset search and update operations.
`customers`	Syncro MSP customers: customer fields, contacts, sites and locations, and customer create, update, and search operations.
`invoices`	Syncro MSP invoices: invoice fields, line items, payment processing, and billing workflows.
`tickets`	Syncro MSP tickets: ticket fields, statuses, priorities, problem types, timer operations, workflow automations, and the validation, time-tracking, and reporting logic around them.
`api-patterns`	Syncro MSP REST API fundamentals: API key setup and authentication, request and response patterns, pagination, rate limiting, and error handling.

Blackpoint

Skill	Description
`asset-inventory`	Blackpoint Cyber (CompassOne) asset data: the six asset classes, listing and paginating assets per class, cross-class search, asset detail, and walking parent/child/sibling relationships to build a blast-radius or topology view.
`incident-response`	Blackpoint Cyber (CompassOne) detection investigation: the read-only tool surface across tenants, assets, detections, and vulnerabilities, the tenant → asset → detection → vulnerability drill-down, asset relationship maps, dark-web and external-exposure cross-references, and which tool domains are stubs.
`multi-tenant-operations`	Partner-level Blackpoint Cyber (CompassOne) operations: the partner-tenant hierarchy, enumerating customer tenants, sweeping detections and vulnerabilities across all of them, spotting volume anomalies, and building per-tenant scorecards.
`vulnerability-management`	Blackpoint Cyber (CompassOne) exposure data across four lenses: host vulnerability findings and the filters that matter (CVE, severity, patch and exploit availability), scan history, dark-web credential and data leaks, and internet-facing external exposures — plus how to combine them into a prioritized remediation view.
`api-patterns`	Blackpoint Cyber (CompassOne) MCP fundamentals: API-token header auth and its internal Bearer forwarding, the partner-tenant-asset hierarchy, navigation tools, which tool domains are functional versus stubbed, pagination, and HTTP error causes.

Saas Alerts

Skill	Description
`triage`	Triaging the SaaS Alerts queue across managed M365 / Google Workspace tenants: the triage tool surface, the critical-first sweep, per-customer summary and cross-tenant pattern workflows, the low/medium/critical severity model and its default dispositions, and the edge cases — legitimately empty results, time-window sensitivity, whitelist suppression, and per-partner rate limits.
`api-patterns`	SaaS Alerts MCP fundamentals: API-key authentication via the gateway header, the MSP → customer → account → user hierarchy, navigation and functional tool naming, event filter parameters, cursor pagination, and HTTP error codes.

Crewhu

Skill	Description
`surveys`	Crewhu CSAT/NPS survey data: the list/search/get tools and the detractor/promoter sentiment slices, the trend, detractor-follow-up, promoter-recognition and per-tech roll-up workflows, and the edge cases that skew scores — sparse response counts, comment-only feedback, and tenant-local timestamps.
`api-patterns`	Crewhu MCP fundamentals: token authentication via the `X-Crewhu-Api-Token` header and its gateway env-var mapping, the flat 18-tool surface across the surveys, users, badges, and prizes domains (only `crewhu_badges_update_contest` writes), pagination, and error codes.

Immybot

Skill	Description
`endpoint-management`	ImmyBot computers/endpoints and their tenant grouping: the computer tool surface, workflows for surveying a tenant fleet, locating a device, auditing inventory against desired state, onboarding a new computer record, and forcing an agent check-in, plus the filtering caveats around online status and serials.
`maintenance-sessions`	ImmyBot maintenance sessions — the reconciliation engine that brings endpoints into their desired state: the session tool surface, start parameters (computer vs tenant scope, type, priority, reboot flag), pause/resume/cancel semantics, polling to a terminal state, failure investigation, and reboot-spanning and queued-vs-running edge cases.
`script-execution`	ImmyBot's PowerShell script library and its SYSTEM-context execution model: the script tool surface, the find → validate → confirm target → approve → execute → review workflow, parameter/timeout/execution-context options, and the safety rules governing this destructive, highly privileged operation.
`software-deployment`	ImmyBot's desired-state software deployment model end-to-end: the software catalog, deployment, maintenance-session and computer tool surfaces; the canonical select → scope → assert → reconcile → verify workflow; and the pinned-vs-latest, conflicting-deployment, and reboot edge cases.
`tenant-compliance`	ImmyBot tenants (client organizations) and fleet-wide reporting: the tenant and background-task tool surfaces, the per-tenant compliance scorecard and fleet task-queue audit procedures, and how to assemble a client QBR report from stats, compliance, software inventory, and failed-task history.
`api-patterns`	ImmyBot MCP fundamentals: Entra ID OAuth 2.0 client-credentials auth (four fields), the `immybot_<domain>_<action>` tool naming and domain list, the two-step desired-state deployment model, the four destructive operations that need explicit confirmation, task/session polling cadence, and HTTP error codes.

Timezest

Skill	Description
`agents-and-teams`	TimeZest agents (individual technicians) and teams (round-robin / shared availability pools): listing each, fetching detail for a named resource, and the criteria for booking an agent versus a team.
`appointment-types`	TimeZest appointment types: the types configured for a tenant, each type's duration, and how to match a type to the work described on a ConnectWise / Autotask / Halo ticket.
`psa-integration`	Wiring a TimeZest scheduling request into a PSA: the associatedEntities payload shapes for ConnectWise, Autotask, and Halo tickets, the difference between the pod and generate_url trigger modes, and the causes of bookings that complete but never update the PSA ticket.
`resources`	TimeZest's combined resource pool — the unified list of agents and teams available for scheduling — including filtering by resource type and surveying what is bookable before drilling into a specific agent or team.
`scheduling`	The TimeZest scheduling-request lifecycle: resolving the right agent and appointment type, creating a request against a ConnectWise / Autotask / Halo ticket, polling its status through to booking, and canceling.
`api-patterns`	TimeZest MCP fundamentals: Bearer token authentication, the navigation pattern, scheduling-request payloads that carry PSA associated_entities (ConnectWise / Autotask / Halo ticket IDs), and the polling-only update model (no webhooks).

Threatlocker

Skill	Description
`approval-requests`	ThreatLocker application approval request triage: pulling the pending queue, grouping requests by application and hash, signed-publisher and path heuristics, and approve/deny recommendations with audit-friendly reasoning.
`audit-log`	The ThreatLocker Action Log (the API name is "audit"): incident timelines, tracing a file's history across endpoints, repeated-denial detection, and correlating policy bypasses or audit-only matches with user and computer context.
`computer-groups`	ThreatLocker computer groups — the policy-scoping boundary that determines which allow/deny rules apply to which endpoints.
`computers`	ThreatLocker-protected endpoints: fleet inventory, identifying offline agents, a single computer's check-in history, and correlating computers across organizations and groups.
`organizations`	The ThreatLocker MSP multi-tenant model: enumerating child organizations, retrieving per-org auth keys, and identifying valid move targets when relocating computers between tenants.
`api-patterns`	ThreatLocker Portal API fundamentals: raw-key authentication (no Bearer prefix), multi-tenant routing via the organizationId header, POST-based "GetByParameters" list endpoints, pagination shape, and child-organization fan-out patterns.

Kaseya Vsa

Skill	Description
`api-patterns`	Kaseya VSA REST API fundamentals: two-step token-based authentication, the /api/v1.0 surface, pagination ($skip/$top) and filtering ($filter), the request/response envelope, error codes, and Kaseya One SSO bearer-token auth for unified-login tenants.

Datto Bcdr

Skill	Description
`api-patterns`	Datto BCDR (Backup Portal) REST API fundamentals: public/private key HMAC-SHA256 request signing, the /v1 endpoint surface, pagination, appliance/agent hierarchy, and screenshot verification retrieval.

Kaseya Bms

Skill	Description
`api-patterns`	Kaseya BMS PSA REST API v2 fundamentals: tenant subdomain routing, API-token bearer auth, Kaseya One SSO bridging, ticket and account workflows, and OData-style pagination.

Datto Saas Protection

Skill	Description
`seat-coverage`	Seat-coverage and backup-health sweep for Datto SaaS Protection: finding unprotected and paused seats per customer, reading per-application backup status and detailed stats, and proposing (never silently applying) seat licence changes with datto_saas_bulk_seat_change.
`api-patterns`	Datto SaaS Protection (formerly Backupify) through Conduit: the six datto_saas_* tools, the customer/domain/seat object model, Basic-auth key pair, seat types and states, and the confirm-gated bulk seat change.

Unitrends

Skill	Description
`api-patterns`	Unitrends Backup REST API fundamentals: session-token login exchange, the appliance-vs-asset hierarchy, backup job status queries, recovery point listing, and replication state.

Spanning

Skill	Description
`api-patterns`	Spanning Cloud Backup REST API fundamentals: admin-email + API-token auth, the per-platform endpoint surface (M365, Google Workspace, Salesforce), the user/license model, backup status queries, and restore operations.

HubSpot CRM

Skill	Description
`activities`	HubSpot tasks, notes, and associations: task priority and status values, notes-vs-tasks semantics, the association type matrix linking contacts, companies, deals, and tickets, and engagement-history workflows.
`companies`	HubSpot company records: core fields, industry classification values, lifecycle stages, domain-based deduplication and automatic contact-company matching, and cross-referencing associated contacts, deals, and tickets.
`contacts`	HubSpot contact records: core and MSP-relevant custom fields, lifecycle stages, lead status values, contact ownership, CRM search filter patterns, and associations to companies and deals.
`deals`	HubSpot deal records and sales pipelines: deal fields, default and custom pipeline stages, deal amount conventions (MRR vs. TCV), forecast categories and weighted forecasting, and associating deals with contacts and companies.
`tickets`	HubSpot support tickets: core fields, default pipeline stages, priority levels, MSP ticket categories, SLA timestamp properties, and associating tickets with contacts, companies, and deals.
`api-patterns`	HubSpot's official remote MCP server (brokered by Conduit) and the CRM Search API behind it: the live tool catalog (search_crm_objects, get_crm_objects, manage_crm_objects, properties and owners), OAuth via the Conduit connect flow, scopes, sensitive-data (PHI) exclusion, filter/sort/ pagination syntax, plan-tier rate limits, and error handling.

Spamtitan

Skill	Description
`lists`	SpamTitan sender allowlists and blocklists: the add/remove/list action parameter, entry types, allowlisting trusted senders to prevent false positives, blocking unwanted senders and domains, and the scoping limit — neither manage tool takes a domain parameter.
`quarantine`	SpamTitan quarantine queue: quarantine types, release vs. delete semantics, message aging, email flow statistics, and the tenant-isolation limit — the queue listing accepts no domain filter, so on a multi-tenant appliance it spans every customer.
`api-patterns`	SpamTitan MCP fundamentals: the available tool catalog and its exact parameters, API-key header authentication, API structure, pagination, rate limiting, and error handling.

Xero

Skill	Description
`accounts`	Xero chart of accounts: account classes and types, account codes, tax settings, system accounts, and how MSP revenue, cost-of-sales, and expense categories map to the general ledger.
`contacts`	Xero contacts (customers and suppliers): contact fields, addresses and phones, contact groups, status values and read-only balances, plus MSP client onboarding, offboarding, and PSA cross-referencing patterns.
`invoices`	Xero sales invoices (ACCREC) and supplier bills (ACCPAY): status lifecycle, invoice numbering, line items and tracking categories, tax handling, credit notes, batch creation, validation-error shapes, and recurring managed-services billing for MSPs.
`payments`	Xero payments: recording AR and AP payments, partial payments, payment allocation, overpayments and prepayments, batch payment creation, and outstanding-balance and aging tracking for MSP billing and reconciliation.
`reports`	Xero Reports API: Profit and Loss, Balance Sheet, Aged Receivables and Payables, Trial Balance, Bank Summary and other management reports.
`api-patterns`	Xero Accounting API fundamentals: OAuth2 Custom Connection (client credentials) auth and scopes, the xero-tenant-id header, where-clause filter syntax, page-based pagination, rate limits, the two date formats, validation-error shape, and batch operations.

Alternative Payments

Skill	Description
`customers`	Alternative Payments customers and their users: customer fields and status, the customer/user relationship, MSP client onboarding, and the destructive archive operation that requires confirmation.
`invoicing`	Alternative Payments invoices and hosted payment requests: invoice status and line-item fields, hosted payment links and signed PDF links, archiving, and payment-request creation and retrieval.
`payments`	Alternative Payments transactions and payouts: transaction types, statuses, and the customer/invoice/payment-method filters; payout objects and the transactions that compose them for reconciliation.
`api-patterns`	Alternative Payments API fundamentals: OAuth2 client-credentials token minting and bearer auth, scopes, REST endpoint structure, cursor pagination, the 5 req/sec rate limit, idempotency, error handling, and the read + safe-write capability posture that deliberately excludes direct payment creation.

Ironscales

Skill	Description
`incidents`	Ironscales phishing incidents end to end: incident statuses and severities, the five remediation actions and which of them are irreversible, the stateless AI email-classification tool and the message content it exports, allowlist entries for email/domain/IP, daily-triage and campaign workflows, and the failure modes — already-closed incidents, partial remediation, and allowlist scope.
`api-patterns`	Ironscales MCP fundamentals: API-key plus company-ID header authentication and the per-tenant scoping that follows from it, the nine tools this server registers and what each one actually changes, offset/limit pagination without a total count, rate-limit behavior, and how API failures surface to the model.

Mimecast

Skill	Description
`message-tracking`	Mimecast message tracing: searching by sender, recipient, or subject; message states and message IDs; retrieving message metadata and headers; and holding or releasing messages.
`queue-management`	Mimecast email delivery queues: inbound and outbound queue types, queue message states, retry behavior, and the signals that identify stuck messages, delivery delays, and backlog conditions.
`threat-intelligence`	Mimecast threat data: Targeted Threat Protection logs for URL clicks, attachment analysis, and impersonation attempts; threat remediation incidents; and audit events.
`api-patterns`	Mimecast MCP fundamentals: the available tool catalog, OAuth 2.0 client-credentials authentication, regional API endpoints, pagination, rate limiting, and error handling.

Mailprotector

Skill	Description
`allow-block-rules`	Sender allow/block rules at all five scopes: downward inheritance (reseller rules apply to everything beneath), the listing that returns only directly-attached rules, create with `rule_type: allow\|block` and address-or-domain values, and the flat delete endpoint.
`customers-and-domains`	Customer lifecycle (create/edit/delete under the reseller), domain creation with the Pending → Active verification flow and verification_token, domain aliases, moving domains between customers, address discovery, and mail routing via email destinations and email sources.
`quarantine-and-messages`	Quarantine triage across all five scopes (reseller/customer/domain/ user_group/user): message fields (`quarantine_type`, `decision`, `score`, scoring `results`), releasing a single message via `/deliver`, bulk release via `/deliver_many` with its silent scope-mismatch skip and the `all_selected` release-everything switch, and the release permission flags in configuration.
`users-and-groups`	User groups as the service container (services get/update with its deactivate-what-you-omit semantics), user CRUD including create_many and find_by_address, user aliases, password resets, and user syncs — LDAP/AD source creation, Entra/Google console-only sources, sync schedules, and comparison-type filters.
`api-patterns`	Mailprotector MCP fundamentals: gateway header authentication (`X-Mailprotector-Api-Key` / `X-Mailprotector-Reseller-Id`) and its translation to the upstream Bearer token, the Provider → Reseller → Customer → Domain → User Group → User entity hierarchy, the router-pattern tool surface with `mailprotector_execute_tool` for the long tail, scope/scope_id consolidation, field-based list filtering, `page` pagination (max 50 on messages), and error handling.

Wyre Gateway

Skill	Description

Microsoft Graph

Skill Description

connection Connecting the Microsoft Graph MCP Server for Enterprise (public preview) through the Wyre gateway: BYOC multi-tenant Entra app registration, the tenantId/clientId/clientSecret triple, the delegated MCP.* permissions and the per-tenant admin consent that must be granted out of band, plus the read-only design, the 100 calls/min/user limit, licensing implications, and a symptom-to-cause troubleshooting table.

querying The RAG query loop for the Microsoft Graph MCP Server for Enterprise — microsoft_graph_suggest_queries to retrieve vetted candidate Graph calls, microsoft_graph_get to execute them, microsoft_graph_list_properties for entity schema — with worked identity and directory examples, result-presentation guidance, and the read-only, RBAC-scoped, rate-limited constraints on what comes back.

Azure Mcp

Skill	Description
`connection`	Onboarding the azure-mcp connector in the WYRE MCP Gateway: Azure service-principal registration, the tenantId/clientId/clientSecret triple, least-privilege Reader-tier RBAC assignments, the gateway's read-only namespace allowlist, and connection verification and failure modes (expired secret, missing role assignment).
`cost-and-capacity`	The read-only cost and capacity half of the azure-mcp connector — the pricing, quota, subscription, and group namespaces: retail meter-rate lookups, quota and usage headroom, subscription and resource-group inventory, and the retail-versus- actual-billing distinction that shapes every estimate.
`observability`	The read-only observability half of the azure-mcp connector — the monitor, resourcehealth, applens, and advisor namespaces: Azure Monitor metrics, Log Analytics KQL, alert-rule state, platform health states, AppLens detectors, and Advisor recommendation categories, plus the degraded-resource investigation order.

Stripe

Skill	Description

Slack

Skill	Description

Meraki

Skill	Description
`devices`	Cisco Meraki device inventory and status through the hosted Meraki MCP: serial-based identity, the MX/MS/MR/MV/MG/MT product lines, org inventory versus network assignment, availability and its change history, uplink addresses, provisioning, end-of-life (EOX) and firmware status.
`security-appliance`	Cisco Meraki MX security appliance review through the hosted Meraki MCP: L3, L7 and inbound firewall rules, port forwarding and 1:1 / 1:many NAT, firewalled services, organization-wide policy rulesets, site-to-site VPN status, VPN firewall rules, third-party peers, threat protection and security events, and SSID L3 firewall rules.
`troubleshooting`	Read-only Cisco Meraki diagnostics through the hosted Meraki MCP: site and device outages from availability history and WAN uplink loss/latency, switch port status and error counters, LLDP/CDP topology, wireless connection failures and packet loss, client lookup by MAC, and "what changed?" from the change log and event log.
`api-patterns`	How to work with Cisco's hosted Meraki MCP server: its two tools (semantic_search and execute_api), the getOrganizations to getOrganizationNetworks to capability flow, passing parameters, single-page results, the per-organization rate limit, Conduit access tiers, error handling, and a table of verified read-only Dashboard API capability IDs.

Ncentral

Skill	Description
`devices`	N-central device records: listing with saved device filters (filterId), asset and warranty lookups, lifecycle reads and updates, and service-monitor status triage on a single device.
`monitoring-tasks`	N-central monitoring and automation: active-issue triage per customer or site, job statuses, the scheduled task -> status -> per-device details drill-down, and the safety rules for direct-support task execution.
`organizations`	N-central org units: the service organization -> customer -> site hierarchy, the org-unit vs customer distinction, agent registration tokens (credential-sensitive), and custom properties at both org and device level.
`api-patterns`	N-central MCP fundamentals: User-API Token (JWT) authentication through Conduit, 1-based pagination with the totalItems/totalPages envelope, rate-limit behavior, preview-endpoint caveats, and on-prem server specifics.

Nutanix

Skill	Description
`cluster-operations`	Working the clustermgmt namespace through `clustermgmt_execute` — cluster and host inventory, configuration and health state — plus the adjacent read surfaces: `prism_execute` for Prism Central tasks and categories, and `lifecycle_execute` for LCM upgrade inventory and recommendations.
`monitoring-aiops`	The Nutanix operational-intelligence read surface: `monitoring_execute` for alerts, alert policies, events, and audit logs, and `aiops_execute` for capacity planning, VM rightsizing recommendations, and workload performance analysis — the namespaces behind health checks and capacity reports.
`networking`	The Nutanix networking read surface: `networking_execute` for AHV network configuration (subnets, VPCs, vSwitch, BGP — coverage varies by artifact set, down to a minimal capabilities/AWS-VPC slice) and `microseg_execute` for Flow Network Security policies, service groups, and address groups.
`storage`	The Nutanix storage read surface across four namespaces: `storage_execute` for storage containers and volume groups, `volumes_execute` for iSCSI / NVMe-TCP volume group attachment state, `objects_execute` for the S3-compatible object store, and `files_execute` for virtual file servers and NFS/SMB shares — capacity, configuration, and attachment queries.
`vm-management`	Working the vmm namespace through `vmm_execute`: VM inventory and lookup on AHV clusters, resolving names to extId UUIDs, reading VM configuration (disks, NICs, GPUs, power state), OData filters for VM queries, and the read-only boundaries around VM lifecycle actions.
`api-patterns`	Nutanix MCP fundamentals: the discovery-driven tool surface (4 discovery tools plus one `<namespace>_execute` tool per v4 API namespace — not per-entity CRUD tools), the listOperations → getOperationSchema → execute workflow, Conduit gateway credential configuration for Prism Central, OData query parameters, the read-only enforcement mode, and namespace availability rules.

Ops Pack

Skill	Description
`board-hygiene`	Board-wide ticket maintenance, distinct from working any single ticket: stale-ticket detection with per-status staleness thresholds, the Waiting-on-Client rot case and its three valid resolutions, duplicate/related-ticket detection signals and safe linking, and technician queue-balance assessment weighted by more than raw ticket count.
`dispatch-prioritization`	Priority scoring and assignment for an unassigned PSA ticket queue: the scoring factors (SLA proximity, client tier, ticket age, technician load, skill/category match), how to combine them into an explainable ranked order rather than a black-box formula, and the tool-discovery pattern for finding which PSA and RMM connectors are actually live before calling any vendor's tools.
`sla-escalation-playbooks`	A cross-PSA escalation framework for SLA pressure: how each PSA family (Autotask, HaloPSA, ConnectWise Manage, Syncro, Kaseya BMS) models SLA/priority state and where breach risk lives in each, a normalized breach-risk state model (healthy, at risk, breached-response, breached-resolution) with the default escalation action per state, how notification audience shifts by contract tier, and the evidence to gather before paging anyone.

Secops Pack

Skill	Description
`alert-severity-normalization`	A common Critical/High/Medium/Low normalized severity model for security alerts, incidents, and findings, with the judgment axes (confidence, mitigation state, blast radius) that place a record in a tier and the mapping from each vendor's native terminology — Huntress incident status, SentinelOne threat confidence, Blumira finding priority, CIPP alert queue severity, Blackpoint Cyber SOC severity, SaaS Alerts risk level — plus how to discover which security vendors are actually connected.
`bec-response`	Business Email Compromise detection and first response: the signals that reveal it in CIPP/M365 audit logs, mailbox and forwarding rules, and connected email security vendor alerts; the order-dependent response sequence (session revocation, forwarding-rule audit, mailbox rule and delegate cleanup, password reset, MFA re-enrollment, lateral-spread check, recipient notification); and what a defensible incident timeline must capture for insurance or bank-fraud claims.
`containment-playbooks`	Ordered first-response containment sequences for the most common MSP incident classes — compromised account, malware/ransomware detection, business email compromise, and exposed credential — including why the order matters, which connected tool family (RMM, EDR, CIPP/Entra, PSA, documentation) handles each step, and the evidence-preservation principles that apply across all of them.
`msp-tool-compromise-response`	Cross-tool investigation of a suspected or vendor-disclosed compromise of an MSP management-plane platform (RMM, remote access, or similar automation).
`screenconnect-session-hijack-response`	Read-only investigation of legitimate ScreenConnect panel abuse, rogue remote-access clients, and a reported GUI-session reverse pivot onto technician workstations.
`shadow-ai`	Per-client comparison of observed RMM installed software with Microsoft 365 / Entra application and service principal inventory, conservative AI product matching, unsanctioned-tool findings, optional consent-risk review, and explicit source-coverage limitations.

Finance Pack

Skill	Description
`agreement-reconciliation`	Reconciling PSA contract/agreement entitlements (seats, hours, recurring services) against invoiced reality in an accounting platform, across any combination of PSA (Autotask, HaloPSA, ConnectWise, Syncro) and accounting platform (QuickBooks Online, Xero).
`churn-scanner`	Cross-vendor client retention risk ranking from ticket volume, customer sentiment, SLA misses, overdue invoices, upcoming agreement renewals, and RMM availability proxies.
`license-true-up`	Three-way seat reconciliation per client per SKU: seats provisioned in a cloud marketplace (Pax8, Sherweb) vs. seats billed in accounting or PSA billing vs. seats actually deployed in the tenant (microsoft-graph or CIPP).
`margin-analysis`	Per-client and per-service-line margin computation for an MSP: revenue from PSA billing or accounting invoices, cost of goods from Pax8/Sherweb wholesale pricing, and estimated labor from PSA time entries × a loaded technician rate.
`renewal-and-price-increase-prep`	Composes Agreement Reconciliation and Margin Analysis into per-client talking points for an upcoming renewal or a price-increase conversation.

Compliance Pack

Skill	Description
`evidence-mapping`	Tracing a compliance control (CIS, SOC 2, HIPAA, or a cyber-insurance questionnaire line item) to concrete, retrievable tool evidence: which vendor family can observe what — CIPP for live M365/Entra configuration, Liongard for point-in-time infrastructure state, IT Glue/Hudu for documentation — a representative control-to-tool-call map, and the evidentiary weights that separate Configured from Documented, Contradicted, and Unable to Verify.
`insurance-questionnaires`	Drafting tool-verified answers to cyber-insurance renewal, new-business, and underwriter security questionnaires: the standard recurring question set (MFA everywhere including privileged accounts, EDR coverage ratio, tested and immutable backups, documented and tested IR plan, security awareness training), which connected tools actually answer each one, and the evidence-backed / documented-only / unable-to-verify labeling discipline that keeps an answer defensible during a claim investigation.
`standards-drift`	Detecting configuration drift against an established baseline: CIPP standards checks and Best Practice Analyser results, Liongard change detections and inspection timelines, the three conditions that make a diff real drift rather than noise, the signals that separate intentional or authorized change from unauthorized weakening (ticket correlation, reversion pattern, direction of change), and the priority order for ranking several drift findings at once.

Sales Pack

Skill	Description
`pipeline-health`	CRM pipeline health assessment against whatever CRM is discovered through the gateway: stage-velocity norms derived from closed-won deals, activity-based stalled-deal detection, raw and quality-adjusted pipeline coverage against a revenue target, and the CRM-less degradation rule (report nothing rather than fabricate figures).
`prospect-security-snapshot`	A one-page, plain-language public-domain risk report for a first sales conversation: SPF, DKIM, and DMARC from CIPP only after the operator confirms any CIPP use and the domain is a connected tenant's default or initial domain (MX from the agent's own DNS lookups, or unavailable); certificates and exposed services only when a read-only tool or an in-session lookup already has that data; breach mentions only when a tool or a cited public search exists.
`quote-to-close-tracking`	The quote-to-close handoff chain — a Pax8/Sherweb/Kaseya Quote Manager quote or SalesBuildr proposal, through a PandaDoc document's sent/viewed/signed status, to a closed-won CRM deal — and the four distinct stall points along it (quote built with no proposal document, proposal sent but not opened, viewed but not signed, signed but the CRM deal never marked closed-won), including cross-system record matching and what to report when only part of the chain is connected.
`warm-lead-routing`	Lead-warmth scoring from intent and engagement signals — Warmly website-visitor identification, CRM form fills and email engagement, and Calendly booking activity — using an explainable Hot/Warm/Warm-Cool/Cool tiering, plus routing recommendations based on owner continuity, CRM routing rules, or rep capacity, and the degradation path to CRM-only signals when intent tools aren't connected.

Marketing Pack

Skill	Description
`case-study-drafter`	Turns a closed PSA project or a resolved incident, plus optional documentation records, into an anonymized case study with a challenge, approach, and result.
`review-and-referral-ask`	Picks clients who appear happy from CrewHu or SmileBack survey results (or another discovered survey tool) together with ticket SLA and resolution data, then drafts a review or referral request for the MSP to send.

Devops Pack

Skill	Description
`error-budget-tracking`	Error-budget and burn-rate assessment from whatever observability tools (Sentry, Datadog, Grafana, BetterStack) are connected: SLI, SLO, error budget, and burn rate applied practically, how to compute burn rate from available SLI data and the thresholds that make it actionable, what separates a budget-threatening trend from noise, and the fallback to raw trend reporting against a trailing baseline when no formal SLO is defined.
`incident-postmortem`	Assembling a blameless postmortem grounded in systems of record: timeline reconstruction merging the incident tool's event log with correlated observability anomalies (Sentry error spikes, Datadog/Grafana metric anomalies, including precursor signal that predates formal detection) and deploy history from connected platform connectors, all normalized to one stated timezone; the root-cause versus contributing-factor distinction and the test for telling them apart; and how to label a root cause that is still only a hypothesis.
`oncall-handoff`	Assembling an on-call shift handoff from whatever incident-management tool (Rootly, PagerDuty, BetterStack) is connected, plus corroborating observability signal where available: the four handoff categories in priority order (currently paging, escalated without an owner, last-shift history, known-flaky watch list), why an empty open-incidents list is not an empty handoff, and the bar for calling an alert known-flaky rather than simply resolved.

Cloudops Pack

Skill	Description
`cloud-capacity-planning`	Right-sizing and capacity forecasting for cloud resources on whatever platforms (Azure, DigitalOcean) are connected: the per-platform over-provisioned and under-provisioned signals, growth-trend-based forecasting toward a projected exhaustion window, and the discipline that separates a genuine capacity risk from normal variance — require a trend not a spike, distinguish burst-tolerant from sustained-critical resources, and always state the observation window behind a forecast.
`cloud-cost-management`	Cloud spend anomaly detection and reclaimable-spend hunting on whatever platforms (Azure, DigitalOcean) are connected: the signals that make a spend increase an anomaly rather than expected cost, the per-platform orphaned/idle resource catalog (unattached storage, idle load balancers, stopped-but-not-deallocated compute, idle managed databases, orphaned network resources), and how to build a monthly cost trend view — or a clearly labeled inventory-and-list-pricing estimate when a platform exposes no billing data.
`network-health-sweep`	A normalized device and network health sweep across whatever network-monitoring tools (Auvik, Meraki, Domotz) are connected: each vendor family's data model and native status fields mapped into one Down/Degraded/Unknown/Healthy taxonomy, default interface error and utilization thresholds, topology-change detection, and why an offline Domotz collector renders its devices "unknown" rather than "down".

Awareness Pack

Skill	Description
`phishing-simulation-analysis`	Phishing-simulation campaign analysis: click-rate trend direction across campaigns, repeat-clicker identification with remedial-training cross-reference, and optional enrichment that correlates simulated failures with real-world phishing incidents from a connected email-security tool as a compounding risk signal.
`risk-scoring`	Explainable per-user and per-org human risk scoring from training-completion status, phishing-simulation failure history, and optional real-world click/attack-targeting signal: the weighted factor table, three-tier bucketing, per-org rollup as a distribution rather than a blended number, and graceful degradation when only some inputs are connected.
`training-completion-tracking`	Security-awareness training completion across whatever training/awareness platform is connected: assignment-overdue versus cadence-overdue detection, per-campaign and per-org completion-rate calculation, ranking clients that have fallen behind a contracted cadence, and the unmeasured-versus-0% distinction.

Backup Pack

Skill	Description
`backup-job-health`	Portfolio-wide backup job health across whatever BCDR and SaaS-backup tools are connected: the two structurally different job models (image-based appliance backup vs. SaaS-data snapshot backup) and how to normalize them into one health record per protected unit, why a live consecutive-failure streak matters more than a trailing success rate, the missed-versus-failed distinction and its different root causes, and the two storage-trending risk patterns (approaching capacity, anomalous growth).
`restore-test-verification`	Whether a backup is actually recoverable rather than merely present: the ranked hierarchy of restore evidence (actual restore performed, full boot/virtualization verification, screenshot verification, spot-check restore drill, no evidence at all), adequate test cadence per data-criticality tier, and why a never-tested backup is the highest-priority finding — outranking even an actively failing job.
`retention-rpo-compliance`	Comparing configured backup retention and cadence against contracted retention windows and RPO (recovery point objective) targets: the two distinct retention gap types (configured-shorter-than-contracted vs. storage-forced truncation), why achievable RPO must be derived from actual job success history rather than the nominal schedule, where the contracted side of the comparison actually lives, and why "no documented requirement" is its own finding rather than an automatic pass.

Assets Pack

Skill	Description
`eol-eos-flagging`	End-of-life versus end-of-support risk for devices, OS versions, and firmware: combining RMM inventory (make, model, OS version, firmware) with general lifecycle knowledge, the mandatory verify-against-vendor-lifecycle caveat, what qualifies as a finding versus merely "old", and criticality-first prioritization of the resulting risk list.
`refresh-cycle-planning`	Forward-looking hardware refresh planning: combining warranty expiration, EOL/EOS timing, and device age from whatever RMM and documentation platforms are connected into replace-now / plan-this-year / monitor tiers, laying those tiers onto a dated calendar, surfacing replacement clusters, and keeping an explicit insufficient-data bucket.
`refresh-quote-list`	Turns a Refresh Cycle Planning calendar into a per-client list of devices to quote, matched against a connected ScalePad Quoter, Kaseya Quote Manager, or ConnectWise PSA product catalog, then hands off to a quoting skill.
`warranty-tracking`	Endpoint hardware warranty status across whatever RMM platforms (Datto RMM, NinjaOne, N-central, Kaseya VSA, ConnectWise Automate, Atera, SuperOps, Syncro, Action1, ImmyBot) and documentation tools (IT Glue, Hudu) are connected: the reliability spread between OEM-resolved and hand-entered warranty fields, serial/asset-tag cross-referencing when RMM data is missing or stale, and the expired / expiring-soon / covered / unknown bucketing.

Clio

Skill	Description
`contacts`	Clio contacts -- the people and companies connected to matters: person vs. company contact types, and how a contact relates to the matters they are party to (client, opposing party, witness, and other roles).
`matters`	Clio matters -- the case/client-file object that almost everything else in Clio hangs off of: the matter status lifecycle, linking a matter to a client contact, practice areas, custom fields, and matter numbering.
`time-billing`	Clio time and expense activities logged against a matter: the activities domain's create-only lifecycle, the billing-read / time-entry-write split, and why billing mutations are out of scope for v1.
`api-patterns`	Clio Manage MCP fundamentals: OAuth 2.0 Authorization Code connection via Conduit, region selection, the matters-as-hub data model, decision-tree tool navigation, pagination, and the deliberate v1 scope limits (no delete anywhere, documents metadata-only, communications/calendar/bills read-only).

Scalepad

Skill	Description
`backup-radar`	ScalePad Backup Radar, the read-only backup monitoring surface: per-client backup health records and backup device inventory, in regions us and eu.
`controlmap`	ScalePad ControlMap per-client compliance management: risk registers, control libraries, evidence collection, policies and procedures, framework objectives, assessments, and remediation action items across regions us, eu, ca, and au.
`core`	The ScalePad Core API — the read-only, US-only unified data layer over clients, contacts, members, sites, opportunities, hardware and SaaS assets, the product catalog, service contracts, tickets, and integration configurations.
`lifecycle-manager`	ScalePad Lifecycle Manager, the engagement and roadmap workflow product: initiatives, goals, meetings, action items, assessments, deliverables, budget forecasting, contracts, notes, hardware lifecycle records, and warranty pricing.
`quoter`	Quoter through ScalePad: building and publishing quotes, managing the catalog (items, item groups, tiers, options, manufacturers), quote contacts, suppliers and datafeeds, and the OAuth helpers for the standalone api.quoter.com path.
`api-patterns`	ScalePad MCP fundamentals: API-key authentication via the `X-ScalePad-Api-Key` header, tool discovery across the five product domains, cursor pagination, the 50-requests-per-5-seconds rate limit, and 402 subscription errors.

Axcient

Skill	Description
`appliances`	Axcient x360Recover appliances: the physical/virtual hardware running local backups, its device roster, and the org-wide vs client-scoped list tools.
`clients`	Axcient x360Recover clients: the health_status model, client_code, the three-way protected-system counter breakdown (appliance_based, d2c, cloud_archive), and minting direct-to-cloud agent enrollment tokens.
`devices`	Axcient x360Recover protected devices (servers and workstations): SERVER/WORKSTATION typing, the current/previous health-status model, local vs vault vs cloud usage and recovery-point timestamps, AutoVerify screenshot verification, and restore points.
`jobs`	Axcient x360Recover backup jobs: the BRC vs Replibit job-type split, per-job protection thresholds, and job run history with its starttime_begin pagination floor.
`vaults`	Axcient x360Recover vaults: Private vs Cloud vault types, storage capacity, and the connectivity-loss alert threshold — including axcient_set_vault_threshold, the one tool in this plugin that changes alerting configuration rather than just reading it.
`api-patterns`	Axcient x360Recover API and MCP fundamentals: x-api-key header authentication, the single production base URL, the full 20-tool MCP catalog by domain, why most list endpoints return bare arrays with no pagination, and the five distinct error response shapes the upstream API actually returns.

KPN

Skill	Description
`mobile-fleet`	KPN business mobile through the Grexx (IRMA) interface: finding a customer's mobile orders, reading number/SIM/subscription/bundle data (kpn_grexx_mobile_orders), the active SIM or eSIM (kpn_grexx_get_sim), blocks and limits (kpn_grexx_mobile_settings), current usage (kpn_grexx_mobile_usage) and available number portings.
`network-checks`	Address- and line-level checks against KPN's Grexx interface: technology, speeds and product availability at a Dutch address (kpn_grexx_zipcode_check, kpn_grexx_prequalification), infrastructure and planned work (kpn_grexx_carrier_info), and live line diagnostics on a connectivity order (kpn_grexx_radius_check, kpn_grexx_ras_check, kpn_grexx_start_line_diagnose).
`api-patterns`	How the KPN tool surface behaves through Conduit: the Grexx (IRMA) wholesale interface behind the kpn_grexx_* tools, the client-ID/secret credential pair and the optional Grexx URL fields, the IRMA customer/order model, the one write tool, and common errors.

Ai Org Admin

Skill	Description
`claude-code-adoption`	Claude Code adoption and value reporting for a client's Anthropic organization: the per-user daily Claude Code usage report (sessions, lines added and removed, commits, pull requests, tool accept/reject counts, tokens and estimated cost per model), how to roll days up into a month, and how to set it against seat inventory to find unused seats.
`key-and-audit-review`	Security review of a client's Anthropic organization from the two admin-gated surfaces: the API key inventory (status, workspace scope, creator, principal, expiry, partial hint; never the secret) and the compliance activity feed (sign-ins, membership and role changes, key lifecycle events).
`seat-inventory`	Seat and access inventory for a client's Anthropic organization: members and their organization roles, pending and expired invites, workspaces and per-workspace membership, and how to turn them into a seat count, an admin-role review, and an offboarding check against the client's leaver list.
`spend-review`	Claude API spend and token usage for a client's Anthropic organization: the daily cost report, the Messages usage report, and the beta cost and usage analytics, with breakdowns by workspace, model, API key, and person; month-over-month comparison, per-client chargeback when clients are split by workspace, spike investigation, and rate-limit headroom.
`api-patterns`	Anthropic Admin MCP fundamentals: the Conduit X-Anthropic-Admin-Key header and the sk-ant-admin key it carries, one key = one Anthropic organization, the 19 read-only tools and which three are admin-gated in Conduit, the two pagination styles (ID cursors and page tokens), response truncation, the cents-not-dollars cost units, time-range limits, and how vendor errors and 429s come back.

Openai Admin

Skill	Description
`seat-key-inventory`	Building the access inventory of a client's OpenAI organization: organization members and their roles, pending and expired invites, projects and their members, service accounts, project API keys and Admin keys with owner and last-used dates, and how to reconcile that inventory against the client's staff list to find stale seats and orphaned keys.
`security-review`	Security and offboarding review of a client's OpenAI organization from the audit log (logins, membership and role changes, key and project lifecycle), the key inventory (keys left behind by removed users, unused and over-privileged Admin keys), and mTLS certificate expiry, plus how to scope an incident question to an actor, a project, or a time window.
`spend-review`	Turning the OpenAI Admin usage and cost reports into a per-client spend review: daily cost by project, line item, user, or API key; token and request volume behind that cost; month-over-month comparison; spike attribution; and project rate-limit headroom when a client reports 429s.
`api-patterns`	OpenAI Admin MCP fundamentals: the Admin key sent as the `X-OpenAI-Admin-Key` header through Conduit, the 30-tool read-only surface and which five tools Conduit admin-gates, the two pagination styles (object cursors for lists, page tokens for usage and cost reports), Unix-second time ranges, truncated pages, and the error and 429 shapes the server returns.

Jamf

Skill	Description
`device-compliance`	Fleet compliance review for Jamf Pro: what jamf_backup_check measures on Macs (FileVault, recovery key escrow, managed state, inventory and check-in age) and iOS/iPadOS (passcode, data protection, device-reported iCloud Backup), its finding codes and severities, drilling into single devices, safe remediation with the write-tier tools, and smart groups for ongoing visibility.
`device-offboarding`	Lost, stolen, and leaver device handling in Jamf Pro, almost all of it in the admin tier: operator-only Mac locking through jamf_prepare_computer_lock, mobile device lock, wipe, unmanage, record deletion, static group removal (write tier), and the read-only evidence to gather before any of them.
`patch-management`	OS and third-party patch posture in Jamf Pro: which macOS and iOS versions Jamf can deploy, measuring OS version spread from inventory, managed software update plans and their status, patch management titles and per-title patch reports, the policies that deliver patches, and scheduling OS updates without forcing restarts.
`user-onboarding`	New-hire setup in Jamf Pro: user records and how to avoid duplicates, scoping a new Mac's serial to a computer PreStage enrollment for Automated Device Enrollment, assigning computers and mobile devices to a user, building, department, and site, and adding Macs to static groups so the right policies and profiles apply.
`api-patterns`	Jamf Pro MCP fundamentals through Conduit: the three X-Jamf-* credential headers and the API client they come from, the read/write/admin tool tiers and how Conduit and the sidecar each gate them, zero-based paging and RSQL filters on the Jamf Pro API tools, contains/limit on the Classic API list tools, inventory sections, response caps, and the error and rate-limit messages the sidecar returns.

Acronis

Skill	Description
`backup-health`	Alert-driven backup health triage in Acronis Cyber Protect Cloud: ranking customers by active alert load, drilling into the worst machines, reading an alert's plan, resource and error context, separating real backup failures from noise, and the false-positive write (off by default, write tier in Conduit).
`edr-incidents`	Endpoint Detection and Response (EDR) incident review in Acronis Cyber Protect Cloud: listing open incidents across customers, reading an incident's detections, activities and response actions, checking the status of a response action started in the console, and updating the investigation state or adding a comment (off by default, write tier in Conduit).
`protection-coverage`	Protection coverage in Acronis Cyber Protect Cloud: which machines and workloads have no protection plan, which plans failed to deploy or are blocked, which agents are offline, outdated or unsupported, and how to reconcile Acronis resources against the client's machine list.
`tenants-and-usage`	The Acronis Cyber Protect Cloud tenant hierarchy as an MSP sees it: finding the partner tenant, listing and searching customer tenants, mapping them to PSA companies, reading per-customer usage for billing reconciliation, listing a customer's Acronis users and their roles for access reviews, and checking MFA enrollment.
`api-patterns`	Acronis Cyber Protect Cloud MCP fundamentals through Conduit: the three `X-Acronis-*` headers (data center URL, API client ID and secret), the partner → customer → unit tenant hierarchy and what an API client can see, the 37-tool surface (34 reads plus 3 writes that are off by default, one of them admin-only in Conduit), the `path` / `query` / `body` argument shape, the different pagination styles per API family, filter operator syntax, nanosecond alert timestamps, response size caps, and the error shape.

Bitwarden

Skill	Description
`event-log-review`	Reading a client's Bitwarden organization event log through the admin-gated bitwarden_events_list tool: date ranges and the 367-day limit, continuationToken paging, the one-filter rule, the event types that matter to an MSP (failed logins, 2FA changes, vault exports, item views and copies, member and policy changes), resolving IDs back to members, groups and collections, and handling the personal data events carry.
`license-reconciliation`	Reconciling a client's Bitwarden subscription against its real membership: Password Manager and Secrets Manager seats and autoscale limits from the subscription, member counts by status, invites that never completed, revoked members still listed, and the figures to check against the MSP's billing agreement.
`offboarding-access-review`	Mapping everything a departing user could reach in a client's Bitwarden organization: their membership, role and status, collections granted directly and through groups, their recent vault activity from the admin-gated event log, and the follow-up list (revoke in the Admin Console, rotate exposed shared credentials, rotate the organization API key if they were an owner).
`security-posture`	Assessing a client's Bitwarden organization posture from the read-only Public API: which security policies are enabled and how they are set, two-step login coverage across confirmed members, owner and admin sprawl, members stuck in Invited or Accepted, and the SSO caveat on the 2FA flag.
`api-patterns`	Bitwarden MCP fundamentals: the organization API key passed through Conduit as X-Bitwarden-Client-Id / X-Bitwarden-Client-Secret / X-Bitwarden-Region, the 12 read-only tools and which one is admin-gated, full-list responses versus the paged event log, response truncation, the member role and status enums, error and rate-limit handling, and what the Public API can never return.

1password

Skill	Description
`account-hygiene`	Periodic hygiene review of a client's 1Password account for QBRs and license true-ups: reconciling active and suspended seats against the client's headcount, finding long-suspended and never-used seats, and summarising the admin changes made during the review period (who was invited, who gained or lost group and vault access, who changed account settings).
`offboarding-review`	How to review a departing or departed user's 1Password footprint with the read-only tools: confirm the seat is suspended, find every shared-vault item they used so the client can rotate it, catch sign-ins or item access after the departure date, and see who suspended them and when.
`signin-triage`	Triage of 1Password sign-in attempts for one client account: pulling the sign-in feed over a window, grouping failures by user, category and country, separating password-guessing from MFA failures and firewall blocks, spotting successes from new countries after a run of failures, and deciding what is noise and what goes to the client.
`api-patterns`	1Password MCP fundamentals through Conduit: the region plus two independent credential halves (Events Reporting token, Users API client) and their X-OnePassword-* headers, which of the six read-only tools needs which half, which three are admin-gated in Conduit, cursor paging on the Events feeds, page-token paging on users, time windows and 120-day retention, rate limits, and how vendor errors come back.

Zabbix

Skill	Description
`monitoring-coverage`	Monitoring-coverage and collector-health review for a customer's Zabbix: disabled and unreachable hosts, hosts with no templates or triggers, templates linked to nothing, site proxies that stopped reporting, proxy group HA state, maintenance windows that never end, and disabled web scenarios.
`problem-triage`	NOC triage of Zabbix problems for MSPs: pulling open problems by severity and customer host group, resolving each problem to its host through the trigger or event, separating cause from symptom and suppressed problems, checking maintenance and acknowledgement state, confirming whether an alert was actually sent, and reading recent event history for flapping.
`sla-reporting`	Customer availability reporting from Zabbix: the business service tree and its status, SLA definitions (SLO, period, schedule, excluded downtime), per-period SLI figures from sla.getsli, a problem-history summary for customers without configured SLAs, and hourly trend aggregates for capacity notes.
`api-patterns`	Zabbix MCP fundamentals through Conduit: the X-Zabbix-Base-Url and X-Zabbix-Api-Token headers, version-dependent token auth, the read-only 18-tool surface (one admin-gated tool, three opt-in tools Conduit does not list), the shared JSON-RPC get parameters (output, filter, search, tags, sortfield, limit), keyset paging by event ID or time range, the 500-row cap, output truncation and redaction, and the error types the sidecar returns.

Lastpass

Skill	Description
`msp-billing`	Reconciling LastPass MSP license consumption: billing cycles, the per-company billing report (`dailyAverageLicenseCount`, `licenseType`, `addons`), managed-company license limits and active/suspended status, and matching all of it against what the MSP bills each client in the PSA.
`offboarding-review`	Leaver access review in LastPass: finding a departing user in the MSP's own company or a client company, reading their account status, admin level and group memberships, catching a pending invite that was never revoked, and producing the checklist of actions a LastPass admin must take in the Admin Console, because this connector cannot disable or remove anyone.
`privileged-access`	Reviewing who holds LastPass admin rights: admin levels (RBAC roles) and their permissions, the users in each level, the MSP cross-tenant admin-user report, and how to cross-check admins for MFA, dormancy and leaver status.
`security-posture`	Per-client LastPass account hygiene from user records: MFA coverage (`advancedMfaStatus`, `enabledMfa`), weak Security Challenge and master-password scores, stale master passwords, dormant enrolled accounts, invitations that never converted, and how to roll those into a client-facing posture summary.
`api-patterns`	The LastPass Business and MSP admin tool surface as exposed through Conduit: the 23 read-only tools and their Conduit tier, Business key versus MSP key scope, the `X-LastPass-API-Key` header, `max_results` / `page_token` pagination, wildcard and `[from:to]` range filters, the users LastPass silently omits from lists, the user record fields, and the error vocabulary (401 early access, 403 wrong key type, 429 shared limits, oversize pages).

Moovila

Skill	Description
`project-health`	Portfolio-level project health for MSP project delivery in Moovila: building the active-project list per customer, finding overdue and stalled tasks, milestones at risk, blocked work waiting on predecessors, projects past their due or forecast date, and producing a weekly project status report or a per-customer project review for a QBR.
`project-profitability`	Budget versus actual for MSP projects in Moovila: reading project budget lines (total, allocated, unallocated, percentage committed), task-level totalBudget/totalActual/remainingBudget, labor cost from time entries at pay rate or labor type fully burdened cost, revenue from billable hours at bill rate or projectValue, and rolling these up to a per-project and per-customer margin view.
`resource-utilization`	Technician utilization from Moovila data: the active user roster with labor types, hours logged per user from time entries, billable utilization against each labor type's workTargetBillable, open task load and work estimates per owner, and spotting over- and under-allocated technicians before scheduling new project work.
`time-reconciliation`	Reviewing Moovila time entries for billing: pulling a billing period's entries completely and filtering them on startTime, separating billable from non-billable and time adjustments, catching entries with missing billing codes, zero bill rates, billable flags that disagree with billable hours, or no task, and reconciling Moovila hours against PSA time per customer and project before invoicing.
`api-patterns`	The Moovila tool surface as exposed through Conduit: the 19 read-only report tools and their tiers, the bring-your-own-client OAuth connection and the X-Moovila-Access-Token header Conduit injects, offset/limit paging with the 100-record cap and truncation notes, lastChangedDate incremental pulls, GUID validation, the record shapes (Project, ProjectBudget, Task, TimeEntry, User, labor type), and the error vocabulary.

Webroot

Skill	Description
`console-audit`	Webroot GSM console access and agent-command audit using the four admin-gated tools: console and per-site administrators with their roles (names, emails, phone numbers), and the history of agent commands (scan, cleanup, uninstall, changekeycode, restart, deactivate, reactivate, sysisolate) with command states.
`endpoint-health`	Webroot endpoint protection posture triage: console-wide and per-site statistics (infected, needs attention, active threats), stale agents by last seen, outdated agent versions, endpoints on detect-only or unmanaged policies, SkyStatus agent status classes, and coverage gaps against the site's expected device count.
`threat-review`	Webroot detection review for a site or endpoint: threat history (file, path, malware group, first/last seen), repeat infections, Web Threat Shield URL actions, and DNS Protection traffic and blocked domains, with explicit date windows and paging.
`usage-reconciliation`	Webroot seat and usage reconciliation for MSP billing: the per-site usage report and its three report types, console seats allowed vs. deployed, per-site devices allowed vs. total endpoints, trial, expiring, suspended and deactivated sites, and how to compare the result with PSA agreement quantities.
`api-patterns`	Webroot Unity API fundamentals through Conduit: the five X-Webroot-* headers and the console-user password grant behind them, the GSM key bound to the connection, the 25 read-only tools and which four Conduit admin-gates, the three paging styles (PageNr/TotalAvailable, PageNr/MoreAvailable, ContinuationToken), siteId vs. site keycode, date-range defaults, error statuses, and response size limits.

Cove

Skill	Description
`access-review`	Reviewing who can sign in to the Cove Management Console for each customer and with which role, spotting leavers and over-privileged accounts, and reading the user-action audit log (cove_audit_actions_list, admin-gated in Conduit and needing an Administrator API user in Cove) to see who changed devices, retention, users or customers.
`backup-health`	Finding Cove devices whose backups failed, finished with errors, or have gone stale, for one customer or the whole customer tree, using cove_device_statistics_list column queries; classifying each device; drilling into a device's profile and data sources; and writing a ranked triage list a technician can work through.
`customer-inventory`	Building a per-customer inventory from Cove: the customer (partner) tree and each customer's state, assigned products and retention, protected device counts, storage used and its growth, and the storage locations that hold the data.
`api-patterns`	How the Cove Data Protection MCP tools talk to N-able's JSON-RPC API through Conduit: the three X-Cove-* headers and the API user behind them, the 15-minute visa session, finding partner (customer) IDs, statistics column codes and units, paging and truncation, Cove error numbers, and which tool is admin-gated in Conduit.

Unitrends Uniview

Skill	Description
`backup-health-triage`	The cross-customer backup health sweep in Unitrends UniView: failed and warning backup jobs, failed replication, open BackupIQ alerts, offline appliances and low appliance storage, how to tell a one-off failure from a protection gap, and how to rank the findings into a technician work queue.
`protection-coverage`	Per-customer protection inventory in Unitrends UniView: appliance-protected assets with their last backup, Endpoint Backup devices, Spanning and Entra tenants mapped to the customer, and the appliances behind them; how to spot stale or missing protection and assemble a coverage summary for a QBR or onboarding review.
`spanning-saas-backup`	Spanning SaaS backup data in Unitrends UniView: Microsoft 365 and Google Workspace domains with their mapped customer, user and license counts and expiration, per-user last backup status, the v1 and v2 tool shapes, and the personal-data handling the user tools need.
`api-patterns`	Unitrends UniView MCP fundamentals: the two Conduit credential headers and the OAuth2 client_credentials exchange behind them, the flat 12-tool read-only surface, the {data, paging} response shape, page_number/page_size paging and truncation, parameter validation (enums, UUIDs, ISO 8601, include objects), error and 429 handling, and which tools return personal data.

Gogetssl

Skill	Description
`billing-reconciliation`	Reconciling a GoGetSSL reseller account against client billing: the prepaid balance, unpaid orders and invoices, invoice line items for a date window, the invoice behind a single order, and mapping certificate spend back to client domains so it can be rebilled.
`certificate-expiry`	Tracking SSL certificate expiry across every client domain in a GoGetSSL reseller account: which order fields carry the expiry date, how to treat unissued orders, grouping certificates by client domain, renewal tiers, batch status checks for a known set of orders, and reading one order's validity and renewal flags.
`renewal-prep`	Getting a GoGetSSL certificate renewal or reissue ready before anyone places it in the client area: choosing and pricing a product, checking wildcard and SAN support, confirming which approver email addresses email domain validation will accept, decoding the client's CSR to catch mistakes, and confirming the prepaid balance covers the renewals.
`api-patterns`	GoGetSSL MCP fundamentals: the username plus API-password credential pair Conduit sends as X-GoGetSSL-* headers, the sidecar's cached auth-key login, the flat 20-tool read-only surface (none admin-gated), the single reseller account model with no client scoping, which list tools page and which do not, response-size limits, and GoGetSSL's error envelope.

Smileback

Skill	Description
`csat-qbr-summary`	Building a per-client customer-satisfaction section for a QBR or account review from SmileBack: resolving the client, pulling a quarter of CSAT reviews and NPS responses, computing satisfaction, response rate and NPS with period-over-period change, reading project survey results, picking representative comments, and the sample-size and data-protection caveats that keep the numbers honest.
`detractor-follow-up`	Finding and triaging unhappy customers in SmileBack: negative and neutral CSAT reviews on recent tickets and NPS detractors, enriching each with the ticket, board, technicians and comment, spotting repeat detractors and at-risk clients, checking what follow-up SmileBack already records, and handing each case to the PSA because SmileBack's API cannot record a follow-up.
`technician-csat`	Reporting CSAT by technician and by PSA service board from SmileBack: mapping reviews to the agents and boards on each ticket, per-tech response rate and satisfaction with minimum sample sizes, handling tickets credited to several agents and techs who have left, surfacing praise for recognition and negatives for coaching, and keeping the output fair enough to use in a one-to-one.
`api-patterns`	The SmileBack tool surface as exposed through Conduit: the 12 read-only tools over the Data Replication API v3, the five-header credential (OAuth2 password grant run by the server), the US/EU region, Conduit access tiers (all read, none admin-gated), limit/offset pagination, response truncation, client-side filtering because the API has no per-company or date-range filter, the error vocabulary, and the personal data the responses carry.

Myitprocess

Skill	Description
`alignment-reviews`	The myITprocess alignment-review pipeline: review status stages (New through Complete), engineer and vCIO due dates, standards categories that are up for review or overdue per client, and client-level staleness signals (last review date, last assigned-member activity, alignment score).
`qbr-prep`	Assembling a one-client brief from myITprocess before a QBR or strategy meeting: the meeting record and its agenda recommendations, the client's alignment score and review history, open and recently changed recommendations, budget for the coming quarters, initiatives, and open review gaps.
`roadmap`	The myITprocess strategic roadmap: findings from alignment reviews, the recommendations they become (type, responsible party, status, priority, budget, budget month, hours), the initiatives that group recommendations, and the IT Glue configurations attached to a recommendation.
`api-patterns`	myITprocess MCP fundamentals: the single X-MyITprocess-Api-Key header Conduit sends (forwarded upstream as MITP-API-KEY), the nine read-only list tools and their shared page / page_size / filters / sort parameters, the {page, pageSize, totalCount, items} response shape, the 50 requests per minute account-wide rate limit, and the error messages the server returns.

Alga Psa

Skill	Description
`client-review`	Building a per-client account picture from Alga PSA for a QBR, renewal or health check: client record, locations and contacts, ticket volume and open backlog over a period, time spent, invoices and payment state, contracts, assets, and active projects.
`project-status`	Reading Alga PSA projects for status reporting: projects by client, status or search; phases; tasks per project or phase; the ordered task status columns (project_status_mapping_id) a project or phase uses; and time logged against project tasks.
`ticket-triage`	Reading the Alga PSA service desk: open queues by board, status, priority and assignee; stale, unassigned and aging tickets; a single ticket's full history (comments with internal notes, logged time, linked assets); finding the ticket behind an RMM alert by external link; and knowledge articles that match a problem.
`time-and-billing`	Alga PSA time and billing reads: time sheet approval states and the backlog waiting for a manager, time entries by technician, work item type, service and billable flag, technician schedules, invoice status (draft, sent, overdue, paid ...) with date-range filters, invoice line items, and the service catalog.
`api-patterns`	Alga PSA MCP fundamentals through Conduit: the X-Alga-Instance-Url / X-Alga-Api-Key / X-Alga-Tenant-Id headers, the 42-tool read-only surface (no writes, nothing admin-gated), the four pagination styles (page/limit, limit-only search, offset, cursor), response truncation, error messages, concurrency and retry limits, and the untrusted-content envelope.

Dubber

Skill	Description
`call-retrieval`	Finding specific Dubber recordings for a complaint, billing dispute, HR matter or QA sample: resolving a person or line to Dub.Points, windowed recording searches in the client's timezone, reading recording details, and marking calls with tags or metadata for follow-up or retention.
`recording-coverage`	Read-only audit that proves Dubber is actually capturing calls for a client: which Dub.Points (recorded lines) have recent recordings and which have gone silent, recordings Dubber could not match to an account, and whether REST-hook integrations are active and draining.
`user-lifecycle`	Adding, updating and removing Dubber users on a client account during staff onboarding and offboarding, and reviewing who has a Dubber login.
`api-patterns`	How the Dubber tool surface behaves through Conduit: the five X-Dubber-* credential headers and the password-grant token they mint, region selection, the account/group/Dub.Point/recording hierarchy, how dubber_recordings_list pages and filters, which list tools return a single page, the error and rate-limit behaviour, the confirm_destructive_action flow, and which tools Conduit treats as read, write or admin.

Mspcfo

Skill	Description
`agreement-pricing-review`	Using MSPCFO's profitability data to review managed-services agreements: finding underpriced, over-consumed or declining agreements, ranking the weakest, working out a defensible annual rate increase toward MSPCFO's efficiency target, and drafting a vCIO plan per agreement.
`client-profitability`	Reading MSPCFO's Client P&L, Client Segments and Market Segments reports to find which clients make or lose money, why, and what to do about it: margin ranking, flagged clients, segment comparison, separating real margin problems from PSA data problems, and preparing the profitability section of a client review.
`technician-utilization`	Reading MSPCFO's Member Work Report, Utilization Hours and Members Billing by Month reports: billable vs. non-billable time, utilization trends, cost per hour and revenue per member, how labor drives client and agreement margin, and handling this employee performance data responsibly.
`api-patterns`	MSPCFO MCP fundamentals for this plugin: OAuth 2.0 + PKCE browser sign-in brokered by Conduit (no API key, no headers), the admin-only tool gate while MSPCFO's tools are unclassified in Conduit, discovering tool names at runtime because MSPCFO does not publish them, report parameters and result size, error handling, and data-freshness caveats.

MarketSharp

Skill	Description
`appointments`	Reading MarketSharp appointments: the schedule for a date range or one salesperson, appointments changed since a date, appointments for a set of leads or one contact, and the active appointment results and result reasons used to read outcomes.
`customer-lookup`	Finding one customer in MarketSharp from whatever the caller gave you (name, phone, email, address or job number) and assembling their contact record, inquiries, appointments, jobs and notes.
`lead-pipeline`	Reporting on MarketSharp inquiries (leads): listing them by modified date, appointment window or salesperson, resolving status, lead source and product interest IDs against the company's reference lists, counting by status and source, and the appointment default that hides leads nobody has booked yet.
`sales-opportunities`	Reporting on sold jobs and open leads from MarketSharp's opportunities list: jobs and leads changed since a date with job numbers, sale and contract dates, contract totals, contract status and balance due.
`api-patterns`	The MarketSharp tool surface as exposed through Conduit: the 25 read-only tools over the MarketSharp REST API, the Conduit connection fields (Company ID, API key, API secret, optional Employee ID), which tools need the Employee ID or a MarketSharp permission, read-tier access, page-size and record caps, the 200,000-character response cap and how an oversized page is cut, the appointment default on inquiries, date formats, untrusted-content wrapping, retries and errors.

Using Skills Effectively

Automatic Usage

Claude automatically references relevant skills when you ask about MSP topics. Just ask naturally:

How do I handle SLA breaches in ConnectWise?

Claude will reference the connectwise-psa:tickets skill to provide accurate information.

Direct Invocation

For specific questions, invoke skills directly:

/skill it-glue:passwords

What security measures should I follow when using the password API?

Combining Skills

For complex workflows, Claude can combine knowledge from multiple skills:

I need to create a ticket in Autotask and link it to the asset in IT Glue.
How should I structure this workflow?

Claude will reference both autotask:tickets and it-glue:configurations to provide a comprehensive answer.