# Blackpoint Cyber API Patterns

> >

- **Type:** Skill
- **Install:** `agentstack add skill-wyre-ai-msp-claude-plugins-api-patterns`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [WYRE-AI](https://agentstack.voostack.com/s/wyre-ai)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [WYRE-AI](https://github.com/WYRE-AI)
- **Source:** https://github.com/WYRE-AI/msp-claude-plugins/tree/main/msp-claude-plugins/blackpoint/blackpoint/skills/api-patterns
- **Website:** https://mcp.wyre.ai/getting-started/

## Install

```sh
agentstack add skill-wyre-ai-msp-claude-plugins-api-patterns
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Blackpoint Cyber (CompassOne) MCP Tools & API Patterns

## Overview

Blackpoint Cyber is a managed detection and response (MDR) provider.
The CompassOne portal exposes a partner-tenant-asset hierarchy: a
partner (the MSP) sees many tenants (their customers), each tenant has
many assets (endpoints, identities, cloud accounts), and detections /
vulnerabilities are produced against those assets.

## Connection & Authentication

Blackpoint uses an API token passed via header. CompassOne issues the
token in the partner portal.

| Header | Value |
|--------|-------|
| `X-Blackpoint-Api-Token` | The raw CompassOne token |

The gateway maps the environment variable `BLACKPOINT_API_TOKEN` onto
the `X-Blackpoint-Api-Token` header automatically. Internally, the
Blackpoint MCP server forwards this to CompassOne as a `Bearer` token —
you do not need to add the `Bearer ` prefix yourself.

```bash
export BLACKPOINT_API_TOKEN="your-compassone-token"
```

Optional: `BLACKPOINT_BASE_URL` overrides the CompassOne base URL for
regional or partner-specific deployments.

## Hierarchy

```
Partner (MSP)
  └── Tenant (customer)
        └── Asset (endpoint / identity / cloud account)
              └── Detections / Vulnerabilities
```

Always pivot top-down: identify the tenant first, then drill into
assets, then look at detections/vulnerabilities for that asset.

## Navigation Tools

| Tool | Purpose |
|------|---------|
| `blackpoint_navigate` | Discover available domains |
| `blackpoint_back` | Pop back to the prior context |
| `blackpoint_status` | Health/status check |

## Functional Tool Surface (today)

Tools follow `blackpoint__`. Currently functional
domains:

- `tenants`
- `assets`
- `detections`
- `vulnerabilities`

Additional domains (alerts, cloud security, notifications, partners,
threat intel, tickets) are stubbed in the MCP server but not yet
implemented — do not call those.

## Pagination

Blackpoint list endpoints use page/limit-style pagination. Always
check whether more pages exist before claiming a result is complete,
especially for `detections` and `vulnerabilities` — those can run
into the thousands.

## Error Handling

| Status | Meaning | Action |
|--------|---------|--------|
| 401 | Bad/missing Bearer token | Re-check `BLACKPOINT_API_TOKEN` |
| 403 | Token valid but no access to the requested tenant | Check partner-tenant scoping |
| 404 | Unknown tenant / asset / detection | Re-list to confirm |
| 429 | Rate limit | Back off and retry |

## Best Practices

- For incident-response work, always list the affected tenant's
  assets and detections together — a detection without its asset
  context is hard to action.
- For multi-tenant rollups (partner view), iterate
  `blackpoint_tenants_list` first and then drill in per-tenant.
- The current tool surface is read-only — there are no write tools
  yet. Any "respond to detection" workflow must happen in the
  CompassOne portal itself.

## Related Skills

- [incident-response](../incident-response/SKILL.md) - Primary investigation skill

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [WYRE-AI](https://github.com/WYRE-AI)
- **Source:** [WYRE-AI/msp-claude-plugins](https://github.com/WYRE-AI/msp-claude-plugins)
- **License:** Apache-2.0
- **Homepage:** https://mcp.wyre.ai/getting-started/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-wyre-ai-msp-claude-plugins-api-patterns
- Seller: https://agentstack.voostack.com/s/wyre-ai
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.