The marketplace for trusted agents & tools

Creates a payment charge via Stripe API. Handles card processing, amount validation, idempotency, and automatic retry on network failures.

Retrieves a paginated list of invoices from Stripe. Supports filtering by customer, status, and date range.

Sends transactional emails via configured SMTP or provider (SendGrid, SES). Supports HTML templates, attachments, and delivery tracking.

Executes SELECT queries against the configured database. Read-only; parameterized queries enforced to prevent injection.

Executes INSERT/UPDATE statements. Requires MFA approval for production environments. All writes are logged to the tamper-evident audit chain.

Executes DELETE statements. High-risk operation — requires MFA approval and generates an immutable audit event with full parameter hash.

Downloads an object from Amazon S3. Supports presigned URLs, range requests, and automatic retry with exponential backoff.

Uploads an object to Amazon S3 with server-side encryption. Enforces content-type validation and max upload size limits.

Posts a message to a Slack channel or DM via the Slack Web API. Supports Block Kit for rich formatting and attachments.

Creates a support ticket in Zendesk with requester details, priority, and custom fields. Supports ticket tagging and auto-assignment.

Opens a pull request on GitHub with specified base and head branches. Supports draft PRs, reviewers, labels, and milestone assignment.

Performs an HTTP GET request to allowed URLs. URL allowlist enforced from agent manifest. Response size and timeout limits apply.

Executes a Splunk SPL search query via the REST API. Supports earliest/latest time bounds, field extraction, and result pagination.

Creates a saved search alert in Splunk with configurable trigger conditions, throttling, and notification actions.

Retrieves a Splunk ES notable event by event_id including risk score, contributing events, and analyst annotations.

Updates the status, owner, urgency, or comment on a Splunk ES notable event for SOC workflow management.

Sends a structured event to Splunk via the HTTP Event Collector (HEC). Supports custom sourcetype, index, and host fields.

Lists Falcon detections filtered by severity, status, date range, and hostname. Returns detection IDs with summary metadata.

Retrieves full incident details from CrowdStrike Falcon including associated detections, hosts, and tactics used.

Network-isolates an endpoint via CrowdStrike Real Time Response. Host retains connection to Falcon cloud only. Requires MFA approval.

Removes network containment from a CrowdStrike-isolated host, restoring full network connectivity. Requires MFA approval.

Retrieves endpoint device details from CrowdStrike including OS, agent version, last seen, and containment status.

Lists active threats on SentinelOne-managed endpoints filtered by severity, status, and site. Returns threat classification and file details.

Applies kill, quarantine, or remediate mitigation action to a SentinelOne threat. Requires MFA for production endpoints.