Claude Skills by WYRE-AI

Domotz API and MCP fundamentals: X-Api-Key header authentication, the region-selected base URL (us-east-1 / eu-central-1), the full 21-tool MCP catalog by domain, the agent-scoped call shape, why there are no pagination arguments, rate limiting, and HTTP error codes.

Domotz device inventory: how agents discover and classify devices, the identification attributes (IP, MAC, hostname, display name, vendor), the ONLINE/OFFLINE/UNKNOWN status model, the five device tools — list, get, uptime, history, inventory metadata — and why device lookup is a client-side match rather than a server-side search.

Domotz network observation: the collector's topology graph, its own interfaces, detected IP conflicts, and the two SNMP surfaces — polled variables and custom sensors — with their history endpoints and the tools and error modes for each.

Domotz PDU and smart-outlet control: listing outlets and their power state, and the one non-GET tool the Domotz server exposes — switching an outlet on, off, or cycling it. Covers the confirm argument, why it is advisory, and the pre-flight checks that belong before a mains interruption.

Shape of the Checkpoint Harmony Email (Avanan) `hec_*` tool surface: the thirteen tools and what each reaches, the event/entity split that governs which tool accepts which id, the `responseEnvelope`/`responseData` result shape, `scrollId` pagination, and the auth, regional-routing and farm-scope behaviour behind every call.

The Checkpoint Harmony Email (Avanan) whitelist and blacklist surface: the match fields and matching modes an exception accepts, the defaults that widen an entry beyond what was typed, the id mismatch between listing and editing, and the standing security consequence of a detection bypass.

Finding and acting on mail in Checkpoint Harmony Email (Avanan): the `hec_search_emails` attribute-filter syntax, what an entity payload carries, the asynchronous quarantine and restore actions and their task polling, and the judgement a restore requires because delivery cannot be undone.

The Checkpoint Harmony Email (Avanan) security-event surface: the event type, state, severity and SaaS enums accepted by `hec_query_events`, what a detection record does and does not carry, how `availableEventActions` governs what you can do next, and phishing, BEC and malware triage built on those fields.

KnowBe4 REST API fundamentals: Bearer token authentication, multi-region base URLs (US, EU, CA, UK, DE), pagination, rate limiting, error handling, and response formats.

KnowBe4 phishing simulations: campaign creation and lifecycle, security test management, recipient interaction tracking (sent, opened, clicked, reported), phish-prone percentage calculation, template selection, landing pages, and click tracking.

KnowBe4 security awareness reporting: phishing summary statistics, training completion rates, risk score overviews, trend analysis, organizational benchmarks, and executive dashboards, including how to interpret metrics and communicate posture to stakeholders.

KnowBe4 training campaign management: campaign lifecycle, enrollment workflows, completion tracking, training module and content library browsing, store purchases, and compliance deadline monitoring.

KnowBe4 user and group management: user lifecycle and status, group creation and membership, risk scores and risk score history, user event tracking, provisioning, and group-based targeting for campaigns.

Proofpoint Essentials API fundamentals: X-User/X-Password header authentication with org-admin credentials, regional pod resolution via the endpoint discovery API, base URL construction, batch-create 207 multi-status handling, and error codes.

Proofpoint Essentials organization lifecycle: get an org and its domains, activate/deactivate, delete, manage domains, toggle features, adjust licensing allocation, change package/subscription tier, and mint an Odin-based SSO token for console handoff.

Proofpoint Essentials inbound and outbound email flow reporting: time-series mail volume and disposition metrics for a customer org, how to interpret them, and how to build recurring MSP status reports from them.

Proofpoint Essentials mailbox user management within a customer org: list, get, create (including batch create), update, and delete mailbox-protected users.

Proofpoint API fundamentals: HTTP Basic Auth with service principal and secret, base URLs and versioning across TAP SIEM, People, Quarantine, Forensics, and URL Defense APIs, rate limits, pagination patterns, and error handling.

Proofpoint Forensics and Threat Response (TRAP) fundamentals: auto-pull and search-and-destroy remediation actions, evidence collection, message trace, and post-delivery incident response workflows for email-borne threats.

Proofpoint People-Centric Security fundamentals: Very Attacked People (VAP) reports, attack index scoring, click susceptibility, top clickers, and user risk categorization for targeting security controls and training.

Proofpoint quarantine management fundamentals: quarantine reasons and folders, message states, search/filter parameters, and release/delete workflows for admin and end-user quarantine.

Proofpoint Targeted Attack Protection (TAP) fundamentals: threat events across URL, attachment, and message-level vectors, click tracking, message disposition, SIEM integration feeds, and campaign correlation.

Proofpoint Threat Intelligence fundamentals: campaign tracking, threat families and actors, indicators of compromise (IOCs), and how campaign/IOC data enriches individual TAP threat events.

Proofpoint URL Defense fundamentals: URL rewriting (v2/v3 formats), click-time analysis and verdicts, and manual/API decoding of rewritten URLs back to their originals.

Reconciling PSA contract/agreement entitlements (seats, hours, recurring services) against invoiced reality in an accounting platform, across any combination of PSA (Autotask, HaloPSA, ConnectWise, Syncro) and accounting platform (QuickBooks Online, Xero). Covers building the entitlement ledger, the cross-system matching priority, and the gap classes — under-billing, over-billing, lapsed agreements still invoiced, active agreements never billed, and price drift.

Three-way seat reconciliation per client per SKU: seats provisioned in a cloud marketplace (Pax8, Sherweb) vs. seats billed in accounting or PSA billing vs. seats actually deployed in the tenant (microsoft-graph or CIPP). Covers the finding class for each pairwise mismatch, disabled users holding paid licenses, intentional-buffer caveats, and how to degrade to a two-way check when an axis isn't connected.

Per-client and per-service-line margin computation for an MSP: revenue from PSA billing or accounting invoices, cost of goods from Pax8/Sherweb wholesale pricing, and estimated labor from PSA time entries × a loaded technician rate. Covers the full-margin / gross-margin-only / cost-data-unavailable reporting tiers and why a missing cost input is flagged rather than interpolated from portfolio averages.

Freshdesk MCP tool surface and REST API v2 fundamentals: header-based authentication via `X-Freshdesk-Domain` and `X-Freshdesk-Api-Key` (which the MCP server translates into upstream HTTP Basic `apikey:X` auth), the `/api/v2` base URL, `page`/`per_page` pagination and the `link` header, per-minute rate limits, the search query language and its 300-result cap, and the status/priority/source integer encodings.

Freshdesk contacts and companies: contact fields and the required contact-channel rule, contact CRUD plus merge and make_agent, company fields and domain-based auto-association, search and autocomplete lookups, and the MSP workflow of resolving a ticket requester to a contact and then to its parent company through the Freshdesk REST API v2.

Freshdesk Solutions knowledge base: the three-level categories -> folders -> articles hierarchy, article fields and draft/published status, finding an article by walking that tree (there is no KB search tool), and the MSP workflow of suggesting relevant KB articles to deflect or resolve a ticket, through the Freshdesk REST API v2.

Freshdesk SLA policies and business-hours calendars: policy and calendar fields, per-priority respond_within / resolve_within targets, how the business-hours vs 24x7 clock computes a ticket's fr_due_by and due_by, and breach / at-risk detection through the Freshdesk REST API v2.

Freshdesk ticket operations: list, get, search, create, update, reply, notes, and conversation threads. Covers status/priority/source integer encodings, core requester / assignment / SLA fields, the search query language, and the MSP creation, triage, and escalation workflows through the Freshdesk REST API v2.

HaloPSA agents (technicians) and teams as a read-only MCP surface: listing technicians, retrieving agent detail, listing team structures, and the inactive-agent filter. Agent IDs resolved here are what ticket assignment needs.

HaloPSA REST API fundamentals: OAuth 2.0 client-credentials authentication, authorization vs. resource server URLs, the tenant query parameter, filtering and pagination conventions, array-wrapped POST bodies, rate-limit behavior, scopes, and error codes.

HaloPSA asset/CMDB data model: asset (configuration item) fields, device types and statuses, links to clients, sites, users, tickets, and contracts, plus parent-child asset relationships. Covers the Asset API surface, hardware lifecycle workflows, RMM auto-sync and device matching, and validation errors.

HaloPSA CRM data model: client records and their billing/contact fields, sites (locations), contacts (Users), client classification, and parent-child client hierarchy. Covers the Client/Site/Users API surface, onboarding and deactivation workflows, duplicate prevention, and common validation errors.

HaloPSA contract management: contract types (recurring, prepaid hours, ad-hoc, project, warranty), statuses, billing and coverage fields, recurring invoice items, prepaid hour balances and deduction, SLA association, renewal and billing-reconciliation workflows.

HaloPSA invoices as a read-only MCP surface: listing by client or date range, filtering by payment and send status, retrieving line-item detail on a single invoice, and the reporting and reconciliation workflows built on them.

HaloPSA service desk tickets: ticket fields, statuses, priorities and ticket types, actions (notes and time entries), attachments, SLA behaviour, and the creation and status-transition workflows with their validation rules.

HubSpot tasks, notes, and associations: task priority and status values, notes-vs-tasks semantics, the association type matrix linking contacts, companies, deals, and tickets, and engagement-history workflows.

HubSpot's official remote MCP server and the CRM Search API behind it: the complete MCP tool catalog, OAuth 2.0 + PKCE connection over Streamable HTTP, automatic scope derivation, sensitive-data (PHI) exclusion, filter/sort/ pagination syntax, plan-tier rate limits, and error handling.

HubSpot company records: core fields, industry classification values, lifecycle stages, domain-based deduplication and automatic contact-company matching, and cross-referencing associated contacts, deals, and tickets.

HubSpot contact records: core and MSP-relevant custom fields, lifecycle stages, lead status values, contact ownership, CRM search filter patterns, and associations to companies and deals.

HubSpot deal records and sales pipelines: deal fields, default and custom pipeline stages, deal amount conventions (MRR vs. TCV), forecast categories and weighted forecasting, and associating deals with contacts and companies.

HubSpot support tickets: core fields, default pipeline stages, priority levels, MSP ticket categories, SLA timestamp properties, and associating tickets with contacts, companies, and deals.

Hudu REST API fundamentals: x-api-key authentication, base URL and /api/v1/ structure, granular API key permission levels, UI-vs-API resource naming differences, query-parameter filtering, page-based pagination, the 300 req/min rate limit, and HTTP status/error semantics.

Hudu knowledge base articles: HTML content format, company-scoped vs global articles, article folders (including nesting), drafts vs published, the /api/v1/articles endpoint surface, and search, templating, and documentation-health patterns.

Hudu assets and asset layouts: the layout-as-template model, custom field types, the `custom_fields` key/value array shape, archiving vs deletion, company scoping, and filter patterns across /api/v1/assets and /api/v1/asset_layouts.

Hudu companies (clients/organizations): company field reference, parent/child hierarchy, PSA integration matching via id_in_integration, the /api/v1/companies CRUD plus archive/unarchive endpoints, onboarding and offboarding workflows, and how companies scope assets, passwords, articles, and websites.

Hudu secure credential storage: the /api/v1/asset_passwords endpoint (the UI calls these "Passwords"), company scoping and password folders, TOTP secrets, per-API-key password permissions, activity-log auditing, rotation workflows, and output-safety rules for handling plaintext credential values.