Use whenever the user wants to find, shortlist, vet, or enrich US cybersecurity firms — pen-testing/red team, security audits, vCISO, SOC 2 readiness, incident response, managed SOC, IAM, cloud security, and AppSec. Triggers on "find me a pen-testing firm for our SOC 2 audit", "shortlist three vCISO services for our healthcare-tech startup", "we need an incident response retainer", or "pull contact info for these 8 security firm domains", even when described indirectly (we got breached, prepare us for the compliance audit, get us SOC 2 ready). Drives the ServiceGraph API (api.servicegraph.co) — a 100k+ US firm catalog filterable by industry, services, location, size, ratings. Skip in-house security hires, "how do I patch CVE-X" or "configure firewall Y" DIY questions, security-product reviews (CrowdStrike vs SentinelOne, etc.), generic security knowledge questions, consumer/personal security advice, non-US firms, individual freelancers and bug-bounty hunters.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
Use whenever the user wants to find, shortlist, vet, or enrich US cybersecurity firms — pen-testing/red team, security audits, vCISO, SOC 2 readiness, incident response, managed SOC, IAM, cloud security, and AppSec. Triggers on "find me a pen-testing firm for our SOC 2 audit", "shortlist three vCISO services for our healthcare-tech startup", "we need an incident response retainer", or "pull contact info for these 8 security firm domains", even when described indirectly (we got breached, prepare us for the compliance audit, get us SOC 2 ready). Drives the ServiceGraph API (api.servicegraph.co) — a 100k+ US firm catalog filterable by industry, services, location, size, ratings. Skip in-house security hires, "how do I patch CVE-X" or "configure firewall Y" DIY questions, security-product reviews (CrowdStrike vs SentinelOne, etc.), generic security knowledge questions, consumer/personal security advice, non-US firms, individual freelancers and bug-bounty hunters.
Drive the ServiceGraph API (https://api.servicegraph.co) to find,
shortlist, and enrich US cybersecurity firms via the pro_services
dataset.
Always pin service_provided:cybersecurity — that's the only
relevant structured tag in the live catalog. Older docs and the
catalog source mention sub-tags like pen-testing and
security-audit, but in the current release none of those exist as
separate tags — cybersecurity is the broad catch-all and every
sub-type (pen-testing, red-team, vCISO, SOC 2 readiness, IR retainer,
IAM, cloud security, AppSec) is a keyword substring search on firm
text. Confirm via /v1/datasets/pro_services/fields?include_values=1
once per session.
The industry tag also drifts between releases — newer catalogs may
use industry:cybersecurity, older ones used industry:security.
Confirm the value via /fields and pin both industry and
service_provided:cybersecurity for safety.
Any HTTP client works (curl, fetch, requests). Examples below use curl.
When NOT to use this skill
Consumer/personal cybersecurity ("my Gmail got hacked", "how do I secure my home wifi") — the catalog is B2B procurement only.
the ServiceGraph MCP server (https://mcp.servicegraph.co) loaded in
your harness — this plugin's .mcp.json wires it up; OAuth 2.1 + PKCE
keeps credentials in the harness sandbox — or
a ServiceGraph API key (vk_…, minted at
https://servicegraph.co/profile/api-keys) available as
SERVICEGRAPH_API_KEY in the environment or .env.local for the REST
path (setup steps under Auth below).
An HTTP client for the REST path — the examples use curl.
Instructions
The loop is free-first: discovery, validation, search, and brief reads cost
nothing; only unlock after the user confirms the spend.
Pick the call path — the ServiceGraph MCP tools if loaded, otherwise the
REST flow (MCP server and Auth sections below).
GET /v1/datasets/pro_services/fields?include_values=1 — confirm the
fields and values you plan to filter on exist.
Build the filter (Filter DSL below) and validate it with
GET /v1/datasets/pro_services/check — or draft it from plain English via
POST /v1/datasets/pro_services/translate-intent.
GET /v1/datasets/pro_services/search — present the free brief cards and
let the user pick.
Quote the unlock cost (10 credits per row, 30-day TTL) and get an explicit
go-ahead.
POST /v1/datasets/pro_services/unlocks with the chosen apexes; report the
revealed detail.
GET /v1/me/credits to report the remaining balance when asked.
MCP server (preferred for authed calls)
If your harness has the ServiceGraph MCP server loaded (tools
containing servicegraph), prefer those — OAuth 2.1 + PKCE keeps the
token in the harness sandbox. Otherwise use the REST flow below.
API surface (dataset id: pro_services)
Every endpoint requires the bearer (Authorization: Bearer vk_…).
No anonymous tier.
Endpoint
Cost
Use it for
GET /v1/datasets/pro_services/fields[?include_values=1]
free
Confirm industry value name and cybersecurity is in service_provided.
GET /v1/datasets/pro_services/check?filter=…
free
Validate filter.
POST /v1/datasets/pro_services/translate-intent
free
{intent} → DSL filter + sanity count.
GET /v1/datasets/pro_services/search?filter=…&limit=
free
Brief firm cards + per-row unlock hint + total.
GET /v1/datasets/pro_services/:apex
free
One row brief; detail only if unlocked.
POST /v1/datasets/pro_services/unlocks
10 credits / firm
{apexes:[...]} ≤100; atomic; 30-day TTL on detail.
GET /v1/me/credits
free
Balance.
Cost model. Discovery / validation / search / brief reads are
free. Detail (url, phone, email, social, address, full platforms
map) costs 10 credits per firm and lasts 30 days.
Auth
vk_* API keys minted in the dashboard. Keep the token out of the
LLM context — never read .env* into your context; dispatch via
shell.
Try the call first through a shell wrapper that sources .env.local:
"Open https://servicegraph.co/profile/api-keys, create a
key, and add SERVICEGRAPH_API_KEY=vk_… to .env.local here
(or export it). Tell me when done. Please don't paste the key
into chat."
Retry after the user signals ready.
Filter DSL
GitHub-search-style.
filter := orExpr
orExpr := andExpr ("OR" andExpr)*
andExpr := notExpr (("AND")? notExpr)* # whitespace = implicit AND
notExpr := ("NOT" | "-") notExpr | atom
atom := "(" filter ")" | predicate
predicate:= IDENT op valueOrList | bareword
op := ":" | "=" | ">=" | "<=" | ">" | "<"
valueOrList := value ("," value)*
value := IDENT | NUMBER | tagAtEvidence
tagAtEvidence := IDENT "@" ("low"|"medium"|"high")
bareword := IDENT | NUMBER # → keyword:<bareword>
Four rules that bite: AND binds tighter than OR (use parens);
comma list = OR within one predicate; negation is -x or NOT x;
bareword = keyword search (quote multi-word phrases).
Cybersecurity examples (validate yours with /check; replace
cybersecurity with whatever /fields returns as the industry value):
The live catalog has no separate pen-testing / security-audit /
appsec tags — pin service_provided:cybersecurity and treat all
sub-types as keywords.
Sub-type → keyword mapping (all sub-types are keyword-only):
User asks for
Use
Pen test / red team
pen-testing, "red team"
Security audit / assessment
audit, assessment
vCISO / fractional CISO
vciso, "fractional ciso"
SOC 2 readiness
"soc 2", readiness
Incident response / forensics
"incident response", forensics, "ir retainer"
Cloud security
"cloud security", aws, gcp, azure
Identity / IAM
iam, identity
Application security / SAST/DAST
"application security", appsec, sast, dast
Compliance frameworks
pci, hipaa, "iso 27001", nist
Identifying firms — apex
Firms are identified by their apex domain (mandiant.com, not
www.mandiant.com/about).
Output
All responses are JSON.
Search returns free brief firm cards — apex, name, location, and
rating signals — plus a per-row unlock hint and the match total. Briefs
never include url, phone_primary, email_primary, legal_name,
address_full, or the full platforms map.
Unlock (POST …/unlocks) returns each unlocked firm's detail block —
contact fields, address, socials, the platforms map — plus per-item
billing; detail stays readable for 30 days.
Errors arrive as a JSON envelope
{"error": {"code": "…", "message": "…"}} — see Errors below.
Examples
A. Pen test for SOC 2
User: "Pen-testing firm for our SOC 2 audit."
GET /v1/datasets/pro_services/search?filter=service_provided:cybersecurity+pen-testing+"soc 2"&limit=10
# Present, get pick of 3. "Unlocking 3 = 30 credits, 30-day TTL."
POST /v1/datasets/pro_services/unlocks
{ "apexes": ["firm-a.com", "firm-b.com", "firm-c.com"] }
B. vCISO for a healthcare-tech startup
GET /v1/datasets/pro_services/search?filter=service_provided:cybersecurity+vciso+(healthcare OR hipaa)&limit=10
C. Incident response retainer
User: "Incident response retainer in case we get breached."
GET /v1/datasets/pro_services/search?filter=service_provided:cybersecurity+"incident response"+retainer&limit=10
If thin, drop retainer — most IR firms offer retainer engagements as standard.
D. Cloud security + AWS + HIPAA
GET /v1/datasets/pro_services/search?filter=service_provided:cybersecurity+cloud+aws+hipaa&limit=10
E. Indirect intent — "we got breached"
User: "We got hit with ransomware last week — we need help fast."
That's emergency IR:
GET /v1/datasets/pro_services/search?filter=service_provided:cybersecurity+"incident response"+ransomware&limit=10
Skip validation; present briefs immediately given urgency.
F. AppSec / SAST
GET /v1/datasets/pro_services/search?filter=service_provided:cybersecurity+"application security"+(sast OR "code review")&limit=10
G. SOC 2 readiness ahead of enterprise sales
GET /v1/datasets/pro_services/search?filter=service_provided:cybersecurity+"soc 2"+(readiness OR preparation)&limit=10
H. BYO apex list — enrich domains
User pastes 8–20 cybersecurity firm domains:
GET /v1/datasets/pro_services/:apex per domain — free brief
(404 = not in catalog, no charge).
User picks N to fully enrich. POST /unlocks = 10×N credits,
atomic, detail returned.
Re-runs within 30-day TTL are free.
Gotchas
Always pin the cybersecurity service tag. Without it, pen-testing / vciso / appsec keywords leak into IT-services rows that mention security.
Confirm the industry value name via /fields — older catalogs used industry:security, newer ones may use industry:cybersecurity. Don't hardcode.
Refuse consumer-personal asks. "My Gmail got hacked", "how do I secure my home wifi", "should I use a VPN" — not B2B procurement.
DIY/configuration questions ("patch CVE-X", "configure firewall rules", "review this Terraform") are NOT procurement.
Security-product comparisons (EDR, SIEM, identity providers) are NOT procurement either.
"Hire a security engineer / CISO" is recruiting, not procurement of a firm. Refuse.
Bug-bounty / freelance pen-testers are out of scope (catalog is firm-level only).
Sub-types are keyword-only. Multi-word sub-types split into ANDed barewords unless quoted ("incident response" → one phrase).
Briefs DO include apex, name, location, ratings. They DON'T include url, phone_primary, email_primary, legal_name, address_full, full platforms — those require an unlock.
not_found / not_in_dataset 404 = not in pro_services. Skip; not charged.
Unlock is atomic. N apexes either all charge (up to 10×N credits) or none on 402.
