EXTENSIONS

Read fantasy league state from the Sleeper platform's public read-only API — no key, no OAuth, no write surface. Resolve a username to a user ID, list leagues and drafts, and read a league in depth: settings and scoring, rosters with owners joined and standings derived, weekly matchups paired head to head, the transaction log, traded picks, playoff brackets, the draft board, and league-wide add/drop trends. Player IDs are resolved to names from a locally cached catalogue, and a missing record (which Sleeper reports as HTTP 200 with a null body) fails loudly instead of reading as empty.

Broad Microsoft Graph extension — nine model types over one shared app-only client: calendar (room/user calendarView, current/next meeting), places (room resources), users (Entra directory reads, manager, memberOf), groups, mail (Outlook messages), teams (chats/teams/channels/messages), presence, sharepoint (document-library navigation, search, and file download, working under either Sites.Read.All or Sites.Selected), and intune (enrolled devices, compliance policies, configuration profiles and settings catalog, remediation scripts, confirmation-gated device actions, and async report exports). Token caching, automatic paging, and a raw-bytes downloader; app credentials supplied from a vault. Supersedes the narrow ms-graph-calendar and absorbs azure-ad-user's lookup.

Cisco RoomOS device and macro management via Webex Control Hub — device inventory, health checks, workspace management, xAPI command execution, status queries, configuration management, macro lifecycle (save, activate, deploy, fleet push), and MTR-aware operations. Vault-based credential resolution.

Pexip Infinity v39 management and development — conference lifecycle, node deployment, platform administration, integrations, policy server development, event-driven automation, branding, client API, auth/RBAC, network infrastructure, licensing, recording, diagnostics, and Exchange calendar connectors.

Read and administer an Apple Business Manager organization over the Apple Business API. OAuth 2 client-credentials auth with an ES256 JWT client assertion signed in WebCrypto — no JWT library, no native dependencies — with in-process token caching, 429 and 5xx retry honouring Retry-After, and automatic re-mint on a mid-flight 401. Accepts the private key whether it is PKCS#8 or SEC1, detected from the DER rather than the PEM label, because Apple issues a PKCS#8 key under EC PRIVATE KEY armour. Roll the whole organization up in one call — devices tallied by product family, status, and purchase source alongside the device management service inventory. Sweep devices, device management services, blueprints, configurations, users, user groups, organizational units, apps, and packages, each fully paged through links.next and filterable client-side with a CEL selector since the API offers no server-side filtering. Drill into a single device, its AppleCare coverage, its assigned management service, or an enrolled device's OS, storage, FileVault, firewall, lock, and erase state. Assign and unassign devices to a device management service as one batched activity and poll it to completion, read the organization audit log over a time window, and reach any unwrapped endpoint through an authenticated passthrough. Works against Apple School Manager by pointing apiBaseUrl at api-school.apple.com and setting the scope to school.api.

Microsoft Purview compliance-portal RBAC — role groups, their constituent management roles, membership, and the eDiscovery Administrator list, over Security & Compliance PowerShell. Exists because eDiscovery permission is invisible from Entra: Global Administrator maps to OrganizationManagement, which carries Case Management, Compliance Search, Hold and Search And Purge but not Export, Preview, Review, RMS Decrypt or Custodian, so a tenant admin can run a search yet be unable to export a single item. auditPrincipals separates canSearch from canExport and flags eDiscovery Administrators, who can open every case in the tenant. Carries its own credential surface because the compliance endpoint rejects Azure CLI tokens regardless of user.

Azure infrastructure management via az CLI — 43 model types covering compute, networking, data, security, RBAC, Azure Policy, Defender for Cloud, Entra directory, monitoring, DNS, DevOps, Azure AI Foundry (accounts, model deployments, projects, quota), AI Search, Cosmos DB, PostgreSQL Flexible Server, Static Web Apps, Service Bus, Event Grid, Recovery Services, Log Analytics, subscription-wide topology with Mermaid diagrams and cost estimation, actual-spend cost analysis and waste auditing via Cost Management/Resource Graph/Advisor, and the Azure AI Vision Face REST API for identity-aware room services.

Manage a ZEDEDA Cloud (ZEDCloud) tenant and the EVE-OS edge nodes it controls, over the ZEDCloud REST API. Bearer auth with a vault-resolved session token, plus a two-step token-exchange method for rotating it before its 90-day expiry. Read controller and tenant status, sweep the whole object graph in one fan-out inventory call, list and inspect edge nodes with fleet-wide health rollup, and read app instances, logs, events, and time-series metrics. Onboard nodes zero-touch by minting a single-use EVE-OS installer bound to one node, drive node lifecycle (activate, deactivate, reboot, prepare-power-off, offboard), open EdgeView remote-access sessions, run EVE-OS base image upgrades, deploy and control application instances, create node-local network instances, and reach any other endpoint through a generic authenticated passthrough.

Appspace Cloud v3 API administration toolkit — devices, reservations, users, visitors, and the custom card development lifecycle (scaffold, pull existing, validate, package, register instances). Walk-in workflows fire DropIn invitations through Appspace's native notification routing (Teams Passport, in-app push, Concierge) with no external webhook required.

OpenAI-powered document and webpage generation — analyze and enhance .pptx/.docx, design PDFs from natural language, compose decks from outlines using your own theme template, and generate self-contained HTML/CSS pages from reference designs via vision. Vault-based API key, headless Chromium for rendering.

ServiceNow integration model — OAuth client_credentials authentication with automatic token caching, generic Table API CRUD (query, get, create, update, delete), Aggregate API for data analysis, and a passthrough REST call for endpoints outside the Table API. Foundation for spoke development, administration, and ad-hoc operations against any ServiceNow instance.

On-brand slide deck pipeline for swamp: a workflow that renders a deck from a voiced brief and a design reference via openai-document.webpageDesign, plus a skill that guides authoring the copy in your writing-voice profile, pinning brand tokens, and converting the PDF to PPTX. Depends on the openai-document, writing-voice, and openai-image extensions.

Full OPNsense management via REST API — system status, interfaces, DNS, tunables, services, firmware/plugins, firewall states, DHCP leases, ARP table, Tailscale, WireGuard, and raw API passthrough. Replaces MCP server.

Manage a Cisco IOS switch (e.g. Catalyst 2960) over SSH after console bootstrap — capture running-config and device facts, run verification commands, and push idempotent baselines: secure-access hardening, SNMPv2c, and Layer-3/VLAN/access-port config. Shells out to OpenSSH; vault-resolved credentials; live reachability pre-flight check.

Wrap the Neat Pulse REST API to read Teams-Room device sensor data and enumerate the org's rooms and devices. Provides people count, temperature, humidity, CO2/air quality, occupancy, and privacy-shutter state from Neat Sense-capable devices (Neat Bar, Neat Bar Pro, Neat Board). Used as the room-sensor signal source in the Identity-Aware Room Services (IARS) meeting-agent. Requires Neat Pulse Plus or Pro plan. Credentials: api-token + org-id from the neat vault.

OpenAI image generation and editing via gpt-image-1 and DALL-E 3 — text-to-image generation, image editing with reference images, model selection, and configurable size and quality. Vault-based API key.

Image manipulation via ImageMagick and potrace — recolor, resize, format conversion, vector tracing, SVG rasterization, and compositing. Requires ImageMagick and potrace installed locally.

Query the Shodan internet-wide scan database to find and profile internet-exposed devices. Single API key resolved from vault. Read the account plan and remaining credits, run searches that return trimmed device records (IP, org, product, location, open port, CVEs) with facet rollups, count results without spending query credits, pull the full banner history for one IP, do keyless InternetDB lookups (ports, CPEs, tags, CVEs), and request on-demand scans of IPs you own. Built for AV/IoT exposure recon.

Organizational writing voice management — tone tiers, audience targeting, document type templates, anti-patterns, and kill-list enforcement for consistent client-facing communications.

Google Meet hardware device monitoring via Workspace Admin Reports API. Tracks device online/offline state, peripheral attach/detach (camera, mic, speaker, display, touch controller), call state (Meet, Teams, Webex, Zoom), power state, firmware updates, and restarts. Uses service account with domain-wide delegation — no interactive auth required.

Manage a NETGEAR M4250 (AV Line) managed switch over its SSH CLI — capture running-config and device facts, run verification show-commands (VLANs, ports, PoE, MAC table, LLDP, IGMP snooping), apply IGMP-querier and multicast-containment config, and force/restore a port's speed-duplex. Prompt-paced I/O for the M4250's interactive shell, vault-resolved credentials, shells out to OpenSSH.

Eero mesh WiFi management via cloud API — network health, per-node status, per-client band/signal/channel diagnostics, speed tests, settings management, and raw API passthrough. Reverse-engineered from the eero mobile app API.

OpenAI platform usage and cost reporting via the Organization Usage API — daily and total completion token counts and USD spend, month-to-date by default. Vault-based Admin API key (the api.usage.read scope is required; a standard project key cannot read usage).

Integrate with a CybrIQ (Sepio) asset-visibility / hardware-access-control platform over its REST + GraphQL API. Local-login bearer auth with vault-resolved credentials. Read the asset dashboard, inventory, device types, risk insights, switches, external scan engines (Netpollers), events, alarm destinations, policies, scopes, tags, and user attributes; create tags, user attributes, policies, and scopes; and reach any other endpoint through a generic authenticated passthrough.