Blackpoint Cyber API Patterns — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Blackpoint Cyber API Patterns (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Blackpoint Cyber is a managed detection and response (MDR) provider. The CompassOne portal exposes a partner-tenant-asset hierarchy: a partner (the MSP) sees many tenants (their customers), each tenant has many assets (endpoints, identities, cloud accounts), and detections / vulnerabilities are produced against those assets.
Blackpoint uses an API token passed via header. CompassOne issues the token in the partner portal.
| Header | Value |
|---|---|
X-Blackpoint-Api-Token | The raw CompassOne token |
The gateway maps the environment variable BLACKPOINT_API_TOKEN onto the X-Blackpoint-Api-Token header automatically. Internally, the Blackpoint MCP server forwards this to CompassOne as a Bearer token — you do not need to add the Bearer prefix yourself.
export BLACKPOINT_API_TOKEN="your-compassone-token"Optional: BLACKPOINT_BASE_URL overrides the CompassOne base URL for regional or partner-specific deployments.
Partner (MSP)
└── Tenant (customer)
└── Asset (endpoint / identity / cloud account)
└── Detections / VulnerabilitiesAlways pivot top-down: identify the tenant first, then drill into assets, then look at detections/vulnerabilities for that asset.
| Tool | Purpose |
|---|---|
blackpoint_navigate | Discover available domains |
blackpoint_back | Pop back to the prior context |
blackpoint_status | Health/status check |
Tools follow blackpoint_<domain>_<action>. Currently functional domains:
tenantsassetsdetectionsvulnerabilitiesAdditional domains (alerts, cloud security, notifications, partners, threat intel, tickets) are stubbed in the MCP server but not yet implemented — do not call those.
Blackpoint list endpoints use page/limit-style pagination. Always check whether more pages exist before claiming a result is complete, especially for detections and vulnerabilities — those can run into the thousands.
| Status | Meaning | Action |
|---|---|---|
| 401 | Bad/missing Bearer token | Re-check BLACKPOINT_API_TOKEN |
| 403 | Token valid but no access to the requested tenant | Check partner-tenant scoping |
| 404 | Unknown tenant / asset / detection | Re-list to confirm |
| 429 | Rate limit | Back off and retry |
assets and detections together — a detection without its asset context is hard to action.
blackpoint_tenants_list first and then drill in per-tenant.
yet. Any "respond to detection" workflow must happen in the CompassOne portal itself.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.