EXTENSIONS

Webflow extension — Data API v2 site publishing, CMS collection schema discovery, CMS item CRUD with batch create/update/delete/publish, live-item read/create/update/unpublish, page metadata with SEO/Open Graph management, paginated and localized page DOM read/write, merge-safe page custom code, and JSON-LD structured data; plus an MCP-backed designer model for headless page creation, element building, style writes and CMS field bindings through Webflow's hosted MCP server, with OAuth refresh-token rotation persisted to a vault.

Administer an Apple Developer Program team over the App Store Connect API. Team-key auth with an ES256 JWT signed in WebCrypto (no JWT library, no native dependencies), cached in-process and re-signed near its 20-minute limit, with 429 and 5xx retry honouring Retry-After and a re-sign on a mid-flight 401. Roll the whole team up in one call: members by role, pending invitations, devices by class and status, and every certificate or provisioning profile that has expired or expires within a window, which catches the lapsed development profile that makes a tvOS or iOS app silently refuse to launch. Invite people with roles and the Certificates, Identifiers & Profiles permission, cancel invitations, change a member's roles, and register development devices by UDID. List users, invitations, devices, certificates, profiles, and bundle IDs, fully paged and filterable with a CEL selector, with daysToExpiry computed on anything that expires. Reach any unwrapped endpoint through an authenticated passthrough.

Pointr Cloud v10 content API toolkit for indoor maps and wayfinding. Authenticates with the license-key client-credentials grant or a Pointr Cloud user (password grant), and records the token's roles and permissions without storing the token. Lists sites, buildings and levels, indexes POIs by scope with external ids and centroids, reads features and published version stamps, and reads webhook configurations and deliveries. Pairs POIs with rooms, desks or other resources from any booking or directory system, as POI external ids or as a link list an application keeps. Feature upserts (PUT only, never the destructive POST replace), external-id assignment and site publishing are dry-run by default.

Appspace Cloud v3 API administration toolkit — devices, reservations, users, visitors, and the custom card development lifecycle (scaffold, pull existing, validate, package, register instances). Walk-in workflows fire DropIn invitations through Appspace's native notification routing (Teams Passport, in-app push, Concierge) with no external webhook required.

Microsoft Purview compliance-portal RBAC — role groups, their constituent management roles, membership, and the eDiscovery Administrator list, over Security & Compliance PowerShell. Exists because eDiscovery permission is invisible from Entra: Global Administrator maps to OrganizationManagement, which carries Case Management, Compliance Search, Hold and Search And Purge but not Export, Preview, Review, RMS Decrypt or Custodian, so a tenant admin can run a search yet be unable to export a single item. auditPrincipals separates canSearch from canExport and flags eDiscovery Administrators, who can open every case in the tenant. Carries its own credential surface because the compliance endpoint rejects Azure CLI tokens regardless of user.

Utelogy AV monitoring platform — rooms with CLM status and metrics, assets with driver/feature inventory, alerts with acknowledgement, and Global Device Library search. REST API integration with vault-based credentials.

Pexip Infinity v39 management and development — conference lifecycle, node deployment, platform administration, integrations, policy server development, event-driven automation, branding, client API, auth/RBAC, network infrastructure, licensing, recording, diagnostics, and Exchange calendar connectors.

ServiceNow integration model — OAuth client_credentials authentication with automatic token caching, generic Table API CRUD (query, get, create, update, delete), Aggregate API for data analysis, Attachment API (list, download, upload, delete), and a passthrough REST call for endpoints outside the Table API. Foundation for spoke development, administration, and ad-hoc operations against any ServiceNow instance.

OpenAI platform usage and cost reporting via the Organization Usage API — daily and total completion token counts, embeddings/moderations/images/audio usage, and USD spend, month-to-date by default, optionally grouped and filtered by project, model, API key, or cost line item. Vault-based Admin API key (the api.usage.read scope is required; a standard project key cannot read usage).

Query the Shodan internet-wide scan database to find and profile internet-exposed devices. Single API key resolved from vault. Read the account plan and remaining credits, run searches that return trimmed device records (IP, org, product, location, open port, CVEs) with facet rollups, count results without spending query credits, pull the full banner history for one IP, do keyless InternetDB lookups (ports, CPEs, tags, CVEs), request on-demand scans of IPs you own, and poll their status. Built for AV/IoT exposure recon.

Read fantasy league state from the Sleeper platform's public read-only API — no key, no OAuth, no write surface. Resolve a username to a user ID, list leagues and drafts, and read a league in depth: settings and scoring, rosters with owners joined and standings derived, weekly matchups paired head to head, the transaction log, traded picks (league-wide and per draft), playoff brackets, the draft board, and league-wide add/drop trends. Player IDs are resolved to names from a locally cached catalogue, and a missing record (which Sleeper reports as HTTP 200 with a null body) fails loudly instead of reading as empty.

OpenAI image generation and editing via OpenAI's GPT image models (defaults gpt-image-2.5-flare for generation, gpt-image-2.5-sunburst for edits) — text-to-image generation, image editing with reference images, free-form model selection with pass-through for newer models, per-model size and quality validation, and local refusal of shut-down models. Vault-based API key.

GoDaddy Domains API toolkit authenticated with a Personal Access Token (Bearer gd_pat_). Read the domain portfolio and full registration detail (transfer authCode always stripped, contacts opt-in), list DNS records by zone, type, or type and name, check availability in bulk, get name suggestions and the TLD catalogue, and read the account's monthly API usage. DNS add, replace, and delete methods are dry-run by default and record a before/planned/after change set. No purchase, renewal, transfer, contact, or privacy operations.

Azure infrastructure management via az CLI — 43 model types covering compute, networking, data, security, RBAC, Azure Policy, Defender for Cloud, Entra directory, monitoring, DNS, DevOps, Azure AI Foundry (accounts, model deployments, projects, quota), AI Search, Cosmos DB, PostgreSQL Flexible Server, Static Web Apps, Service Bus, Event Grid, Recovery Services, Log Analytics, subscription-wide topology with Mermaid diagrams and cost estimation, actual-spend cost analysis and waste auditing via Cost Management/Resource Graph/Advisor, and the Azure AI Vision Face REST API for identity-aware room services.

Broad Microsoft Graph extension — nine model types over one shared app-only client: calendar (room/user calendarView, current/next meeting), places (room resources), users (Entra directory reads, manager, memberOf), groups, mail (Outlook messages), teams (chats/teams/channels/messages), presence, sharepoint (document-library navigation, search, and file download, working under either Sites.Read.All or Sites.Selected), and intune (enrolled devices, compliance policies, configuration profiles and settings catalog, remediation scripts, confirmation-gated device actions, and async report exports). Token caching, automatic paging, and a raw-bytes downloader; app credentials supplied from a vault. Supersedes the narrow ms-graph-calendar and absorbs azure-ad-user's lookup.

Cisco RoomOS device and macro management via Webex Control Hub — device inventory, health checks, workspace management, xAPI command execution, status queries, configuration management, macro lifecycle (save, activate, deploy, fleet push), and MTR-aware operations. Vault-based credential resolution.

Read and administer an Apple Business Manager organization over the Apple Business API. OAuth 2 client-credentials auth with an ES256 JWT client assertion signed in WebCrypto — no JWT library, no native dependencies — with in-process token caching, 429 and 5xx retry honouring Retry-After, and automatic re-mint on a mid-flight 401. Accepts the private key whether it is PKCS#8 or SEC1, detected from the DER rather than the PEM label, because Apple issues a PKCS#8 key under EC PRIVATE KEY armour. Roll the whole organization up in one call — devices tallied by product family, status, and purchase source alongside the device management service inventory. Sweep devices, device management services, blueprints, configurations, users, user groups, organizational units, apps, and packages, each fully paged through links.next and filterable client-side with a CEL selector since the API offers no server-side filtering. Drill into a single device, its AppleCare coverage, its assigned management service, or an enrolled device's OS, storage, FileVault, firewall, lock, and erase state. Assign and unassign devices to a device management service as one batched activity and poll it to completion, read the organization audit log over a time window, and reach any unwrapped endpoint through an authenticated passthrough. Works against Apple School Manager by pointing apiBaseUrl at api-school.apple.com and setting the scope to school.api.

Manage a ZEDEDA Cloud (ZEDCloud) tenant and the EVE-OS edge nodes it controls, over the ZEDCloud REST API. Bearer auth with a vault-resolved session token, plus a two-step token-exchange method for rotating it before its 90-day expiry. Read controller and tenant status, sweep the whole object graph in one fan-out inventory call, list and inspect edge nodes with fleet-wide health rollup, and read app instances, logs, events, and time-series metrics. Onboard nodes zero-touch by minting a single-use EVE-OS installer bound to one node, drive node lifecycle (activate, deactivate, reboot, prepare-power-off, offboard), open EdgeView remote-access sessions, run EVE-OS base image upgrades, deploy and control application instances, create node-local network instances, and reach any other endpoint through a generic authenticated passthrough.

OpenAI-powered document and webpage generation — analyze and enhance .pptx/.docx, design PDFs from natural language, compose decks from outlines using your own theme template, and generate self-contained HTML/CSS pages from reference designs via vision. Vault-based API key, headless Chromium for rendering.

On-brand slide deck pipeline for swamp: a workflow that renders a deck from a voiced brief and a design reference via openai-document.webpageDesign, plus a skill that guides authoring the copy in your writing-voice profile, pinning brand tokens, and converting the PDF to PPTX. Depends on the openai-document, writing-voice, and openai-image extensions.

Full OPNsense management via REST API — system status, interfaces, DNS, tunables, services, firmware/plugins, firewall states, DHCP leases, ARP table, Tailscale, WireGuard, and raw API passthrough. Replaces MCP server.

Manage a Cisco IOS switch (e.g. Catalyst 2960) over SSH after console bootstrap — capture running-config and device facts, run verification commands, and push idempotent baselines: secure-access hardening, SNMPv2c, and Layer-3/VLAN/access-port config. Shells out to OpenSSH; vault-resolved credentials; live reachability pre-flight check.

Wrap the Neat Pulse REST API to read Teams-Room device sensor data and enumerate the org's rooms and devices. Provides people count, temperature, humidity, CO2/air quality, occupancy, and privacy-shutter state from Neat Sense-capable devices (Neat Bar, Neat Bar Pro, Neat Board). Used as the room-sensor signal source in the Identity-Aware Room Services (IARS) meeting-agent. Requires Neat Pulse Plus or Pro plan. Credentials: api-token + org-id from the neat vault.

Image manipulation via ImageMagick and potrace — recolor, resize, format conversion, vector tracing, SVG rasterization, and compositing. Requires ImageMagick and potrace installed locally.