Amgen Capabilities

Submits a clinical study report from Veeva Vault to OpenAI for summarization and stores the structured summary back in SharePoint for regulatory affairs teams.

naftiko: "0.5"
info:
  label: "AI Document Summarization for Clinical Reports"
  description: "Submits a clinical study report from Veeva Vault to OpenAI for summarization and stores the structured summary back in SharePoint for regulatory affairs teams."
  tags:
    - ai
    - clinical-trials
    - veeva
    - openai
    - sharepoint
capability:
  exposes:
    - type: mcp
      namespace: ai-clinical
      port: 8080
      tools:
        - name: summarize-clinical-report
          description: "Given a Veeva Vault document ID for a clinical report, retrieve the document, submit it to OpenAI for a structured summary, and store the result in SharePoint."
          inputParameters:
            - name: vault_doc_id
              in: body
              type: string
              description: "The Veeva Vault document ID for the clinical study report."
            - name: sharepoint_site_id
              in: body
              type: string
              description: "The SharePoint site ID where the summary should be stored."
          steps:
            - name: get-vault-document
              type: call
              call: "veeva-ai.get-document"
              with:
                doc_id: "{{vault_doc_id}}"
            - name: generate-summary
              type: call
              call: "openai.create-completion"
              with:
                model: "gpt-4o"
                prompt: "Summarize the following clinical study report in structured format with sections for Objective, Methods, Results, and Conclusion: {{get-vault-document.content}}"
            - name: store-summary
              type: call
              call: "sharepoint-ai.create-file"
              with:
                site_id: "{{sharepoint_site_id}}"
                file_name: "summary_{{vault_doc_id}}.txt"
                content: "{{generate-summary.text}}"
  consumes:
    - type: http
      namespace: veeva-ai
      baseUri: "https://amgen.veevavault.com/api/v23.1"
      authentication:
        type: bearer
        token: "$secrets.veeva_vault_token"
      resources:
        - name: documents
          path: "/objects/documents/{{doc_id}}"
          inputParameters:
            - name: doc_id
              in: path
          operations:
            - name: get-document
              method: GET
    - type: http
      namespace: openai
      baseUri: "https://api.openai.com/v1"
      authentication:
        type: bearer
        token: "$secrets.openai_api_key"
      resources:
        - name: completions
          path: "/chat/completions"
          operations:
            - name: create-completion
              method: POST
    - type: http
      namespace: sharepoint-ai
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: drive-items
          path: "/sites/{{site_id}}/drive/items/root:/{{file_name}}:/content"
          inputParameters:
            - name: site_id
              in: path
            - name: file_name
              in: path
          operations:
            - name: create-file
              method: PUT

Retrieves Azure AD group memberships for a user.

naftiko: "0.5"
info:
  label: "Azure AD Group Membership Lookup"
  description: "Retrieves Azure AD group memberships for a user."
  tags:
    - security
    - identity
    - azure-active-directory
capability:
  exposes:
    - type: mcp
      namespace: ad-groups
      port: 8080
      tools:
        - name: get-user-groups
          description: "Given a UPN, return Azure AD group memberships. Use when IT audits user group assignments."
          inputParameters:
            - name: user_upn
              in: body
              type: string
              description: "User principal name."
          call: azure-ad.get-member-of
          with:
            upn: "{{user_upn}}"
          outputParameters:
            - name: group_count
              type: integer
              mapping: "$.value.length"
  consumes:
    - type: http
      namespace: azure-ad
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.azure_ad_token"
      resources:
        - name: users
          path: "/users/{{upn}}/memberOf"
          inputParameters:
            - name: upn
              in: path
          operations:
            - name: get-member-of
              method: GET

Queries Azure Cost Management for current month spend by resource group.

naftiko: "0.5"
info:
  label: "Azure Resource Cost Lookup"
  description: "Queries Azure Cost Management for current month spend by resource group."
  tags:
    - it
    - cloud
    - microsoft-azure
capability:
  exposes:
    - type: mcp
      namespace: cloud-cost
      port: 8080
      tools:
        - name: get-resource-group-cost
          description: "Given an Azure resource group, return current month spend and budget utilization. Use when FinOps needs cost visibility."
          inputParameters:
            - name: resource_group
              in: body
              type: string
              description: "Azure resource group name."
          call: azure.get-cost-summary
          with:
            rg_name: "{{resource_group}}"
          outputParameters:
            - name: current_spend
              type: number
              mapping: "$.properties.rows[0].cost"
  consumes:
    - type: http
      namespace: azure
      baseUri: "https://management.azure.com"
      authentication:
        type: bearer
        token: "$secrets.azure_token"
      resources:
        - name: cost-management
          path: "/subscriptions/{{subscription_id}}/resourceGroups/{{rg_name}}/providers/Microsoft.CostManagement/query"
          inputParameters:
            - name: rg_name
              in: path
          operations:
            - name: get-cost-summary
              method: POST

When a serious adverse event is reported for a biologic therapy, logs it in the safety database, notifies pharmacovigilance, creates a regulatory filing task, and updates the CTMS.

naftiko: "0.5"
info:
  label: "Biologic Drug Adverse Event Reporting Orchestration"
  description: "When a serious adverse event is reported for a biologic therapy, logs it in the safety database, notifies pharmacovigilance, creates a regulatory filing task, and updates the CTMS."
  tags:
    - clinical
    - regulatory
    - safety
    - oracle
    - servicenow
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: drug-safety
      port: 8080
      tools:
        - name: report-adverse-event
          description: "Given a study ID, patient ID, event description, and severity, log the event, alert pharmacovigilance, create filing task, and update CTMS. Use when clinical sites report serious adverse events."
          inputParameters:
            - name: study_id
              in: body
              type: string
              description: "Clinical study identifier."
            - name: patient_id
              in: body
              type: string
              description: "Patient subject identifier."
            - name: event_description
              in: body
              type: string
              description: "Description of the adverse event."
            - name: severity
              in: body
              type: string
              description: "Severity: mild, moderate, severe, life-threatening."
          steps:
            - name: log-safety-event
              type: call
              call: oracle-argus.create-case
              with:
                study_id: "{{study_id}}"
                subject_id: "{{patient_id}}"
                description: "{{event_description}}"
                seriousness: "{{severity}}"
            - name: notify-pharmacovigilance
              type: call
              call: msteams.send-message
              with:
                channel_id: "pharmacovigilance"
                text: "SAE Alert - Study {{study_id}}, Patient {{patient_id}}: {{event_description}} ({{severity}}). Argus case: {{log-safety-event.case_number}}"
            - name: create-regulatory-task
              type: call
              call: servicenow.create-task
              with:
                short_description: "Regulatory SAE report - {{log-safety-event.case_number}}"
                category: "regulatory_filing"
                priority: "1"
                assigned_group: "Drug_Safety"
  consumes:
    - type: http
      namespace: oracle-argus
      baseUri: "https://amgen-argus.oracle.com/api/v2"
      authentication:
        type: bearer
        token: "$secrets.oracle_argus_token"
      resources:
        - name: cases
          path: "/cases"
          operations:
            - name: create-case
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msteams_token"
      resources:
        - name: messages
          path: "/teams/{{channel_id}}/channels/general/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: send-message
              method: POST
    - type: http
      namespace: servicenow
      baseUri: "https://amgen.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.servicenow_user"
        password: "$secrets.servicenow_password"
      resources:
        - name: tasks
          path: "/table/sc_task"
          operations:
            - name: create-task
              method: POST

Monitors bioreactor fermentation parameters and when out-of-spec conditions occur, creates a deviation, alerts manufacturing, and logs data in the process historian.

naftiko: "0.5"
info:
  label: "Bioprocess Fermentation Monitoring Orchestration"
  description: "Monitors bioreactor fermentation parameters and when out-of-spec conditions occur, creates a deviation, alerts manufacturing, and logs data in the process historian."
  tags:
    - manufacturing
    - quality
    - servicenow
    - sap
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: bioprocess-monitoring
      port: 8080
      tools:
        - name: handle-fermentation-excursion
          description: "Given a bioreactor ID, parameter name, and measured value, create a deviation, alert the team, and log data. Use when bioreactor monitoring detects out-of-spec conditions."
          inputParameters:
            - name: bioreactor_id
              in: body
              type: string
              description: "Bioreactor identifier."
            - name: parameter_name
              in: body
              type: string
              description: "Parameter name: pH, dissolved_oxygen, temperature, agitation."
            - name: measured_value
              in: body
              type: string
              description: "The measured out-of-spec value."
          steps:
            - name: create-deviation
              type: call
              call: servicenow.create-deviation
              with:
                description: "Fermentation excursion: {{parameter_name}} = {{measured_value}} at bioreactor {{bioreactor_id}}"
                area: "bioprocess"
                priority: "2"
            - name: log-event
              type: call
              call: sap-erp.create-process-event
              with:
                equipment: "{{bioreactor_id}}"
                parameter: "{{parameter_name}}"
                value: "{{measured_value}}"
            - name: alert-team
              type: call
              call: msteams.send-message
              with:
                channel_id: "bioprocess-ops"
                text: "ALERT: Bioreactor {{bioreactor_id}} - {{parameter_name}} excursion: {{measured_value}}. Deviation: {{create-deviation.number}}"
  consumes:
    - type: http
      namespace: servicenow
      baseUri: "https://amgen.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.servicenow_user"
        password: "$secrets.servicenow_password"
      resources:
        - name: deviations
          path: "/table/u_deviation"
          operations:
            - name: create-deviation
              method: POST
    - type: http
      namespace: sap-erp
      baseUri: "https://amgen-s4.sap.com/sap/opu/odata/sap/PP_PROCESS_SRV"
      authentication:
        type: basic
        username: "$secrets.sap_user"
        password: "$secrets.sap_password"
      resources:
        - name: events
          path: "/A_ProcessEvent"
          operations:
            - name: create-process-event
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msteams_token"
      resources:
        - name: messages
          path: "/teams/{{channel_id}}/channels/general/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: send-message
              method: POST

Orchestrates bioreactor scale-up validation by comparing process parameters across scales, generating equivalency reports, and notifying process development.

naftiko: "0.5"
info:
  label: "Bioreactor Scale-Up Validation Orchestration"
  description: "Orchestrates bioreactor scale-up validation by comparing process parameters across scales, generating equivalency reports, and notifying process development."
  tags:
    - manufacturing
    - rd
    - quality
    - snowflake
    - servicenow
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: scale-up-validation
      port: 8080
      tools:
        - name: validate-scale-up
          description: "Given small-scale and large-scale batch IDs, compare process parameters, generate equivalency report, and notify team. Use when process development validates scale-up."
          inputParameters:
            - name: small_scale_batch
              in: body
              type: string
              description: "Small-scale batch identifier."
            - name: large_scale_batch
              in: body
              type: string
              description: "Large-scale batch identifier."
          steps:
            - name: compare-parameters
              type: call
              call: snowflake.execute-query
              with:
                query_name: "scale_up_comparison"
                params: "{{small_scale_batch}},{{large_scale_batch}}"
            - name: create-validation-record
              type: call
              call: servicenow.create-task
              with:
                short_description: "Scale-up validation: {{small_scale_batch}} vs {{large_scale_batch}}"
                category: "process_validation"
                assigned_group: "Process_Development"
            - name: notify-team
              type: call
              call: msteams.send-message
              with:
                channel_id: "process-development"
                text: "Scale-up comparison complete. Titer equivalence: {{compare-parameters.titer_equivalence}}%. CQA within spec: {{compare-parameters.cqa_pass}}. Task: {{create-validation-record.number}}"
  consumes:
    - type: http
      namespace: snowflake
      baseUri: "https://amgen.snowflakecomputing.com/api/v2"
      authentication:
        type: bearer
        token: "$secrets.snowflake_token"
      resources:
        - name: statements
          path: "/statements"
          operations:
            - name: execute-query
              method: POST
    - type: http
      namespace: servicenow
      baseUri: "https://amgen.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.servicenow_user"
        password: "$secrets.servicenow_password"
      resources:
        - name: tasks
          path: "/table/sc_task"
          operations:
            - name: create-task
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msteams_token"
      resources:
        - name: messages
          path: "/teams/{{channel_id}}/channels/general/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: send-message
              method: POST

Generates a competitive intelligence report on biosimilar market activity by querying Snowflake analytics for patent expirations, competitor filings, and market share data.

naftiko: "0.5"
info:
  label: "Biosimilar Competitive Intelligence Report"
  description: "Generates a competitive intelligence report on biosimilar market activity by querying Snowflake analytics for patent expirations, competitor filings, and market share data."
  tags:
    - commercial
    - analytics
    - snowflake
capability:
  exposes:
    - type: mcp
      namespace: competitive-intel
      port: 8080
      tools:
        - name: get-biosimilar-report
          description: "Given a therapeutic area and molecule name, return competitive landscape data including biosimilar filings, patent status, and market share. Use when commercial strategy needs competitive intelligence."
          inputParameters:
            - name: therapeutic_area
              in: body
              type: string
              description: "Therapeutic area, e.g. 'oncology', 'inflammation'."
            - name: molecule_name
              in: body
              type: string
              description: "Reference molecule name."
          call: snowflake.execute-query
          with:
            query_name: "biosimilar_competitive_report"
            params: "{{therapeutic_area}},{{molecule_name}}"
          outputParameters:
            - name: biosimilar_count
              type: integer
              mapping: "$.data[0].biosimilar_count"
            - name: market_share
              type: number
              mapping: "$.data[0].originator_market_share"
  consumes:
    - type: http
      namespace: snowflake
      baseUri: "https://amgen.snowflakecomputing.com/api/v2"
      authentication:
        type: bearer
        token: "$secrets.snowflake_token"
      resources:
        - name: statements
          path: "/statements"
          operations:
            - name: execute-query
              method: POST

Uploads a document to a Box folder and returns the file ID and link.

naftiko: "0.5"
info:
  label: "Box Regulatory File Upload"
  description: "Uploads a document to a Box folder and returns the file ID and link."
  tags:
    - regulatory
    - documentation
    - box
capability:
  exposes:
    - type: mcp
      namespace: file-storage
      port: 8080
      tools:
        - name: upload-to-box
          description: "Given a folder ID and file name, upload to Box. Use when teams store documents in Box."
          inputParameters:
            - name: folder_id
              in: body
              type: string
              description: "Box folder ID."
            - name: file_name
              in: body
              type: string
              description: "File name."
          call: box.upload-file
          with:
            folder_id: "{{folder_id}}"
            name: "{{file_name}}"
          outputParameters:
            - name: file_id
              type: string
              mapping: "$.entries[0].id"
  consumes:
    - type: http
      namespace: box
      baseUri: "https://upload.box.com/api/2.0"
      authentication:
        type: bearer
        token: "$secrets.box_token"
      resources:
        - name: files
          path: "/files/content"
          operations:
            - name: upload-file
              method: POST

Tracks cell line development milestones by querying the LIMS for clone data, updating Jira tasks, and notifying the cell biology team.

naftiko: "0.5"
info:
  label: "Cell Line Development Tracking Orchestration"
  description: "Tracks cell line development milestones by querying the LIMS for clone data, updating Jira tasks, and notifying the cell biology team."
  tags:
    - rd
    - manufacturing
    - jira
    - snowflake
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: cell-line-dev
      port: 8080
      tools:
        - name: update-cell-line-status
          description: "Given a cell line ID, query clone selection data, update Jira, and notify the team. Use when cell biology reaches development milestones."
          inputParameters:
            - name: cell_line_id
              in: body
              type: string
              description: "Cell line identifier."
          steps:
            - name: get-clone-data
              type: call
              call: snowflake.execute-query
              with:
                query_name: "cell_line_clone_data"
                params: "{{cell_line_id}}"
            - name: update-jira
              type: call
              call: jira.update-issue
              with:
                issue_key: "CLD-{{cell_line_id}}"
                status: "{{get-clone-data.current_stage}}"
            - name: notify-team
              type: call
              call: msteams.send-message
              with:
                channel_id: "cell-biology"
                text: "Cell line {{cell_line_id}} update: Stage {{get-clone-data.current_stage}}. Top clone titer: {{get-clone-data.top_titer}} g/L."
  consumes:
    - type: http
      namespace: snowflake
      baseUri: "https://amgen.snowflakecomputing.com/api/v2"
      authentication:
        type: bearer
        token: "$secrets.snowflake_token"
      resources:
        - name: statements
          path: "/statements"
          operations:
            - name: execute-query
              method: POST
    - type: http
      namespace: jira
      baseUri: "https://amgen.atlassian.net/rest/api/3"
      authentication:
        type: basic
        username: "$secrets.jira_user"
        password: "$secrets.jira_api_token"
      resources:
        - name: issues
          path: "/issue/{{issue_key}}"
          inputParameters:
            - name: issue_key
              in: path
          operations:
            - name: update-issue
              method: PUT
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msteams_token"
      resources:
        - name: messages
          path: "/teams/{{channel_id}}/channels/general/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: send-message
              method: POST

Creates a ServiceNow change request for infrastructure changes, routes it to the CAB board, and notifies requestors in Teams upon approval or rejection.

naftiko: "0.5"
info:
  label: "Change Management Approval Workflow"
  description: "Creates a ServiceNow change request for infrastructure changes, routes it to the CAB board, and notifies requestors in Teams upon approval or rejection."
  tags:
    - itsm
    - change-management
    - servicenow
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: change-mgmt
      port: 8080
      tools:
        - name: create-change-request
          description: "Given change details, create a ServiceNow change request and notify the requestor in Teams. Use for any infrastructure or application change requiring CAB approval."
          inputParameters:
            - name: short_description
              in: body
              type: string
              description: "Brief description of the change, e.g. Upgrade Kubernetes cluster to v1.30."
            - name: change_type
              in: body
              type: string
              description: "Change type: normal, standard, or emergency."
            - name: risk_level
              in: body
              type: string
              description: "Risk level: low, medium, high, or critical."
            - name: requestor_upn
              in: body
              type: string
              description: "The UPN of the change requestor for Teams notification."
          steps:
            - name: create-cr
              type: call
              call: "servicenow-chg.create-change"
              with:
                short_description: "{{short_description}}"
                type: "{{change_type}}"
                risk: "{{risk_level}}"
                assignment_group: "CAB"
            - name: notify-requestor
              type: call
              call: "msteams-chg.send-message"
              with:
                recipient_upn: "{{requestor_upn}}"
                message: "Your change request has been submitted: {{create-cr.number}}. Type: {{change_type}}. Risk: {{risk_level}}. Pending CAB review."
  consumes:
    - type: http
      namespace: servicenow-chg
      baseUri: "https://amgen.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.servicenow_user"
        password: "$secrets.servicenow_password"
      resources:
        - name: change-requests
          path: "/table/change_request"
          operations:
            - name: create-change
              method: POST
    - type: http
      namespace: msteams-chg
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: chats
          path: "/users/{{recipient_upn}}/chats"
          inputParameters:
            - name: recipient_upn
              in: path
          operations:
            - name: send-message
              method: POST

Orchestrates clinical database lock by running data quality checks, generating discrepancy reports, locking the database, and notifying biostatistics.

naftiko: "0.5"
info:
  label: "Clinical Data Lock Orchestration"
  description: "Orchestrates clinical database lock by running data quality checks, generating discrepancy reports, locking the database, and notifying biostatistics."
  tags:
    - clinical
    - rd
    - snowflake
    - oracle
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: clinical-data-lock
      port: 8080
      tools:
        - name: execute-database-lock
          description: "Given a study ID and lock date, run quality checks, generate reports, lock database, and notify biostat. Use when clinical data management locks a study database."
          inputParameters:
            - name: study_id
              in: body
              type: string
              description: "Clinical study identifier."
            - name: lock_date
              in: body
              type: string
              description: "Target lock date YYYY-MM-DD."
          steps:
            - name: run-quality-checks
              type: call
              call: snowflake.execute-query
              with:
                query_name: "clinical_data_quality_check"
                params: "{{study_id}}"
            - name: lock-database
              type: call
              call: oracle-clinical.lock-study
              with:
                study_id: "{{study_id}}"
                lock_date: "{{lock_date}}"
            - name: notify-biostat
              type: call
              call: msteams.send-message
              with:
                channel_id: "biostatistics"
                text: "Study {{study_id}} database locked as of {{lock_date}}. Open queries: {{run-quality-checks.open_query_count}}"
  consumes:
    - type: http
      namespace: snowflake
      baseUri: "https://amgen.snowflakecomputing.com/api/v2"
      authentication:
        type: bearer
        token: "$secrets.snowflake_token"
      resources:
        - name: statements
          path: "/statements"
          operations:
            - name: execute-query
              method: POST
    - type: http
      namespace: oracle-clinical
      baseUri: "https://amgen-ctms.oracle.com/api/v2"
      authentication:
        type: bearer
        token: "$secrets.oracle_ctms_token"
      resources:
        - name: studies
          path: "/studies/{{study_id}}/lock"
          inputParameters:
            - name: study_id
              in: path
          operations:
            - name: lock-study
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msteams_token"
      resources:
        - name: messages
          path: "/teams/{{channel_id}}/channels/general/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: send-message
              method: POST

Activates a clinical trial site by verifying IRB approval, provisioning site access, scheduling initiation visit, and notifying clinical operations.

naftiko: "0.5"
info:
  label: "Clinical Site Activation Orchestration"
  description: "Activates a clinical trial site by verifying IRB approval, provisioning site access, scheduling initiation visit, and notifying clinical operations."
  tags:
    - clinical
    - rd
    - oracle
    - okta
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: site-activation
      port: 8080
      tools:
        - name: activate-clinical-site
          description: "Given a study ID and site ID, verify IRB, provision access, schedule visit, and notify ops. Use when clinical ops activates a trial site."
          inputParameters:
            - name: study_id
              in: body
              type: string
              description: "Clinical study identifier."
            - name: site_id
              in: body
              type: string
              description: "Clinical site identifier."
          steps:
            - name: verify-irb
              type: call
              call: oracle-clinical.get-irb-status
              with:
                study_id: "{{study_id}}"
                site_id: "{{site_id}}"
            - name: provision-access
              type: call
              call: okta.assign-group
              with:
                group_name: "study-{{study_id}}-site-{{site_id}}"
            - name: schedule-visit
              type: call
              call: oracle-clinical.create-visit
              with:
                study_id: "{{study_id}}"
                site_id: "{{site_id}}"
                visit_type: "site_initiation"
            - name: notify-ops
              type: call
              call: msteams.send-message
              with:
                channel_id: "clinical-ops"
                text: "Site {{site_id}} activated for study {{study_id}}. IRB: {{verify-irb.status}}. Visit: {{schedule-visit.visit_date}}"
  consumes:
    - type: http
      namespace: oracle-clinical
      baseUri: "https://amgen-ctms.oracle.com/api/v2"
      authentication:
        type: bearer
        token: "$secrets.oracle_ctms_token"
      resources:
        - name: irb
          path: "/studies/{{study_id}}/sites/{{site_id}}/irb"
          inputParameters:
            - name: study_id
              in: path
            - name: site_id
              in: path
          operations:
            - name: get-irb-status
              method: GET
        - name: visits
          path: "/studies/{{study_id}}/sites/{{site_id}}/visits"
          inputParameters:
            - name: study_id
              in: path
            - name: site_id
              in: path
          operations:
            - name: create-visit
              method: POST
    - type: http
      namespace: okta
      baseUri: "https://amgen.okta.com/api/v1"
      authentication:
        type: apikey
        key: "Authorization"
        value: "$secrets.okta_token"
        placement: header
      resources:
        - name: groups
          path: "/groups"
          operations:
            - name: assign-group
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msteams_token"
      resources:
        - name: messages
          path: "/teams/{{channel_id}}/channels/general/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: send-message
              method: POST

Queries the clinical trial management system for patient enrollment counts, site-level progress, and projected completion for a study.

naftiko: "0.5"
info:
  label: "Clinical Trial Patient Enrollment Tracker"
  description: "Queries the clinical trial management system for patient enrollment counts, site-level progress, and projected completion for a study."
  tags:
    - clinical
    - rd
    - oracle
capability:
  exposes:
    - type: mcp
      namespace: clinical-enrollment
      port: 8080
      tools:
        - name: get-enrollment-status
          description: "Given a clinical study ID, return enrollment count, target, site breakdown, and projected completion. Use when clinical ops needs enrollment visibility."
          inputParameters:
            - name: study_id
              in: body
              type: string
              description: "Clinical study identifier."
          call: oracle-clinical.get-study-enrollment
          with:
            study_id: "{{study_id}}"
          outputParameters:
            - name: enrolled_count
              type: integer
              mapping: "$.data.enrolled"
            - name: target_count
              type: integer
              mapping: "$.data.target"
            - name: projected_completion
              type: string
              mapping: "$.data.projected_completion_date"
  consumes:
    - type: http
      namespace: oracle-clinical
      baseUri: "https://amgen-ctms.oracle.com/api/v2"
      authentication:
        type: bearer
        token: "$secrets.oracle_ctms_token"
      resources:
        - name: studies
          path: "/studies/{{study_id}}/enrollment"
          inputParameters:
            - name: study_id
              in: path
          operations:
            - name: get-study-enrollment
              method: GET

Randomizes a patient into a clinical trial arm by verifying eligibility, executing randomization, updating CTMS, and notifying the site coordinator.

naftiko: "0.5"
info:
  label: "Clinical Trial Randomization Orchestration"
  description: "Randomizes a patient into a clinical trial arm by verifying eligibility, executing randomization, updating CTMS, and notifying the site coordinator."
  tags:
    - clinical
    - rd
    - oracle
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: trial-randomization
      port: 8080
      tools:
        - name: randomize-patient
          description: "Given a study ID, site ID, and patient ID, verify eligibility, randomize, update CTMS, and notify. Use when sites randomize patients into clinical trials."
          inputParameters:
            - name: study_id
              in: body
              type: string
              description: "Study identifier."
            - name: site_id
              in: body
              type: string
              description: "Site identifier."
            - name: patient_id
              in: body
              type: string
              description: "Patient identifier."
          steps:
            - name: verify-eligibility
              type: call
              call: oracle-clinical.check-eligibility
              with:
                study_id: "{{study_id}}"
                patient_id: "{{patient_id}}"
            - name: execute-randomization
              type: call
              call: oracle-clinical.randomize
              with:
                study_id: "{{study_id}}"
                site_id: "{{site_id}}"
                patient_id: "{{patient_id}}"
            - name: notify-site
              type: call
              call: msteams.send-message
              with:
                channel_id: "clinical-sites"
                text: "Patient {{patient_id}} randomized in study {{study_id}} at site {{site_id}}. Arm: {{execute-randomization.treatment_arm}}. Kit: {{execute-randomization.kit_number}}."
  consumes:
    - type: http
      namespace: oracle-clinical
      baseUri: "https://amgen-ctms.oracle.com/api/v2"
      authentication:
        type: bearer
        token: "$secrets.oracle_ctms_token"
      resources:
        - name: eligibility
          path: "/studies/{{study_id}}/patients/{{patient_id}}/eligibility"
          inputParameters:
            - name: study_id
              in: path
            - name: patient_id
              in: path
          operations:
            - name: check-eligibility
              method: GET
        - name: randomization
          path: "/studies/{{study_id}}/randomize"
          inputParameters:
            - name: study_id
              in: path
          operations:
            - name: randomize
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msteams_token"
      resources:
        - name: messages
          path: "/teams/{{channel_id}}/channels/general/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: send-message
              method: POST

When a new clinical trial site is approved in Veeva Vault, creates a ServiceNow task for site setup, notifies the clinical operations team in Teams, and logs the activation in Salesforce.

naftiko: "0.5"
info:
  label: "Clinical Trial Site Activation"
  description: "When a new clinical trial site is approved in Veeva Vault, creates a ServiceNow task for site setup, notifies the clinical operations team in Teams, and logs the activation in Salesforce."
  tags:
    - clinical-trials
    - veeva
    - servicenow
    - salesforce
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: clinical-ops
      port: 8080
      tools:
        - name: activate-trial-site
          description: "Given a Veeva Vault study ID and site ID, create a ServiceNow setup task, log the site in Salesforce, and notify the clinical operations team via Teams."
          inputParameters:
            - name: vault_study_id
              in: body
              type: string
              description: "The Veeva Vault study document ID for the clinical trial."
            - name: site_id
              in: body
              type: string
              description: "The clinical site identifier to be activated."
            - name: site_name
              in: body
              type: string
              description: "The human-readable name of the clinical trial site."
          steps:
            - name: create-setup-task
              type: call
              call: "servicenow-clin.create-task"
              with:
                short_description: "Site activation: {{site_name}} for study {{vault_study_id}}"
                assignment_group: "Clinical_Operations"
            - name: log-in-salesforce
              type: call
              call: "salesforce-clin.create-record"
              with:
                object_type: "Clinical_Site__c"
                study_id: "{{vault_study_id}}"
                site_id: "{{site_id}}"
                site_name: "{{site_name}}"
                status: "Activated"
            - name: notify-team
              type: call
              call: "msteams-clin.post-channel-message"
              with:
                channel_id: "clinical-ops-alerts"
                message: "Site {{site_name}} (ID: {{site_id}}) activated for study {{vault_study_id}}. ServiceNow task: {{create-setup-task.number}}."
  consumes:
    - type: http
      namespace: servicenow-clin
      baseUri: "https://amgen.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.servicenow_user"
        password: "$secrets.servicenow_password"
      resources:
        - name: tasks
          path: "/table/task"
          operations:
            - name: create-task
              method: POST
    - type: http
      namespace: salesforce-clin
      baseUri: "https://amgen.my.salesforce.com/services/data/v58.0"
      authentication:
        type: bearer
        token: "$secrets.salesforce_token"
      resources:
        - name: sobjects
          path: "/sobjects/{{object_type}}"
          inputParameters:
            - name: object_type
              in: path
          operations:
            - name: create-record
              method: POST
    - type: http
      namespace: msteams-clin
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: channel-messages
          path: "/teams/{{channel_id}}/channels/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-channel-message
              method: POST

When an AWS cost anomaly is detected, annotates the event in Datadog, opens a ServiceNow ticket for FinOps review, and posts a summary to the finance alerts Teams channel.

naftiko: "0.5"
info:
  label: "Cloud Cost Anomaly Responder"
  description: "When an AWS cost anomaly is detected, annotates the event in Datadog, opens a ServiceNow ticket for FinOps review, and posts a summary to the finance alerts Teams channel."
  tags:
    - finops
    - cloud
    - aws
    - datadog
    - servicenow
capability:
  exposes:
    - type: mcp
      namespace: cloud-finops
      port: 8080
      tools:
        - name: handle-cost-anomaly
          description: "Given an AWS cost anomaly ID, affected service, and estimated overage, create a Datadog event annotation, open a ServiceNow FinOps ticket, and notify the finance channel in Teams."
          inputParameters:
            - name: anomaly_id
              in: body
              type: string
              description: "The AWS Cost Anomaly Detection anomaly ID."
            - name: aws_service
              in: body
              type: string
              description: "The AWS service generating the anomaly, e.g. EC2, S3, RDS."
            - name: estimated_overage_usd
              in: body
              type: number
              description: "Estimated dollar overage detected."
            - name: business_unit
              in: body
              type: string
              description: "The Amgen business unit owning the AWS account."
          steps:
            - name: annotate-datadog
              type: call
              call: "datadog-finops.create-event"
              with:
                title: "AWS Cost Anomaly: {{aws_service}}"
                text: "Anomaly {{anomaly_id}} — estimated overage: ${{estimated_overage_usd}} — BU: {{business_unit}}"
                alert_type: "warning"
            - name: create-finops-ticket
              type: call
              call: "servicenow-finops.create-incident"
              with:
                short_description: "AWS cost anomaly on {{aws_service}} — ${{estimated_overage_usd}} overage"
                description: "Anomaly {{anomaly_id}} on {{aws_service}} for {{business_unit}}. Datadog event: {{annotate-datadog.id}}."
                assignment_group: "FinOps"
            - name: notify-finance
              type: call
              call: "msteams-finops.post-channel-message"
              with:
                channel_id: "cloud-finance-alerts"
                message: "AWS Cost Anomaly: {{aws_service}} | Overage: ${{estimated_overage_usd}} | BU: {{business_unit}} | Ticket: {{create-finops-ticket.number}}"
  consumes:
    - type: http
      namespace: datadog-finops
      baseUri: "https://api.datadoghq.com/api/v1"
      authentication:
        type: apikey
        key: "DD-API-KEY"
        value: "$secrets.datadog_api_key"
        placement: header
      resources:
        - name: events
          path: "/events"
          operations:
            - name: create-event
              method: POST
    - type: http
      namespace: servicenow-finops
      baseUri: "https://amgen.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.servicenow_user"
        password: "$secrets.servicenow_password"
      resources:
        - name: incidents
          path: "/table/incident"
          operations:
            - name: create-incident
              method: POST
    - type: http
      namespace: msteams-finops
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: channel-messages
          path: "/teams/{{channel_id}}/channels/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-channel-message
              method: POST

When a cold chain temperature excursion is detected during biologic shipment, creates a deviation, quarantines the batch, notifies quality, and initiates stability assessment.

naftiko: "0.5"
info:
  label: "Cold Chain Temperature Excursion Orchestration"
  description: "When a cold chain temperature excursion is detected during biologic shipment, creates a deviation, quarantines the batch, notifies quality, and initiates stability assessment."
  tags:
    - supply-chain
    - quality
    - manufacturing
    - servicenow
    - sap
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: cold-chain
      port: 8080
      tools:
        - name: handle-temp-excursion
          description: "Given a shipment ID, batch number, and temperature reading, create deviation, quarantine batch, notify quality, and start assessment. Use when cold chain monitoring detects temperature breach."
          inputParameters:
            - name: shipment_id
              in: body
              type: string
              description: "Shipment tracking identifier."
            - name: batch_number
              in: body
              type: string
              description: "Affected batch number."
            - name: temperature_reading
              in: body
              type: string
              description: "Recorded temperature reading."
          steps:
            - name: create-deviation
              type: call
              call: servicenow.create-deviation
              with:
                description: "Cold chain excursion: Shipment {{shipment_id}}, Batch {{batch_number}}, Temp {{temperature_reading}}"
                area: "cold_chain"
                priority: "1"
            - name: quarantine-batch
              type: call
              call: sap-erp.update-batch-status
              with:
                batch: "{{batch_number}}"
                status: "quarantine"
            - name: notify-quality
              type: call
              call: msteams.send-message
              with:
                channel_id: "quality-supply-chain"
                text: "COLD CHAIN ALERT: Shipment {{shipment_id}}, Batch {{batch_number}} quarantined. Temp: {{temperature_reading}}. Deviation: {{create-deviation.number}}"
  consumes:
    - type: http
      namespace: servicenow
      baseUri: "https://amgen.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.servicenow_user"
        password: "$secrets.servicenow_password"
      resources:
        - name: deviations
          path: "/table/u_deviation"
          operations:
            - name: create-deviation
              method: POST
    - type: http
      namespace: sap-erp
      baseUri: "https://amgen-s4.sap.com/sap/opu/odata/sap/PP_BATCH_SRV"
      authentication:
        type: basic
        username: "$secrets.sap_user"
        password: "$secrets.sap_password"
      resources:
        - name: batches
          path: "/A_Batch('{{batch}}')"
          inputParameters:
            - name: batch
              in: path
          operations:
            - name: update-batch-status
              method: PATCH
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msteams_token"
      resources:
        - name: messages
          path: "/teams/{{channel_id}}/channels/general/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: send-message
              method: POST

Initiates a compliance document review by retrieving the document, creating reviewer tasks, and notifying reviewers.

naftiko: "0.5"
info:
  label: "Compliance Document Review Orchestration"
  description: "Initiates a compliance document review by retrieving the document, creating reviewer tasks, and notifying reviewers."
  tags:
    - compliance
    - quality
    - veeva-vault
    - servicenow
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: compliance-review
      port: 8080
      tools:
        - name: initiate-document-review
          description: "Given a document ID and deadline, create review tasks and notify reviewers. Use when quality initiates document reviews."
          inputParameters:
            - name: document_id
              in: body
              type: string
              description: "Veeva Vault document ID."
            - name: review_deadline
              in: body
              type: string
              description: "Review deadline YYYY-MM-DD."
          steps:
            - name: get-document
              type: call
              call: veeva-vault.get-document
              with:
                doc_id: "{{document_id}}"
            - name: create-task
              type: call
              call: servicenow.create-task
              with:
                short_description: "Review: {{get-document.title}}"
                category: "compliance_review"
                due_date: "{{review_deadline}}"
                assigned_group: "Quality_Compliance"
            - name: notify
              type: call
              call: msteams.send-message
              with:
                channel_id: "compliance-reviews"
                text: "Document review: {{get-document.title}} (v{{get-document.version}}). Due: {{review_deadline}}. Task: {{create-task.number}}"
  consumes:
    - type: http
      namespace: veeva-vault
      baseUri: "https://amgen-regulatory.veevavault.com/api/v24.1"
      authentication:
        type: bearer
        token: "$secrets.veeva_vault_token"
      resources:
        - name: documents
          path: "/objects/documents/{{doc_id}}"
          inputParameters:
            - name: doc_id
              in: path
          operations:
            - name: get-document
              method: GET
    - type: http
      namespace: servicenow
      baseUri: "https://amgen.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.servicenow_user"
        password: "$secrets.servicenow_password"
      resources:
        - name: tasks
          path: "/table/sc_task"
          operations:
            - name: create-task
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msteams_token"
      resources:
        - name: messages
          path: "/teams/{{channel_id}}/channels/general/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: send-message
              method: POST

Retrieves a standard operating procedure from Confluence by page ID.

naftiko: "0.5"
info:
  label: "Confluence SOP Retrieval"
  description: "Retrieves a standard operating procedure from Confluence by page ID."
  tags:
    - quality
    - documentation
    - confluence
capability:
  exposes:
    - type: mcp
      namespace: sop-library
      port: 8080
      tools:
        - name: get-sop
          description: "Given a Confluence page ID, return title, version, and last updated date. Use when staff references SOPs."
          inputParameters:
            - name: page_id
              in: body
              type: string
              description: "Confluence page ID."
          call: confluence.get-page
          with:
            page_id: "{{page_id}}"
          outputParameters:
            - name: title
              type: string
              mapping: "$.title"
            - name: version
              type: integer
              mapping: "$.version.number"
  consumes:
    - type: http
      namespace: confluence
      baseUri: "https://amgen.atlassian.net/wiki/rest/api"
      authentication:
        type: basic
        username: "$secrets.confluence_user"
        password: "$secrets.confluence_api_token"
      resources:
        - name: pages
          path: "/content/{{page_id}}?expand=version"
          inputParameters:
            - name: page_id
              in: path
          operations:
            - name: get-page
              method: GET

Queries CrowdStrike for threat detections on a specific endpoint.

naftiko: "0.5"
info:
  label: "CrowdStrike Endpoint Threat Lookup"
  description: "Queries CrowdStrike for threat detections on a specific endpoint."
  tags:
    - security
    - endpoint
    - crowdstrike
capability:
  exposes:
    - type: mcp
      namespace: endpoint-security
      port: 8080
      tools:
        - name: get-endpoint-threats
          description: "Given a hostname, return active detections and severity. Use when security investigates alerts."
          inputParameters:
            - name: hostname
              in: body
              type: string
              description: "Endpoint hostname."
          call: crowdstrike.get-detections
          with:
            filter: "device.hostname:'{{hostname}}'"
          outputParameters:
            - name: detection_count
              type: integer
              mapping: "$.meta.pagination.total"
  consumes:
    - type: http
      namespace: crowdstrike
      baseUri: "https://api.crowdstrike.com"
      authentication:
        type: bearer
        token: "$secrets.crowdstrike_token"
      resources:
        - name: detections
          path: "/detects/queries/detects/v1"
          operations:
            - name: get-detections
              method: GET

When CrowdStrike detects a high-severity endpoint detection, creates a ServiceNow security incident, isolates the endpoint via CrowdStrike API, and alerts the SOC team in Teams.

naftiko: "0.5"
info:
  label: "CrowdStrike Security Alert Triage"
  description: "When CrowdStrike detects a high-severity endpoint detection, creates a ServiceNow security incident, isolates the endpoint via CrowdStrike API, and alerts the SOC team in Teams."
  tags:
    - security
    - crowdstrike
    - servicenow
    - incident-response
    - soc
capability:
  exposes:
    - type: mcp
      namespace: security-ops
      port: 8080
      tools:
        - name: handle-endpoint-detection
          description: "Given a CrowdStrike detection ID and host ID, create a ServiceNow security incident, isolate the host via CrowdStrike, and alert the SOC channel in Teams."
          inputParameters:
            - name: detection_id
              in: body
              type: string
              description: "The CrowdStrike detection ID."
            - name: host_id
              in: body
              type: string
              description: "The CrowdStrike host/device ID for the affected endpoint."
            - name: severity
              in: body
              type: string
              description: "Detection severity: critical, high, medium, or low."
          steps:
            - name: create-security-incident
              type: call
              call: "servicenow-soc.create-incident"
              with:
                short_description: "CrowdStrike detection {{detection_id}} — {{severity}} severity"
                category: "security"
                assignment_group: "SOC"
                urgency: "1"
            - name: isolate-host
              type: call
              call: "crowdstrike.contain-host"
              with:
                host_id: "{{host_id}}"
            - name: alert-soc
              type: call
              call: "msteams-soc.post-channel-message"
              with:
                channel_id: "soc-alerts"
                message: "SECURITY ALERT: CrowdStrike detection {{detection_id}} ({{severity}}) on host {{host_id}}. Host isolated. Incident: {{create-security-incident.number}}."
  consumes:
    - type: http
      namespace: servicenow-soc
      baseUri: "https://amgen.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.servicenow_user"
        password: "$secrets.servicenow_password"
      resources:
        - name: incidents
          path: "/table/incident"
          operations:
            - name: create-incident
              method: POST
    - type: http
      namespace: crowdstrike
      baseUri: "https://api.crowdstrike.com"
      authentication:
        type: bearer
        token: "$secrets.crowdstrike_token"
      resources:
        - name: host-containment
          path: "/devices/entities/devices-actions/v2"
          operations:
            - name: contain-host
              method: POST
    - type: http
      namespace: msteams-soc
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: channel-messages
          path: "/teams/{{channel_id}}/channels/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-channel-message
              method: POST

Deploys a machine learning model from Databricks to production by registering, creating a change request, and notifying the data science team.

naftiko: "0.5"
info:
  label: "Databricks ML Model Deployment Orchestration"
  description: "Deploys a machine learning model from Databricks to production by registering, creating a change request, and notifying the data science team."
  tags:
    - rd
    - ai
    - databricks
    - servicenow
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: ml-deployment
      port: 8080
      tools:
        - name: deploy-ml-model
          description: "Given a model name and version, register in production, create change request, and notify team. Use when data science deploys a model."
          inputParameters:
            - name: model_name
              in: body
              type: string
              description: "Databricks model name."
            - name: model_version
              in: body
              type: string
              description: "Model version number."
          steps:
            - name: register-model
              type: call
              call: databricks.register-model-version
              with:
                name: "{{model_name}}"
                version: "{{model_version}}"
                stage: "Production"
            - name: create-change
              type: call
              call: servicenow.create-change
              with:
                short_description: "ML model: {{model_name}} v{{model_version}}"
                category: "application"
                assigned_group: "Data_Science"
            - name: notify-team
              type: call
              call: msteams.send-message
              with:
                channel_id: "data-science"
                text: "Model {{model_name}} v{{model_version}} deployed. Change: {{create-change.number}}"
  consumes:
    - type: http
      namespace: databricks
      baseUri: "https://amgen.cloud.databricks.com/api/2.0"
      authentication:
        type: bearer
        token: "$secrets.databricks_token"
      resources:
        - name: models
          path: "/mlflow/model-versions/transition-stage"
          operations:
            - name: register-model-version
              method: POST
    - type: http
      namespace: servicenow
      baseUri: "https://amgen.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.servicenow_user"
        password: "$secrets.servicenow_password"
      resources:
        - name: changes
          path: "/table/change_request"
          operations:
            - name: create-change
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msteams_token"
      resources:
        - name: messages
          path: "/teams/{{channel_id}}/channels/general/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: send-message
              method: POST

Queries Datadog for application health status, returning uptime, error rate, and active alerts.

naftiko: "0.5"
info:
  label: "Datadog Application Health Check"
  description: "Queries Datadog for application health status, returning uptime, error rate, and active alerts."
  tags:
    - it
    - observability
    - datadog
capability:
  exposes:
    - type: mcp
      namespace: app-monitoring
      port: 8080
      tools:
        - name: get-app-health
          description: "Given a service name, return uptime, error rate, and active alert count. Use when SRE needs application health."
          inputParameters:
            - name: service_name
              in: body
              type: string
              description: "Datadog service name."
          call: datadog.get-service-summary
          with:
            service: "{{service_name}}"
          outputParameters:
            - name: uptime_percent
              type: number
              mapping: "$.data.uptime"
            - name: error_rate
              type: number
              mapping: "$.data.error_rate"
  consumes:
    - type: http
      namespace: datadog
      baseUri: "https://api.datadoghq.com/api/v1"
      authentication:
        type: apikey
        key: "DD-API-KEY"
        value: "$secrets.datadog_api_key"
        placement: header
      resources:
        - name: services
          path: "/service_summary?service={{service}}"
          inputParameters:
            - name: service
              in: query
          operations:
            - name: get-service-summary
              method: GET

Retrieves the current health status of Amgen's monitored infrastructure hosts and services from Datadog, returning a consolidated health snapshot.

naftiko: "0.5"
info:
  label: "Datadog Infrastructure Health Check"
  description: "Retrieves the current health status of Amgen's monitored infrastructure hosts and services from Datadog, returning a consolidated health snapshot."
  tags:
    - observability
    - datadog
    - monitoring
    - infrastructure
capability:
  exposes:
    - type: mcp
      namespace: infra-monitoring
      port: 8080
      tools:
        - name: get-infrastructure-health
          description: "Query Datadog for the current status of all monitored hosts and active alerts. Returns a health summary suitable for ops dashboards and incident triage."
          inputParameters:
            - name: environment
              in: body
              type: string
              description: "The deployment environment to query: production, staging, or development."
          call: "datadog.list-monitors"
          with:
            tags: "env:{{environment}}"
          outputParameters:
            - name: monitors
              type: array
              mapping: "$.monitors"
  consumes:
    - type: http
      namespace: datadog
      baseUri: "https://api.datadoghq.com/api/v1"
      authentication:
        type: apikey
        key: "DD-API-KEY"
        value: "$secrets.datadog_api_key"
        placement: header
      resources:
        - name: monitors
          path: "/monitor"
          operations:
            - name: list-monitors
              method: GET
              inputParameters:
                - name: tags
                  in: query

Sends a contract for electronic signature via DocuSign, updates Salesforce, and notifies legal upon completion.

naftiko: "0.5"
info:
  label: "DocuSign Contract Execution Orchestration"
  description: "Sends a contract for electronic signature via DocuSign, updates Salesforce, and notifies legal upon completion."
  tags:
    - legal
    - sales
    - docusign
    - salesforce
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: contract-execution
      port: 8080
      tools:
        - name: send-contract-for-signature
          description: "Given a Salesforce opportunity ID and template, send contract via DocuSign, update CRM, and notify legal. Use when commercial executes a contract."
          inputParameters:
            - name: opportunity_id
              in: body
              type: string
              description: "Salesforce opportunity ID."
            - name: template_id
              in: body
              type: string
              description: "DocuSign template ID."
          steps:
            - name: get-opportunity
              type: call
              call: salesforce.get-opportunity
              with:
                opp_id: "{{opportunity_id}}"
            - name: send-envelope
              type: call
              call: docusign.create-envelope
              with:
                template_id: "{{template_id}}"
                signer_email: "{{get-opportunity.contact_email}}"
                signer_name: "{{get-opportunity.contact_name}}"
            - name: update-crm
              type: call
              call: salesforce.update-opportunity
              with:
                opp_id: "{{opportunity_id}}"
                contract_status: "Sent for Signature"
            - name: notify-legal
              type: call
              call: msteams.send-message
              with:
                channel_id: "legal-contracts"
                text: "Contract sent for {{get-opportunity.account_name}} via DocuSign. Envelope: {{send-envelope.envelope_id}}"
  consumes:
    - type: http
      namespace: salesforce
      baseUri: "https://amgen.my.salesforce.com/services/data/v59.0"
      authentication:
        type: bearer
        token: "$secrets.salesforce_token"
      resources:
        - name: opportunities
          path: "/sobjects/Opportunity/{{opp_id}}"
          inputParameters:
            - name: opp_id
              in: path
          operations:
            - name: get-opportunity
              method: GET
            - name: update-opportunity
              method: PATCH
    - type: http
      namespace: docusign
      baseUri: "https://na4.docusign.net/restapi/v2.1"
      authentication:
        type: bearer
        token: "$secrets.docusign_token"
      resources:
        - name: envelopes
          path: "/accounts/{{account_id}}/envelopes"
          operations:
            - name: create-envelope
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msteams_token"
      resources:
        - name: messages
          path: "/teams/{{channel_id}}/channels/general/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: send-message
              method: POST

Retrieves the current development phase and key milestones for a drug molecule in the pipeline tracking system.

naftiko: "0.5"
info:
  label: "Drug Molecule Pipeline Status Lookup"
  description: "Retrieves the current development phase and key milestones for a drug molecule in the pipeline tracking system."
  tags:
    - rd
    - clinical
    - snowflake
capability:
  exposes:
    - type: mcp
      namespace: pipeline-tracker
      port: 8080
      tools:
        - name: get-molecule-status
          description: "Given a molecule ID, return the development phase, next milestone, and projected timeline. Use when R&D leadership needs pipeline visibility."
          inputParameters:
            - name: molecule_id
              in: body
              type: string
              description: "Internal molecule identifier."
          call: snowflake.execute-query
          with:
            query_name: "molecule_pipeline_status"
            params: "{{molecule_id}}"
          outputParameters:
            - name: phase
              type: string
              mapping: "$.data[0].phase"
            - name: next_milestone
              type: string
              mapping: "$.data[0].next_milestone"
            - name: projected_date
              type: string
              mapping: "$.data[0].projected_date"
  consumes:
    - type: http
      namespace: snowflake
      baseUri: "https://amgen.snowflakecomputing.com/api/v2"
      authentication:
        type: bearer
        token: "$secrets.snowflake_token"
      resources:
        - name: statements
          path: "/statements"
          operations:
            - name: execute-query
              method: POST

Manages drug product lot release by checking QC results, verifying stability data, generating the certificate of analysis, and notifying distribution.

naftiko: "0.5"
info:
  label: "Drug Product Lot Release Orchestration"
  description: "Manages drug product lot release by checking QC results, verifying stability data, generating the certificate of analysis, and notifying distribution."
  tags:
    - quality
    - manufacturing
    - sap
    - servicenow
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: lot-release
      port: 8080
      tools:
        - name: release-drug-product-lot
          description: "Given a batch number and product code, verify QC, check stability, create CoA, and notify distribution. Use when QA releases a drug product lot."
          inputParameters:
            - name: batch_number
              in: body
              type: string
              description: "Batch number."
            - name: product_code
              in: body
              type: string
              description: "Drug product code."
          steps:
            - name: get-qc-results
              type: call
              call: sap-erp.get-inspection
              with:
                batch: "{{batch_number}}"
                material: "{{product_code}}"
            - name: release-batch
              type: call
              call: sap-erp.release-batch
              with:
                batch: "{{batch_number}}"
                status: "released"
            - name: create-coa-task
              type: call
              call: servicenow.create-task
              with:
                short_description: "CoA: Batch {{batch_number}} - {{product_code}}"
                category: "quality_release"
                assigned_group: "Quality_Assurance"
            - name: notify-distribution
              type: call
              call: msteams.send-message
              with:
                channel_id: "drug-product-distribution"
                text: "Lot {{batch_number}} ({{product_code}}) released. QC: {{get-qc-results.result}}. CoA task: {{create-coa-task.number}}"
  consumes:
    - type: http
      namespace: sap-erp
      baseUri: "https://amgen-s4.sap.com/sap/opu/odata/sap/QM_INSPECTION_SRV"
      authentication:
        type: basic
        username: "$secrets.sap_user"
        password: "$secrets.sap_password"
      resources:
        - name: inspections
          path: "/A_InspectionResult"
          operations:
            - name: get-inspection
              method: GET
        - name: batches
          path: "/A_BatchRelease"
          operations:
            - name: release-batch
              method: POST
    - type: http
      namespace: servicenow
      baseUri: "https://amgen.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.servicenow_user"
        password: "$secrets.servicenow_password"
      resources:
        - name: tasks
          path: "/table/sc_task"
          operations:
            - name: create-task
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msteams_token"
      resources:
        - name: messages
          path: "/teams/{{channel_id}}/channels/general/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: send-message
              method: POST

When a pharmacovigilance signal is flagged in the safety database, creates a ServiceNow case for medical affairs review and notifies the drug safety team in Teams.

naftiko: "0.5"
info:
  label: "Drug Safety Signal Notification"
  description: "When a pharmacovigilance signal is flagged in the safety database, creates a ServiceNow case for medical affairs review and notifies the drug safety team in Teams."
  tags:
    - pharmacovigilance
    - drug-safety
    - servicenow
    - microsoft-teams
    - compliance
capability:
  exposes:
    - type: mcp
      namespace: drug-safety
      port: 8080
      tools:
        - name: notify-safety-signal
          description: "Given a drug safety signal ID and product name, create a ServiceNow case for medical affairs review and notify the pharmacovigilance team in Teams."
          inputParameters:
            - name: signal_id
              in: body
              type: string
              description: "The pharmacovigilance safety signal identifier."
            - name: product_name
              in: body
              type: string
              description: "The Amgen product name associated with the signal."
            - name: signal_type
              in: body
              type: string
              description: "The type of safety signal, e.g. adverse_event, labeling_update."
            - name: severity
              in: body
              type: string
              description: "Signal severity: serious, non-serious."
          steps:
            - name: create-safety-case
              type: call
              call: "servicenow-safety.create-case"
              with:
                short_description: "Safety signal: {{product_name}} — {{signal_type}} ({{severity}})"
                category: "pharmacovigilance"
                assignment_group: "Medical_Affairs"
                description: "Signal ID: {{signal_id}}. Product: {{product_name}}. Type: {{signal_type}}. Severity: {{severity}}."
            - name: notify-pv-team
              type: call
              call: "msteams-safety.post-channel-message"
              with:
                channel_id: "drug-safety-alerts"
                message: "Safety Signal: {{product_name}} | Type: {{signal_type}} | Severity: {{severity}} | Case: {{create-safety-case.number}}"
  consumes:
    - type: http
      namespace: servicenow-safety
      baseUri: "https://amgen.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.servicenow_user"
        password: "$secrets.servicenow_password"
      resources:
        - name: cases
          path: "/table/sn_customerservice_case"
          operations:
            - name: create-case
              method: POST
    - type: http
      namespace: msteams-safety
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: channel-messages
          path: "/teams/{{channel_id}}/channels/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-channel-message
              method: POST

When an employee termination is recorded in Workday, revokes Microsoft 365 access, closes all open ServiceNow tickets assigned to the user, and notifies the HR business partner via Teams.

naftiko: "0.5"
info:
  label: "Employee Offboarding Workflow"
  description: "When an employee termination is recorded in Workday, revokes Microsoft 365 access, closes all open ServiceNow tickets assigned to the user, and notifies the HR business partner via Teams."
  tags:
    - hr
    - offboarding
    - workday
    - servicenow
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: hr-offboarding
      port: 8080
      tools:
        - name: trigger-employee-offboarding
          description: "Given a Workday employee ID and termination date, revoke Microsoft 365 licenses, disable the Azure AD account, close open ServiceNow tickets, and alert the HR business partner in Teams."
          inputParameters:
            - name: workday_employee_id
              in: body
              type: string
              description: "The Workday worker ID for the departing employee."
            - name: termination_date
              in: body
              type: string
              description: "The effective termination date in ISO 8601 format."
            - name: hr_bp_upn
              in: body
              type: string
              description: "The UPN of the HR business partner to notify, e.g. jsmith@amgen.com."
          steps:
            - name: get-worker
              type: call
              call: "workday-off.get-worker"
              with:
                worker_id: "{{workday_employee_id}}"
            - name: disable-account
              type: call
              call: "msgraph-off.disable-user"
              with:
                user_principal_name: "{{get-worker.work_email}}"
            - name: revoke-licenses
              type: call
              call: "msgraph-off.remove-license"
              with:
                user_principal_name: "{{get-worker.work_email}}"
            - name: notify-hr-bp
              type: call
              call: "msteams-off.send-message"
              with:
                recipient_upn: "{{hr_bp_upn}}"
                message: "Offboarding complete for {{get-worker.full_name}} (termination: {{termination_date}}). M365 access revoked."
  consumes:
    - type: http
      namespace: workday-off
      baseUri: "https://wd2-impl-services1.workday.com/ccx/api/v1"
      authentication:
        type: bearer
        token: "$secrets.workday_token"
      resources:
        - name: workers
          path: "/amgen/workers/{{worker_id}}"
          inputParameters:
            - name: worker_id
              in: path
          operations:
            - name: get-worker
              method: GET
    - type: http
      namespace: msgraph-off
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: users
          path: "/users/{{user_principal_name}}"
          inputParameters:
            - name: user_principal_name
              in: path
          operations:
            - name: disable-user
              method: PATCH
            - name: remove-license
              method: POST
    - type: http
      namespace: msteams-off
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: chats
          path: "/users/{{recipient_upn}}/chats"
          inputParameters:
            - name: recipient_upn
              in: path
          operations:
            - name: send-message
              method: POST

When a new hire is created in Workday, opens a ServiceNow onboarding ticket, provisions Microsoft 365 access, and sends a Microsoft Teams welcome message to the new employee.

naftiko: "0.5"
info:
  label: "Employee Onboarding Orchestrator"
  description: "When a new hire is created in Workday, opens a ServiceNow onboarding ticket, provisions Microsoft 365 access, and sends a Microsoft Teams welcome message to the new employee."
  tags:
    - hr
    - onboarding
    - workday
    - servicenow
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: hr-onboarding
      port: 8080
      tools:
        - name: trigger-employee-onboarding
          description: "Given a Workday employee ID and start date, orchestrate the full onboarding sequence across ServiceNow, Microsoft Teams, and Microsoft Graph. Creates the onboarding ticket, grants M365 license, and sends a welcome message."
          inputParameters:
            - name: workday_employee_id
              in: body
              type: string
              description: "The Workday worker ID for the new hire, e.g. WD-00123."
            - name: start_date
              in: body
              type: string
              description: "The employee start date in ISO 8601 format, e.g. 2026-04-01."
            - name: department
              in: body
              type: string
              description: "The business department the new hire is joining, e.g. Research & Development."
          steps:
            - name: get-worker
              type: call
              call: "workday.get-worker"
              with:
                worker_id: "{{workday_employee_id}}"
            - name: create-onboarding-ticket
              type: call
              call: "servicenow.create-incident"
              with:
                short_description: "New hire onboarding: {{get-worker.full_name}}"
                category: "hr_onboarding"
                assignment_group: "IT_Onboarding"
                caller_id: "{{get-worker.work_email}}"
            - name: provision-m365
              type: call
              call: "msgraph.assign-license"
              with:
                user_principal_name: "{{get-worker.work_email}}"
                sku_id: "enterprisepack"
            - name: send-welcome
              type: call
              call: "msteams.send-message"
              with:
                recipient_upn: "{{get-worker.work_email}}"
                message: "Welcome to Amgen, {{get-worker.first_name}}! Your IT onboarding ticket is {{create-onboarding-ticket.number}}. Your Microsoft 365 access has been provisioned."
  consumes:
    - type: http
      namespace: workday
      baseUri: "https://wd2-impl-services1.workday.com/ccx/api/v1"
      authentication:
        type: bearer
        token: "$secrets.workday_token"
      resources:
        - name: workers
          path: "/amgen/workers/{{worker_id}}"
          inputParameters:
            - name: worker_id
              in: path
          operations:
            - name: get-worker
              method: GET
    - type: http
      namespace: servicenow
      baseUri: "https://amgen.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.servicenow_user"
        password: "$secrets.servicenow_password"
      resources:
        - name: incidents
          path: "/table/incident"
          operations:
            - name: create-incident
              method: POST
    - type: http
      namespace: msgraph
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: user-licenses
          path: "/users/{{user_principal_name}}/assignLicense"
          inputParameters:
            - name: user_principal_name
              in: path
          operations:
            - name: assign-license
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: chats
          path: "/users/{{recipient_upn}}/chats"
          inputParameters:
            - name: recipient_upn
              in: path
          operations:
            - name: send-message
              method: POST

When an employee transfers between departments, updates Workday, re-provisions Okta groups, transfers assets, and notifies managers.

naftiko: "0.5"
info:
  label: "Employee Transfer Orchestration"
  description: "When an employee transfers between departments, updates Workday, re-provisions Okta groups, transfers assets, and notifies managers."
  tags:
    - hr
    - identity
    - workday
    - okta
    - servicenow
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: employee-transfer
      port: 8080
      tools:
        - name: process-employee-transfer
          description: "Given a worker ID and target department, update records, re-provision access, transfer assets, and notify. Use when HR processes a transfer."
          inputParameters:
            - name: worker_id
              in: body
              type: string
              description: "Workday worker ID."
            - name: target_department
              in: body
              type: string
              description: "Target department code."
          steps:
            - name: get-employee
              type: call
              call: workday.get-worker
              with:
                worker_id: "{{worker_id}}"
            - name: update-okta
              type: call
              call: okta.update-user-groups
              with:
                user_email: "{{get-employee.work_email}}"
                new_department: "{{target_department}}"
            - name: transfer-assets
              type: call
              call: servicenow.transfer-assets
              with:
                user_id: "{{worker_id}}"
                new_department: "{{target_department}}"
            - name: notify
              type: call
              call: msteams.send-message
              with:
                channel_id: "hr-operations"
                text: "Transfer: {{get-employee.first_name}} {{get-employee.last_name}} to {{target_department}}. Access and assets updated."
  consumes:
    - type: http
      namespace: workday
      baseUri: "https://wd2-impl-services1.workday.com/ccx/api/v1"
      authentication:
        type: bearer
        token: "$secrets.workday_token"
      resources:
        - name: workers
          path: "/workers/{{worker_id}}"
          inputParameters:
            - name: worker_id
              in: path
          operations:
            - name: get-worker
              method: GET
    - type: http
      namespace: okta
      baseUri: "https://amgen.okta.com/api/v1"
      authentication:
        type: apikey
        key: "Authorization"
        value: "$secrets.okta_token"
        placement: header
      resources:
        - name: users
          path: "/users/{{user_email}}/groups"
          inputParameters:
            - name: user_email
              in: path
          operations:
            - name: update-user-groups
              method: PUT
    - type: http
      namespace: servicenow
      baseUri: "https://amgen.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.servicenow_user"
        password: "$secrets.servicenow_password"
      resources:
        - name: assets
          path: "/table/alm_asset"
          operations:
            - name: transfer-assets
              method: PATCH
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msteams_token"
      resources:
        - name: messages
          path: "/teams/{{channel_id}}/channels/general/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: send-message
              method: POST

Retrieves the current status of an Investigational New Drug application from the regulatory tracking system by IND number.

naftiko: "0.5"
info:
  label: "FDA IND Submission Status Lookup"
  description: "Retrieves the current status of an Investigational New Drug application from the regulatory tracking system by IND number."
  tags:
    - regulatory
    - clinical
    - veeva-vault
capability:
  exposes:
    - type: mcp
      namespace: regulatory-submissions
      port: 8080
      tools:
        - name: get-ind-status
          description: "Given an IND number, return the current review status, FDA division, and expected response date. Use when regulatory affairs checks IND submission progress."
          inputParameters:
            - name: ind_number
              in: body
              type: string
              description: "FDA IND application number."
          call: veeva-vault.get-submission
          with:
            ind_number: "{{ind_number}}"
          outputParameters:
            - name: status
              type: string
              mapping: "$.data.status"
            - name: fda_division
              type: string
              mapping: "$.data.review_division"
            - name: expected_response
              type: string
              mapping: "$.data.target_date"
  consumes:
    - type: http
      namespace: veeva-vault
      baseUri: "https://amgen-regulatory.veevavault.com/api/v24.1"
      authentication:
        type: bearer
        token: "$secrets.veeva_vault_token"
      resources:
        - name: submissions
          path: "/objects/submission__c/{{ind_number}}"
          inputParameters:
            - name: ind_number
              in: path
          operations:
            - name: get-submission
              method: GET

On a GitHub Actions pipeline failure on a protected branch, opens a Jira bug, creates a Datadog deployment marker, and alerts the engineering team in Microsoft Teams.

naftiko: "0.5"
info:
  label: "GitHub CI/CD Pipeline Failure Response"
  description: "On a GitHub Actions pipeline failure on a protected branch, opens a Jira bug, creates a Datadog deployment marker, and alerts the engineering team in Microsoft Teams."
  tags:
    - devops
    - cicd
    - github
    - jira
    - datadog
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: devops-cicd
      port: 8080
      tools:
        - name: handle-pipeline-failure
          description: "Given a GitHub Actions workflow run failure event, create a Datadog deployment marker, open a Jira bug for engineering triage, and alert the engineering channel in Teams."
          inputParameters:
            - name: repo_name
              in: body
              type: string
              description: "The GitHub repository name in org/repo format, e.g. amgen/bioinfo-pipeline."
            - name: workflow_name
              in: body
              type: string
              description: "The name of the GitHub Actions workflow that failed."
            - name: branch_name
              in: body
              type: string
              description: "The branch where the failure occurred."
            - name: commit_sha
              in: body
              type: string
              description: "The commit SHA that triggered the workflow."
            - name: run_url
              in: body
              type: string
              description: "URL to the failed GitHub Actions workflow run."
          steps:
            - name: create-dd-marker
              type: call
              call: "datadog-cicd.create-event"
              with:
                title: "Pipeline failure: {{repo_name}}"
                text: "Workflow {{workflow_name}} failed on {{branch_name}} at {{commit_sha}}"
                alert_type: "error"
            - name: create-jira-bug
              type: call
              call: "jira.create-issue"
              with:
                project_key: "ENG"
                issuetype: "Bug"
                summary: "[CI Failure] {{repo_name}} / {{branch_name}} — {{workflow_name}}"
                description: "Pipeline failure on {{branch_name}}. Commit: {{commit_sha}}. Run: {{run_url}}. Datadog: {{create-dd-marker.id}}."
            - name: notify-engineering
              type: call
              call: "msteams-cicd.post-channel-message"
              with:
                channel_id: "engineering-alerts"
                message: "Pipeline Failure: {{repo_name}} | Branch: {{branch_name}} | Workflow: {{workflow_name}} | Jira: {{create-jira-bug.key}} | Run: {{run_url}}"
  consumes:
    - type: http
      namespace: datadog-cicd
      baseUri: "https://api.datadoghq.com/api/v1"
      authentication:
        type: apikey
        key: "DD-API-KEY"
        value: "$secrets.datadog_api_key"
        placement: header
      resources:
        - name: events
          path: "/events"
          operations:
            - name: create-event
              method: POST
    - type: http
      namespace: jira
      baseUri: "https://amgen.atlassian.net/rest/api/3"
      authentication:
        type: basic
        username: "$secrets.jira_user"
        password: "$secrets.jira_api_token"
      resources:
        - name: issues
          path: "/issue"
          operations:
            - name: create-issue
              method: POST
    - type: http
      namespace: msteams-cicd
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: channel-messages
          path: "/teams/{{channel_id}}/channels/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-channel-message
              method: POST

Checks a GitHub repository for branch protection, required reviewers, and security scanning configuration.

naftiko: "0.5"
info:
  label: "GitHub Repository Compliance Check"
  description: "Checks a GitHub repository for branch protection, required reviewers, and security scanning configuration."
  tags:
    - security
    - devops
    - github
capability:
  exposes:
    - type: mcp
      namespace: repo-compliance
      port: 8080
      tools:
        - name: check-repo-compliance
          description: "Given a repo name, return branch protection status and security scanning enablement. Use when engineering verifies repo governance."
          inputParameters:
            - name: repo_name
              in: body
              type: string
              description: "GitHub repository name in org/repo format."
          call: github.get-repo-settings
          with:
            repo: "{{repo_name}}"
          outputParameters:
            - name: branch_protection_enabled
              type: boolean
              mapping: "$.data.branch_protection"
            - name: security_scanning
              type: boolean
              mapping: "$.data.security_scanning_enabled"
  consumes:
    - type: http
      namespace: github
      baseUri: "https://api.github.com"
      authentication:
        type: bearer
        token: "$secrets.github_token"
      resources:
        - name: repos
          path: "/repos/{{repo}}"
          inputParameters:
            - name: repo
              in: path
          operations:
            - name: get-repo-settings
              method: GET

When GitHub Advanced Security finds a critical code scanning alert, automatically creates a Jira security issue and notifies the security engineering team in Teams.

naftiko: "0.5"
info:
  label: "GitHub Security Scan to Jira"
  description: "When GitHub Advanced Security finds a critical code scanning alert, automatically creates a Jira security issue and notifies the security engineering team in Teams."
  tags:
    - security
    - devops
    - github
    - jira
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: appsec
      port: 8080
      tools:
        - name: handle-code-scanning-alert
          description: "Given a GitHub code scanning alert ID and repository, create a Jira security issue for remediation and notify the AppSec team in Teams."
          inputParameters:
            - name: repo_name
              in: body
              type: string
              description: "The GitHub repository in org/repo format."
            - name: alert_number
              in: body
              type: integer
              description: "The GitHub code scanning alert number."
            - name: alert_severity
              in: body
              type: string
              description: "Alert severity: critical, high, medium, or low."
            - name: rule_description
              in: body
              type: string
              description: "The code scanning rule description."
          steps:
            - name: get-alert
              type: call
              call: "github.get-code-scanning-alert"
              with:
                repo: "{{repo_name}}"
                alert_number: "{{alert_number}}"
            - name: create-security-issue
              type: call
              call: "jira-appsec.create-issue"
              with:
                project_key: "SEC"
                issuetype: "Security Vulnerability"
                summary: "[{{alert_severity}}] {{rule_description}} in {{repo_name}}"
                description: "GitHub alert #{{alert_number}} in {{repo_name}}. Rule: {{rule_description}}. File: {{get-alert.file_path}}."
            - name: notify-appsec
              type: call
              call: "msteams-appsec.post-channel-message"
              with:
                channel_id: "appsec-alerts"
                message: "Code Scan Alert: {{repo_name}} | {{alert_severity}} | {{rule_description}} | Jira: {{create-security-issue.key}}"
  consumes:
    - type: http
      namespace: github
      baseUri: "https://api.github.com"
      authentication:
        type: bearer
        token: "$secrets.github_token"
      resources:
        - name: code-scanning-alerts
          path: "/repos/{{repo}}/code-scanning/alerts/{{alert_number}}"
          inputParameters:
            - name: repo
              in: path
            - name: alert_number
              in: path
          operations:
            - name: get-code-scanning-alert
              method: GET
    - type: http
      namespace: jira-appsec
      baseUri: "https://amgen.atlassian.net/rest/api/3"
      authentication:
        type: basic
        username: "$secrets.jira_user"
        password: "$secrets.jira_api_token"
      resources:
        - name: issues
          path: "/issue"
          operations:
            - name: create-issue
              method: POST
    - type: http
      namespace: msteams-appsec
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: channel-messages
          path: "/teams/{{channel_id}}/channels/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-channel-message
              method: POST

Checks GMP training compliance for a department by querying Workday Learning.

naftiko: "0.5"
info:
  label: "GMP Training Compliance Check"
  description: "Checks GMP training compliance for a department by querying Workday Learning."
  tags:
    - quality
    - compliance
    - workday
capability:
  exposes:
    - type: mcp
      namespace: training-compliance
      port: 8080
      tools:
        - name: check-gmp-compliance
          description: "Given a department code, return GMP training completion rate and overdue count. Use when quality needs training visibility."
          inputParameters:
            - name: department_code
              in: body
              type: string
              description: "Workday department code."
          call: workday.get-training-compliance
          with:
            department: "{{department_code}}"
            training_type: "gmp"
          outputParameters:
            - name: completion_rate
              type: number
              mapping: "$.data.completion_rate"
            - name: overdue_count
              type: integer
              mapping: "$.data.overdue_count"
  consumes:
    - type: http
      namespace: workday
      baseUri: "https://wd2-impl-services1.workday.com/ccx/api/v1"
      authentication:
        type: bearer
        token: "$secrets.workday_token"
      resources:
        - name: training
          path: "/training/compliance"
          operations:
            - name: get-training-compliance
              method: GET

Retrieves the current GxP validation status for a regulated system from ServiceNow, returning validation lifecycle details for compliance reporting.

naftiko: "0.5"
info:
  label: "GxP System Validation Status Check"
  description: "Retrieves the current GxP validation status for a regulated system from ServiceNow, returning validation lifecycle details for compliance reporting."
  tags:
    - compliance
    - gxp
    - validation
    - servicenow
    - regulatory
capability:
  exposes:
    - type: mcp
      namespace: gxp-compliance
      port: 8080
      tools:
        - name: get-system-validation-status
          description: "Given a GxP system name or CMDB CI ID, retrieve its current validation status, last qualification date, and next revalidation due date from ServiceNow."
          inputParameters:
            - name: system_ci_id
              in: body
              type: string
              description: "The ServiceNow CMDB configuration item ID for the GxP system."
          call: "servicenow-gxp.get-ci"
          with:
            ci_id: "{{system_ci_id}}"
          outputParameters:
            - name: system_name
              type: string
              mapping: "$.result.name"
            - name: validation_status
              type: string
              mapping: "$.result.u_validation_status"
            - name: last_qualified
              type: string
              mapping: "$.result.u_last_qualified_date"
            - name: next_revalidation
              type: string
              mapping: "$.result.u_next_revalidation_date"
  consumes:
    - type: http
      namespace: servicenow-gxp
      baseUri: "https://amgen.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.servicenow_user"
        password: "$secrets.servicenow_password"
      resources:
        - name: cmdb-ci
          path: "/table/cmdb_ci/{{ci_id}}"
          inputParameters:
            - name: ci_id
              in: path
          operations:
            - name: get-ci
              method: GET

Triggers an Informatica Cloud data integration job.

naftiko: "0.5"
info:
  label: "Informatica Data Integration Job Trigger"
  description: "Triggers an Informatica Cloud data integration job."
  tags:
    - data
    - integration
    - informatica
capability:
  exposes:
    - type: mcp
      namespace: data-integration
      port: 8080
      tools:
        - name: trigger-integration-job
          description: "Given a task ID, trigger the ETL job. Use when data engineering runs integration jobs."
          inputParameters:
            - name: task_id
              in: body
              type: string
              description: "Informatica task ID."
          call: informatica.start-job
          with:
            taskId: "{{task_id}}"
          outputParameters:
            - name: run_id
              type: string
              mapping: "$.runId"
            - name: status
              type: string
              mapping: "$.status"
  consumes:
    - type: http
      namespace: informatica
      baseUri: "https://na1.dm-us.informaticacloud.com/saas/api/v2"
      authentication:
        type: bearer
        token: "$secrets.informatica_token"
      resources:
        - name: jobs
          path: "/job"
          operations:
            - name: start-job
              method: POST

When a complex ServiceNow incident is created, submits the incident description to OpenAI for AI-assisted triage categorization and recommended resolution steps, updating the ticket with the analysis.

naftiko: "0.5"
info:
  label: "Intelligent Incident Triage with OpenAI"
  description: "When a complex ServiceNow incident is created, submits the incident description to OpenAI for AI-assisted triage categorization and recommended resolution steps, updating the ticket with the analysis."
  tags:
    - ai
    - itsm
    - servicenow
    - openai
    - incident-response
capability:
  exposes:
    - type: mcp
      namespace: ai-triage
      port: 8080
      tools:
        - name: triage-incident-with-ai
          description: "Given a ServiceNow incident number, retrieve the incident, submit to OpenAI for root cause and resolution recommendations, and update the ServiceNow record with the AI analysis."
          inputParameters:
            - name: incident_number
              in: body
              type: string
              description: "The ServiceNow incident number, e.g. INC0012345."
          steps:
            - name: get-incident
              type: call
              call: "servicenow-ai.get-incident"
              with:
                number: "{{incident_number}}"
            - name: analyze-incident
              type: call
              call: "openai-triage.create-completion"
              with:
                model: "gpt-4o"
                prompt: "Analyze this IT incident and provide: 1) Probable root cause, 2) Recommended resolution steps, 3) Priority suggestion. Incident: {{get-incident.short_description}} — {{get-incident.description}}"
            - name: update-incident
              type: call
              call: "servicenow-ai.update-incident"
              with:
                number: "{{incident_number}}"
                work_notes: "AI Triage Analysis: {{analyze-incident.text}}"
  consumes:
    - type: http
      namespace: servicenow-ai
      baseUri: "https://amgen.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.servicenow_user"
        password: "$secrets.servicenow_password"
      resources:
        - name: incidents
          path: "/table/incident"
          operations:
            - name: get-incident
              method: GET
              inputParameters:
                - name: number
                  in: query
            - name: update-incident
              method: PATCH
    - type: http
      namespace: openai-triage
      baseUri: "https://api.openai.com/v1"
      authentication:
        type: bearer
        token: "$secrets.openai_api_key"
      resources:
        - name: completions
          path: "/chat/completions"
          operations:
            - name: create-completion
              method: POST

When a vendor invoice is received in SAP Ariba, validates it against the SAP purchase order, routes it for approval via ServiceNow, and notifies the finance team in Teams.

naftiko: "0.5"
info:
  label: "Invoice Processing and Approval"
  description: "When a vendor invoice is received in SAP Ariba, validates it against the SAP purchase order, routes it for approval via ServiceNow, and notifies the finance team in Teams."
  tags:
    - finance
    - procurement
    - sap-ariba
    - servicenow
    - invoice-processing
capability:
  exposes:
    - type: mcp
      namespace: finance-ap
      port: 8080
      tools:
        - name: process-vendor-invoice
          description: "Given an Ariba invoice ID and SAP PO number, validate the invoice against the PO in SAP, create a ServiceNow approval task, and notify the finance team in Microsoft Teams."
          inputParameters:
            - name: ariba_invoice_id
              in: body
              type: string
              description: "The SAP Ariba invoice identifier."
            - name: po_number
              in: body
              type: string
              description: "The SAP purchase order number to validate against."
            - name: vendor_name
              in: body
              type: string
              description: "The vendor name for notification context."
          steps:
            - name: get-invoice
              type: call
              call: "sap-ariba.get-invoice"
              with:
                invoice_id: "{{ariba_invoice_id}}"
            - name: validate-po
              type: call
              call: "sap-po.get-po"
              with:
                po_number: "{{po_number}}"
            - name: create-approval-task
              type: call
              call: "servicenow-ap.create-task"
              with:
                short_description: "Invoice approval: {{vendor_name}} - {{ariba_invoice_id}}"
                description: "Invoice {{ariba_invoice_id}} from {{vendor_name}} against PO {{po_number}}. Amount: {{get-invoice.total_amount}} {{get-invoice.currency}}."
                assignment_group: "Finance_AP"
            - name: notify-finance
              type: call
              call: "msteams-ap.send-message"
              with:
                recipient_upn: "finance-ap@amgen.com"
                message: "Invoice {{ariba_invoice_id}} from {{vendor_name}} pending approval. PO: {{po_number}}. Task: {{create-approval-task.number}}."
  consumes:
    - type: http
      namespace: sap-ariba
      baseUri: "https://openapi.ariba.com/api/invoice/v1"
      authentication:
        type: bearer
        token: "$secrets.ariba_token"
      resources:
        - name: invoices
          path: "/invoices/{{invoice_id}}"
          inputParameters:
            - name: invoice_id
              in: path
          operations:
            - name: get-invoice
              method: GET
    - type: http
      namespace: sap-po
      baseUri: "https://amgen-s4.sap.com/sap/opu/odata/sap/MM_PUR_PO_MAINT_V2_SRV"
      authentication:
        type: basic
        username: "$secrets.sap_user"
        password: "$secrets.sap_password"
      resources:
        - name: purchase-orders
          path: "/A_PurchaseOrder('{{po_number}}')"
          inputParameters:
            - name: po_number
              in: path
          operations:
            - name: get-po
              method: GET
    - type: http
      namespace: servicenow-ap
      baseUri: "https://amgen.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.servicenow_user"
        password: "$secrets.servicenow_password"
      resources:
        - name: tasks
          path: "/table/task"
          operations:
            - name: create-task
              method: POST
    - type: http
      namespace: msteams-ap
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: chats
          path: "/users/{{recipient_upn}}/chats"
          inputParameters:
            - name: recipient_upn
              in: path
          operations:
            - name: send-message
              method: POST

When a critical Datadog alert fires, creates a ServiceNow incident, posts an alert to the Microsoft Teams ops channel, and pages the on-call engineer.

naftiko: "0.5"
info:
  label: "IT Incident Response Chain"
  description: "When a critical Datadog alert fires, creates a ServiceNow incident, posts an alert to the Microsoft Teams ops channel, and pages the on-call engineer."
  tags:
    - itsm
    - incident-response
    - datadog
    - servicenow
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: it-ops
      port: 8080
      tools:
        - name: handle-critical-alert
          description: "Given a Datadog alert ID, severity, and affected service, create a ServiceNow incident and notify the IT operations channel in Microsoft Teams. Use when a Datadog monitor reaches critical state."
          inputParameters:
            - name: alert_id
              in: body
              type: string
              description: "The Datadog alert or monitor ID."
            - name: severity
              in: body
              type: string
              description: "Alert severity level: critical, high, medium, or low."
            - name: service_name
              in: body
              type: string
              description: "The name of the affected service or application."
            - name: alert_message
              in: body
              type: string
              description: "The alert message body from Datadog."
          steps:
            - name: create-incident
              type: call
              call: "servicenow-ops.create-incident"
              with:
                short_description: "{{severity}} alert: {{service_name}} - {{alert_id}}"
                description: "{{alert_message}}"
                urgency: "1"
                impact: "1"
                assignment_group: "IT_Operations"
            - name: post-alert
              type: call
              call: "msteams-ops.post-channel-message"
              with:
                channel_id: "it-ops-alerts"
                message: "INCIDENT: {{severity}} alert on {{service_name}} | Datadog: {{alert_id}} | ServiceNow: {{create-incident.number}}"
  consumes:
    - type: http
      namespace: servicenow-ops
      baseUri: "https://amgen.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.servicenow_user"
        password: "$secrets.servicenow_password"
      resources:
        - name: incidents
          path: "/table/incident"
          operations:
            - name: create-incident
              method: POST
    - type: http
      namespace: msteams-ops
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: channel-messages
          path: "/teams/{{channel_id}}/channels/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-channel-message
              method: POST

Creates a bug report in Jira with project, summary, description, and priority.

naftiko: "0.5"
info:
  label: "Jira Bug Report Creation"
  description: "Creates a bug report in Jira with project, summary, description, and priority."
  tags:
    - devops
    - engineering
    - jira
capability:
  exposes:
    - type: mcp
      namespace: issue-tracking
      port: 8080
      tools:
        - name: create-bug-report
          description: "Given project key, summary, description, and priority, create a Jira bug. Use when engineering logs defects."
          inputParameters:
            - name: project_key
              in: body
              type: string
              description: "Jira project key."
            - name: summary
              in: body
              type: string
              description: "Bug summary."
            - name: priority
              in: body
              type: string
              description: "Priority level."
          call: jira.create-issue
          with:
            project: "{{project_key}}"
            issuetype: "Bug"
            summary: "{{summary}}"
            priority: "{{priority}}"
          outputParameters:
            - name: issue_key
              type: string
              mapping: "$.key"
  consumes:
    - type: http
      namespace: jira
      baseUri: "https://amgen.atlassian.net/rest/api/3"
      authentication:
        type: basic
        username: "$secrets.jira_user"
        password: "$secrets.jira_api_token"
      resources:
        - name: issues
          path: "/issue"
          operations:
            - name: create-issue
              method: POST

Generates a daily sprint status digest from Jira, summarizing completed, in-progress, and blocked issues, then posts it to the engineering Teams channel.

naftiko: "0.5"
info:
  label: "Jira Sprint Digest Report"
  description: "Generates a daily sprint status digest from Jira, summarizing completed, in-progress, and blocked issues, then posts it to the engineering Teams channel."
  tags:
    - devops
    - jira
    - reporting
    - sprint
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: sprint-reporting
      port: 8080
      tools:
        - name: digest-sprint-status
          description: "Given a Jira project key and sprint name, fetch all sprint issues and post a summary digest to the engineering Teams channel. Use for daily stand-up prep and sprint reviews."
          inputParameters:
            - name: project_key
              in: body
              type: string
              description: "The Jira project key, e.g. ENG or BIONF."
            - name: sprint_name
              in: body
              type: string
              description: "The Jira sprint name to summarize."
            - name: teams_channel_id
              in: body
              type: string
              description: "The Teams channel ID to post the digest to."
          steps:
            - name: get-sprint-issues
              type: call
              call: "jira-sprint.search-issues"
              with:
                jql: "project = {{project_key}} AND sprint = '{{sprint_name}}'"
            - name: post-digest
              type: call
              call: "msteams-sprint.post-channel-message"
              with:
                channel_id: "{{teams_channel_id}}"
                message: "Sprint Digest — {{project_key}} / {{sprint_name}}: Total: {{get-sprint-issues.total}} | Done: {{get-sprint-issues.done_count}} | In Progress: {{get-sprint-issues.inprogress_count}} | Blocked: {{get-sprint-issues.blocked_count}}"
  consumes:
    - type: http
      namespace: jira-sprint
      baseUri: "https://amgen.atlassian.net/rest/api/3"
      authentication:
        type: basic
        username: "$secrets.jira_user"
        password: "$secrets.jira_api_token"
      resources:
        - name: issues
          path: "/search"
          operations:
            - name: search-issues
              method: GET
              inputParameters:
                - name: jql
                  in: query
    - type: http
      namespace: msteams-sprint
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: channel-messages
          path: "/teams/{{channel_id}}/channels/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-channel-message
              method: POST

When a candidate applies via LinkedIn Recruiter, enriches their profile in Workday Recruiting and notifies the hiring manager in Teams.

naftiko: "0.5"
info:
  label: "LinkedIn Talent Acquisition Signal"
  description: "When a candidate applies via LinkedIn Recruiter, enriches their profile in Workday Recruiting and notifies the hiring manager in Teams."
  tags:
    - hr
    - recruiting
    - linkedin
    - workday
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: talent-acquisition
      port: 8080
      tools:
        - name: enrich-candidate-profile
          description: "Given a LinkedIn member URN and a Workday job requisition ID, fetch the LinkedIn profile and create or enrich the candidate record in Workday, then notify the hiring manager in Teams."
          inputParameters:
            - name: linkedin_member_urn
              in: body
              type: string
              description: "The LinkedIn member URN for the candidate."
            - name: job_req_id
              in: body
              type: string
              description: "The Workday job requisition ID the candidate applied for."
            - name: hiring_manager_upn
              in: body
              type: string
              description: "The UPN of the hiring manager to notify."
          steps:
            - name: get-linkedin-profile
              type: call
              call: "linkedin.get-profile"
              with:
                member_urn: "{{linkedin_member_urn}}"
            - name: create-candidate
              type: call
              call: "workday-recruit.create-candidate"
              with:
                job_req_id: "{{job_req_id}}"
                first_name: "{{get-linkedin-profile.firstName}}"
                last_name: "{{get-linkedin-profile.lastName}}"
                headline: "{{get-linkedin-profile.headline}}"
            - name: notify-hiring-manager
              type: call
              call: "msteams-recruit.send-message"
              with:
                recipient_upn: "{{hiring_manager_upn}}"
                message: "New candidate: {{get-linkedin-profile.firstName}} {{get-linkedin-profile.lastName}} applied for req {{job_req_id}}. Title: {{get-linkedin-profile.headline}}. Workday record: {{create-candidate.candidate_id}}."
  consumes:
    - type: http
      namespace: linkedin
      baseUri: "https://api.linkedin.com/v2"
      authentication:
        type: bearer
        token: "$secrets.linkedin_token"
      resources:
        - name: profiles
          path: "/people/{{member_urn}}"
          inputParameters:
            - name: member_urn
              in: path
          operations:
            - name: get-profile
              method: GET
    - type: http
      namespace: workday-recruit
      baseUri: "https://wd2-impl-services1.workday.com/ccx/api/v1"
      authentication:
        type: bearer
        token: "$secrets.workday_token"
      resources:
        - name: candidates
          path: "/amgen/jobRequisitions/{{job_req_id}}/candidates"
          inputParameters:
            - name: job_req_id
              in: path
          operations:
            - name: create-candidate
              method: POST
    - type: http
      namespace: msteams-recruit
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: chats
          path: "/users/{{recipient_upn}}/chats"
          inputParameters:
            - name: recipient_upn
              in: path
          operations:
            - name: send-message
              method: POST

Retrieves employer brand and talent pipeline metrics from LinkedIn.

naftiko: "0.5"
info:
  label: "LinkedIn Talent Pipeline Report"
  description: "Retrieves employer brand and talent pipeline metrics from LinkedIn."
  tags:
    - hr
    - marketing
    - linkedin
capability:
  exposes:
    - type: mcp
      namespace: employer-brand
      port: 8080
      tools:
        - name: get-talent-metrics
          description: "Return LinkedIn follower count, engagement rate, and talent pipeline size. Use when HR needs employer brand data."
          inputParameters:
            - name: time_period
              in: body
              type: string
              description: "Reporting period."
          call: linkedin.get-organization-stats
          with:
            period: "{{time_period}}"
          outputParameters:
            - name: follower_count
              type: integer
              mapping: "$.data.followerCount"
            - name: engagement_rate
              type: number
              mapping: "$.data.engagementRate"
  consumes:
    - type: http
      namespace: linkedin
      baseUri: "https://api.linkedin.com/v2"
      authentication:
        type: bearer
        token: "$secrets.linkedin_token"
      resources:
        - name: stats
          path: "/organizationPageStatistics"
          operations:
            - name: get-organization-stats
              method: GET

Retrieves a biologic manufacturing batch record from SAP, returning batch status, yield, titer data, and quality release information.

naftiko: "0.5"
info:
  label: "Manufacturing Batch Record Status Check"
  description: "Retrieves a biologic manufacturing batch record from SAP, returning batch status, yield, titer data, and quality release information."
  tags:
    - manufacturing
    - quality
    - sap
capability:
  exposes:
    - type: mcp
      namespace: manufacturing-batch
      port: 8080
      tools:
        - name: get-batch-status
          description: "Given a batch number, return the manufacturing batch status, yield, titer, and release status. Use when production teams need batch visibility for biologics manufacturing."
          inputParameters:
            - name: batch_number
              in: body
              type: string
              description: "SAP batch number."
          call: sap-erp.get-batch-record
          with:
            batch_id: "{{batch_number}}"
          outputParameters:
            - name: status
              type: string
              mapping: "$.d.BatchStatus"
            - name: yield_percentage
              type: number
              mapping: "$.d.YieldPercent"
            - name: titer
              type: number
              mapping: "$.d.Titer"
  consumes:
    - type: http
      namespace: sap-erp
      baseUri: "https://amgen-s4.sap.com/sap/opu/odata/sap/PP_BATCH_SRV"
      authentication:
        type: basic
        username: "$secrets.sap_user"
        password: "$secrets.sap_password"
      resources:
        - name: batch-records
          path: "/A_BatchRecord('{{batch_id}}')"
          inputParameters:
            - name: batch_id
              in: path
          operations:
            - name: get-batch-record
              method: GET

When a biologics manufacturing line goes down, creates an incident, alerts maintenance, logs downtime in SAP, and adjusts production schedule.

naftiko: "0.5"
info:
  label: "Manufacturing Line Downtime Response"
  description: "When a biologics manufacturing line goes down, creates an incident, alerts maintenance, logs downtime in SAP, and adjusts production schedule."
  tags:
    - manufacturing
    - it
    - servicenow
    - sap
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: mfg-downtime
      port: 8080
      tools:
        - name: handle-line-downtime
          description: "Given a production line ID and failure reason, create incident, notify team, log downtime, and adjust schedule. Use when manufacturing detects an unplanned stoppage."
          inputParameters:
            - name: line_id
              in: body
              type: string
              description: "Production line identifier."
            - name: failure_reason
              in: body
              type: string
              description: "Description of the failure."
          steps:
            - name: create-incident
              type: call
              call: servicenow.create-incident
              with:
                short_description: "Line {{line_id}} down: {{failure_reason}}"
                category: "manufacturing"
                priority: "1"
                assigned_group: "Maintenance_Engineering"
            - name: alert-team
              type: call
              call: msteams.send-message
              with:
                channel_id: "manufacturing-ops"
                text: "ALERT: Line {{line_id}} down. Reason: {{failure_reason}}. Incident: {{create-incident.number}}"
            - name: log-downtime
              type: call
              call: sap-erp.create-downtime-record
              with:
                work_center: "{{line_id}}"
                reason_code: "{{failure_reason}}"
  consumes:
    - type: http
      namespace: servicenow
      baseUri: "https://amgen.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.servicenow_user"
        password: "$secrets.servicenow_password"
      resources:
        - name: incidents
          path: "/table/incident"
          operations:
            - name: create-incident
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msteams_token"
      resources:
        - name: messages
          path: "/teams/{{channel_id}}/channels/general/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: send-message
              method: POST
    - type: http
      namespace: sap-erp
      baseUri: "https://amgen-s4.sap.com/sap/opu/odata/sap/PP_DOWNTIME_SRV"
      authentication:
        type: basic
        username: "$secrets.sap_user"
        password: "$secrets.sap_password"
      resources:
        - name: downtime
          path: "/A_DowntimeRecord"
          operations:
            - name: create-downtime-record
              method: POST

Assembles a New Drug Application submission package by gathering documents from Veeva Vault, creating the eCTD structure, and notifying the regulatory team.

naftiko: "0.5"
info:
  label: "NDA Submission Package Orchestration"
  description: "Assembles a New Drug Application submission package by gathering documents from Veeva Vault, creating the eCTD structure, and notifying the regulatory team."
  tags:
    - regulatory
    - clinical
    - veeva-vault
    - servicenow
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: nda-submission
      port: 8080
      tools:
        - name: assemble-nda-package
          description: "Given an NDA number and molecule name, gather documents, create eCTD structure, and notify team. Use when regulatory affairs prepares an NDA filing."
          inputParameters:
            - name: nda_number
              in: body
              type: string
              description: "NDA application number."
            - name: molecule_name
              in: body
              type: string
              description: "Drug molecule name."
          steps:
            - name: gather-documents
              type: call
              call: veeva-vault.query-documents
              with:
                nda_number: "{{nda_number}}"
                doc_type: "ectd"
            - name: create-submission
              type: call
              call: veeva-vault.create-submission
              with:
                nda_number: "{{nda_number}}"
                molecule: "{{molecule_name}}"
                document_ids: "{{gather-documents.document_ids}}"
            - name: create-task
              type: call
              call: servicenow.create-task
              with:
                short_description: "NDA submission: {{nda_number}} - {{molecule_name}}"
                category: "regulatory_submission"
                assigned_group: "Regulatory_Affairs"
            - name: notify-team
              type: call
              call: msteams.send-message
              with:
                channel_id: "regulatory-submissions"
                text: "NDA {{nda_number}} package assembled for {{molecule_name}}. Documents: {{gather-documents.count}}. Task: {{create-task.number}}"
  consumes:
    - type: http
      namespace: veeva-vault
      baseUri: "https://amgen-regulatory.veevavault.com/api/v24.1"
      authentication:
        type: bearer
        token: "$secrets.veeva_vault_token"
      resources:
        - name: documents
          path: "/query"
          operations:
            - name: query-documents
              method: POST
        - name: submissions
          path: "/objects/submission__c"
          operations:
            - name: create-submission
              method: POST
    - type: http
      namespace: servicenow
      baseUri: "https://amgen.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.servicenow_user"
        password: "$secrets.servicenow_password"
      resources:
        - name: tasks
          path: "/table/sc_task"
          operations:
            - name: create-task
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msteams_token"
      resources:
        - name: messages
          path: "/teams/{{channel_id}}/channels/general/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: send-message
              method: POST

When a new employee joins Amgen, provisions the appropriate Okta application assignments based on their department and role, as defined in Workday.

naftiko: "0.5"
info:
  label: "Okta User Access Provisioning"
  description: "When a new employee joins Amgen, provisions the appropriate Okta application assignments based on their department and role, as defined in Workday."
  tags:
    - identity
    - security
    - okta
    - workday
    - access-management
capability:
  exposes:
    - type: mcp
      namespace: identity-provisioning
      port: 8080
      tools:
        - name: provision-okta-access
          description: "Given a Workday employee ID, retrieve their role and department, then assign the appropriate Okta application groups. Use during onboarding or role changes."
          inputParameters:
            - name: workday_employee_id
              in: body
              type: string
              description: "The Workday worker ID for the employee."
            - name: okta_user_id
              in: body
              type: string
              description: "The Okta user ID for the employee."
          steps:
            - name: get-worker-profile
              type: call
              call: "workday-okta.get-worker"
              with:
                worker_id: "{{workday_employee_id}}"
            - name: assign-okta-groups
              type: call
              call: "okta.assign-group"
              with:
                user_id: "{{okta_user_id}}"
                department: "{{get-worker-profile.department}}"
                job_title: "{{get-worker-profile.job_title}}"
  consumes:
    - type: http
      namespace: workday-okta
      baseUri: "https://wd2-impl-services1.workday.com/ccx/api/v1"
      authentication:
        type: bearer
        token: "$secrets.workday_token"
      resources:
        - name: workers
          path: "/amgen/workers/{{worker_id}}"
          inputParameters:
            - name: worker_id
              in: path
          operations:
            - name: get-worker
              method: GET
    - type: http
      namespace: okta
      baseUri: "https://amgen.okta.com/api/v1"
      authentication:
        type: apikey
        key: "Authorization"
        value: "$secrets.okta_api_token"
        placement: header
      resources:
        - name: group-members
          path: "/groups/{{group_id}}/users/{{user_id}}"
          inputParameters:
            - name: group_id
              in: path
            - name: user_id
              in: path
          operations:
            - name: assign-group
              method: PUT

Retrieves an Okta user profile by email, returning account status, last login, and MFA enrollment.

naftiko: "0.5"
info:
  label: "Okta User Status Check"
  description: "Retrieves an Okta user profile by email, returning account status, last login, and MFA enrollment."
  tags:
    - security
    - identity
    - okta
capability:
  exposes:
    - type: mcp
      namespace: identity-management
      port: 8080
      tools:
        - name: get-user-status
          description: "Given an email, return Okta account status, last login, and MFA state. Use when IT security verifies user access."
          inputParameters:
            - name: email
              in: body
              type: string
              description: "Employee email address."
          call: okta.get-user
          with:
            login: "{{email}}"
          outputParameters:
            - name: status
              type: string
              mapping: "$.status"
            - name: last_login
              type: string
              mapping: "$.lastLogin"
  consumes:
    - type: http
      namespace: okta
      baseUri: "https://amgen.okta.com/api/v1"
      authentication:
        type: apikey
        key: "Authorization"
        value: "$secrets.okta_token"
        placement: header
      resources:
        - name: users
          path: "/users/{{login}}"
          inputParameters:
            - name: login
              in: path
          operations:
            - name: get-user
              method: GET

Uses OpenAI to generate a structured summary of a clinical study report or protocol document.

naftiko: "0.5"
info:
  label: "OpenAI Clinical Document Summarization"
  description: "Uses OpenAI to generate a structured summary of a clinical study report or protocol document."
  tags:
    - clinical
    - ai
    - openai
capability:
  exposes:
    - type: mcp
      namespace: doc-summarization
      port: 8080
      tools:
        - name: summarize-clinical-document
          description: "Given document text, generate a structured summary. Use when clinical teams need quick document overviews."
          inputParameters:
            - name: document_text
              in: body
              type: string
              description: "Clinical document text."
          call: openai.create-completion
          with:
            model: "gpt-4"
            prompt: "Summarize this clinical document: {{document_text}}"
          outputParameters:
            - name: summary
              type: string
              mapping: "$.choices[0].message.content"
  consumes:
    - type: http
      namespace: openai
      baseUri: "https://api.openai.com/v1"
      authentication:
        type: bearer
        token: "$secrets.openai_api_key"
      resources:
        - name: completions
          path: "/chat/completions"
          operations:
            - name: create-completion
              method: POST

Retrieves the current on-call engineer for a PagerDuty schedule.

naftiko: "0.5"
info:
  label: "PagerDuty On-Call Schedule Lookup"
  description: "Retrieves the current on-call engineer for a PagerDuty schedule."
  tags:
    - it
    - observability
    - pagerduty
capability:
  exposes:
    - type: mcp
      namespace: on-call
      port: 8080
      tools:
        - name: get-on-call-engineer
          description: "Given a PagerDuty schedule ID, return the on-call engineer name and rotation end time. Use when teams identify who is on call."
          inputParameters:
            - name: schedule_id
              in: body
              type: string
              description: "PagerDuty schedule identifier."
          call: pagerduty.get-on-call
          with:
            schedule_id: "{{schedule_id}}"
          outputParameters:
            - name: engineer_name
              type: string
              mapping: "$.oncalls[0].user.name"
            - name: email
              type: string
              mapping: "$.oncalls[0].user.email"
  consumes:
    - type: http
      namespace: pagerduty
      baseUri: "https://api.pagerduty.com"
      authentication:
        type: apikey
        key: "Authorization"
        value: "$secrets.pagerduty_token"
        placement: header
      resources:
        - name: oncalls
          path: "/oncalls?schedule_ids[]={{schedule_id}}"
          inputParameters:
            - name: schedule_id
              in: query
          operations:
            - name: get-on-call
              method: GET

Returns current headcount by department and cost center from Workday, suitable for finance planning and headcount reporting.

naftiko: "0.5"
info:
  label: "Payroll Headcount Snapshot"
  description: "Returns current headcount by department and cost center from Workday, suitable for finance planning and headcount reporting."
  tags:
    - hr
    - finance
    - reporting
    - workday
    - headcount
capability:
  exposes:
    - type: mcp
      namespace: hr-reporting
      port: 8080
      tools:
        - name: get-headcount-by-department
          description: "Returns a list of active Amgen employees grouped by department and cost center from Workday. Use for headcount planning, budget reviews, and workforce analytics."
          call: "workday-hc.headcount-report"
          outputParameters:
            - name: employees
              type: array
              mapping: "$.data"
  consumes:
    - type: http
      namespace: workday-hc
      baseUri: "https://wd2-impl-services1.workday.com/ccx/api/v1"
      authentication:
        type: bearer
        token: "$secrets.workday_token"
      resources:
        - name: headcount
          path: "/amgen/reports/headcount"
          operations:
            - name: headcount-report
              method: GET

Orchestrates PK data analysis by extracting concentration data from Snowflake, running noncompartmental analysis, generating reports, and notifying the clinical pharmacology team.

naftiko: "0.5"
info:
  label: "Pharmacokinetics Data Analysis Orchestration"
  description: "Orchestrates PK data analysis by extracting concentration data from Snowflake, running noncompartmental analysis, generating reports, and notifying the clinical pharmacology team."
  tags:
    - clinical
    - rd
    - analytics
    - snowflake
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: pk-analysis
      port: 8080
      tools:
        - name: run-pk-analysis
          description: "Given a study ID and analyte, extract PK data, run NCA, generate report, and notify team. Use when clinical pharmacology performs PK analysis."
          inputParameters:
            - name: study_id
              in: body
              type: string
              description: "Clinical study identifier."
            - name: analyte
              in: body
              type: string
              description: "Analyte name."
          steps:
            - name: extract-pk-data
              type: call
              call: snowflake.execute-query
              with:
                query_name: "extract_pk_concentrations"
                params: "{{study_id}},{{analyte}}"
            - name: run-nca
              type: call
              call: snowflake.execute-query
              with:
                query_name: "pk_nca_analysis"
                params: "{{study_id}},{{analyte}}"
            - name: notify-team
              type: call
              call: msteams.send-message
              with:
                channel_id: "clinical-pharmacology"
                text: "PK analysis complete for {{study_id}} - {{analyte}}. Cmax: {{run-nca.cmax}}. AUC: {{run-nca.auc}}. Half-life: {{run-nca.half_life}}h."
  consumes:
    - type: http
      namespace: snowflake
      baseUri: "https://amgen.snowflakecomputing.com/api/v2"
      authentication:
        type: bearer
        token: "$secrets.snowflake_token"
      resources:
        - name: statements
          path: "/statements"
          operations:
            - name: execute-query
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msteams_token"
      resources:
        - name: messages
          path: "/teams/{{channel_id}}/channels/general/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: send-message
              method: POST

Generates a periodic safety update report by aggregating adverse events, complaint data, and field actions into a consolidated regulatory report.

naftiko: "0.5"
info:
  label: "Post-Market Surveillance Report Orchestration"
  description: "Generates a periodic safety update report by aggregating adverse events, complaint data, and field actions into a consolidated regulatory report."
  tags:
    - regulatory
    - quality
    - safety
    - snowflake
    - veeva-vault
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: pms-reporting
      port: 8080
      tools:
        - name: generate-psur
          description: "Given a product name and reporting period, aggregate safety data and generate a PSUR. Use when pharmacovigilance prepares periodic safety reports."
          inputParameters:
            - name: product_name
              in: body
              type: string
              description: "Drug product name."
            - name: reporting_period
              in: body
              type: string
              description: "Reporting period."
          steps:
            - name: get-adverse-events
              type: call
              call: snowflake.execute-query
              with:
                query_name: "psur_adverse_events"
                params: "{{product_name}},{{reporting_period}}"
            - name: get-complaint-data
              type: call
              call: snowflake.execute-query
              with:
                query_name: "psur_complaints"
                params: "{{product_name}},{{reporting_period}}"
            - name: create-report
              type: call
              call: veeva-vault.create-document
              with:
                doc_type: "psur"
                product: "{{product_name}}"
                period: "{{reporting_period}}"
            - name: notify
              type: call
              call: msteams.send-message
              with:
                channel_id: "pharmacovigilance"
                text: "PSUR generated for {{product_name}} ({{reporting_period}}). AEs: {{get-adverse-events.total}}. Complaints: {{get-complaint-data.total}}."
  consumes:
    - type: http
      namespace: snowflake
      baseUri: "https://amgen.snowflakecomputing.com/api/v2"
      authentication:
        type: bearer
        token: "$secrets.snowflake_token"
      resources:
        - name: statements
          path: "/statements"
          operations:
            - name: execute-query
              method: POST
    - type: http
      namespace: veeva-vault
      baseUri: "https://amgen-regulatory.veevavault.com/api/v24.1"
      authentication:
        type: bearer
        token: "$secrets.veeva_vault_token"
      resources:
        - name: documents
          path: "/objects/documents"
          operations:
            - name: create-document
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msteams_token"
      resources:
        - name: messages
          path: "/teams/{{channel_id}}/channels/general/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: send-message
              method: POST

Triggers a refresh of the commercial performance Power BI dashboard.

naftiko: "0.5"
info:
  label: "Power BI Commercial Dashboard Refresh"
  description: "Triggers a refresh of the commercial performance Power BI dashboard."
  tags:
    - commercial
    - analytics
    - power-bi
capability:
  exposes:
    - type: mcp
      namespace: bi-refresh
      port: 8080
      tools:
        - name: refresh-commercial-dashboard
          description: "Given a dataset ID, trigger a Power BI refresh. Use when commercial teams need updated data."
          inputParameters:
            - name: dataset_id
              in: body
              type: string
              description: "Power BI dataset ID."
          call: powerbi.trigger-refresh
          with:
            dataset_id: "{{dataset_id}}"
          outputParameters:
            - name: status
              type: string
              mapping: "$.status"
  consumes:
    - type: http
      namespace: powerbi
      baseUri: "https://api.powerbi.com/v1.0/myorg"
      authentication:
        type: bearer
        token: "$secrets.powerbi_token"
      resources:
        - name: datasets
          path: "/datasets/{{dataset_id}}/refreshes"
          inputParameters:
            - name: dataset_id
              in: path
          operations:
            - name: trigger-refresh
              method: POST

Generates a Power BI embed token for a specific report and workspace, enabling secure embedding in Amgen's internal portal.

naftiko: "0.5"
info:
  label: "Power BI Report Embed Token Generator"
  description: "Generates a Power BI embed token for a specific report and workspace, enabling secure embedding in Amgen's internal portal."
  tags:
    - data
    - analytics
    - power-bi
    - reporting
capability:
  exposes:
    - type: mcp
      namespace: powerbi-reporting
      port: 8080
      tools:
        - name: get-report-embed-token
          description: "Given a Power BI workspace ID and report ID, generate a secure embed token for use in Amgen's internal analytics portal."
          inputParameters:
            - name: workspace_id
              in: body
              type: string
              description: "The Power BI workspace (group) ID."
            - name: report_id
              in: body
              type: string
              description: "The Power BI report ID to generate a token for."
          call: "powerbi.generate-embed-token"
          with:
            workspace_id: "{{workspace_id}}"
            report_id: "{{report_id}}"
          outputParameters:
            - name: token
              type: string
              mapping: "$.token"
            - name: expiration
              type: string
              mapping: "$.expiration"
  consumes:
    - type: http
      namespace: powerbi
      baseUri: "https://api.powerbi.com/v1.0/myorg"
      authentication:
        type: bearer
        token: "$secrets.powerbi_token"
      resources:
        - name: embed-token
          path: "/groups/{{workspace_id}}/reports/{{report_id}}/GenerateToken"
          inputParameters:
            - name: workspace_id
              in: path
            - name: report_id
              in: path
          operations:
            - name: generate-embed-token
              method: POST

When protein characterization experiments complete, ingests analytical results into Snowflake, validates data quality, and notifies the R&D team.

naftiko: "0.5"
info:
  label: "Protein Characterization Data Pipeline"
  description: "When protein characterization experiments complete, ingests analytical results into Snowflake, validates data quality, and notifies the R&D team."
  tags:
    - rd
    - analytics
    - snowflake
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: protein-analytics
      port: 8080
      tools:
        - name: process-characterization-data
          description: "Given an experiment ID and data path, ingest results, validate quality, and notify researchers. Use when analytical lab completes protein characterization."
          inputParameters:
            - name: experiment_id
              in: body
              type: string
              description: "Experiment identifier."
            - name: data_path
              in: body
              type: string
              description: "S3 path to results file."
          steps:
            - name: ingest-data
              type: call
              call: snowflake.execute-query
              with:
                query_name: "ingest_protein_characterization"
                params: "{{experiment_id}},{{data_path}}"
            - name: validate-quality
              type: call
              call: snowflake.execute-query
              with:
                query_name: "validate_analytical_quality"
                params: "{{experiment_id}}"
            - name: notify-team
              type: call
              call: msteams.send-message
              with:
                channel_id: "rd-analytical"
                text: "Protein characterization {{experiment_id}} processed. Quality: {{validate-quality.pass_rate}}% pass."
  consumes:
    - type: http
      namespace: snowflake
      baseUri: "https://amgen.snowflakecomputing.com/api/v2"
      authentication:
        type: bearer
        token: "$secrets.snowflake_token"
      resources:
        - name: statements
          path: "/statements"
          operations:
            - name: execute-query
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msteams_token"
      resources:
        - name: messages
          path: "/teams/{{channel_id}}/channels/general/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: send-message
              method: POST

Retrieves a corrective and preventive action record from the quality management system by CAPA number.

naftiko: "0.5"
info:
  label: "Quality CAPA Status Lookup"
  description: "Retrieves a corrective and preventive action record from the quality management system by CAPA number."
  tags:
    - quality
    - compliance
    - servicenow
capability:
  exposes:
    - type: mcp
      namespace: quality-capa
      port: 8080
      tools:
        - name: get-capa-status
          description: "Given a CAPA number, return phase, root cause, due date, and owner. Use when quality teams track CAPA progress."
          inputParameters:
            - name: capa_number
              in: body
              type: string
              description: "CAPA record number."
          call: servicenow.get-capa
          with:
            number: "{{capa_number}}"
          outputParameters:
            - name: phase
              type: string
              mapping: "$.result.phase"
            - name: root_cause
              type: string
              mapping: "$.result.root_cause_category"
            - name: due_date
              type: string
              mapping: "$.result.due_date"
  consumes:
    - type: http
      namespace: servicenow
      baseUri: "https://amgen.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.servicenow_user"
        password: "$secrets.servicenow_password"
      resources:
        - name: capa-records
          path: "/table/u_capa?sysparm_query=number={{number}}"
          inputParameters:
            - name: number
              in: query
          operations:
            - name: get-capa
              method: GET

When a deviation is escalated, assigns an investigator, pulls batch data, creates investigation tasks, and notifies quality.

naftiko: "0.5"
info:
  label: "Quality Deviation Investigation Orchestration"
  description: "When a deviation is escalated, assigns an investigator, pulls batch data, creates investigation tasks, and notifies quality."
  tags:
    - quality
    - manufacturing
    - servicenow
    - sap
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: deviation-investigation
      port: 8080
      tools:
        - name: initiate-investigation
          description: "Given a deviation number, assign investigator, pull batch data, create tasks, and notify. Use when QA escalates a deviation."
          inputParameters:
            - name: deviation_number
              in: body
              type: string
              description: "Deviation record number."
          steps:
            - name: get-deviation
              type: call
              call: servicenow.get-deviation
              with:
                number: "{{deviation_number}}"
            - name: get-batch
              type: call
              call: sap-erp.get-batch-record
              with:
                batch_id: "{{get-deviation.batch_number}}"
            - name: create-task
              type: call
              call: servicenow.create-task
              with:
                short_description: "Investigate: {{deviation_number}}"
                category: "quality_investigation"
                assigned_group: "Quality_Investigation"
            - name: notify
              type: call
              call: msteams.send-message
              with:
                channel_id: "quality-investigations"
                text: "Investigation for {{deviation_number}}. Batch: {{get-deviation.batch_number}}. Yield: {{get-batch.yield_percentage}}%. Task: {{create-task.number}}"
  consumes:
    - type: http
      namespace: servicenow
      baseUri: "https://amgen.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.servicenow_user"
        password: "$secrets.servicenow_password"
      resources:
        - name: deviations
          path: "/table/u_deviation"
          operations:
            - name: get-deviation
              method: GET
        - name: tasks
          path: "/table/sc_task"
          operations:
            - name: create-task
              method: POST
    - type: http
      namespace: sap-erp
      baseUri: "https://amgen-s4.sap.com/sap/opu/odata/sap/PP_BATCH_SRV"
      authentication:
        type: basic
        username: "$secrets.sap_user"
        password: "$secrets.sap_password"
      resources:
        - name: batch-records
          path: "/A_BatchRecord('{{batch_id}}')"
          inputParameters:
            - name: batch_id
              in: path
          operations:
            - name: get-batch-record
              method: GET
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msteams_token"
      resources:
        - name: messages
          path: "/teams/{{channel_id}}/channels/general/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: send-message
              method: POST

Assembles QBR data by pulling financials from SAP, pipeline from Salesforce, headcount from Workday, and generating a consolidated report.

naftiko: "0.5"
info:
  label: "Quarterly Business Review Data Orchestration"
  description: "Assembles QBR data by pulling financials from SAP, pipeline from Salesforce, headcount from Workday, and generating a consolidated report."
  tags:
    - finance
    - sales
    - hr
    - sap
    - salesforce
    - workday
    - snowflake
capability:
  exposes:
    - type: mcp
      namespace: qbr-data
      port: 8080
      tools:
        - name: assemble-qbr-data
          description: "Given a business unit and quarter, pull financials, pipeline, headcount, and generate report. Use when finance prepares QBRs."
          inputParameters:
            - name: business_unit
              in: body
              type: string
              description: "Business unit code."
            - name: fiscal_quarter
              in: body
              type: string
              description: "Fiscal quarter."
          steps:
            - name: get-financials
              type: call
              call: sap-erp.get-pl-summary
              with:
                unit: "{{business_unit}}"
                quarter: "{{fiscal_quarter}}"
            - name: get-pipeline
              type: call
              call: salesforce.get-pipeline-summary
              with:
                unit: "{{business_unit}}"
            - name: get-headcount
              type: call
              call: workday.get-headcount
              with:
                unit: "{{business_unit}}"
            - name: generate-report
              type: call
              call: snowflake.execute-query
              with:
                query_name: "qbr_report"
                params: "{{business_unit}},{{fiscal_quarter}}"
  consumes:
    - type: http
      namespace: sap-erp
      baseUri: "https://amgen-s4.sap.com/sap/opu/odata/sap/FI_PL_SRV"
      authentication:
        type: basic
        username: "$secrets.sap_user"
        password: "$secrets.sap_password"
      resources:
        - name: pl-summary
          path: "/A_PLSummary"
          operations:
            - name: get-pl-summary
              method: GET
    - type: http
      namespace: salesforce
      baseUri: "https://amgen.my.salesforce.com/services/data/v59.0"
      authentication:
        type: bearer
        token: "$secrets.salesforce_token"
      resources:
        - name: pipeline
          path: "/analytics/reports/pipeline_summary"
          operations:
            - name: get-pipeline-summary
              method: GET
    - type: http
      namespace: workday
      baseUri: "https://wd2-impl-services1.workday.com/ccx/api/v1"
      authentication:
        type: bearer
        token: "$secrets.workday_token"
      resources:
        - name: headcount
          path: "/headcount"
          operations:
            - name: get-headcount
              method: GET
    - type: http
      namespace: snowflake
      baseUri: "https://amgen.snowflakecomputing.com/api/v2"
      authentication:
        type: bearer
        token: "$secrets.snowflake_token"
      resources:
        - name: statements
          path: "/statements"
          operations:
            - name: execute-query
              method: POST

Prepares for a regulatory audit by gathering open CAPAs, pending deviations, training compliance, and generating a readiness report.

naftiko: "0.5"
info:
  label: "Regulatory Audit Preparation Orchestration"
  description: "Prepares for a regulatory audit by gathering open CAPAs, pending deviations, training compliance, and generating a readiness report."
  tags:
    - regulatory
    - quality
    - compliance
    - servicenow
    - workday
    - snowflake
capability:
  exposes:
    - type: mcp
      namespace: audit-preparation
      port: 8080
      tools:
        - name: prepare-audit-package
          description: "Given an audit type and facility code, gather CAPAs, deviations, training status, and generate a readiness report. Use when quality prepares for FDA or EMA audits."
          inputParameters:
            - name: audit_type
              in: body
              type: string
              description: "Audit type: FDA, EMA, internal."
            - name: facility_code
              in: body
              type: string
              description: "Manufacturing facility code."
          steps:
            - name: get-open-capas
              type: call
              call: servicenow.query-capas
              with:
                facility: "{{facility_code}}"
                status: "open"
            - name: get-deviations
              type: call
              call: servicenow.query-deviations
              with:
                facility: "{{facility_code}}"
                status: "pending"
            - name: get-training-compliance
              type: call
              call: workday.get-training-status
              with:
                facility: "{{facility_code}}"
                compliance_type: "gmp"
            - name: generate-report
              type: call
              call: snowflake.execute-query
              with:
                query_name: "audit_readiness_report"
                params: "{{facility_code}},{{audit_type}}"
  consumes:
    - type: http
      namespace: servicenow
      baseUri: "https://amgen.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.servicenow_user"
        password: "$secrets.servicenow_password"
      resources:
        - name: capas
          path: "/table/u_capa"
          operations:
            - name: query-capas
              method: GET
        - name: deviations
          path: "/table/u_deviation"
          operations:
            - name: query-deviations
              method: GET
    - type: http
      namespace: workday
      baseUri: "https://wd2-impl-services1.workday.com/ccx/api/v1"
      authentication:
        type: bearer
        token: "$secrets.workday_token"
      resources:
        - name: training
          path: "/training/compliance"
          operations:
            - name: get-training-status
              method: GET
    - type: http
      namespace: snowflake
      baseUri: "https://amgen.snowflakecomputing.com/api/v2"
      authentication:
        type: bearer
        token: "$secrets.snowflake_token"
      resources:
        - name: statements
          path: "/statements"
          operations:
            - name: execute-query
              method: POST

Retrieves the status of regulatory submission documents from Veeva Vault and cross-references open action items in ServiceNow for a given regulatory filing.

naftiko: "0.5"
info:
  label: "Regulatory Submission Document Tracker"
  description: "Retrieves the status of regulatory submission documents from Veeva Vault and cross-references open action items in ServiceNow for a given regulatory filing."
  tags:
    - regulatory
    - veeva
    - servicenow
    - compliance
capability:
  exposes:
    - type: mcp
      namespace: regulatory-ops
      port: 8080
      tools:
        - name: get-submission-status
          description: "Given a Veeva Vault document ID for a regulatory submission, retrieve document status and cross-reference any open ServiceNow action items. Use for regulatory filing status checks."
          inputParameters:
            - name: vault_doc_id
              in: body
              type: string
              description: "The Veeva Vault document ID for the regulatory submission."
          steps:
            - name: get-vault-doc
              type: call
              call: "veeva-vault.get-document"
              with:
                doc_id: "{{vault_doc_id}}"
            - name: get-action-items
              type: call
              call: "servicenow-reg.query-tasks"
              with:
                correlation_id: "{{vault_doc_id}}"
  consumes:
    - type: http
      namespace: veeva-vault
      baseUri: "https://amgen.veevavault.com/api/v23.1"
      authentication:
        type: bearer
        token: "$secrets.veeva_vault_token"
      resources:
        - name: documents
          path: "/objects/documents/{{doc_id}}"
          inputParameters:
            - name: doc_id
              in: path
          operations:
            - name: get-document
              method: GET
    - type: http
      namespace: servicenow-reg
      baseUri: "https://amgen.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.servicenow_user"
        password: "$secrets.servicenow_password"
      resources:
        - name: tasks
          path: "/table/task"
          operations:
            - name: query-tasks
              method: GET

Generates a weekly account health digest from Salesforce, summarizing open opportunities, recent activities, and support cases for strategic accounts, posted to the sales Teams channel.

naftiko: "0.5"
info:
  label: "Salesforce Account Health Digest"
  description: "Generates a weekly account health digest from Salesforce, summarizing open opportunities, recent activities, and support cases for strategic accounts, posted to the sales Teams channel."
  tags:
    - sales
    - crm
    - salesforce
    - reporting
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: account-health
      port: 8080
      tools:
        - name: digest-account-health
          description: "Given a Salesforce account ID, retrieve open opportunities, recent activities, and open cases, then post a health digest to the sales Teams channel."
          inputParameters:
            - name: account_id
              in: body
              type: string
              description: "The Salesforce account ID, e.g. 0015G00001xyz."
            - name: teams_channel_id
              in: body
              type: string
              description: "The Teams channel ID where the digest should be posted."
          steps:
            - name: get-account
              type: call
              call: "salesforce-acct.get-account"
              with:
                account_id: "{{account_id}}"
            - name: get-opportunities
              type: call
              call: "salesforce-acct.get-account-opportunities"
              with:
                account_id: "{{account_id}}"
            - name: post-digest
              type: call
              call: "msteams-acct.post-channel-message"
              with:
                channel_id: "{{teams_channel_id}}"
                message: "Account Health: {{get-account.name}} | Open Opps: {{get-opportunities.total_count}} | Total Pipeline: ${{get-opportunities.total_amount}} | Health Score: {{get-account.health_score}}"
  consumes:
    - type: http
      namespace: salesforce-acct
      baseUri: "https://amgen.my.salesforce.com/services/data/v58.0"
      authentication:
        type: bearer
        token: "$secrets.salesforce_token"
      resources:
        - name: accounts
          path: "/sobjects/Account/{{account_id}}"
          inputParameters:
            - name: account_id
              in: path
          operations:
            - name: get-account
              method: GET
        - name: account-opportunities
          path: "/sobjects/Account/{{account_id}}/Opportunities"
          inputParameters:
            - name: account_id
              in: path
          operations:
            - name: get-account-opportunities
              method: GET
    - type: http
      namespace: msteams-acct
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: channel-messages
          path: "/teams/{{channel_id}}/channels/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-channel-message
              method: POST

Retrieves a Salesforce account record by ID, returning account name, type, annual revenue, and owner.

naftiko: "0.5"
info:
  label: "Salesforce Account Lookup"
  description: "Retrieves a Salesforce account record by ID, returning account name, type, annual revenue, and owner."
  tags:
    - sales
    - crm
    - salesforce
capability:
  exposes:
    - type: mcp
      namespace: crm-accounts
      port: 8080
      tools:
        - name: get-account
          description: "Given a Salesforce account ID, return name, type, annual revenue, and owner. Use when commercial teams need account details."
          inputParameters:
            - name: account_id
              in: body
              type: string
              description: "Salesforce account ID."
          call: salesforce.get-account
          with:
            id: "{{account_id}}"
          outputParameters:
            - name: name
              type: string
              mapping: "$.Name"
            - name: account_type
              type: string
              mapping: "$.Type"
            - name: annual_revenue
              type: number
              mapping: "$.AnnualRevenue"
  consumes:
    - type: http
      namespace: salesforce
      baseUri: "https://amgen.my.salesforce.com/services/data/v59.0"
      authentication:
        type: bearer
        token: "$secrets.salesforce_token"
      resources:
        - name: accounts
          path: "/sobjects/Account/{{id}}"
          inputParameters:
            - name: id
              in: path
          operations:
            - name: get-account
              method: GET

Retrieves the current status, value, and stage of a Salesforce opportunity by ID, for use in sales pipeline reviews and CRM status checks.

naftiko: "0.5"
info:
  label: "Salesforce Opportunity Status Lookup"
  description: "Retrieves the current status, value, and stage of a Salesforce opportunity by ID, for use in sales pipeline reviews and CRM status checks."
  tags:
    - sales
    - crm
    - salesforce
    - reporting
capability:
  exposes:
    - type: mcp
      namespace: crm-sales
      port: 8080
      tools:
        - name: get-opportunity
          description: "Look up a Salesforce opportunity by ID. Returns stage, amount, close date, and account name. Use for pipeline reviews or to surface deal context during customer calls."
          inputParameters:
            - name: opportunity_id
              in: body
              type: string
              description: "The Salesforce opportunity record ID, e.g. 0065G00001abc."
          call: "salesforce.get-opportunity"
          with:
            opportunity_id: "{{opportunity_id}}"
          outputParameters:
            - name: name
              type: string
              mapping: "$.Name"
            - name: stage
              type: string
              mapping: "$.StageName"
            - name: amount
              type: number
              mapping: "$.Amount"
            - name: close_date
              type: string
              mapping: "$.CloseDate"
            - name: account_name
              type: string
              mapping: "$.Account.Name"
  consumes:
    - type: http
      namespace: salesforce
      baseUri: "https://amgen.my.salesforce.com/services/data/v58.0"
      authentication:
        type: bearer
        token: "$secrets.salesforce_token"
      resources:
        - name: opportunities
          path: "/sobjects/Opportunity/{{opportunity_id}}"
          inputParameters:
            - name: opportunity_id
              in: path
          operations:
            - name: get-opportunity
              method: GET

Manages contract renewals by checking expiring contracts in Ariba, creating renewal tasks, and notifying procurement leadership.

naftiko: "0.5"
info:
  label: "SAP Ariba Contract Renewal Orchestration"
  description: "Manages contract renewals by checking expiring contracts in Ariba, creating renewal tasks, and notifying procurement leadership."
  tags:
    - procurement
    - sap-ariba
    - servicenow
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: contract-renewal
      port: 8080
      tools:
        - name: process-contract-renewal
          description: "Given a contract ID, check terms, create renewal task, and notify procurement. Use when contracts approach expiration."
          inputParameters:
            - name: contract_id
              in: body
              type: string
              description: "SAP Ariba contract ID."
          steps:
            - name: get-contract
              type: call
              call: ariba.get-contract
              with:
                id: "{{contract_id}}"
            - name: create-renewal-task
              type: call
              call: servicenow.create-task
              with:
                short_description: "Contract renewal: {{get-contract.title}}"
                category: "procurement"
                assigned_group: "Strategic_Sourcing"
                due_date: "{{get-contract.expiry_date}}"
            - name: notify
              type: call
              call: msteams.send-message
              with:
                channel_id: "procurement"
                text: "Contract {{contract_id}} expiring {{get-contract.expiry_date}}: {{get-contract.title}}. Task: {{create-renewal-task.number}}"
  consumes:
    - type: http
      namespace: ariba
      baseUri: "https://openapi.ariba.com/api/contract-management/v1"
      authentication:
        type: bearer
        token: "$secrets.ariba_token"
      resources:
        - name: contracts
          path: "/contracts/{{id}}"
          inputParameters:
            - name: id
              in: path
          operations:
            - name: get-contract
              method: GET
    - type: http
      namespace: servicenow
      baseUri: "https://amgen.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.servicenow_user"
        password: "$secrets.servicenow_password"
      resources:
        - name: tasks
          path: "/table/sc_task"
          operations:
            - name: create-task
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msteams_token"
      resources:
        - name: messages
          path: "/teams/{{channel_id}}/channels/general/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: send-message
              method: POST

Creates a sourcing event in SAP Ariba for competitive bidding.

naftiko: "0.5"
info:
  label: "SAP Ariba Sourcing Event Creation"
  description: "Creates a sourcing event in SAP Ariba for competitive bidding."
  tags:
    - procurement
    - sap-ariba
capability:
  exposes:
    - type: mcp
      namespace: strategic-sourcing
      port: 8080
      tools:
        - name: create-sourcing-event
          description: "Given category, description, and budget, create an Ariba sourcing event. Use when procurement initiates bidding."
          inputParameters:
            - name: category
              in: body
              type: string
              description: "Sourcing category."
            - name: description
              in: body
              type: string
              description: "Event description."
            - name: budget_amount
              in: body
              type: number
              description: "Budget amount."
          call: ariba.create-event
          with:
            category: "{{category}}"
            description: "{{description}}"
            budget: "{{budget_amount}}"
          outputParameters:
            - name: event_id
              type: string
              mapping: "$.data.eventId"
  consumes:
    - type: http
      namespace: ariba
      baseUri: "https://openapi.ariba.com/api/sourcing-projects/v1"
      authentication:
        type: bearer
        token: "$secrets.ariba_token"
      resources:
        - name: events
          path: "/events"
          operations:
            - name: create-event
              method: POST

Retrieves a pending expense report from SAP Concur, validates it against travel policy, and routes it for manager approval via ServiceNow.

naftiko: "0.5"
info:
  label: "SAP Concur Expense Report Approval"
  description: "Retrieves a pending expense report from SAP Concur, validates it against travel policy, and routes it for manager approval via ServiceNow."
  tags:
    - finance
    - expense-management
    - sap-concur
    - servicenow
capability:
  exposes:
    - type: mcp
      namespace: expense-mgmt
      port: 8080
      tools:
        - name: process-expense-report
          description: "Given a SAP Concur expense report ID and employee ID, retrieve the report, validate against Amgen travel policy, and create a ServiceNow approval task for the manager."
          inputParameters:
            - name: expense_report_id
              in: body
              type: string
              description: "The SAP Concur expense report identifier."
            - name: employee_id
              in: body
              type: string
              description: "The employee ID submitting the expense report."
          steps:
            - name: get-expense-report
              type: call
              call: "sap-concur.get-expense-report"
              with:
                report_id: "{{expense_report_id}}"
            - name: create-approval-task
              type: call
              call: "servicenow-exp.create-task"
              with:
                short_description: "Expense approval: {{employee_id}} — {{expense_report_id}}"
                description: "Amount: {{get-expense-report.total_amount}} {{get-expense-report.currency}}. Period: {{get-expense-report.period}}."
                assignment_group: "Finance_Expense"
  consumes:
    - type: http
      namespace: sap-concur
      baseUri: "https://www.concursolutions.com/api/v3.0"
      authentication:
        type: bearer
        token: "$secrets.concur_token"
      resources:
        - name: expense-reports
          path: "/expense/reports/{{report_id}}"
          inputParameters:
            - name: report_id
              in: path
          operations:
            - name: get-expense-report
              method: GET
    - type: http
      namespace: servicenow-exp
      baseUri: "https://amgen.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.servicenow_user"
        password: "$secrets.servicenow_password"
      resources:
        - name: tasks
          path: "/table/task"
          operations:
            - name: create-task
              method: POST

Retrieves a travel request from SAP Concur by request ID.

naftiko: "0.5"
info:
  label: "SAP Concur Travel Request Lookup"
  description: "Retrieves a travel request from SAP Concur by request ID."
  tags:
    - finance
    - travel
    - sap-concur
capability:
  exposes:
    - type: mcp
      namespace: travel-management
      port: 8080
      tools:
        - name: get-travel-request
          description: "Given a request ID, return destination, dates, cost, and approval status. Use when employees check travel requests."
          inputParameters:
            - name: request_id
              in: body
              type: string
              description: "Concur travel request ID."
          call: concur.get-request
          with:
            id: "{{request_id}}"
          outputParameters:
            - name: destination
              type: string
              mapping: "$.MainDestination"
            - name: approval_status
              type: string
              mapping: "$.ApprovalStatusName"
  consumes:
    - type: http
      namespace: concur
      baseUri: "https://us.api.concursolutions.com/api/v3.0"
      authentication:
        type: bearer
        token: "$secrets.concur_token"
      resources:
        - name: requests
          path: "/travelrequest/requests/{{id}}"
          inputParameters:
            - name: id
              in: path
          operations:
            - name: get-request
              method: GET

Retrieves budget vs actual figures for an SAP cost center.

naftiko: "0.5"
info:
  label: "SAP Cost Center Budget Lookup"
  description: "Retrieves budget vs actual figures for an SAP cost center."
  tags:
    - finance
    - erp
    - sap
capability:
  exposes:
    - type: mcp
      namespace: cost-center-budget
      port: 8080
      tools:
        - name: get-cost-center-budget
          description: "Given a cost center code and fiscal period, return planned budget, actual spend, and variance. Use when finance needs budget data."
          inputParameters:
            - name: cost_center
              in: body
              type: string
              description: "SAP cost center code."
            - name: fiscal_period
              in: body
              type: string
              description: "Fiscal period."
          call: sap-erp.get-budget
          with:
            cost_center: "{{cost_center}}"
            period: "{{fiscal_period}}"
          outputParameters:
            - name: planned_budget
              type: number
              mapping: "$.d.PlannedAmount"
            - name: actual_spend
              type: number
              mapping: "$.d.ActualAmount"
  consumes:
    - type: http
      namespace: sap-erp
      baseUri: "https://amgen-s4.sap.com/sap/opu/odata/sap/FI_CO_BUDGET_SRV"
      authentication:
        type: basic
        username: "$secrets.sap_user"
        password: "$secrets.sap_password"
      resources:
        - name: budgets
          path: "/A_CostCenterBudget(CostCenter='{{cost_center}}',Period='{{period}}')"
          inputParameters:
            - name: cost_center
              in: path
            - name: period
              in: path
          operations:
            - name: get-budget
              method: GET

Posts a goods receipt in SAP for an inbound delivery of raw materials or drug substance.

naftiko: "0.5"
info:
  label: "SAP Goods Receipt Posting"
  description: "Posts a goods receipt in SAP for an inbound delivery of raw materials or drug substance."
  tags:
    - supply-chain
    - sap
capability:
  exposes:
    - type: mcp
      namespace: goods-receipt
      port: 8080
      tools:
        - name: post-goods-receipt
          description: "Given a delivery number, post the goods receipt in SAP. Use when warehouse confirms receipt of materials."
          inputParameters:
            - name: delivery_number
              in: body
              type: string
              description: "SAP inbound delivery number."
          call: sap-erp.post-gr
          with:
            delivery: "{{delivery_number}}"
          outputParameters:
            - name: material_document
              type: string
              mapping: "$.d.MaterialDocument"
  consumes:
    - type: http
      namespace: sap-erp
      baseUri: "https://amgen-s4.sap.com/sap/opu/odata/sap/MM_GR_SRV"
      authentication:
        type: basic
        username: "$secrets.sap_user"
        password: "$secrets.sap_password"
      resources:
        - name: goods-receipts
          path: "/A_GoodsReceipt"
          operations:
            - name: post-gr
              method: POST

Queries SAP for current inventory levels of a material at a plant, returning available stock, reserved quantity, and reorder status.

naftiko: "0.5"
info:
  label: "SAP Inventory Level Check"
  description: "Queries SAP for current inventory levels of a material at a plant, returning available stock, reserved quantity, and reorder status."
  tags:
    - supply-chain
    - manufacturing
    - sap
capability:
  exposes:
    - type: mcp
      namespace: inventory-management
      port: 8080
      tools:
        - name: get-inventory-level
          description: "Given a material number and plant code, return unrestricted stock, reserved quantity, and reorder point. Use when supply chain checks stock availability."
          inputParameters:
            - name: material_number
              in: body
              type: string
              description: "SAP material number."
            - name: plant_code
              in: body
              type: string
              description: "SAP plant code."
          call: sap-erp.get-material-stock
          with:
            material: "{{material_number}}"
            plant: "{{plant_code}}"
          outputParameters:
            - name: unrestricted_stock
              type: number
              mapping: "$.d.UnrestrictedStock"
            - name: reserved_quantity
              type: number
              mapping: "$.d.ReservedQuantity"
  consumes:
    - type: http
      namespace: sap-erp
      baseUri: "https://amgen-s4.sap.com/sap/opu/odata/sap/MM_MATERIAL_STOCK_SRV"
      authentication:
        type: basic
        username: "$secrets.sap_user"
        password: "$secrets.sap_password"
      resources:
        - name: material-stock
          path: "/A_MaterialStock(Material='{{material}}',Plant='{{plant}}')"
          inputParameters:
            - name: material
              in: path
            - name: plant
              in: path
          operations:
            - name: get-material-stock
              method: GET

Creates a preventive maintenance order in SAP for biologics manufacturing equipment.

naftiko: "0.5"
info:
  label: "SAP Maintenance Order Creation"
  description: "Creates a preventive maintenance order in SAP for biologics manufacturing equipment."
  tags:
    - manufacturing
    - maintenance
    - sap
capability:
  exposes:
    - type: mcp
      namespace: plant-maintenance
      port: 8080
      tools:
        - name: create-maintenance-order
          description: "Given equipment ID and maintenance type, create a PM order in SAP. Use when maintenance schedules trigger equipment servicing."
          inputParameters:
            - name: equipment_id
              in: body
              type: string
              description: "SAP equipment ID."
            - name: maintenance_type
              in: body
              type: string
              description: "Type: preventive, corrective, calibration."
          call: sap-erp.create-pm-order
          with:
            equipment: "{{equipment_id}}"
            order_type: "{{maintenance_type}}"
          outputParameters:
            - name: order_number
              type: string
              mapping: "$.d.MaintenanceOrder"
  consumes:
    - type: http
      namespace: sap-erp
      baseUri: "https://amgen-s4.sap.com/sap/opu/odata/sap/PM_ORDER_SRV"
      authentication:
        type: basic
        username: "$secrets.sap_user"
        password: "$secrets.sap_password"
      resources:
        - name: orders
          path: "/A_MaintenanceOrder"
          operations:
            - name: create-pm-order
              method: POST

Retrieves material master data from SAP by material number.

naftiko: "0.5"
info:
  label: "SAP Material Master Lookup"
  description: "Retrieves material master data from SAP by material number."
  tags:
    - supply-chain
    - erp
    - sap
capability:
  exposes:
    - type: mcp
      namespace: material-master
      port: 8080
      tools:
        - name: get-material-master
          description: "Given a material number, return description, UoM, and material group. Use when supply chain needs material details."
          inputParameters:
            - name: material_number
              in: body
              type: string
              description: "SAP material number."
          call: sap-erp.get-material
          with:
            material: "{{material_number}}"
          outputParameters:
            - name: description
              type: string
              mapping: "$.d.MaterialDescription"
            - name: base_uom
              type: string
              mapping: "$.d.BaseUnitOfMeasure"
  consumes:
    - type: http
      namespace: sap-erp
      baseUri: "https://amgen-s4.sap.com/sap/opu/odata/sap/MM_MATERIAL_SRV"
      authentication:
        type: basic
        username: "$secrets.sap_user"
        password: "$secrets.sap_password"
      resources:
        - name: materials
          path: "/A_Material('{{material}}')"
          inputParameters:
            - name: material
              in: path
          operations:
            - name: get-material
              method: GET

Retrieves a biologics production order from SAP, returning status, planned quantity, actual output, and schedule.

naftiko: "0.5"
info:
  label: "SAP Production Order Status Lookup"
  description: "Retrieves a biologics production order from SAP, returning status, planned quantity, actual output, and schedule."
  tags:
    - manufacturing
    - erp
    - sap
capability:
  exposes:
    - type: mcp
      namespace: production-orders
      port: 8080
      tools:
        - name: get-production-order
          description: "Given a SAP production order number, return status, planned vs actual quantity, and scheduled dates. Use when manufacturing planners need order visibility."
          inputParameters:
            - name: order_number
              in: body
              type: string
              description: "SAP production order number."
          call: sap-erp.get-prod-order
          with:
            order: "{{order_number}}"
          outputParameters:
            - name: status
              type: string
              mapping: "$.d.OrderStatus"
            - name: planned_quantity
              type: number
              mapping: "$.d.PlannedQuantity"
            - name: actual_output
              type: number
              mapping: "$.d.ActualQuantity"
  consumes:
    - type: http
      namespace: sap-erp
      baseUri: "https://amgen-s4.sap.com/sap/opu/odata/sap/PP_PROD_ORDER_SRV"
      authentication:
        type: basic
        username: "$secrets.sap_user"
        password: "$secrets.sap_password"
      resources:
        - name: production-orders
          path: "/A_ProductionOrder('{{order}}')"
          inputParameters:
            - name: order
              in: path
          operations:
            - name: get-prod-order
              method: GET

Looks up an Amgen SAP S/4HANA purchase order by number and returns header status, vendor details, total value, and open line items.

naftiko: "0.5"
info:
  label: "SAP Purchase Order Lookup"
  description: "Looks up an Amgen SAP S/4HANA purchase order by number and returns header status, vendor details, total value, and open line items."
  tags:
    - finance
    - procurement
    - sap
    - erp
capability:
  exposes:
    - type: mcp
      namespace: erp-procurement
      port: 8080
      tools:
        - name: get-purchase-order
          description: "Look up a SAP S/4HANA purchase order by PO number. Returns header status, vendor name, total value, and currency. Use for procurement status checks and invoice matching."
          inputParameters:
            - name: po_number
              in: body
              type: string
              description: "The SAP purchase order number, e.g. 4500012345."
          call: "sap-erp.get-po"
          with:
            po_number: "{{po_number}}"
          outputParameters:
            - name: status
              type: string
              mapping: "$.d.OverallStatus"
            - name: vendor
              type: string
              mapping: "$.d.Supplier.CompanyName"
            - name: total_value
              type: string
              mapping: "$.d.TotalAmount"
            - name: currency
              type: string
              mapping: "$.d.TransactionCurrency"
  consumes:
    - type: http
      namespace: sap-erp
      baseUri: "https://amgen-s4.sap.com/sap/opu/odata/sap/MM_PUR_PO_MAINT_V2_SRV"
      authentication:
        type: basic
        username: "$secrets.sap_user"
        password: "$secrets.sap_password"
      resources:
        - name: purchase-orders
          path: "/A_PurchaseOrder('{{po_number}}')"
          inputParameters:
            - name: po_number
              in: path
          operations:
            - name: get-po
              method: GET
              outputRawFormat: xml

Retrieves quality inspection lot details from SAP, returning results, usage decision, and defect counts.

naftiko: "0.5"
info:
  label: "SAP Quality Inspection Lot Lookup"
  description: "Retrieves quality inspection lot details from SAP, returning results, usage decision, and defect counts."
  tags:
    - quality
    - manufacturing
    - sap
capability:
  exposes:
    - type: mcp
      namespace: quality-inspection
      port: 8080
      tools:
        - name: get-inspection-lot
          description: "Given an inspection lot number, return status, usage decision, and defects. Use when quality reviews inspection results."
          inputParameters:
            - name: inspection_lot
              in: body
              type: string
              description: "SAP inspection lot number."
          call: sap-erp.get-inspection
          with:
            lot: "{{inspection_lot}}"
          outputParameters:
            - name: status
              type: string
              mapping: "$.d.InspectionLotStatus"
            - name: usage_decision
              type: string
              mapping: "$.d.UsageDecision"
  consumes:
    - type: http
      namespace: sap-erp
      baseUri: "https://amgen-s4.sap.com/sap/opu/odata/sap/QM_INSPECTION_SRV"
      authentication:
        type: basic
        username: "$secrets.sap_user"
        password: "$secrets.sap_password"
      resources:
        - name: inspection-lots
          path: "/A_InspectionLot('{{lot}}')"
          inputParameters:
            - name: lot
              in: path
          operations:
            - name: get-inspection
              method: GET

Queries SAP for vendor payment status by invoice number.

naftiko: "0.5"
info:
  label: "SAP Vendor Payment Status Lookup"
  description: "Queries SAP for vendor payment status by invoice number."
  tags:
    - finance
    - procurement
    - sap
capability:
  exposes:
    - type: mcp
      namespace: vendor-payments
      port: 8080
      tools:
        - name: get-payment-status
          description: "Given an invoice number, return payment status, date, and amount. Use when AP verifies vendor payment."
          inputParameters:
            - name: invoice_number
              in: body
              type: string
              description: "SAP invoice document number."
          call: sap-erp.get-invoice-payment
          with:
            invoice: "{{invoice_number}}"
          outputParameters:
            - name: payment_status
              type: string
              mapping: "$.d.PaymentStatus"
            - name: payment_date
              type: string
              mapping: "$.d.PaymentDate"
  consumes:
    - type: http
      namespace: sap-erp
      baseUri: "https://amgen-s4.sap.com/sap/opu/odata/sap/FI_AP_INVOICE_SRV"
      authentication:
        type: basic
        username: "$secrets.sap_user"
        password: "$secrets.sap_password"
      resources:
        - name: invoices
          path: "/A_Invoice('{{invoice}}')/payments"
          inputParameters:
            - name: invoice
              in: path
          operations:
            - name: get-invoice-payment
              method: GET

When a critical security alert fires, creates a security incident, isolates the endpoint, notifies SOC, and logs for compliance.

naftiko: "0.5"
info:
  label: "Security Incident Response Orchestration"
  description: "When a critical security alert fires, creates a security incident, isolates the endpoint, notifies SOC, and logs for compliance."
  tags:
    - security
    - it
    - crowdstrike
    - servicenow
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: security-response
      port: 8080
      tools:
        - name: respond-to-security-incident
          description: "Given a detection ID and hostname, create incident, isolate endpoint, notify SOC. Use when SOC confirms a real threat."
          inputParameters:
            - name: detection_id
              in: body
              type: string
              description: "CrowdStrike detection ID."
            - name: hostname
              in: body
              type: string
              description: "Affected endpoint hostname."
          steps:
            - name: create-sec-incident
              type: call
              call: servicenow.create-incident
              with:
                short_description: "Security incident: threat on {{hostname}}"
                category: "security"
                priority: "1"
                assigned_group: "SOC"
            - name: isolate-endpoint
              type: call
              call: crowdstrike.contain-host
              with:
                hostname: "{{hostname}}"
            - name: notify-soc
              type: call
              call: msteams.send-message
              with:
                channel_id: "security-ops"
                text: "CRITICAL: Security incident {{create-sec-incident.number}} - Host {{hostname}} isolated. Detection: {{detection_id}}"
  consumes:
    - type: http
      namespace: servicenow
      baseUri: "https://amgen.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.servicenow_user"
        password: "$secrets.servicenow_password"
      resources:
        - name: incidents
          path: "/table/incident"
          operations:
            - name: create-incident
              method: POST
    - type: http
      namespace: crowdstrike
      baseUri: "https://api.crowdstrike.com"
      authentication:
        type: bearer
        token: "$secrets.crowdstrike_token"
      resources:
        - name: hosts
          path: "/devices/entities/host-actions/v2"
          operations:
            - name: contain-host
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msteams_token"
      resources:
        - name: messages
          path: "/teams/{{channel_id}}/channels/general/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: send-message
              method: POST

Retrieves the current status and assignment details for a ServiceNow incident by ticket number.

naftiko: "0.5"
info:
  label: "ServiceNow Incident Status Lookup"
  description: "Retrieves the current status and assignment details for a ServiceNow incident by ticket number."
  tags:
    - it
    - servicenow
capability:
  exposes:
    - type: mcp
      namespace: it-incidents
      port: 8080
      tools:
        - name: get-incident-status
          description: "Given a ServiceNow incident number, return current state, priority, and assigned group. Use when IT support checks ticket status."
          inputParameters:
            - name: incident_number
              in: body
              type: string
              description: "ServiceNow incident number."
          call: servicenow.get-incident
          with:
            number: "{{incident_number}}"
          outputParameters:
            - name: state
              type: string
              mapping: "$.result.state"
            - name: priority
              type: string
              mapping: "$.result.priority"
  consumes:
    - type: http
      namespace: servicenow
      baseUri: "https://amgen.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.servicenow_user"
        password: "$secrets.servicenow_password"
      resources:
        - name: incidents
          path: "/table/incident?sysparm_query=number={{number}}"
          inputParameters:
            - name: number
              in: query
          operations:
            - name: get-incident
              method: GET

Searches Amgen SharePoint document libraries by keyword.

naftiko: "0.5"
info:
  label: "SharePoint Document Search"
  description: "Searches Amgen SharePoint document libraries by keyword."
  tags:
    - documentation
    - collaboration
    - sharepoint
capability:
  exposes:
    - type: mcp
      namespace: doc-search
      port: 8080
      tools:
        - name: search-sharepoint
          description: "Given a search query, return matching documents with titles and links. Use when employees search SharePoint."
          inputParameters:
            - name: query
              in: body
              type: string
              description: "Search keywords."
          call: sharepoint.search
          with:
            querytext: "{{query}}"
          outputParameters:
            - name: result_count
              type: integer
              mapping: "$.PrimaryQueryResult.RelevantResults.TotalRows"
  consumes:
    - type: http
      namespace: sharepoint
      baseUri: "https://amgen.sharepoint.com/_api"
      authentication:
        type: bearer
        token: "$secrets.sharepoint_token"
      resources:
        - name: search
          path: "/search/query?querytext='{{querytext}}'"
          inputParameters:
            - name: querytext
              in: query
          operations:
            - name: search
              method: GET

Queries Snowflake for failed or long-running data pipeline tasks and reports their status, enabling data engineering teams to triage issues quickly.

naftiko: "0.5"
info:
  label: "Snowflake Data Pipeline Health Check"
  description: "Queries Snowflake for failed or long-running data pipeline tasks and reports their status, enabling data engineering teams to triage issues quickly."
  tags:
    - data
    - analytics
    - snowflake
    - pipeline-monitoring
capability:
  exposes:
    - type: mcp
      namespace: data-ops
      port: 8080
      tools:
        - name: get-pipeline-task-failures
          description: "Query Snowflake task history for failed or suspended pipeline tasks in a given database and schema. Use to triage data engineering issues and SLA breaches."
          inputParameters:
            - name: database_name
              in: body
              type: string
              description: "The Snowflake database to query, e.g. AMGEN_ANALYTICS."
            - name: schema_name
              in: body
              type: string
              description: "The Snowflake schema to query, e.g. PIPELINES."
            - name: lookback_hours
              in: body
              type: integer
              description: "Number of hours to look back in task history, e.g. 24."
          call: "snowflake.query-task-history"
          with:
            database: "{{database_name}}"
            schema: "{{schema_name}}"
            hours: "{{lookback_hours}}"
          outputParameters:
            - name: failed_tasks
              type: array
              mapping: "$.data"
  consumes:
    - type: http
      namespace: snowflake
      baseUri: "https://amgen.snowflakecomputing.com/api/v2"
      authentication:
        type: bearer
        token: "$secrets.snowflake_token"
      resources:
        - name: task-history
          path: "/databases/{{database}}/schemas/{{schema}}/tasks/history"
          inputParameters:
            - name: database
              in: path
            - name: schema
              in: path
            - name: hours
              in: query
          operations:
            - name: query-task-history
              method: GET

When a Snowflake data quality check fails, creates a Jira data quality issue and notifies the data engineering team via Microsoft Teams.

naftiko: "0.5"
info:
  label: "Snowflake Data Quality Alert"
  description: "When a Snowflake data quality check fails, creates a Jira data quality issue and notifies the data engineering team via Microsoft Teams."
  tags:
    - data
    - analytics
    - snowflake
    - jira
    - data-quality
capability:
  exposes:
    - type: mcp
      namespace: data-quality
      port: 8080
      tools:
        - name: handle-data-quality-failure
          description: "Given a Snowflake data quality check failure for a specific table, open a Jira data quality issue and notify the data engineering team in Teams."
          inputParameters:
            - name: table_name
              in: body
              type: string
              description: "The fully qualified Snowflake table name that failed the quality check."
            - name: check_name
              in: body
              type: string
              description: "The name of the data quality check that failed."
            - name: failure_detail
              in: body
              type: string
              description: "Description of what failed and relevant metrics."
          steps:
            - name: create-dq-issue
              type: call
              call: "jira-dq.create-issue"
              with:
                project_key: "DATA"
                issuetype: "Bug"
                summary: "[DQ Failure] {{table_name}} — {{check_name}}"
                description: "Data quality check {{check_name}} failed on table {{table_name}}. Detail: {{failure_detail}}."
            - name: notify-data-team
              type: call
              call: "msteams-dq.post-channel-message"
              with:
                channel_id: "data-engineering-alerts"
                message: "Data Quality Failure: {{table_name}} | Check: {{check_name}} | Jira: {{create-dq-issue.key}}"
  consumes:
    - type: http
      namespace: jira-dq
      baseUri: "https://amgen.atlassian.net/rest/api/3"
      authentication:
        type: basic
        username: "$secrets.jira_user"
        password: "$secrets.jira_api_token"
      resources:
        - name: issues
          path: "/issue"
          operations:
            - name: create-issue
              method: POST
    - type: http
      namespace: msteams-dq
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: channel-messages
          path: "/teams/{{channel_id}}/channels/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-channel-message
              method: POST

Monitors drug product stability studies by checking timepoint results, flagging out-of-trend data, and notifying the stability team.

naftiko: "0.5"
info:
  label: "Stability Study Monitoring Orchestration"
  description: "Monitors drug product stability studies by checking timepoint results, flagging out-of-trend data, and notifying the stability team."
  tags:
    - quality
    - rd
    - manufacturing
    - snowflake
    - servicenow
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: stability-monitoring
      port: 8080
      tools:
        - name: check-stability-timepoint
          description: "Given a stability protocol ID and timepoint, check results, flag trends, and notify team. Use when stability lab reports new timepoint data."
          inputParameters:
            - name: protocol_id
              in: body
              type: string
              description: "Stability protocol identifier."
            - name: timepoint
              in: body
              type: string
              description: "Timepoint in months."
          steps:
            - name: get-results
              type: call
              call: snowflake.execute-query
              with:
                query_name: "stability_timepoint_results"
                params: "{{protocol_id}},{{timepoint}}"
            - name: check-trends
              type: call
              call: snowflake.execute-query
              with:
                query_name: "stability_trend_analysis"
                params: "{{protocol_id}}"
            - name: notify-team
              type: call
              call: msteams.send-message
              with:
                channel_id: "stability-studies"
                text: "Stability {{protocol_id}} T={{timepoint}}mo: All specs met: {{get-results.all_pass}}. Trend alert: {{check-trends.trend_flag}}."
  consumes:
    - type: http
      namespace: snowflake
      baseUri: "https://amgen.snowflakecomputing.com/api/v2"
      authentication:
        type: bearer
        token: "$secrets.snowflake_token"
      resources:
        - name: statements
          path: "/statements"
          operations:
            - name: execute-query
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msteams_token"
      resources:
        - name: messages
          path: "/teams/{{channel_id}}/channels/general/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: send-message
              method: POST

Generates a supplier quality scorecard by pulling rejection rates from SAP, audit findings from ServiceNow, and delivery performance metrics.

naftiko: "0.5"
info:
  label: "Supplier Quality Scorecard Generation"
  description: "Generates a supplier quality scorecard by pulling rejection rates from SAP, audit findings from ServiceNow, and delivery performance metrics."
  tags:
    - quality
    - procurement
    - sap
    - servicenow
    - snowflake
capability:
  exposes:
    - type: mcp
      namespace: supplier-quality
      port: 8080
      tools:
        - name: generate-supplier-scorecard
          description: "Given a supplier ID, gather rejection rates, audit findings, and delivery metrics for a quality scorecard. Use when procurement evaluates supplier performance."
          inputParameters:
            - name: supplier_id
              in: body
              type: string
              description: "SAP supplier/vendor number."
          steps:
            - name: get-rejection-data
              type: call
              call: sap-erp.get-supplier-rejections
              with:
                vendor_id: "{{supplier_id}}"
            - name: get-audit-findings
              type: call
              call: servicenow.query-supplier-audits
              with:
                supplier_id: "{{supplier_id}}"
            - name: calculate-scorecard
              type: call
              call: snowflake.execute-query
              with:
                query_name: "supplier_scorecard"
                params: "{{supplier_id}},{{get-rejection-data.rejection_rate}},{{get-audit-findings.findings_count}}"
  consumes:
    - type: http
      namespace: sap-erp
      baseUri: "https://amgen-s4.sap.com/sap/opu/odata/sap/MM_VENDOR_SRV"
      authentication:
        type: basic
        username: "$secrets.sap_user"
        password: "$secrets.sap_password"
      resources:
        - name: rejections
          path: "/A_VendorRejection(Vendor='{{vendor_id}}')"
          inputParameters:
            - name: vendor_id
              in: path
          operations:
            - name: get-supplier-rejections
              method: GET
    - type: http
      namespace: servicenow
      baseUri: "https://amgen.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.servicenow_user"
        password: "$secrets.servicenow_password"
      resources:
        - name: audits
          path: "/table/u_supplier_audit"
          operations:
            - name: query-supplier-audits
              method: GET
    - type: http
      namespace: snowflake
      baseUri: "https://amgen.snowflakecomputing.com/api/v2"
      authentication:
        type: bearer
        token: "$secrets.snowflake_token"
      resources:
        - name: statements
          path: "/statements"
          operations:
            - name: execute-query
              method: POST

When a supply chain risk is identified for a critical raw material, creates a ServiceNow procurement task, updates the Salesforce supply record, and alerts the procurement team in Teams.

naftiko: "0.5"
info:
  label: "Supply Chain Disruption Alert"
  description: "When a supply chain risk is identified for a critical raw material, creates a ServiceNow procurement task, updates the Salesforce supply record, and alerts the procurement team in Teams."
  tags:
    - supply-chain
    - procurement
    - servicenow
    - salesforce
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: supply-chain-ops
      port: 8080
      tools:
        - name: handle-supply-disruption
          description: "Given a material ID, supplier name, and disruption severity, create a ServiceNow procurement task, update the Salesforce supply record, and notify the procurement team in Teams."
          inputParameters:
            - name: material_id
              in: body
              type: string
              description: "The SAP material ID for the at-risk raw material."
            - name: supplier_name
              in: body
              type: string
              description: "The supplier name experiencing the disruption."
            - name: disruption_type
              in: body
              type: string
              description: "Type of disruption: shortage, delay, quality_issue, or force_majeure."
            - name: severity
              in: body
              type: string
              description: "Disruption severity: critical, high, medium, or low."
          steps:
            - name: create-procurement-task
              type: call
              call: "servicenow-sc.create-task"
              with:
                short_description: "Supply disruption: {{material_id}} from {{supplier_name}}"
                description: "Disruption type: {{disruption_type}}. Severity: {{severity}}."
                assignment_group: "Procurement"
            - name: update-supply-record
              type: call
              call: "salesforce-sc.update-record"
              with:
                object_type: "Supply_Record__c"
                material_id: "{{material_id}}"
                status: "Disrupted"
                disruption_type: "{{disruption_type}}"
            - name: alert-procurement
              type: call
              call: "msteams-sc.post-channel-message"
              with:
                channel_id: "procurement-alerts"
                message: "Supply Disruption: {{material_id}} from {{supplier_name}} | Type: {{disruption_type}} | Severity: {{severity}} | Task: {{create-procurement-task.number}}"
  consumes:
    - type: http
      namespace: servicenow-sc
      baseUri: "https://amgen.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.servicenow_user"
        password: "$secrets.servicenow_password"
      resources:
        - name: tasks
          path: "/table/task"
          operations:
            - name: create-task
              method: POST
    - type: http
      namespace: salesforce-sc
      baseUri: "https://amgen.my.salesforce.com/services/data/v58.0"
      authentication:
        type: bearer
        token: "$secrets.salesforce_token"
      resources:
        - name: supply-records
          path: "/sobjects/Supply_Record__c"
          operations:
            - name: update-record
              method: PATCH
    - type: http
      namespace: msteams-sc
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: channel-messages
          path: "/teams/{{channel_id}}/channels/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-channel-message
              method: POST

When a supply chain disruption is detected, identifies impacted POs, notifies procurement, and creates sourcing tasks.

naftiko: "0.5"
info:
  label: "Supply Chain Disruption Response Orchestration"
  description: "When a supply chain disruption is detected, identifies impacted POs, notifies procurement, and creates sourcing tasks."
  tags:
    - supply-chain
    - procurement
    - sap
    - servicenow
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: supply-disruption
      port: 8080
      tools:
        - name: respond-to-disruption
          description: "Given a supplier ID and disruption type, identify impacted POs, alert procurement, and create sourcing tasks. Use when supply chain detects disruption."
          inputParameters:
            - name: supplier_id
              in: body
              type: string
              description: "SAP vendor number."
            - name: disruption_type
              in: body
              type: string
              description: "Disruption type."
          steps:
            - name: get-impacted-pos
              type: call
              call: sap-erp.query-open-pos
              with:
                vendor_id: "{{supplier_id}}"
            - name: create-sourcing-task
              type: call
              call: servicenow.create-task
              with:
                short_description: "Alt sourcing: {{disruption_type}} from {{supplier_id}}"
                category: "procurement"
                priority: "1"
                assigned_group: "Strategic_Sourcing"
            - name: notify
              type: call
              call: msteams.send-message
              with:
                channel_id: "supply-chain-ops"
                text: "DISRUPTION: Vendor {{supplier_id}} - {{disruption_type}}. Impacted POs: {{get-impacted-pos.count}}. Task: {{create-sourcing-task.number}}"
  consumes:
    - type: http
      namespace: sap-erp
      baseUri: "https://amgen-s4.sap.com/sap/opu/odata/sap/MM_PUR_PO_MAINT_V2_SRV"
      authentication:
        type: basic
        username: "$secrets.sap_user"
        password: "$secrets.sap_password"
      resources:
        - name: purchase-orders
          path: "/A_PurchaseOrder"
          operations:
            - name: query-open-pos
              method: GET
    - type: http
      namespace: servicenow
      baseUri: "https://amgen.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.servicenow_user"
        password: "$secrets.servicenow_password"
      resources:
        - name: tasks
          path: "/table/sc_task"
          operations:
            - name: create-task
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msteams_token"
      resources:
        - name: messages
          path: "/teams/{{channel_id}}/channels/general/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: send-message
              method: POST

Triggers a Tableau workbook extract refresh and notifies stakeholders in Teams when the refresh completes or fails.

naftiko: "0.5"
info:
  label: "Tableau Dashboard Refresh Trigger"
  description: "Triggers a Tableau workbook extract refresh and notifies stakeholders in Teams when the refresh completes or fails."
  tags:
    - data
    - analytics
    - tableau
    - reporting
capability:
  exposes:
    - type: mcp
      namespace: bi-reporting
      port: 8080
      tools:
        - name: refresh-tableau-workbook
          description: "Given a Tableau workbook ID and site name, trigger an extract refresh and notify the designated stakeholder channel in Teams when complete."
          inputParameters:
            - name: workbook_id
              in: body
              type: string
              description: "The Tableau workbook ID to refresh."
            - name: site_name
              in: body
              type: string
              description: "The Tableau site name, e.g. amgen."
            - name: notification_channel
              in: body
              type: string
              description: "The Teams channel ID to notify on completion."
          steps:
            - name: trigger-refresh
              type: call
              call: "tableau.refresh-workbook"
              with:
                workbook_id: "{{workbook_id}}"
                site: "{{site_name}}"
            - name: notify-stakeholders
              type: call
              call: "msteams-bi.post-channel-message"
              with:
                channel_id: "{{notification_channel}}"
                message: "Tableau workbook {{workbook_id}} refresh triggered. Job ID: {{trigger-refresh.job_id}}."
  consumes:
    - type: http
      namespace: tableau
      baseUri: "https://tableau.amgen.com/api/2.8"
      authentication:
        type: apikey
        key: "X-Tableau-Auth"
        value: "$secrets.tableau_token"
        placement: header
      resources:
        - name: workbook-refresh
          path: "/sites/{{site}}/workbooks/{{workbook_id}}/refresh"
          inputParameters:
            - name: site
              in: path
            - name: workbook_id
              in: path
          operations:
            - name: refresh-workbook
              method: POST
    - type: http
      namespace: msteams-bi
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: channel-messages
          path: "/teams/{{channel_id}}/channels/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-channel-message
              method: POST

Triggers a refresh of a quality metrics Tableau dashboard.

naftiko: "0.5"
info:
  label: "Tableau Quality Dashboard Refresh"
  description: "Triggers a refresh of a quality metrics Tableau dashboard."
  tags:
    - quality
    - analytics
    - tableau
capability:
  exposes:
    - type: mcp
      namespace: quality-analytics
      port: 8080
      tools:
        - name: refresh-quality-dashboard
          description: "Given a workbook name, trigger a data refresh. Use when quality needs updated metrics."
          inputParameters:
            - name: workbook_name
              in: body
              type: string
              description: "Tableau workbook name."
          call: tableau.trigger-refresh
          with:
            workbook: "{{workbook_name}}"
          outputParameters:
            - name: job_id
              type: string
              mapping: "$.job.id"
  consumes:
    - type: http
      namespace: tableau
      baseUri: "https://amgen.online.tableau.com/api/3.19"
      authentication:
        type: bearer
        token: "$secrets.tableau_token"
      resources:
        - name: workbooks
          path: "/sites/{{site_id}}/workbooks/{{workbook}}/refresh"
          inputParameters:
            - name: workbook
              in: path
          operations:
            - name: trigger-refresh
              method: POST

Creates a new Terraform Cloud workspace for a given project and environment, applies initial variable sets, and notifies the infrastructure team in Teams.

naftiko: "0.5"
info:
  label: "Terraform Cloud Workspace Provisioning"
  description: "Creates a new Terraform Cloud workspace for a given project and environment, applies initial variable sets, and notifies the infrastructure team in Teams."
  tags:
    - cloud
    - infrastructure
    - terraform
    - devops
capability:
  exposes:
    - type: mcp
      namespace: infra-provisioning
      port: 8080
      tools:
        - name: provision-terraform-workspace
          description: "Given a project name and environment, create a Terraform Cloud workspace, configure variable sets, and notify the infrastructure team in Teams."
          inputParameters:
            - name: project_name
              in: body
              type: string
              description: "The project name for the new workspace, e.g. genomics-pipeline."
            - name: environment
              in: body
              type: string
              description: "The deployment environment: dev, staging, or prod."
            - name: terraform_org
              in: body
              type: string
              description: "The Terraform Cloud organization name, e.g. amgen."
          steps:
            - name: create-workspace
              type: call
              call: "terraform.create-workspace"
              with:
                org: "{{terraform_org}}"
                name: "{{project_name}}-{{environment}}"
            - name: notify-infra
              type: call
              call: "msteams-tf.post-channel-message"
              with:
                channel_id: "infrastructure-team"
                message: "Terraform workspace created: {{project_name}}-{{environment}} in org {{terraform_org}}. ID: {{create-workspace.workspace_id}}."
  consumes:
    - type: http
      namespace: terraform
      baseUri: "https://app.terraform.io/api/v2"
      authentication:
        type: bearer
        token: "$secrets.terraform_token"
      resources:
        - name: workspaces
          path: "/organizations/{{org}}/workspaces"
          inputParameters:
            - name: org
              in: path
          operations:
            - name: create-workspace
              method: POST
    - type: http
      namespace: msteams-tf
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: channel-messages
          path: "/teams/{{channel_id}}/channels/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-channel-message
              method: POST

Provisions a cloud environment by triggering Terraform, configuring monitoring, creating CMDB record, and notifying DevOps.

naftiko: "0.5"
info:
  label: "Terraform Environment Provisioning Orchestration"
  description: "Provisions a cloud environment by triggering Terraform, configuring monitoring, creating CMDB record, and notifying DevOps."
  tags:
    - devops
    - cloud
    - terraform
    - datadog
    - servicenow
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: env-provisioning
      port: 8080
      tools:
        - name: provision-environment
          description: "Given environment name and workspace ID, run Terraform, configure monitoring, register in CMDB, and notify. Use when engineering needs a new environment."
          inputParameters:
            - name: environment_name
              in: body
              type: string
              description: "Environment name."
            - name: workspace_id
              in: body
              type: string
              description: "Terraform workspace ID."
          steps:
            - name: trigger-terraform
              type: call
              call: terraform.create-run
              with:
                workspace_id: "{{workspace_id}}"
                message: "Provisioning {{environment_name}}"
            - name: configure-monitoring
              type: call
              call: datadog.create-monitor
              with:
                name: "{{environment_name}} health"
                query: "service:{{environment_name}}"
            - name: create-cmdb
              type: call
              call: servicenow.create-ci
              with:
                name: "{{environment_name}}"
                category: "cloud_environment"
            - name: notify
              type: call
              call: msteams.send-message
              with:
                channel_id: "devops"
                text: "Environment {{environment_name}} provisioning started. Run: {{trigger-terraform.run_id}}"
  consumes:
    - type: http
      namespace: terraform
      baseUri: "https://app.terraform.io/api/v2"
      authentication:
        type: bearer
        token: "$secrets.terraform_token"
      resources:
        - name: runs
          path: "/workspaces/{{workspace_id}}/runs"
          inputParameters:
            - name: workspace_id
              in: path
          operations:
            - name: create-run
              method: POST
    - type: http
      namespace: datadog
      baseUri: "https://api.datadoghq.com/api/v1"
      authentication:
        type: apikey
        key: "DD-API-KEY"
        value: "$secrets.datadog_api_key"
        placement: header
      resources:
        - name: monitors
          path: "/monitor"
          operations:
            - name: create-monitor
              method: POST
    - type: http
      namespace: servicenow
      baseUri: "https://amgen.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.servicenow_user"
        password: "$secrets.servicenow_password"
      resources:
        - name: cmdb
          path: "/table/cmdb_ci"
          operations:
            - name: create-ci
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msteams_token"
      resources:
        - name: messages
          path: "/teams/{{channel_id}}/channels/general/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: send-message
              method: POST

Retrieves a regulatory or quality document from Veeva Vault by document number.

naftiko: "0.5"
info:
  label: "Veeva Vault Document Retrieval"
  description: "Retrieves a regulatory or quality document from Veeva Vault by document number."
  tags:
    - regulatory
    - quality
    - veeva-vault
capability:
  exposes:
    - type: mcp
      namespace: vault-documents
      port: 8080
      tools:
        - name: get-vault-document
          description: "Given a Veeva Vault document number, return metadata, version, and lifecycle state. Use when teams locate regulated documents."
          inputParameters:
            - name: document_number
              in: body
              type: string
              description: "Veeva Vault document number."
          call: veeva-vault.get-document
          with:
            doc_number: "{{document_number}}"
          outputParameters:
            - name: title
              type: string
              mapping: "$.data.name__v"
            - name: version
              type: string
              mapping: "$.data.major_version_number__v"
            - name: lifecycle_state
              type: string
              mapping: "$.data.status__v"
  consumes:
    - type: http
      namespace: veeva-vault
      baseUri: "https://amgen-regulatory.veevavault.com/api/v24.1"
      authentication:
        type: bearer
        token: "$secrets.veeva_vault_token"
      resources:
        - name: documents
          path: "/objects/documents/{{doc_number}}"
          inputParameters:
            - name: doc_number
              in: path
          operations:
            - name: get-document
              method: GET

Retrieves the version history of a Veeva Vault regulatory document and checks it against compliance audit requirements, returning a structured audit trail.

naftiko: "0.5"
info:
  label: "Veeva Vault Document Version Audit"
  description: "Retrieves the version history of a Veeva Vault regulatory document and checks it against compliance audit requirements, returning a structured audit trail."
  tags:
    - regulatory
    - compliance
    - veeva
    - audit
capability:
  exposes:
    - type: mcp
      namespace: doc-audit
      port: 8080
      tools:
        - name: audit-document-versions
          description: "Given a Veeva Vault document ID, retrieve all version history entries and return a structured audit trail for compliance review."
          inputParameters:
            - name: vault_doc_id
              in: body
              type: string
              description: "The Veeva Vault document ID to audit."
          call: "veeva-audit.get-document-versions"
          with:
            doc_id: "{{vault_doc_id}}"
          outputParameters:
            - name: versions
              type: array
              mapping: "$.data"
  consumes:
    - type: http
      namespace: veeva-audit
      baseUri: "https://amgen.veevavault.com/api/v23.1"
      authentication:
        type: bearer
        token: "$secrets.veeva_vault_token"
      resources:
        - name: document-versions
          path: "/objects/documents/{{doc_id}}/versions"
          inputParameters:
            - name: doc_id
              in: path
          operations:
            - name: get-document-versions
              method: GET

Performs vendor risk assessment by querying SAP financial data, compliance records, and calculating a risk score.

naftiko: "0.5"
info:
  label: "Vendor Risk Assessment Orchestration"
  description: "Performs vendor risk assessment by querying SAP financial data, compliance records, and calculating a risk score."
  tags:
    - procurement
    - compliance
    - sap
    - servicenow
    - snowflake
capability:
  exposes:
    - type: mcp
      namespace: vendor-risk
      port: 8080
      tools:
        - name: assess-vendor-risk
          description: "Given a vendor ID, collect financial data, compliance records, and calculate risk score. Use when procurement evaluates vendor risk."
          inputParameters:
            - name: vendor_id
              in: body
              type: string
              description: "SAP vendor number."
          steps:
            - name: get-financials
              type: call
              call: sap-erp.get-vendor-master
              with:
                vendor_id: "{{vendor_id}}"
            - name: get-compliance
              type: call
              call: servicenow.query-vendor-compliance
              with:
                vendor_id: "{{vendor_id}}"
            - name: calculate-score
              type: call
              call: snowflake.execute-query
              with:
                query_name: "vendor_risk_score"
                params: "{{vendor_id}}"
  consumes:
    - type: http
      namespace: sap-erp
      baseUri: "https://amgen-s4.sap.com/sap/opu/odata/sap/MM_VENDOR_SRV"
      authentication:
        type: basic
        username: "$secrets.sap_user"
        password: "$secrets.sap_password"
      resources:
        - name: vendors
          path: "/A_Vendor('{{vendor_id}}')"
          inputParameters:
            - name: vendor_id
              in: path
          operations:
            - name: get-vendor-master
              method: GET
    - type: http
      namespace: servicenow
      baseUri: "https://amgen.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.servicenow_user"
        password: "$secrets.servicenow_password"
      resources:
        - name: compliance
          path: "/table/u_vendor_compliance"
          operations:
            - name: query-vendor-compliance
              method: GET
    - type: http
      namespace: snowflake
      baseUri: "https://amgen.snowflakecomputing.com/api/v2"
      authentication:
        type: bearer
        token: "$secrets.snowflake_token"
      resources:
        - name: statements
          path: "/statements"
          operations:
            - name: execute-query
              method: POST

Retrieves employee benefits enrollment status from Workday.

naftiko: "0.5"
info:
  label: "Workday Benefits Enrollment Status"
  description: "Retrieves employee benefits enrollment status from Workday."
  tags:
    - hr
    - benefits
    - workday
capability:
  exposes:
    - type: mcp
      namespace: benefits
      port: 8080
      tools:
        - name: get-benefits-status
          description: "Given a worker ID, return benefits elections and enrollment deadline. Use when HR or employees check benefits."
          inputParameters:
            - name: worker_id
              in: body
              type: string
              description: "Workday worker ID."
          call: workday.get-benefits
          with:
            worker_id: "{{worker_id}}"
          outputParameters:
            - name: medical_plan
              type: string
              mapping: "$.data.medical_plan"
            - name: enrollment_deadline
              type: string
              mapping: "$.data.enrollment_deadline"
  consumes:
    - type: http
      namespace: workday
      baseUri: "https://wd2-impl-services1.workday.com/ccx/api/v1"
      authentication:
        type: bearer
        token: "$secrets.workday_token"
      resources:
        - name: benefits
          path: "/workers/{{worker_id}}/benefits"
          inputParameters:
            - name: worker_id
              in: path
          operations:
            - name: get-benefits
              method: GET

Launches a compensation review cycle by pulling performance data, generating recommendations, and notifying managers.

naftiko: "0.5"
info:
  label: "Workday Compensation Review Orchestration"
  description: "Launches a compensation review cycle by pulling performance data, generating recommendations, and notifying managers."
  tags:
    - hr
    - finance
    - workday
    - servicenow
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: comp-review
      port: 8080
      tools:
        - name: launch-comp-review
          description: "Given department and cycle name, pull performance, generate recommendations, and notify. Use when HR launches annual comp reviews."
          inputParameters:
            - name: department_code
              in: body
              type: string
              description: "Department code."
            - name: cycle_name
              in: body
              type: string
              description: "Review cycle name."
          steps:
            - name: get-performance
              type: call
              call: workday.get-performance-ratings
              with:
                department: "{{department_code}}"
            - name: generate-recommendations
              type: call
              call: workday.create-comp-recommendations
              with:
                department: "{{department_code}}"
                cycle: "{{cycle_name}}"
            - name: create-task
              type: call
              call: servicenow.create-task
              with:
                short_description: "Comp review: {{department_code}} - {{cycle_name}}"
                assigned_group: "HR_Compensation"
            - name: notify
              type: call
              call: msteams.send-message
              with:
                channel_id: "hr-compensation"
                text: "Comp review '{{cycle_name}}' launched for {{department_code}}. Task: {{create-task.number}}"
  consumes:
    - type: http
      namespace: workday
      baseUri: "https://wd2-impl-services1.workday.com/ccx/api/v1"
      authentication:
        type: bearer
        token: "$secrets.workday_token"
      resources:
        - name: performance
          path: "/performance/ratings"
          operations:
            - name: get-performance-ratings
              method: GET
        - name: compensation
          path: "/compensation/recommendations"
          operations:
            - name: create-comp-recommendations
              method: POST
    - type: http
      namespace: servicenow
      baseUri: "https://amgen.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.servicenow_user"
        password: "$secrets.servicenow_password"
      resources:
        - name: tasks
          path: "/table/sc_task"
          operations:
            - name: create-task
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msteams_token"
      resources:
        - name: messages
          path: "/teams/{{channel_id}}/channels/general/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: send-message
              method: POST

Retrieves an employee profile from Workday by worker ID, returning name, department, job title, and location.

naftiko: "0.5"
info:
  label: "Workday Employee Profile Lookup"
  description: "Retrieves an employee profile from Workday by worker ID, returning name, department, job title, and location."
  tags:
    - hr
    - workday
capability:
  exposes:
    - type: mcp
      namespace: hr-profile
      port: 8080
      tools:
        - name: get-employee-profile
          description: "Given a Workday worker ID, return employee name, department, title, and location. Use when HR or managers need employee information."
          inputParameters:
            - name: worker_id
              in: body
              type: string
              description: "Workday worker ID."
          call: workday.get-worker
          with:
            worker_id: "{{worker_id}}"
          outputParameters:
            - name: full_name
              type: string
              mapping: "$.data.full_name"
            - name: department
              type: string
              mapping: "$.data.department"
            - name: job_title
              type: string
              mapping: "$.data.job_title"
  consumes:
    - type: http
      namespace: workday
      baseUri: "https://wd2-impl-services1.workday.com/ccx/api/v1"
      authentication:
        type: bearer
        token: "$secrets.workday_token"
      resources:
        - name: workers
          path: "/workers/{{worker_id}}"
          inputParameters:
            - name: worker_id
              in: path
          operations:
            - name: get-worker
              method: GET

Retrieves open job requisitions from Workday by department.

naftiko: "0.5"
info:
  label: "Workday Open Requisition Report"
  description: "Retrieves open job requisitions from Workday by department."
  tags:
    - hr
    - recruiting
    - workday
capability:
  exposes:
    - type: mcp
      namespace: talent-acquisition
      port: 8080
      tools:
        - name: get-open-requisitions
          description: "Given a department code, return open requisition count and average days open. Use when HR needs recruiting visibility."
          inputParameters:
            - name: department_code
              in: body
              type: string
              description: "Workday department code."
          call: workday.get-requisitions
          with:
            department: "{{department_code}}"
            status: "open"
          outputParameters:
            - name: open_count
              type: integer
              mapping: "$.data.total"
            - name: avg_days_open
              type: number
              mapping: "$.data.avg_days_open"
  consumes:
    - type: http
      namespace: workday
      baseUri: "https://wd2-impl-services1.workday.com/ccx/api/v1"
      authentication:
        type: bearer
        token: "$secrets.workday_token"
      resources:
        - name: requisitions
          path: "/recruiting/requisitions"
          operations:
            - name: get-requisitions
              method: GET

When an employee changes roles in Workday, updates their Okta group memberships, adjusts Salesforce profile permissions, and notifies the new manager via Teams.

naftiko: "0.5"
info:
  label: "Workday Role Change Provisioning"
  description: "When an employee changes roles in Workday, updates their Okta group memberships, adjusts Salesforce profile permissions, and notifies the new manager via Teams."
  tags:
    - hr
    - identity
    - workday
    - okta
    - salesforce
capability:
  exposes:
    - type: mcp
      namespace: hr-role-change
      port: 8080
      tools:
        - name: sync-role-change
          description: "Given a Workday employee ID and new role details, update Okta group assignments, adjust Salesforce profile, and notify the new manager in Teams."
          inputParameters:
            - name: workday_employee_id
              in: body
              type: string
              description: "The Workday worker ID for the employee changing roles."
            - name: new_role
              in: body
              type: string
              description: "The new job role or title."
            - name: new_manager_upn
              in: body
              type: string
              description: "The UPN of the new manager."
          steps:
            - name: get-worker
              type: call
              call: "workday-role.get-worker"
              with:
                worker_id: "{{workday_employee_id}}"
            - name: update-okta-groups
              type: call
              call: "okta-role.update-user-groups"
              with:
                user_id: "{{get-worker.okta_user_id}}"
                new_department: "{{get-worker.new_department}}"
            - name: notify-new-manager
              type: call
              call: "msteams-role.send-message"
              with:
                recipient_upn: "{{new_manager_upn}}"
                message: "{{get-worker.full_name}} has been assigned to your team in role: {{new_role}}. Okta and Salesforce access updated."
  consumes:
    - type: http
      namespace: workday-role
      baseUri: "https://wd2-impl-services1.workday.com/ccx/api/v1"
      authentication:
        type: bearer
        token: "$secrets.workday_token"
      resources:
        - name: workers
          path: "/amgen/workers/{{worker_id}}"
          inputParameters:
            - name: worker_id
              in: path
          operations:
            - name: get-worker
              method: GET
    - type: http
      namespace: okta-role
      baseUri: "https://amgen.okta.com/api/v1"
      authentication:
        type: apikey
        key: "Authorization"
        value: "$secrets.okta_api_token"
        placement: header
      resources:
        - name: users
          path: "/users/{{user_id}}/groups"
          inputParameters:
            - name: user_id
              in: path
          operations:
            - name: update-user-groups
              method: PUT
    - type: http
      namespace: msteams-role
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: chats
          path: "/users/{{recipient_upn}}/chats"
          inputParameters:
            - name: recipient_upn
              in: path
          operations:
            - name: send-message
              method: POST