Schema | usap-skills

usap-skills

Overview Schema Related Servers Score Discussions

Server Configuration

Describes the environment variables required to run the server.

Name	Required	Description	Default
No arguments

Capabilities

Features and capabilities supported by this server

Capability	Details
`tools`	{}
`resources`	{}

Tools

Functions exposed to the LLM to take actions

Name	Description
list_skillsA	List USAP skills with one-line descriptions. Optionally filter by domain (one of: appsec-devsecops, cloud-infra, detection, governance, identity-access, pentest, platform-ai, red-team, response, risk-compliance, system-security, webapp-security).
list_agentsA	List the 12 cs-* USAP orchestrator agents.
get_skillA	Return the full SKILL.md content for one skill. Use this to load a skill as a system prompt in the client's LLM context.
get_agentA	Return the full agent definition for one cs-* orchestrator agent. Use this to activate the agent persona in the client's LLM.
validate_payloadA	Validate a JSON payload against the USAP 11-field output contract (agent_slug, intent_type, action, rationale, confidence, severity, key_findings, evidence_references, next_agents, human_approval_required, timestamp_utc). Returns 'PASS' or a list of violations.
route_payloadA	Phase 2 routing. Take an 11-field USAP payload and look up which specialist MCP would handle it (Splunk / CrowdStrike / FortiGate / Okta / Slack / GitHub / AWS Security Hub, etc.) per the registry at registry/usap-mcp-registry.yaml. If the payload or the matched capability sets human_approval_required: true, returns an approval prompt instead of dispatching. Phase 3 will actually invoke the adapter; Phase 2 confirms routing logic + approval gate. Every decision is written to ~/.usap/audit/YYYY-MM-DD.jsonl.
list_mcpsA	List all specialist MCPs the router knows about, with their enabled/disabled status, declared capabilities, and which intent_type values route to them.
dispatch_after_approvalA	Phase 3 explicit dispatch. After `route_payload` returned an approval_required decision and the calling client surfaced the prompt to the user, the client calls this to actually invoke the downstream capability. Writes approval_granted + dispatch audit lines so the chain is recoverable end-to-end.

Prompts

Interactive templates invoked by user choice

Name	Description
No prompts

Resources

Contextual data attached and managed by the client

Name	Description
`appsec-code-review`	USAP agent skill for AppSec Code Review. Use for Security-focused static code analysis — OWASP Top 10, logic flaws, dependency audits.
`appsec-customize`	USAP agent skill for adapting the AppSec chain to a new language or vulnerability class. Use for walking three forcing questions (language, threat patterns, deployment target) and emitting a CUSTOMIZE.md plan that defines the pattern catalog, exploitability scores, and patch recipes the threat-model / vuln-scan / finding-triage / patch-candidate skills will use for the new target.
`build-integrity`	USAP agent skill for Build Integrity. Verify build provenance, validate artifact signatures, check SLSA compliance, and detect signs of build pipeline compromise.
`devsecops-pipeline`	USAP agent skill for DevSecOps Pipeline Security. Use for assessing security gate completeness in CI/CD pipelines, pipeline configuration review, SAST/DAST integration gaps, secret scanning in pipeline YAML, and security toolchain hardening.
`finding-triage`	USAP agent skill for AppSec finding triage. Use for reading VULN-FINDINGS.json from the vuln-scan skill, verifying each finding against the threat model, deduplicating across runs, ranking by exploitability + business impact, and emitting a TRIAGE.md hit list the patch-candidate skill consumes.
`patch-candidate`	USAP agent skill for generating candidate patches against triaged AppSec findings. Use for reading TRIAGE.md from the finding-triage skill, producing per-finding patch proposals as unified diffs, and writing PATCH-CANDIDATES.md plus per-finding .patch files. Never auto-applies. L4 skill — requires explicit human approval before any patch is committed.
`pipeline-security-scan`	USAP agent skill for Pipeline Security Scan. Use for CI/CD pipeline security scanning — secrets in env vars, SAST integration, artifact signing check.
`sast-dast-coordinator`	USAP agent skill for SAST/DAST Coordinator. Orchestrate static and dynamic application security testing, correlate findings across tools, deduplicate results, and prioritize by exploitability.
`secure-sdlc`	USAP agent skill for Secure SDLC. Embed security into every phase of development — design, coding, testing, deployment, and operations — with developer-friendly controls.
`security-requirements-review`	USAP agent skill for Security Requirements Review. Use for proactive analysis of design documents — POA&M, PRDs, architecture docs, requirements specs — to extract security gaps before any alerts fire.
`supply-chain-risk`	USAP agent skill for Supply Chain Risk. Evaluate software and hardware supply chain dependencies, detect malicious package injection, and assess build pipeline integrity.
`supply-chain-simulation`	USAP agent skill for Supply Chain Simulation. Design and analyze supply chain attack scenarios in isolated environments to test detection coverage and response capabilities.
`threat-model`	USAP agent skill for application threat modeling. Use for building a STRIDE+DREAD threat model from a target spec, generating a structured THREAT_MODEL.md artifact, and seeding the downstream vuln-scan + finding-triage chain with a prioritized asset and trust-boundary inventory.
`vuln-scan`	USAP agent skill for threat-model-scoped vulnerability scanning. Use for running static analysis (SAST, secrets, dependency vuln) against a target the threat-model skill has already mapped, weighting findings by their proximity to the model's top-DREAD threats, and emitting structured VULN-FINDINGS.json for downstream triage.
`cloud-security-posture`	USAP agent skill for Cloud Security Posture. Use for Evaluate cloud misconfigurations and posture drift.
`cloud-workload-protection`	USAP agent skill for Cloud Workload Protection. Use for Container and serverless runtime security — anomaly detection, escape detection, CSPM gap analysis.
`container-image-scan`	USAP agent skill for Container Image Scan. Use for classifying container-image vulnerability scan findings from Trivy, Grype, or Snyk into a block-deploy, fix-by-SLA-window, track, or accept decision across base-image OS packages, application dependencies, and unexpected image layers.
`endpoint-os-security`	USAP agent skill for Endpoint & OS Security. Analyze endpoint security posture, evaluate EDR coverage, detect configuration drift, and recommend hardening for Windows, Linux, macOS, and containers.
`iac-security`	USAP agent skill for IaC Security. Analyze Terraform, CloudFormation, Kubernetes manifests, and Helm charts for misconfigurations, insecure defaults, and compliance violations.
`ot-iot-device-security`	USAP agent skill for OT/IoT/Device Security. Evaluate operational technology and IoT security controls, identify OT network segmentation gaps, and assess ICS/SCADA security posture.
`attack-surface-management`	USAP agent skill for Attack Surface Management. Use for Continuously discover and assess exposed assets.
`behavioral-analytics`	USAP agent skill for Behavioral Analytics (UEBA). Use for Analyze behavioral anomalies across users and entities.
`deception-honeypot`	USAP agent skill for Deception & Honeypot Strategy. Use for Deception technology planning — honeypot placement, canary token deployment, lateral movement traps.
`detection-engineering`	USAP agent skill for Detection Engineering. Design, validate, and tune detection rules across SIEM, EDR, and cloud telemetry to minimize dwell time and maximize detection fidelity.
`network-exposure`	USAP agent skill for Network Exposure. Use for Identify network segmentation and exposure weaknesses.
`secrets-exposure`	USAP agent skill for Secrets and Credential Exposure Detection. Use for scanning repositories, pipelines, and runtime environments for exposed secrets, API keys, tokens, and credentials — includes entropy analysis, blast-radius estimation, and revocation prioritization.
`telemetry-signal-quality`	USAP agent skill for Telemetry and Signal Quality Assessment. Use for evaluating SIEM data source health, log completeness, normalization error rates, and detection data fidelity before running threat hunts or drawing conclusions from negative detection results.
`threat-hunting`	USAP agent skill for Threat Hunting. Use for Perform hypothesis-driven threat hunting across telemetry.
`threat-intelligence`	USAP agent skill for Threat Intelligence Enrichment and Attribution. Use for IOC enrichment, adversary TTP mapping to MITRE ATT&CK, threat actor attribution, intelligence-driven detection prioritization, and converting raw indicators into actionable detection or control recommendations.
`ciso-brief-generator`	USAP agent skill for CISO Brief Generator. Use for generating CISO-level security briefs — risk posture summaries, board-ready narratives.
`findings-tracker`	USAP agent skill for Findings Tracker. Maintain authoritative registry of security findings, track remediation status, assign risk scores, and enforce SLA compliance.
`knowledge-management`	USAP agent skill for Knowledge Management. Manage reusable security knowledge, record agent decisions with rationale, surface relevant precedents, and prevent institutional amnesia.
`metrics-reporting`	USAP agent skill for Security Metrics and Reporting. Use for producing MTTD/MTTR KPIs, patch coverage rates, SLA compliance metrics, false-positive rates, and board-level security dashboards — always with data provenance statements and period-over-period trend analysis.
`security-architecture`	USAP agent skill for Security Architecture. Validate architecture changes against security principles, assess Zero Trust readiness, and provide security design guidance for new systems.
`security-awareness`	USAP agent skill for Security Awareness. Track and improve human risk posture through targeted training, phishing simulation analysis, and behavioral risk measurement.
`security-debt-tracker`	USAP agent skill for Security Debt Tracking. Use for analyzing aging security findings, computing SLA breach counts, and classifying debt accumulation rate.
`security-policy-control`	USAP agent skill for Security Policy & Control. Author and govern policy-as-code rules, assess control effectiveness, and manage the security policy lifecycle.
`security-posture-score`	USAP agent skill for Security Posture Scoring. Use for Cross-domain security posture scoring — aggregates findings into an executive scorecard.
`security-roadmap-planner`	USAP agent skill for Security Roadmap Planning. Use for building investment-prioritized 12-month security program roadmaps from posture, risk, and compliance data.
`vulnerability-management`	USAP agent skill for Vulnerability Management. Use for Prioritize vulnerabilities by exploitability and impact.
`cryptography-key-management`	USAP agent skill for Cryptography & Key Management. Govern crypto posture, audit key lifecycle, enforce rotation policies, and detect weak or exposed cryptographic material.
`data-security-classification`	USAP agent skill for Data Security & Classification. Classify data sensitivity and assign appropriate protection requirements, handling controls, and retention policies.
`identity-access-risk`	USAP agent skill for Identity and Access Risk Assessment. Use for IAM anomaly detection, privilege escalation path analysis, over-permissioned role scoring, CloudTrail behavioral review, dormant credential identification, and transitive permission chain mapping across AWS, Azure, and GCP.
`insider-physical-risk`	USAP agent skill for Insider & Physical Risk. Evaluate insider threat indicators, analyze behavioral signals, and assess physical access security controls.
`pentest-reporting`	USAP agent skill for Penetration Test Report Generation. Use for compiling pentest findings into executive and technical reports following PTES and OWASP reporting standards.
`web-app-pentest`	USAP agent skill for Web Application Penetration Testing. Use for OWASP Top 10 assessment, API security testing, and auth bypass analysis within authorized scope only.
`agent-integrity-monitor`	USAP agent skill for AI Agent Integrity Monitoring. Use for detecting prompt injection attempts, instruction override, goal drift, and behavioral deviation in autonomous AI agents — monitors production agent sessions against behavioral baselines and raises integrity violations before they produce harmful outputs.
`ai-agent-security`	USAP agent skill for AI Agent Security. Use for Detect prompt injection and misuse against agentic workflows.
`ai-ethics-governance`	USAP agent skill for AI Ethics & Governance. Use for Govern ethical use and explainability of AI decisions.
`guardrail`	USAP agent skill for Guardrail. Enforce approval gates, RBAC role policies, intent_type boundaries, and safety rules for the USAP control plane.
`orchestrator`	USAP agent skill for Orchestrator. Route SecurityFacts through deterministic policy sequences, coordinate multi-agent workflows, and manage agent execution order.
`third-party-vendor-risk`	USAP agent skill for Third-Party & Vendor Risk. Assess vendor security posture, track SLA compliance, and govern external dependency risk throughout the vendor lifecycle.
`tool-execution-broker`	USAP agent skill for Tool Execution Authorization and Brokering. Use for authorizing, logging, and gating all mutating tool calls from USAP agents — enforces scope validation, approval gates, and tamper-evident audit trails for every automated security action before execution.
`ai-red-teaming`	USAP agent skill for AI Red Teaming. Use for Adversarial testing of AI/ML systems — prompt injection, model inversion, jailbreaks.
`attack-path-analysis`	USAP agent skill for Attack Path Analysis. Use for Analyze lateral movement and blast-radius attack paths.
`continuous-pentesting`	USAP agent skill for Continuous Pentesting. Analyze attack surface changes, prioritize emerging exposures for testing, and maintain always-on adversarial posture.
`credential-attacks`	ARIA agent skill for credential attack reasoning. Use for deciding whether to spray vs brute-force, selecting wordlists, interpreting hydra results, and assessing account lockout risk before execution.
`red-team-operations`	USAP agent skill for Red Team Operations. Use for Execute controlled red-team operation workflows.
`red-team-planner`	USAP agent skill for Red Team Planner. Use for Plan red-team engagements, scope, and rules of engagement.
`safe-exploitation`	USAP agent skill for Safe Exploitation. Use for Run controlled exploitation workflows in approved lab contexts.
`security-research`	USAP agent skill for Security Research. Track emerging threats, analyze novel attack techniques, evaluate research findings, and translate intelligence into actionable security improvements.
`web-enumeration`	ARIA agent skill for active web content discovery. Use for reasoning about path brute-forcing results, prioritising discovered endpoints, and identifying high-value targets for exploitation.
`containment-advisor`	USAP agent skill for Incident Containment Strategy. Use for selecting the most targeted containment action for confirmed threats, blast-radius assessment across 10 threat types, production impact quantification, and preparing human-approval-gated containment plans for network isolation, credential revocation, or firewall changes.
`forensics`	USAP agent skill for Digital Forensics. Produce investigation timelines, evidence preservation guidance, and chain-of-custody recommendations for security incidents.
`incident-classification`	USAP agent skill for Security Incident Classification and Triage. Use for classifying incoming security events into 14 incident types, assigning SEV1-SEV4 severity with false-positive filtering across 5 categories, and routing confirmed incidents to the correct response track with zero false-negative tolerance on critical criteria.
`incident-commander`	USAP agent skill for Incident Commander. Coordinate multi-agent incident response, declare severity levels, assign response tracks, and drive decision-making under time pressure.
`zero-day-response`	USAP agent skill for Zero-Day Response. Use for Coordinate compensating controls for zero-day risk.
`zero-day-response-governance`	USAP agent skill for Zero-Day Response Governance. Govern policy and approval pathways for zero-day vulnerability programs — from discovery through coordinated disclosure and emergency response.
`compliance-mapping`	USAP agent skill for Multi-Framework Compliance Mapping. Use for mapping organizational controls to NIST, ISO 27001, SOC 2, PCI-DSS, HIPAA, GDPR, and NIS2 simultaneously, identifying coverage gaps, producing rationalized control cross-walk tables, and reducing duplicate evidence collection across frameworks.
`cyber-insurance`	USAP agent skill for Cyber Insurance. Assess cyber insurance coverage adequacy, identify coverage gaps, maintain claim-readiness evidence, and support renewal applications.
`enterprise-risk-assessment`	USAP agent skill for Enterprise Risk Assessment. Quantify enterprise cyber risk using FAIR methodology, produce risk heat maps, and communicate residual exposure to the board.
`internal-audit-assurance`	USAP agent skill for Internal Audit and Controls Assurance. Use for planning and executing internal security audits, collecting admissible controls evidence for SOC 2, ISO 27001, SOX, and FedRAMP, testing control operating effectiveness, and producing board-ready audit findings with root cause analysis and management responses.
`privacy-dpia`	USAP agent skill for Privacy & DPIA. Produce GDPR-compliant Data Protection Impact Assessments, identify high-risk processing activities, and generate privacy evidence packs.
`quantum-security-readiness`	USAP agent skill for Quantum Security Readiness. Use for Track post-quantum migration readiness and crypto agility.
`regulatory-horizon`	USAP agent skill for Regulatory Horizon. Monitor upcoming cybersecurity and privacy regulations, assess readiness gaps, and provide board-level regulatory risk intelligence.
`risk-threat-modeling`	USAP agent skill for Risk & Threat Modeling. Model attacker paths using STRIDE, PASTA, and attack trees. Quantify risk impact and prioritize mitigations.
`os-hardening`	USAP agent skill for OS Hardening Assessment. Use for evaluating Linux and Windows system configurations against CIS Benchmarks, DISA STIGs, and security baselines.
`api-security-posture`	USAP agent skill for API Security Posture. Use for scoring an API surface against OWASP API Security Top 10 — broken object level authorization, broken authentication, mass assignment, rate-limit gaps — and recommending the next USAP skill to address the largest posture drag.
`owasp-top10-classifier`	USAP agent skill for OWASP Top 10 2025 classification. Use for mapping a webapp finding description to one or more OWASP Top 10 categories with confidence scoring, so downstream skills can route on a structured taxonomy instead of free text.
`webapp-risk-triage`	USAP agent skill for Webapp Risk Triage. Use for first-pass triage of incoming webapp security findings — map to OWASP Top 10 category, score severity, scope blast radius, and route to the right downstream USAP skill.
`cs-security-analyst`	Universal USAP security advisor. One agent for any security question — incident, risk, compliance, red team, architecture, or awareness. Adapts to any audience. Makes decisions.
`cs-incident-responder`	Full incident lifecycle manager coordinating triage, containment, forensics, and post-incident review
`cs-red-teamer`	Offensive security operations coordinator for red team engagements, attack path mapping, and exploitation workflows
`cs-blue-team-analyst`	Blue Team operations orchestrator for detection, threat hunting, DFIR, and detection engineering across the detection and response domains
`cs-cloud-investigator`	USAP orchestrator agent for cloud-incident investigation. Drives misconfiguration triage, workload-runtime analysis, and IAM anomaly attribution across AWS, Azure, and GCP findings.
`cs-supply-chain-defender`	USAP orchestrator agent for software supply chain defense. Drives SBOM analysis, dependency-vulnerability triage, malicious package detection, and build-integrity verification across CI/CD pipelines.
`cs-threat-intel-lead`	USAP orchestrator agent for threat intelligence. Drives IOC enrichment, actor attribution, behavioral corroboration, and intelligence-driven hunt prioritization for active and proactive workflows.
`cs-purple-team-lead`	USAP orchestrator agent for purple team operations. Runs tabletop exercises and detection-vs-attack drills by orchestrating cs-blue-team-analyst, cs-red-teamer, and cs-incident-responder in one coordinated session.
`cs-appsec-engineer`	USAP orchestrator agent for application security. Drives the webapp-security and appsec-devsecops domains end-to-end — runtime triage, OWASP classification, API posture scoring, and pipeline coverage.
`cs-devsecops-engineer`	Security-in-pipeline engineer coordinating AppSec code review, pipeline security scanning, and supply chain risk assessment
`cs-ciso-advisor`	Executive security advisor generating board-ready security posture reports, risk reviews, and regulatory gap assessments
`cs-security-program-manager`	Passive security lifecycle orchestrator for program planning, proactive scanning, and facilitated security reviews

Server Configuration
Capabilities
Tools
Prompts
Resources

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/jaskaranhundal/usap-skills'

If you have feedback or need assistance with the MCP directory API, please join our Discord server