servosity/msp-skills/cork

Cork - Claude Code Skill

Prerequisites: Install the CLI

This skill drives the cork-cli binary. You must verify the CLI is installed before invoking any command from this skill. If it is missing, install it first:

1. macOS / Linux:

``bash bash <(curl -fsSL https://raw.githubusercontent.com/Servosity/msp-skills/main/skills/cork/install.sh) ``

1. Windows (PowerShell):

``powershell iwr -useb https://raw.githubusercontent.com/Servosity/msp-skills/main/skills/cork/install.ps1 | iex ``

1. Verify: cork-cli --version
2. Ensure ~/.local/bin (macOS / Linux) or %LOCALAPPDATA%\Programs\msp-skills (Windows) is on $PATH.

The installer downloads the cork-cli and cork-mcp binaries into ~/.local/bin (macOS / Linux) or %LOCALAPPDATA%\Programs\msp-skills (Windows). It does not register the skill with your agent and writes no MCP client config - see mcp-install.md for that wire-up.

If --version reports "command not found" after install, the runtime cannot see the binary directory on $PATH. Do not proceed with skill commands until verification succeeds.

Cork tells you a client's risk score moved but never why, and offers no way to ask a question across your whole book of business. This CLI mirrors the API into local SQLite, then answers the questions that need history and fan-out: score attribute explains what drove a score change, score regressions ranks every client by how far they slipped, vulnerabilities triage orders patching by what is actually being exploited rather than by CVSS, and integrations health catches the connector that reports healthy while its data quietly went stale.

When to Use This CLI

Reach for this CLI when the question spans more than one Cork client or more than one point in time. It is the right tool for book-of-business risk triage, building a patch queue ordered by exploitability, auditing which connectors have silently stopped feeding data, and preparing warranty or QBR conversations backed by score history. It is also the right tool when an agent needs Cork data in structured form without paging through a web dashboard.

Anti-triggers

Do not use this CLI for:

• Do not use this CLI to provision distributor partners or push software installs; those endpoints mutate real customer environments and belong in a reviewed change process, not an agent loop
• Do not use import in an agent loop for any resource. import <resource> --input file.jsonl issues one POST per line into those same endpoints (import software -> /software/installer/install, import distributor -> /distributor/partners, import integrations -> /integrations) and, by its own help text, failed records are logged but do not stop the run. It is the bulk form of the two commands named above and carries their blast radius; preview with --dry-run and keep a human on it
• Do not use this CLI to retrieve or relay integration credentials; integrations credentials get-integration prints the endpoint's response verbatim with no redaction, and integrations raw-data get-integration returns a presigned URL that downloads the connector's full raw data with no further auth. Both are reads whose output IS the secret - keep them out of any blanket allow-all-reads policy
• Do not use this CLI as a substitute for the Cork web platform when configuring integrations or editing notification settings interactively
• Do not use this CLI for security advisories or CVE metadata in general; it only knows about CVEs Cork has already associated with your fleet, so pair it with a vulnerability database for research

Unique Capabilities

Risk that compounds locally

• `score attribute` - Explain why a client's Cork score moved, broken out by claims, compliance, coverage, and vulnerability impact.

_Reach for this when someone asks why a client got worse, instead of pulling raw score points and eyeballing a trend._

``bash cork-cli score attribute 00000000-0000-0000-0000-000000000000 --since 30d --agent ``

• `score regressions` - Rank every client by score change over a window, worst movers first.

_Use this to open a book-of-business review; it answers 'who moved backwards' in one call instead of one call per client._

``bash cork-cli score regressions --since 7d --min-drop 10 --agent ``

Exploitability over CVSS

• `vulnerabilities triage` - Rank software products by exploitability (known-exploited first, then EPSS, then CVSS) with a blast-radius device count and client names resolved.

_Pick this over a raw vulnerability list when deciding what to patch first. Live-only: Cork's vulnerability rows carry no id so they cannot be mirrored locally, --limit counts products rather than individual findings, and a capped scan sets scan_cap_hit._

``bash cork-cli vulnerabilities triage --kev-only --min-epss 0.3 --limit 25 --agent ``

• `vulnerabilities exposure` - List every affected client, device, product, and version for a single CVE id.

_Use this the moment a specific CVE is named in an advisory or a client email; it is the only way to answer 'are we exposed'. Exit 3 means the scan succeeded and found no exposure, which is a negative answer rather than a failure. Live-only: vulnerability rows carry no id so there is no local mirror to read, and a capped scan sets scan_cap_hit, which is explicitly not a clean bill of health._

``bash cork-cli vulnerabilities exposure CVE-2026-1234 --agent ``

Data you can actually trust

• `compliance overdue` - Surface compliance events that have blown their event type's remediation window, bucketed by age.

_Choose this over listing a client's events when you need the ones that are actively costing score, ordered by how late they are._

``bash cork-cli compliance overdue --bucket --agent ``

• `integrations health` - Flag connectors that are down, degraded, or reporting healthy while their last sync has gone stale, and name the clients they feed.

_Run this before trusting any risk number; a silently stale connector makes every downstream score fiction._

``bash cork-cli integrations health --stale-after 24h --agent ``

• `coverage gaps` - Diff the devices a connector reports against the devices attributed to the client to expose endpoints one tool sees and another misses.

_Use this during onboarding verification or when coverage impact is dragging a score and you need the specific unmonitored endpoints. Exit 3 means there were no connector devices to diff, a negative answer rather than a failure; the command refuses outright rather than reporting gaps against a device baseline it could not read._

``bash cork-cli coverage gaps --client 00000000-0000-0000-0000-000000000000 --agent ``

• `compliance exclusions-due` - List compliance exclusions and silenced alert rules whose review date has passed or that are flagged for review, across every client, oldest first.

_Run this before a compliance review or QBR: an exclusion nobody re-reviewed is a risk the score silently stopped counting. Live fan-out over clients; a capped scan sets scan_cap_hit and is not a clean bill of health._

``bash cork-cli compliance exclusions-due --agent ``

Commercial signal

• `warranties exposure` - Rank unwarranted or lapsed clients by current risk so coverage conversations start with the ones that need it most.

_Reach for this when preparing commercial outreach, rather than listing warranties and cross-checking risk by hand._

``bash cork-cli warranties exposure --limit 20 --agent ``

Command Reference

clients - Manage clients

• cork-cli clients - List clients with their financial protection status (warranty_status), associated integration tenants

compliance - Manage compliance

• cork-cli compliance get-event-notification-settings - List the notification and alerting rules configured for compliance events on client assets.
• cork-cli compliance get-event-types - List all compliance event types with their descriptions and cure periods.
• cork-cli compliance get-events - List policy violations and risk events detected for a client's assets.

distributor - Manage distributor

• cork-cli distributor get-partners - List partner sub-accounts managed by this distributor.
• cork-cli distributor provision-partner - Provision a new Partner account in the system. _note: Requires distributor privileges._

integrations - Manage integrations

• cork-cli integrations connect - Connect an API-based integration. This creates a new integration that will immediately begin syncing data.
• cork-cli integrations delete - Delete an integration and stop all data collection from it. _note: Only API-created integrations can be deleted._
• cork-cli integrations get-available - List integration types that can be connected to Cork, including required credential fields.
• cork-cli integrations get-connected - List integrations that have been connected to Cork, including their vendor, connection status, and sync details.
• cork-cli integrations update - Update an API-created integration's display name and/or credentials.

invoices - Manage invoices

• cork-cli invoices - List billing invoices. Returns invoice UUIDs required by Get Invoice Line Items.

me - Manage me

• cork-cli me - Information on the authenticated user

software - Manage software

• cork-cli software get-installer-history - List past software install attempts (most recent first) with their dispatch state, target client/device, package
• cork-cli software get-installer-setup - Get the one-time setup steps for an RMM vendor that requires manual setup before software installs work.
• cork-cli software get-packages - List software packages available to install across supported package managers (WinGet, Chocolatey).
• cork-cli software install - Install a software package on a single mapped device via the device's RMM integration.

vulnerabilities - Manage vulnerabilities

• cork-cli vulnerabilities get-software - List individual software vulnerabilities with full CVE details including CVSS score, EPSS score, KEV (known exploited)
• cork-cli vulnerabilities get-software-vulnerability-summary - Get a rollup of CVEs grouped by software product, showing number of impacted devices, impacted versions

warranties - Manage warranties

• cork-cli warranties - List active cyber warranty packages.

compliance

• cork-cli compliance overdue - Surface compliance events that have blown their event type's remediation window, bucketed by age.

• cork-cli compliance exclusions-due - List compliance exclusions and silenced alert rules whose review date has passed or that are flagged for review, across every client, oldest first.

coverage

• cork-cli coverage gaps - Diff the devices a connector reports against the devices attributed to the client to expose endpoints one tool sees and another misses.

integrations

• cork-cli integrations health - Flag connectors that are down, degraded, or reporting healthy while their last sync has gone stale, and name the clients they feed.

score

• cork-cli score attribute - Explain why a client's Cork score moved, broken out by claims, compliance, coverage, and vulnerability impact.

• cork-cli score regressions - Rank every client by score change over a window, worst movers first.

vulnerabilities

• cork-cli vulnerabilities triage - Rank software products by exploitability (known-exploited first, then EPSS, then CVSS) with a blast-radius device count and client names resolved.

• cork-cli vulnerabilities exposure - List every affected client, device, product, and version for a single CVE id.

warranties

• cork-cli warranties exposure - Rank unwarranted or lapsed clients by current risk so coverage conversations start with the ones that need it most.

Finding the right command