Find Cybersecurity Firm

What it does

When your agent uses it

• The user wants to find
• Enrich US cybersecurity firms — pen-testing/red team
• Security audits
• SOC 2 readiness

Example prompts

• “find me a pen-testing firm for our SOC 2 audit”
• “shortlist three vCISO services for our healthcare-tech startup”
• “we need an incident response retainer”
• “/find-cybersecurity-firm”

Requirements

• A credential in SERVICEGRAPH_API_KEY
• Compatibility (from SKILL.md): Designed for Claude Code
• Pre-approved tools (allowed-tools): Bash(curl:*), mcp__servicegraph__list_fields, mcp__servicegraph__list_field_values, mcp__servicegraph__check_filter, mcp__servicegraph__translate_intent, mcp__servicegraph__search_dataset, mcp__servicegraph__get_row, mcp__servicegraph__unlock_rows, mcp__servicegraph__get_credit_balance

Workflow steps

7 steps, taken from the first numbered list in SKILL.md.

1. 1Pick the call path — the ServiceGraph MCP tools if loaded, otherwise the
2. 2GET /v1/datasets/pro_services/fields?include_values=1 — confirm the
3. 3Build the filter (Filter DSL below) and validate it with
4. 4GET /v1/datasets/pro_services/search — present the free brief cards and
5. 5Quote the unlock cost (10 credits per row, 30-day TTL) and get an explicit
6. 6POST /v1/datasets/pro_services/unlocks with the chosen apexes; report the
7. 7GET /v1/me/credits to report the remaining balance when asked.

What it can do on your machine

Read from SKILL.md and the folder at commit cfae287. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves these tools, so the agent can use them without asking each time:

  • Bash(curl:*)
  • mcp__servicegraph__list_fields
  • mcp__servicegraph__list_field_values
  • mcp__servicegraph__check_filter
  • mcp__servicegraph__translate_intent
  • mcp__servicegraph__search_dataset
  • mcp__servicegraph__get_row
  • mcp__servicegraph__unlock_rows
  • mcp__servicegraph__get_credit_balance

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Shell commands in SKILL.md call:

  • curl

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  Hosts in commands or code, which the agent is likely to contact:

  • api.servicegraph.co
  • mcp.servicegraph.co

  Also links to:

  • servicegraph.co
  • github.com

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names these keys or tokens, usually read from environment variables:

  • SERVICEGRAPH_API_KEY

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

• Compatibility

  Designed for Claude Code

  From compatibility in the SKILL.md frontmatter.

Context cost

Find Cybersecurity Firm loads about 3.7k tokens when it runs. Until then it costs about 249 tokens; SKILL.md has 1,259 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~249

When it runs · the whole SKILL.md, loaded when a task matches

~3.7k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

• NoteMentions a .env fileSKILL.md:67

  ICEGRAPH_API_KEY` in the environment or `.env.local` for the REST

• NoteMentions a .env fileSKILL.md:119

  LLM context** — never read `.env*` into your context; dispatch via

• NoteMentions a .env fileSKILL.md:122

  ** through a shell wrapper that sources `.env.local`:

• NoteMentions a .env fileSKILL.md:125

  ( set -a; [ -f .env.local ] && . ./.env.local; set +a;

• NoteMentions a .env fileSKILL.md:133

  and add `SERVICEGRAPH_API_KEY=vk_…` to `.env.local` here

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from jeremylongshore/tons-of-skills-marketplace at commit cfae287, republished under its MIT licence (© jeremylongshore). 1,259 words, ~3,651 tokens.

name

find-cybersecurity-firm

description

Use whenever the user wants to find, shortlist, vet, or enrich US cybersecurity firms — pen-testing/red team, security audits, vCISO, SOC 2 readiness, incident response, managed SOC, IAM, cloud security, and AppSec. Triggers on "find me a pen-testing firm for our SOC 2 audit", "shortlist three vCISO services for our healthcare-tech startup", "we need an incident response retainer", or "pull contact info for these 8 security firm domains", even when described indirectly (we got breached, prepare us for the compliance audit, get us SOC 2 ready). Drives the ServiceGraph API (api.servicegraph.co) — a 100k+ US firm catalog filterable by industry, services, location, size, ratings. Skip in-house security hires, "how do I patch CVE-X" or "configure firewall Y" DIY questions, security-product reviews (CrowdStrike vs SentinelOne, etc.), generic security knowledge questions, consumer/personal security advice, non-US firms, individual freelancers and bug-bounty hunters.

allowed-tools

Bash(curl:*), mcp__servicegraph__list_fields, mcp__servicegraph__list_field_values, mcp__servicegraph__check_filter, mcp__servicegraph__translate_intent, mcp__servicegraph__search_dataset, mcp__servicegraph__get_row, mcp__servicegraph__unlock_rows, mcp__servicegraph__get_credit_balance

compatibility

Designed for Claude Code

version

0.3.0

author

Artur Briugeman <artur@nostr.band>

license

MIT

tags

cybersecurity, service-providers, lead-generation, b2b, servicegraph

metadata.api_base

https://api.servicegraph.co

metadata.dataset_id

pro_services

metadata.service

cybersecurity

filter   := orExpr
orExpr   := andExpr ("OR" andExpr)*
andExpr  := notExpr (("AND")? notExpr)*    # whitespace = implicit AND
notExpr  := ("NOT" | "-") notExpr | atom
atom     := "(" filter ")" | predicate
predicate:= IDENT op valueOrList | bareword
op       := ":" | "=" | ">=" | "<=" | ">" | "<"
valueOrList := value ("," value)*
value    := IDENT | NUMBER | tagAtEvidence
tagAtEvidence := IDENT "@" ("low"|"medium"|"high")
bareword := IDENT | NUMBER          # → keyword:<bareword>

industry:cybersecurity service_provided:cybersecurity
service_provided:cybersecurity pen-testing
service_provided:cybersecurity "security audit" "soc 2"
service_provided:cybersecurity vciso
service_provided:cybersecurity "incident response" retainer
service_provided:cybersecurity cloud aws
service_provided:cybersecurity "application security" sast
service_provided:cybersecurity rating>=4 has:clutch
service_provided:cybersecurity hipaa

GET /v1/datasets/pro_services/search?filter=service_provided:cybersecurity+pen-testing+"soc 2"&limit=10
# Present, get pick of 3. "Unlocking 3 = 30 credits, 30-day TTL."
POST /v1/datasets/pro_services/unlocks
  { "apexes": ["firm-a.com", "firm-b.com", "firm-c.com"] }

GET /v1/datasets/pro_services/search?filter=service_provided:cybersecurity+vciso+(healthcare OR hipaa)&limit=10

GET /v1/datasets/pro_services/search?filter=service_provided:cybersecurity+"incident response"+retainer&limit=10

GET /v1/datasets/pro_services/search?filter=service_provided:cybersecurity+cloud+aws+hipaa&limit=10

GET /v1/datasets/pro_services/search?filter=service_provided:cybersecurity+"incident response"+ransomware&limit=10

GET /v1/datasets/pro_services/search?filter=service_provided:cybersecurity+"application security"+(sast OR "code review")&limit=10

GET /v1/datasets/pro_services/search?filter=service_provided:cybersecurity+"soc 2"+(readiness OR preparation)&limit=10

GET /v1/datasets/pro_services/fields?include_values=1
GET /v1/datasets/pro_services/check?filter=service_provided:cybersecurity+pen-testing+"soc 2"+hipaa+rating>=4
GET /v1/datasets/pro_services/search?filter=...&limit=10
# Present briefs. "Unlocking 3 = 30 credits, 30-day TTL."
POST /v1/datasets/pro_services/unlocks
  { "apexes": ["firm-a.com", "firm-b.com", "firm-c.com"] }
GET /v1/me/credits

© jeremylongshore, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in plugins/mcp/servicegraph/skills/find-cybersecurity-firm of jeremylongshore/tons-of-skills-marketplace.

Open the folder on GitHubat commit cfae287