WYRE-AI
- 375 skills
- 0 followers
- 1 day ago last updated
- ▌ Threatlocker Computers · wyre-aiThreatLocker-protected endpoints: fleet inventory, identifying offline agents, a single computer's check-in history, and correlating computers across organizations and groups.
- ▌ Timezest Appointment Types · wyre-aiTimeZest appointment types: the types configured for a tenant, each type's duration, and how to match a type to the work described on a ConnectWise / Autotask / Halo ticket.
- ▌ Retention Rpo Compliance · wyre-aiComparing configured backup retention and cadence against contracted retention windows and RPO (recovery point objective) targets: the two distinct retention gap types (configured-shorter-than-contracted vs. storage-forced truncation), why achievable RPO must be derived from actual job success history rather than the nominal schedule, where the contracted side of the comparison actually lives, and why "no documented requirement" is its own finding rather than an automatic pass.
- ▌ Better Stack API Patterns · wyre-aiBetter Stack MCP and API surface across Uptime, Telemetry (Logtail), and Error Tracking: available tools, Bearer token authentication, API structure, cursor-based pagination, rate limiting, and error handling.
- ▌ Better Stack Status Pages · wyre-aiBetter Stack status pages: status page configuration, resources and components, maintenance windows, and public service-status communication.
- ▌ Proofpoint Quarantine · wyre-aiProofpoint quarantine management fundamentals: quarantine reasons and folders, message states, search/filter parameters, and release/delete workflows for admin and end-user quarantine.
- ▌ Immybot Maintenance Sessions · wyre-aiImmyBot maintenance sessions — the reconciliation engine that brings endpoints into their desired state: the session tool surface, start parameters (computer vs tenant scope, type, priority, reboot flag), pause/resume/cancel semantics, polling to a terminal state, failure investigation, and reboot-spanning and queued-vs-running edge cases.
- ▌ Inforcer Baseline Alignment · wyre-aiInforcer's core drift-detection surface: baseline templates, tenant alignment scores, alignment details (the per-policy breakdown of a tenant against its assigned baseline), and reading deployed tenant policy state. Read-only.
- ▌ Quickbooks Online Reports · wyre-ai bundleQuickBooks Online financial reporting: the report catalog (Profit & Loss, Balance Sheet, A/R and A/P Aging, General Ledger, Customer Sales, Cash Flow, Tax Summary), report parameters, date macros, column customization, the nested row response structure, and MSP analysis patterns like client profitability and aged receivables for collections.
- ▌ Saas Alerts API Patterns · wyre-aiSaaS Alerts MCP fundamentals: API-key authentication via the gateway header, the MSP → customer → account → user hierarchy, navigation and functional tool naming, event filter parameters, cursor pagination, and HTTP error codes.
- ▌ Salesbuildr API Patterns · wyre-aiSalesbuildr API fundamentals: api-key header authentication, offset-based from/size pagination, error handling, and the 500 requests per 10 minutes rate limit.
- ▌ Sentinelone API Patterns · wyre-aiThe SentinelOne Purple MCP server and the APIs behind it: uvx installation and transport modes, Service User token levels, the 23 read-only tools organized by domain, and the dual GraphQL (cursor pagination) / REST (offset pagination) architecture with its differing filter syntaxes, rate limits, and error causes.
- ▌ Azure MCP Cost And Capacity · wyre-aiThe read-only cost and capacity half of the azure-mcp connector — the pricing, quota, subscription, and group namespaces: retail meter-rate lookups, quota and usage headroom, subscription and resource-group inventory, and the retail-versus- actual-billing distinction that shapes every estimate.
- ▌ Restore Test Verification · wyre-aiWhether a backup is actually recoverable rather than merely present: the ranked hierarchy of restore evidence (actual restore performed, full boot/virtualization verification, screenshot verification, spot-check restore drill, no evidence at all), adequate test cadence per data-criticality tier, and why a never-tested backup is the highest-priority finding — outranking even an actively failing job.
- ▌ Blackpoint Asset Inventory · wyre-aiBlackpoint Cyber (CompassOne) asset data: the six asset classes, listing and paginating assets per class, cross-class search, asset detail, and walking parent/child/sibling relationships to build a blast-radius or topology view.
- ▌ Cloud Capacity Planning · wyre-aiRight-sizing and capacity forecasting for cloud resources on whatever platforms (Azure, DigitalOcean) are connected: the per-platform over-provisioned and under-provisioned signals, growth-trend-based forecasting toward a projected exhaustion window, and the discipline that separates a genuine capacity risk from normal variance — require a trend not a spike, distinguish burst-tolerant from sustained-critical resources, and always state the observation window behind a forecast.
- ▌ Proofpoint Url Defense · wyre-aiProofpoint URL Defense fundamentals: URL rewriting (v2/v3 formats), click-time analysis and verdicts, and manual/API decoding of rewritten URLs back to their originals.
- ▌ Agreement Reconciliation · wyre-aiReconciling PSA contract/agreement entitlements (seats, hours, recurring services) against invoiced reality in an accounting platform, across any combination of PSA (Autotask, HaloPSA, ConnectWise, Syncro) and accounting platform (QuickBooks Online, Xero). Covers building the entitlement ledger, the cross-system matching priority, and the gap classes — under-billing, over-billing, lapsed agreements still invoiced, active agreements never billed, and price drift.
- ▌ Inforcer Identity Governance · wyre-aiInforcer's read-only identity inventory for a managed Microsoft 365 tenant: users, groups, and role assignments. Answers "who and what exists" for governance and review rather than performing user administration. Covers the integer Client Tenant ID scoping every identity call requires.
- ▌ Mimecast Threat Intelligence · wyre-aiMimecast threat data: Targeted Threat Protection logs for URL clicks, attachment analysis, and impersonation attempts; threat remediation incidents; and audit events.
- ▌ Quickbooks Online Expenses · wyre-ai bundleQuickBooks Online expense entities: Purchase (check, cash, credit card), Bill for accounts payable, BillPayment, and Vendor. Covers account-based vs item-based expense lines, per-client cost allocation via CustomerRef and BillableStatus, expense categorization, query syntax, error codes, and MSP profitability analysis patterns.
- ▌ Quickbooks Online Invoices · wyre-ai bundleQuickBooks Online Invoice entity: invoice lifecycle and statuses, line item detail types, service items, payment terms, email delivery and PDF retrieval, invoice numbering, void vs delete semantics, query syntax, error codes, and MSP billing patterns such as monthly managed services, project, and time-and-materials invoicing.
- ▌ Quickbooks Online Payments · wyre-ai bundleQuickBooks Online payment handling: recording customer payments and applying them to invoices, partial and multi-invoice application, unapplied amounts and overpayments, credit memos and refund receipts, payment methods, deposit accounts, voiding, and reconciliation.
- ▌ Salesbuildr Opportunities · wyre-aiSalesbuildr opportunities: pipeline search, opportunity creation, stage updates, and deal values, plus how opportunities link companies and contacts to potential revenue.
- ▌ Proofpoint API Patterns · wyre-aiProofpoint API fundamentals: HTTP Basic Auth with service principal and secret, base URLs and versioning across TAP SIEM, People, Quarantine, Forensics, and URL Defense APIs, rate limits, pagination patterns, and error handling.
- ▌ Proofpoint Threat Intelligence · wyre-aiProofpoint Threat Intelligence fundamentals: campaign tracking, threat families and actors, indicators of compromise (IOCs), and how campaign/IOC data enriches individual TAP threat events.
- ▌ Freshdesk Contacts Companies · wyre-aiFreshdesk contacts and companies: contact fields and the required contact-channel rule, contact CRUD plus merge and make_agent, company fields and domain-based auto-association, search and autocomplete lookups, and the MSP workflow of resolving a ticket requester to a contact and then to its parent company through the Freshdesk REST API v2.
- ▌ Freshdesk Sla Business Hours · wyre-aiFreshdesk SLA policies and business-hours calendars: policy and calendar fields, per-priority respond_within / resolve_within targets, how the business-hours vs 24x7 clock computes a ticket's fr_due_by and due_by, and breach / at-risk detection through the Freshdesk REST API v2.
- ▌ Inforcer Compliance Reporting · wyre-aiInforcer compliance and posture reporting: per-tenant Microsoft 365 secure scores, combining them with alignment scores, and the alignedThreshold / semiAlignedThreshold settings that classify each tenant or policy as aligned, semi-aligned, or drifted. Covers portfolio posture roll-ups across the MSP's managed tenants.
- ▌ Netsuite Records Metadata · wyre-aiRetrieving individual NetSuite records by type and internal ID, and discovering a record type's available fields via record-type metadata. Read-only — retrieving existing records, not creating or updating them.
- ▌ Quickbooks Online Customers · wyre-ai bundleQuickBooks Online Customer entity: the parent/sub-customer (job) hierarchy, contact, address, billing and hierarchy fields, payment terms, balance and BalanceWithJobs tracking, sparse updates, deactivation, query syntax, error codes, and PSA cross-referencing patterns for MSP client records.
- ▌ Sentinelone Threat Hunting · wyre-aiPowerQuery against the Singularity Data Lake: the Scalyr-based pipeline syntax (distinct from SPL, SQL, KQL, and Elasticsearch DSL), the powerquery, get_timestamp_range, and iso_to_unix_timestamp tools, time-range and row-limit handling, common hunting scenarios, and the Purple AI generation path.
- ▌ Threatlocker API Patterns · wyre-aiThreatLocker Portal API fundamentals: raw-key authentication (no Bearer prefix), multi-tenant routing via the organizationId header, POST-based "GetByParameters" list endpoints, pagination shape, and child-organization fan-out patterns.
- ▌ Abnormal Security API Patterns · wyre-aiAbnormal Security REST API fundamentals: Bearer token authentication, base URLs, rate limiting, pagination, OData filtering, request/response formats, and error handling.
- ▌ Blackpoint Incident Response · wyre-aiBlackpoint Cyber (CompassOne) detection investigation: the read-only tool surface across tenants, assets, detections, and vulnerabilities, the tenant → asset → detection → vulnerability drill-down, asset relationship maps, dark-web and external-exposure cross-references, and which tool domains are stubs.
- ▌ Posthog Insights Dashboards · wyre-aiPostHog saved insights (trends, funnels, retention, and similar analytics queries) and the dashboards that group them into a single view. Read-only: running and retrieving existing insights and dashboards, not authoring them.
- ▌ Sentinelone Vulnerabilities · wyre-aiCVE tracking through SentinelOne's XSPM module: the read-only vulnerability tools, EPSS scores and exploit-maturity values and why they outrank raw CVSS severity for prioritization, status values and their transitions, the vulnerability field reference, and patch-prioritization and reporting workflows.
- ▌ Threatlocker Organizations · wyre-aiThe ThreatLocker MSP multi-tenant model: enumerating child organizations, retrieving per-org auth keys, and identifying valid move targets when relocating computers between tenants.
- ▌ Cyber Insurance Questionnaires · wyre-aiDrafting tool-verified answers to cyber-insurance renewal, new-business, and underwriter security questionnaires: the standard recurring question set (MFA everywhere including privileged accounts, EDR coverage ratio, tested and immutable backups, documented and tested IR plan, security awareness training), which connected tools actually answer each one, and the evidence-backed / documented-only / unable-to-verify labeling discipline that keeps an answer defensible during a claim investigation.
- ▌ Checkpoint Avanan Threats · wyre-aiThe Checkpoint Harmony Email (Avanan) security-event surface: the event type, state, severity and SaaS enums accepted by `hec_query_events`, what a detection record does and does not carry, how `availableEventActions` governs what you can do next, and phishing, BEC and malware triage built on those fields.
- ▌ Autotask Ticket Notes Attachments · wyre-aiAutotask ticket notes, attachments, and charges — the secondary entities attached to tickets: retrieving/searching notes and attachments, and creating, updating, or searching ticket charges for labor and expenses billed directly to a ticket.
- ▌ Mailprotector API Patterns · wyre-aiMailprotector MCP fundamentals: gateway header authentication (`X-Mailprotector-Api-Key` / `X-Mailprotector-Reseller-Id`) and its translation to the upstream Bearer token, the Provider → Reseller → Customer → Domain → User Group → User entity hierarchy, the router-pattern tool surface with `mailprotector_execute_tool` for the long tail, scope/scope_id consolidation, field-based list filtering, `page` pagination (max 50 on messages), and error handling.
- ▌ Microsoft Graph Querying · wyre-aiThe RAG query loop for the Microsoft Graph MCP Server for Enterprise — microsoft_graph_suggest_queries to retrieve vetted candidate Graph calls, microsoft_graph_get to execute them, microsoft_graph_list_properties for entity schema — with worked identity and directory examples, result-presentation guidance, and the read-only, RBAC-scoped, rate-limited constraints on what comes back.
- ▌ Alert Severity Normalization · wyre-aiA common Critical/High/Medium/Low normalized severity model for security alerts, incidents, and findings, with the judgment axes (confidence, mitigation state, blast radius) that place a record in a tier and the mapping from each vendor's native terminology — Huntress incident status, SentinelOne threat confidence, Blumira finding priority, CIPP alert queue severity, Blackpoint Cyber SOC severity, SaaS Alerts risk level — plus how to discover which security vendors are actually connected.
- ▌ Datto Saas Protection API Patterns · wyre-aiDatto SaaS Protection (formerly Backupify) REST API fundamentals: regional base URLs, bearer-token auth, the seat/tenant object model, backup status queries, and restore operations.
- ▌ Quickbooks Online API Patterns · wyre-ai bundleQuickBooks Online API fundamentals: OAuth2 authentication and token lifecycle, REST structure and base URLs, the Intuit query language, pagination, minor version headers, SyncToken optimistic locking, rate limits, webhooks, and the Fault error object format.
- ▌ Sentinelone Misconfigurations · wyre-aiCloud security posture findings from SentinelOne's XSPM module across AWS, Azure, GCP, Kubernetes, identity providers, and infrastructure-as-code. Covers the read-only misconfiguration tools, view types, severity and status values, compliance-standard and MITRE ATT&CK mappings, evidence fields, and remediation guidance.
- ▌ Threatlocker Computer Groups · wyre-aiThreatLocker computer groups — the policy-scoping boundary that determines which allow/deny rules apply to which endpoints. Covers listing groups, mapping a computer to its group, and the difference between the dropdown and full list endpoints.
- ▌ Microsoft Graph Connection · wyre-aiConnecting the Microsoft Graph MCP Server for Enterprise (public preview) through the Wyre gateway: BYOC multi-tenant Entra app registration, the tenantId/clientId/clientSecret triple, the delegated MCP.* permissions and the per-tenant admin consent that must be granted out of band, plus the read-only design, the 100 calls/min/user limit, licensing implications, and a symptom-to-cause troubleshooting table.
- ▌ Salesbuildr Companies Contacts · wyre-aiSalesbuildr companies and contacts: company search, contact filtering by company, and contact creation with its required fields.
- ▌ Phishing Simulation Analysis · wyre-aiPhishing-simulation campaign analysis: click-rate trend direction across campaigns, repeat-clicker identification with remedial-training cross-reference, and optional enrichment that correlates simulated failures with real-world phishing incidents from a connected email-security tool as a compounding risk signal.
- ▌ Training Completion Tracking · wyre-aiSecurity-awareness training completion across whatever training/awareness platform is connected: assignment-overdue versus cadence-overdue detection, per-campaign and per-org completion-rate calculation, ranking clients that have fallen behind a contracted cadence, and the unmeasured-versus-0% distinction.
- ▌ Checkpoint Avanan Exceptions · wyre-aiThe Checkpoint Harmony Email (Avanan) whitelist and blacklist surface: the match fields and matching modes an exception accepts, the defaults that widen an entry beyond what was typed, the id mismatch between listing and editing, and the standing security consequence of a detection bypass.
- ▌ Checkpoint Avanan Quarantine · wyre-aiFinding and acting on mail in Checkpoint Harmony Email (Avanan): the `hec_search_emails` attribute-filter syntax, what an entity payload carries, the asynchronous quarantine and restore actions and their task polling, and the judgement a restore requires because delivery cannot be undone.
- ▌ Threatlocker Approval Requests · wyre-aiThreatLocker application approval request triage: pulling the pending queue, grouping requests by application and hash, signed-publisher and path heuristics, and approve/deny recommendations with audit-friendly reasoning.
- ▌ Mailprotector Users Groups · wyre-aiUser groups as the service container (services get/update with its deactivate-what-you-omit semantics), user CRUD including create_many and find_by_address, user aliases, password resets, and user syncs — LDAP/AD source creation, Entra/Google console-only sources, sync schedules, and comparison-type filters.
- ▌ Netsuite Reports Saved Searches · wyre-aiRunning NetSuite's standard and custom reports and saved searches, plus the filter-lookup helpers (accounting books, accounting contexts, nexuses, subsidiaries) many of them need. Read-only — running existing reports and searches, not building or editing them.
- ▌ Blackpoint Multi Tenant Operations · wyre-aiPartner-level Blackpoint Cyber (CompassOne) operations: the partner-tenant hierarchy, enumerating customer tenants, sweeping detections and vulnerabilities across all of them, spotting volume anomalies, and building per-tenant scorecards.
- ▌ Checkpoint Avanan API Patterns · wyre-ai bundleShape of the Checkpoint Harmony Email (Avanan) `hec_*` tool surface: the thirteen tools and what each reaches, the event/entity split that governs which tool accepts which id, the `responseEnvelope`/`responseData` result shape, `scrollId` pagination, and the auth, regional-routing and farm-scope behaviour behind every call.
- ▌ Mailprotector Allow Block Rules · wyre-aiSender allow/block rules at all five scopes: downward inheritance (reseller rules apply to everything beneath), the listing that returns only directly-attached rules, create with `rule_type: allow|block` and address-or-domain values, and the flat delete endpoint.
- ▌ Posthog Feature Flags Experiments · wyre-aiRead-only lookups of PostHog early-access feature flags and experiments — rollout status, targeting, and configuration. Does not create, update, or delete flags or experiments.
- ▌ Blackpoint Vulnerability Management · wyre-aiBlackpoint Cyber (CompassOne) exposure data across four lenses: host vulnerability findings and the filters that matter (CVE, severity, patch and exploit availability), scan history, dark-web credential and data leaks, and internet-facing external exposures — plus how to combine them into a prioritized remediation view.
- ▌ Proofpoint Essentials Reporting · wyre-aiProofpoint Essentials inbound and outbound email flow reporting: time-series mail volume and disposition metrics for a customer org, how to interpret them, and how to build recurring MSP status reports from them.
- ▌ Kaseya Quote Manager Quotes Sales Orders · wyre-aiKaseya Quote Manager quoting data: the quote → section → line item hierarchy, and the sales orders, order lines, and payments a quote becomes once accepted. Read-only tool surface.
- ▌ Proofpoint Essentials API Patterns · wyre-aiProofpoint Essentials API fundamentals: X-User/X-Password header authentication with org-admin credentials, regional pod resolution via the endpoint discovery API, base URL construction, batch-create 207 multi-status handling, and error codes.
- ▌ Mailprotector Customers Domains · wyre-aiCustomer lifecycle (create/edit/delete under the reseller), domain creation with the Pending → Active verification flow and verification_token, domain aliases, moving domains between customers, address discovery, and mail routing via email destinations and email sources.
- ▌ Alternative Payments Payments Payouts · wyre-aiAlternative Payments transactions and payouts: transaction types, statuses, and the customer/invoice/payment-method filters; payout objects and the transactions that compose them for reconciliation. A read-only surface -- there is no create-payment or direct-charge operation.
- ▌ Alternative Payments Customers · wyre-aiAlternative Payments customers and their users: customer fields and status, the customer/user relationship, MSP client onboarding, and the destructive archive operation that requires confirmation.
- ▌ Alternative Payments Invoicing · wyre-aiAlternative Payments invoices and hosted payment requests: invoice status and line-item fields, hosted payment links and signed PDF links, archiving, and payment-request creation and retrieval. Hosted links let the customer choose to pay; the integration never moves money on the customer's behalf.
- ▌ Proofpoint Essentials Org Management · wyre-aiProofpoint Essentials organization lifecycle: get an org and its domains, activate/deactivate, delete, manage domains, toggle features, adjust licensing allocation, change package/subscription tier, and mint an Odin-based SSO token for console handoff.
- ▌ Mailprotector Quarantine Messages · wyre-aiQuarantine triage across all five scopes (reseller/customer/domain/ user_group/user): message fields (`quarantine_type`, `decision`, `score`, scoring `results`), releasing a single message via `/deliver`, bulk release via `/deliver_many` with its silent scope-mismatch skip and the `all_selected` release-everything switch, and the release permission flags in configuration.
- ▌ Proofpoint Essentials User Management · wyre-aiProofpoint Essentials mailbox user management within a customer org: list, get, create (including batch create), update, and delete mailbox-protected users.
- ▌ Kaseya Quote Manager Purchasing · wyre-aiKaseya Quote Manager procurement data: purchase orders with their lines and costs, the suppliers they are placed with, and product-supplier records mapping catalog products to supplier SKUs and pricing. Read-only tool surface.
- ▌ Alternative Payments API Patterns · wyre-aiAlternative Payments API fundamentals: OAuth2 client-credentials token minting and bearer auth, scopes, REST endpoint structure, cursor pagination, the 5 req/sec rate limit, idempotency, error handling, and the read + safe-write capability posture that deliberately excludes direct payment creation.
- ▌ Kaseya Quote Manager API Patterns · wyre-aiKaseya Quote Manager (Datto Commerce) API fundamentals: API-key auth and the gateway's header translation, the read-only `kqm_<entity>_list`/`_get` tool surface across the sales, procurement, catalog, CRM, and org domains, page/pageSize/modifiedAfter pagination, rate limits, and error codes.