Lockheed Martin Capabilities

Retrieves payroll processing status from ADP for a given pay period, returning completion status and error count for DCAA-compliant payroll verification.

naftiko: "0.5"
info:
  label: "ADP Payroll Status Lookup"
  description: "Retrieves payroll processing status from ADP for a given pay period, returning completion status and error count for DCAA-compliant payroll verification."
  tags:
    - payroll
    - adp
    - compliance
    - dcaa
    - finance
capability:
  exposes:
    - type: mcp
      namespace: payroll
      port: 8080
      tools:
        - name: get-payroll-status
          description: "Given a pay period date, return the payroll processing status, record count, and error count. Use for DCAA payroll compliance and audit preparation."
          inputParameters:
            - name: pay_period_date
              in: body
              type: string
              description: "The pay period end date in YYYY-MM-DD format."
          call: adp.get-payroll-status
          with:
            pay_period_date: "{{pay_period_date}}"
          outputParameters:
            - name: status
              type: string
              mapping: "$.payrollStatus"
            - name: record_count
              type: integer
              mapping: "$.totalRecords"
            - name: error_count
              type: integer
              mapping: "$.errorCount"
  consumes:
    - type: http
      namespace: adp
      baseUri: "https://api.adp.com/payroll/v1"
      authentication:
        type: bearer
        token: "$secrets.adp_token"
      resources:
        - name: payroll
          path: "/payroll-outputs?payPeriodEndDate={{pay_period_date}}"
          inputParameters:
            - name: pay_period_date
              in: path
          operations:
            - name: get-payroll-status
              method: GET

Uses Anthropic Claude to analyze program risk registers retrieved from SharePoint and generates a concise risk summary for program managers, highlighting top risks and recommended mitigations.

naftiko: "0.5"
info:
  label: "AI-Assisted Program Risk Assessment Summarization"
  description: "Uses Anthropic Claude to analyze program risk registers retrieved from SharePoint and generates a concise risk summary for program managers, highlighting top risks and recommended mitigations."
  tags:
    - ai
    - program-management
    - anthropic
    - sharepoint
    - risk-management
capability:
  exposes:
    - type: mcp
      namespace: ai-risk
      port: 8080
      tools:
        - name: summarize-program-risks
          description: "Given a SharePoint document URL for a program risk register, retrieve the document, send to Anthropic Claude for structured risk analysis (top risks, likelihood, impact, mitigations), and write the summary back to SharePoint. Use for quarterly program risk reviews and IPR preparation."
          inputParameters:
            - name: site_id
              in: body
              type: string
              description: "The SharePoint site ID for the program documentation."
            - name: document_path
              in: body
              type: string
              description: "Relative path to the risk register document in SharePoint."
          steps:
            - name: get-risk-register
              type: call
              call: sharepoint.get-document
              with:
                site_id: "{{site_id}}"
                path: "{{document_path}}"
            - name: analyze-risks
              type: call
              call: anthropic.create-message
              with:
                model: "claude-opus-4-5"
                content: "Analyze this defense program risk register. Identify the top 5 risks by severity, assess likelihood and impact for each, and recommend specific mitigations. Format as a structured executive summary. Document: {{get-risk-register.content}}"
            - name: write-summary
              type: call
              call: sharepoint.create-file
              with:
                site_id: "{{site_id}}"
                filename: "risk-summary.md"
                content: "{{analyze-risks.text}}"
  consumes:
    - type: http
      namespace: sharepoint
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: documents
          path: "/sites/{{site_id}}/drive/root/children"
          inputParameters:
            - name: site_id
              in: path
          operations:
            - name: get-document
              method: GET
            - name: create-file
              method: PUT
    - type: http
      namespace: anthropic
      baseUri: "https://api.anthropic.com/v1"
      authentication:
        type: apikey
        key: "x-api-key"
        value: "$secrets.anthropic_api_key"
        placement: header
      resources:
        - name: messages
          path: "/messages"
          operations:
            - name: create-message
              method: POST

Manages data lifecycle for classified S3 buckets in GovCloud, applies retention policies, audits access logs, creates a ServiceNow compliance ticket, and notifies the data governance team via Teams.

naftiko: "0.5"
info:
  label: "Amazon S3 Classified Data Lifecycle Manager"
  description: "Manages data lifecycle for classified S3 buckets in GovCloud, applies retention policies, audits access logs, creates a ServiceNow compliance ticket, and notifies the data governance team via Teams."
  tags:
    - cloud
    - amazon-web-services
    - servicenow
    - microsoft-teams
    - data-governance
capability:
  exposes:
    - type: mcp
      namespace: cloud
      port: 8080
      tools:
        - name: trigger-s3-lifecycle
          description: "Given an S3 bucket name in GovCloud, audit access logs, apply retention policies, create a ServiceNow compliance ticket, and notify the data governance team."
          inputParameters:
            - name: bucket_name
              in: body
              type: string
              description: "The S3 bucket name in GovCloud."
          steps:
            - name: get-bucket-info
              type: call
              call: aws.get-bucket-info
              with:
                bucket_name: "{{bucket_name}}"
            - name: create-compliance-ticket
              type: call
              call: servicenow.create-incident
              with:
                short_description: "S3 lifecycle audit: {{bucket_name}}"
                category: "data_governance"
            - name: notify-governance
              type: call
              call: msteams.post-message
              with:
                channel_id: "data-governance"
                text: "S3 lifecycle audit: {{bucket_name}}. Objects: {{get-bucket-info.object_count}}. Ticket: {{create-compliance-ticket.number}}."
  consumes:
    - type: http
      namespace: aws
      baseUri: "https://s3.us-gov-west-1.amazonaws.com"
      authentication:
        type: bearer
        token: "$secrets.aws_govcloud_token"
      resources:
        - name: buckets
          path: "/{{bucket_name}}?list-type=2"
          inputParameters:
            - name: bucket_name
              in: path
          operations:
            - name: get-bucket-info
              method: GET
    - type: http
      namespace: servicenow
      baseUri: "https://lockheedmartin.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.snow_user"
        password: "$secrets.snow_password"
      resources:
        - name: incidents
          path: "/table/incident"
          operations:
            - name: create-incident
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

When an Apache Airflow DAG fails, retrieves task failure details, creates a Jira bug for the data engineering team, retries the failed task, and notifies the team via Teams.

naftiko: "0.5"
info:
  label: "Apache Airflow ETL Failure Remediation"
  description: "When an Apache Airflow DAG fails, retrieves task failure details, creates a Jira bug for the data engineering team, retries the failed task, and notifies the team via Teams."
  tags:
    - data-engineering
    - apache-airflow
    - jira
    - microsoft-teams
    - etl
capability:
  exposes:
    - type: mcp
      namespace: data-engineering
      port: 8080
      tools:
        - name: trigger-dag-failure-remediation
          description: "Given an Airflow DAG ID and failed task ID, retrieve failure logs, create a Jira bug, retry the task, and notify the data engineering team."
          inputParameters:
            - name: dag_id
              in: body
              type: string
              description: "The Apache Airflow DAG ID."
            - name: task_id
              in: body
              type: string
              description: "The failed task ID within the DAG."
            - name: run_id
              in: body
              type: string
              description: "The DAG run ID."
          steps:
            - name: get-task-log
              type: call
              call: airflow.get-task-log
              with:
                dag_id: "{{dag_id}}"
                task_id: "{{task_id}}"
            - name: create-bug
              type: call
              call: jira.create-issue
              with:
                project: "DATA"
                summary: "Airflow DAG failure: {{dag_id}}/{{task_id}}"
            - name: retry-task
              type: call
              call: airflow.retry-task
              with:
                dag_id: "{{dag_id}}"
                task_id: "{{task_id}}"
            - name: notify-team
              type: call
              call: msteams.post-message
              with:
                channel_id: "data-engineering"
                text: "DAG {{dag_id}} task {{task_id}} failed. Retrying. Jira: {{create-bug.key}}."
  consumes:
    - type: http
      namespace: airflow
      baseUri: "https://airflow.lockheedmartin.com/api/v1"
      authentication:
        type: bearer
        token: "$secrets.airflow_token"
      resources:
        - name: task-logs
          path: "/dags/{{dag_id}}/dagRuns/{{run_id}}/taskInstances/{{task_id}}/logs"
          inputParameters:
            - name: dag_id
              in: path
            - name: run_id
              in: path
            - name: task_id
              in: path
          operations:
            - name: get-task-log
              method: GET
        - name: task-instances
          path: "/dags/{{dag_id}}/dagRuns/{{run_id}}/taskInstances/{{task_id}}"
          inputParameters:
            - name: dag_id
              in: path
            - name: run_id
              in: path
            - name: task_id
              in: path
          operations:
            - name: retry-task
              method: PATCH
    - type: http
      namespace: jira
      baseUri: "https://lockheedmartin.atlassian.net/rest/api/3"
      authentication:
        type: bearer
        token: "$secrets.jira_token"
      resources:
        - name: issues
          path: "/issue"
          operations:
            - name: create-issue
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

When a non-compliant sign-in is detected in Azure AD, retrieves sign-in details, blocks the session, creates a ServiceNow security incident, and alerts the IAM team via Teams.

naftiko: "0.5"
info:
  label: "Azure AD Conditional Access Policy Enforcer"
  description: "When a non-compliant sign-in is detected in Azure AD, retrieves sign-in details, blocks the session, creates a ServiceNow security incident, and alerts the IAM team via Teams."
  tags:
    - identity
    - azure-active-directory
    - servicenow
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: identity
      port: 8080
      tools:
        - name: trigger-access-enforcement
          description: "Given an Azure AD sign-in event ID flagged as non-compliant, retrieve details, revoke sessions, create a ServiceNow security incident, and alert IAM."
          inputParameters:
            - name: sign_in_id
              in: body
              type: string
              description: "The Azure AD sign-in event ID."
            - name: user_upn
              in: body
              type: string
              description: "The user principal name of the affected user."
          steps:
            - name: get-signin
              type: call
              call: azuread.get-signin
              with:
                sign_in_id: "{{sign_in_id}}"
            - name: block-session
              type: call
              call: azuread.revoke-sessions
              with:
                user_upn: "{{user_upn}}"
            - name: create-incident
              type: call
              call: servicenow.create-incident
              with:
                short_description: "Non-compliant sign-in: {{user_upn}} from {{get-signin.location}}"
                category: "security"
            - name: alert-iam
              type: call
              call: msteams.post-message
              with:
                channel_id: "iam-security"
                text: "Non-compliant sign-in blocked for {{user_upn}}. Location: {{get-signin.location}}. Ticket: {{create-incident.number}}."
  consumes:
    - type: http
      namespace: azuread
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: sign-ins
          path: "/auditLogs/signIns/{{sign_in_id}}"
          inputParameters:
            - name: sign_in_id
              in: path
          operations:
            - name: get-signin
              method: GET
        - name: users
          path: "/users/{{user_upn}}/revokeSignInSessions"
          inputParameters:
            - name: user_upn
              in: path
          operations:
            - name: revoke-sessions
              method: POST
    - type: http
      namespace: servicenow
      baseUri: "https://lockheedmartin.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.snow_user"
        password: "$secrets.snow_password"
      resources:
        - name: incidents
          path: "/table/incident"
          operations:
            - name: create-incident
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Monitors Azure Data Factory pipeline runs for program data integrations, detects failures, creates a Jira incident, and notifies the data platform team via Teams.

naftiko: "0.5"
info:
  label: "Azure Data Factory Pipeline Monitoring Orchestrator"
  description: "Monitors Azure Data Factory pipeline runs for program data integrations, detects failures, creates a Jira incident, and notifies the data platform team via Teams."
  tags:
    - data-engineering
    - azure-data-factory
    - jira
    - microsoft-teams
    - monitoring
capability:
  exposes:
    - type: mcp
      namespace: data-engineering
      port: 8080
      tools:
        - name: trigger-adf-monitoring
          description: "Given an Azure Data Factory name and pipeline name, check recent run status, create a Jira incident on failure, and notify the data platform team."
          inputParameters:
            - name: factory_name
              in: body
              type: string
              description: "The Azure Data Factory name."
            - name: pipeline_name
              in: body
              type: string
              description: "The pipeline name to monitor."
          steps:
            - name: get-pipeline-runs
              type: call
              call: adf.get-pipeline-runs
              with:
                factory_name: "{{factory_name}}"
                pipeline_name: "{{pipeline_name}}"
            - name: create-incident
              type: call
              call: jira.create-issue
              with:
                project: "DATAOPS"
                summary: "ADF pipeline failure: {{factory_name}}/{{pipeline_name}}"
            - name: notify-team
              type: call
              call: msteams.post-message
              with:
                channel_id: "data-platform"
                text: "ADF pipeline {{pipeline_name}} status: {{get-pipeline-runs.status}}. Duration: {{get-pipeline-runs.duration}}. Jira: {{create-incident.key}}."
  consumes:
    - type: http
      namespace: adf
      baseUri: "https://management.usgovcloudapi.net"
      authentication:
        type: bearer
        token: "$secrets.azure_gov_token"
      resources:
        - name: pipeline-runs
          path: "/subscriptions/{{sub_id}}/resourceGroups/{{rg}}/providers/Microsoft.DataFactory/factories/{{factory_name}}/pipelineruns"
          inputParameters:
            - name: factory_name
              in: path
          operations:
            - name: get-pipeline-runs
              method: POST
    - type: http
      namespace: jira
      baseUri: "https://lockheedmartin.atlassian.net/rest/api/3"
      authentication:
        type: bearer
        token: "$secrets.jira_token"
      resources:
        - name: issues
          path: "/issue"
          operations:
            - name: create-issue
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Checks the latest build status for an Azure DevOps pipeline, returning build result, duration, and triggered-by information for CI/CD monitoring on defense software projects.

naftiko: "0.5"
info:
  label: "Azure DevOps Build Status Lookup"
  description: "Checks the latest build status for an Azure DevOps pipeline, returning build result, duration, and triggered-by information for CI/CD monitoring on defense software projects."
  tags:
    - devops
    - azure-devops
    - cicd
    - defense
capability:
  exposes:
    - type: mcp
      namespace: devops
      port: 8080
      tools:
        - name: get-build-status
          description: "Given an Azure DevOps project name and build definition ID, return the latest build status, result, start time, and duration. Use for CI/CD pipeline monitoring."
          inputParameters:
            - name: project
              in: body
              type: string
              description: "The Azure DevOps project name."
            - name: definition_id
              in: body
              type: string
              description: "The build definition ID."
          call: azuredevops.get-build
          with:
            project: "{{project}}"
            definition_id: "{{definition_id}}"
          outputParameters:
            - name: status
              type: string
              mapping: "$.value[0].status"
            - name: result
              type: string
              mapping: "$.value[0].result"
            - name: start_time
              type: string
              mapping: "$.value[0].startTime"
  consumes:
    - type: http
      namespace: azuredevops
      baseUri: "https://dev.azure.com/lockheedmartin"
      authentication:
        type: bearer
        token: "$secrets.azuredevops_token"
      resources:
        - name: builds
          path: "/{{project}}/_apis/build/builds?definitions={{definition_id}}&$top=1&api-version=7.0"
          inputParameters:
            - name: project
              in: path
            - name: definition_id
              in: path
          operations:
            - name: get-build
              method: GET

Monitors Azure Government Cloud subscriptions for cost anomalies, creates a ServiceNow ticket, and posts an alert to the cloud operations Teams channel.

naftiko: "0.5"
info:
  label: "Azure Government Cloud Cost Anomaly Alert"
  description: "Monitors Azure Government Cloud subscriptions for cost anomalies, creates a ServiceNow ticket, and posts an alert to the cloud operations Teams channel."
  tags:
    - cloud
    - finops
    - azure
    - servicenow
    - microsoft-teams
    - government-cloud
capability:
  exposes:
    - type: mcp
      namespace: cloud-finops
      port: 8080
      tools:
        - name: handle-gov-cloud-cost-anomaly
          description: "Given an Azure Government subscription ID and period, retrieve cost anomalies from Azure Cost Management, open a ServiceNow ticket, and alert the cloud operations Teams channel. Use for government cloud FinOps governance."
          inputParameters:
            - name: subscription_id
              in: body
              type: string
              description: "The Azure Government Cloud subscription ID."
            - name: period_days
              in: body
              type: integer
              description: "Number of days to analyze for anomalies."
          steps:
            - name: get-anomalies
              type: call
              call: azure-gov.get-cost-anomalies
              with:
                subscription_id: "{{subscription_id}}"
                period_days: "{{period_days}}"
            - name: create-ticket
              type: call
              call: servicenow.create-incident
              with:
                short_description: "Azure Gov cost anomaly in subscription {{subscription_id}}"
                category: "cloud_cost"
                priority: "3"
            - name: post-alert
              type: call
              call: msteams.post-message
              with:
                channel_id: "$secrets.teams_cloud_ops_channel_id"
                text: "Azure Gov Cost Anomaly: {{subscription_id}} | SNOW: {{create-ticket.number}} | Period: {{period_days}} days"
  consumes:
    - type: http
      namespace: azure-gov
      baseUri: "https://management.usgovcloudapi.net"
      authentication:
        type: bearer
        token: "$secrets.azure_gov_token"
      resources:
        - name: cost-anomalies
          path: "/subscriptions/{{subscription_id}}/providers/Microsoft.CostManagement/anomalies"
          inputParameters:
            - name: subscription_id
              in: path
          operations:
            - name: get-cost-anomalies
              method: GET
    - type: http
      namespace: servicenow
      baseUri: "https://lockheedmartin.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.snow_user"
        password: "$secrets.snow_password"
      resources:
        - name: incidents
          path: "/table/incident"
          operations:
            - name: create-incident
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: channel-messages
          path: "/teams/{{channel_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Looks up Azure Government resource tags by subscription and resource group to verify program allocation and cost center tagging for defense contracts.

naftiko: "0.5"
info:
  label: "Azure Government Resource Tag Lookup"
  description: "Looks up Azure Government resource tags by subscription and resource group to verify program allocation and cost center tagging for defense contracts."
  tags:
    - cloud
    - governance
    - azure
    - defense
    - tagging
capability:
  exposes:
    - type: mcp
      namespace: cloud-governance
      port: 8080
      tools:
        - name: get-resource-tags
          description: "Given an Azure subscription ID and resource group name, return all resource tags including cost center, program code, and classification level."
          inputParameters:
            - name: subscription_id
              in: body
              type: string
              description: "Azure Government subscription ID."
            - name: resource_group
              in: body
              type: string
              description: "Name of the Azure resource group."
          call: azure.get-resource-tags
          with:
            subscription_id: "{{subscription_id}}"
            resource_group: "{{resource_group}}"
          outputParameters:
            - name: tags
              type: object
              mapping: "$.tags"
            - name: location
              type: string
              mapping: "$.location"
  consumes:
    - type: http
      namespace: azure
      baseUri: "https://management.usgovcloudapi.net"
      authentication:
        type: bearer
        token: "$secrets.azure_gov_token"
      resources:
        - name: resource-groups
          path: "/subscriptions/{{subscription_id}}/resourceGroups/{{resource_group}}"
          inputParameters:
            - name: subscription_id
              in: path
            - name: resource_group
              in: path
          operations:
            - name: get-resource-tags
              method: GET

Rotates expiring secrets in Azure Key Vault, updates dependent application configurations in Azure DevOps, creates a ServiceNow change record, and notifies the security team via Teams.

naftiko: "0.5"
info:
  label: "Azure Key Vault Secret Rotation Orchestrator"
  description: "Rotates expiring secrets in Azure Key Vault, updates dependent application configurations in Azure DevOps, creates a ServiceNow change record, and notifies the security team via Teams."
  tags:
    - security
    - azure
    - azure-devops
    - servicenow
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: security
      port: 8080
      tools:
        - name: trigger-secret-rotation
          description: "Given an Azure Key Vault name and secret name nearing expiration, rotate the secret, update Azure DevOps variables, log a ServiceNow change, and notify security."
          inputParameters:
            - name: vault_name
              in: body
              type: string
              description: "The Azure Key Vault name."
            - name: secret_name
              in: body
              type: string
              description: "The secret name to rotate."
          steps:
            - name: rotate-secret
              type: call
              call: azure.rotate-secret
              with:
                vault_name: "{{vault_name}}"
                secret_name: "{{secret_name}}"
            - name: update-pipeline-vars
              type: call
              call: azuredevops.update-variable
              with:
                variable_group: "{{vault_name}}-secrets"
                variable_name: "{{secret_name}}"
            - name: create-change
              type: call
              call: servicenow.create-change
              with:
                short_description: "Secret rotation: {{vault_name}}/{{secret_name}}"
                category: "security"
            - name: notify-security
              type: call
              call: msteams.post-message
              with:
                channel_id: "security-ops"
                text: "Secret rotated: {{vault_name}}/{{secret_name}}. Change: {{create-change.number}}."
  consumes:
    - type: http
      namespace: azure
      baseUri: "https://{{vault_name}}.vault.usgovcloudapi.net"
      authentication:
        type: bearer
        token: "$secrets.azure_gov_token"
      resources:
        - name: secrets
          path: "/secrets/{{secret_name}}"
          inputParameters:
            - name: secret_name
              in: path
          operations:
            - name: rotate-secret
              method: POST
    - type: http
      namespace: azuredevops
      baseUri: "https://dev.azure.com/lockheedmartin"
      authentication:
        type: bearer
        token: "$secrets.azuredevops_token"
      resources:
        - name: variable-groups
          path: "/_apis/distributedtask/variablegroups"
          operations:
            - name: update-variable
              method: PUT
    - type: http
      namespace: servicenow
      baseUri: "https://lockheedmartin.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.snow_user"
        password: "$secrets.snow_password"
      resources:
        - name: changes
          path: "/table/change_request"
          operations:
            - name: create-change
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

When a document is uploaded to Box, classifies it based on content, applies retention policies, logs the classification in ServiceNow, and notifies the records management team via Teams.

naftiko: "0.5"
info:
  label: "Box Document Classification and Retention"
  description: "When a document is uploaded to Box, classifies it based on content, applies retention policies, logs the classification in ServiceNow, and notifies the records management team via Teams."
  tags:
    - document-management
    - box
    - servicenow
    - microsoft-teams
    - compliance
capability:
  exposes:
    - type: mcp
      namespace: document-management
      port: 8080
      tools:
        - name: trigger-doc-classification
          description: "Given a Box file ID, classify the document, apply retention policy, log in ServiceNow, and notify records management."
          inputParameters:
            - name: file_id
              in: body
              type: string
              description: "The Box file ID."
          steps:
            - name: get-file
              type: call
              call: box.get-file
              with:
                file_id: "{{file_id}}"
            - name: apply-classification
              type: call
              call: box.apply-classification
              with:
                file_id: "{{file_id}}"
                classification: "defense_controlled"
            - name: log-classification
              type: call
              call: servicenow.create-incident
              with:
                short_description: "Document classified: {{get-file.name}}"
                category: "records_management"
            - name: notify-records
              type: call
              call: msteams.post-message
              with:
                channel_id: "records-management"
                text: "Document {{get-file.name}} classified. Ticket: {{log-classification.number}}."
  consumes:
    - type: http
      namespace: box
      baseUri: "https://api.box.com/2.0"
      authentication:
        type: bearer
        token: "$secrets.box_token"
      resources:
        - name: files
          path: "/files/{{file_id}}"
          inputParameters:
            - name: file_id
              in: path
          operations:
            - name: get-file
              method: GET
            - name: apply-classification
              method: POST
    - type: http
      namespace: servicenow
      baseUri: "https://lockheedmartin.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.snow_user"
        password: "$secrets.snow_password"
      resources:
        - name: incidents
          path: "/table/incident"
          operations:
            - name: create-incident
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Checks Cisco network device configurations against STIG compliance baselines, logs findings in ServiceNow, updates the compliance dashboard in Power BI, and notifies the network team via Teams.

naftiko: "0.5"
info:
  label: "Cisco Network Device Compliance Checker"
  description: "Checks Cisco network device configurations against STIG compliance baselines, logs findings in ServiceNow, updates the compliance dashboard in Power BI, and notifies the network team via Teams."
  tags:
    - network-security
    - cisco
    - servicenow
    - power-bi
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: network-security
      port: 8080
      tools:
        - name: trigger-compliance-check
          description: "Given a Cisco device hostname, check STIG compliance, log findings in ServiceNow, refresh the Power BI compliance dashboard, and notify the network security team."
          inputParameters:
            - name: device_hostname
              in: body
              type: string
              description: "The Cisco device hostname."
            - name: stig_baseline
              in: body
              type: string
              description: "The STIG baseline version to check against."
          steps:
            - name: get-config
              type: call
              call: cisco.get-device-config
              with:
                hostname: "{{device_hostname}}"
            - name: log-findings
              type: call
              call: servicenow.create-incident
              with:
                short_description: "STIG compliance check: {{device_hostname}}"
                category: "compliance"
            - name: refresh-dashboard
              type: call
              call: powerbi.refresh-dataset
              with:
                dataset_id: "network-compliance"
            - name: notify-team
              type: call
              call: msteams.post-message
              with:
                channel_id: "network-security"
                text: "STIG compliance check for {{device_hostname}} complete. Baseline: {{stig_baseline}}. Ticket: {{log-findings.number}}."
  consumes:
    - type: http
      namespace: cisco
      baseUri: "https://dnac.lockheedmartin.com/dna/intent/api/v1"
      authentication:
        type: bearer
        token: "$secrets.cisco_token"
      resources:
        - name: devices
          path: "/network-device?hostname={{hostname}}"
          inputParameters:
            - name: hostname
              in: path
          operations:
            - name: get-device-config
              method: GET
    - type: http
      namespace: servicenow
      baseUri: "https://lockheedmartin.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.snow_user"
        password: "$secrets.snow_password"
      resources:
        - name: incidents
          path: "/table/incident"
          operations:
            - name: create-incident
              method: POST
    - type: http
      namespace: powerbi
      baseUri: "https://api.powerbi.com/v1.0/myorg"
      authentication:
        type: bearer
        token: "$secrets.powerbi_token"
      resources:
        - name: datasets
          path: "/datasets/{{dataset_id}}/refreshes"
          inputParameters:
            - name: dataset_id
              in: path
          operations:
            - name: refresh-dataset
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

When a scheduled security scan completes on a classified network segment, retrieves scan results from Palo Alto, creates a ServiceNow security ticket, and posts findings to the Microsoft Teams SOC channel.

naftiko: "0.5"
info:
  label: "Classified Network Security Scan Orchestrator"
  description: "When a scheduled security scan completes on a classified network segment, retrieves scan results from Palo Alto, creates a ServiceNow security ticket, and posts findings to the Microsoft Teams SOC channel."
  tags:
    - security-operations
    - palo-alto-networks
    - servicenow
    - microsoft-teams
    - classified-networks
capability:
  exposes:
    - type: mcp
      namespace: security-operations
      port: 8080
      tools:
        - name: trigger-scan-review
          description: "Given a Palo Alto scan ID and network segment, orchestrate retrieval of scan findings, create a ServiceNow security incident, and notify the SOC team via Teams."
          inputParameters:
            - name: scan_id
              in: body
              type: string
              description: "The Palo Alto security scan ID."
            - name: network_segment
              in: body
              type: string
              description: "The classified network segment identifier."
          steps:
            - name: get-scan-results
              type: call
              call: paloalto.get-scan
              with:
                scan_id: "{{scan_id}}"
            - name: create-security-ticket
              type: call
              call: servicenow.create-incident
              with:
                short_description: "Security scan findings: {{network_segment}}"
                category: "security"
                urgency: "2"
            - name: notify-soc
              type: call
              call: msteams.post-message
              with:
                channel_id: "soc-alerts"
                text: "Scan {{scan_id}} on {{network_segment}} complete. Ticket: {{create-security-ticket.number}}. Findings: {{get-scan-results.finding_count}} issues."
  consumes:
    - type: http
      namespace: paloalto
      baseUri: "https://panorama.lockheedmartin.com/restapi/v10.2"
      authentication:
        type: bearer
        token: "$secrets.paloalto_token"
      resources:
        - name: scans
          path: "/scans/{{scan_id}}"
          inputParameters:
            - name: scan_id
              in: path
          operations:
            - name: get-scan
              method: GET
    - type: http
      namespace: servicenow
      baseUri: "https://lockheedmartin.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.snow_user"
        password: "$secrets.snow_password"
      resources:
        - name: incidents
          path: "/table/incident"
          operations:
            - name: create-incident
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

When a new cleared employee is created in Workday, opens a ServiceNow onboarding ticket, provisions a Microsoft 365 account, and sends a Teams welcome message with security briefing links.

naftiko: "0.5"
info:
  label: "Cleared Personnel Onboarding Orchestrator"
  description: "When a new cleared employee is created in Workday, opens a ServiceNow onboarding ticket, provisions a Microsoft 365 account, and sends a Teams welcome message with security briefing links."
  tags:
    - hr
    - onboarding
    - workday
    - servicenow
    - microsoft-teams
    - microsoft-365
    - security-clearance
capability:
  exposes:
    - type: mcp
      namespace: hr-onboarding
      port: 8080
      tools:
        - name: trigger-cleared-onboarding
          description: "Given a Workday employee ID and start date for a cleared hire, orchestrate the full onboarding sequence: open a ServiceNow IT ticket, provision Microsoft 365, and send a Teams welcome message with mandatory security briefing links. Invoke when a new hire record is activated in Workday."
          inputParameters:
            - name: employee_id
              in: body
              type: string
              description: "The Workday worker ID for the new cleared hire."
            - name: start_date
              in: body
              type: string
              description: "The employee's start date in YYYY-MM-DD format."
            - name: clearance_level
              in: body
              type: string
              description: "Security clearance level: SECRET, TOP_SECRET, or TS_SCI."
          steps:
            - name: get-worker
              type: call
              call: workday.get-worker
              with:
                worker_id: "{{employee_id}}"
            - name: create-snow-ticket
              type: call
              call: servicenow.create-incident
              with:
                short_description: "Cleared hire onboarding: {{get-worker.full_name}} ({{clearance_level}})"
                category: "hr_onboarding"
                assigned_group: "IT_Security_Onboarding"
            - name: provision-m365
              type: call
              call: msgraph.create-user
              with:
                displayName: "{{get-worker.full_name}}"
                userPrincipalName: "{{get-worker.work_email}}"
                mailNickname: "{{get-worker.preferred_name}}"
            - name: send-welcome
              type: call
              call: msteams.post-message
              with:
                recipient_upn: "{{get-worker.work_email}}"
                text: "Welcome to Lockheed Martin, {{get-worker.first_name}}! IT ticket: {{create-snow-ticket.number}}. Complete mandatory security briefings before Day 1."
  consumes:
    - type: http
      namespace: workday
      baseUri: "https://wd2-impl-services1.workday.com/ccx/api/v1"
      authentication:
        type: bearer
        token: "$secrets.workday_token"
      resources:
        - name: workers
          path: "/lockheed-martin/workers/{{worker_id}}"
          inputParameters:
            - name: worker_id
              in: path
          operations:
            - name: get-worker
              method: GET
    - type: http
      namespace: servicenow
      baseUri: "https://lockheedmartin.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.snow_user"
        password: "$secrets.snow_password"
      resources:
        - name: incidents
          path: "/table/incident"
          operations:
            - name: create-incident
              method: POST
    - type: http
      namespace: msgraph
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: users
          path: "/users"
          operations:
            - name: create-user
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/users/{{recipient_upn}}/sendMail"
          inputParameters:
            - name: recipient_upn
              in: path
          operations:
            - name: post-message
              method: POST

Detects AWS CloudFormation stack drift for GovCloud workloads, creates a ServiceNow change to remediate, and alerts the cloud engineering team via Teams.

naftiko: "0.5"
info:
  label: "CloudFormation Stack Drift Detection Handler"
  description: "Detects AWS CloudFormation stack drift for GovCloud workloads, creates a ServiceNow change to remediate, and alerts the cloud engineering team via Teams."
  tags:
    - cloud
    - amazon-web-services
    - servicenow
    - microsoft-teams
    - compliance
capability:
  exposes:
    - type: mcp
      namespace: cloud
      port: 8080
      tools:
        - name: trigger-drift-detection
          description: "Given an AWS CloudFormation stack name in GovCloud, detect drift, create a ServiceNow change for remediation, and notify the cloud engineering team."
          inputParameters:
            - name: stack_name
              in: body
              type: string
              description: "The CloudFormation stack name."
            - name: region
              in: body
              type: string
              description: "The AWS GovCloud region."
          steps:
            - name: detect-drift
              type: call
              call: aws.detect-stack-drift
              with:
                stack_name: "{{stack_name}}"
                region: "{{region}}"
            - name: create-change
              type: call
              call: servicenow.create-change
              with:
                short_description: "CloudFormation drift: {{stack_name}} in {{region}}"
                category: "cloud_infrastructure"
            - name: notify-team
              type: call
              call: msteams.post-message
              with:
                channel_id: "cloud-engineering"
                text: "Stack drift detected: {{stack_name}} in {{region}}. Drifted resources: {{detect-drift.drifted_count}}. Change: {{create-change.number}}."
  consumes:
    - type: http
      namespace: aws
      baseUri: "https://cloudformation.us-gov-west-1.amazonaws.com"
      authentication:
        type: bearer
        token: "$secrets.aws_govcloud_token"
      resources:
        - name: stacks
          path: "/?Action=DetectStackDrift&StackName={{stack_name}}"
          inputParameters:
            - name: stack_name
              in: path
          operations:
            - name: detect-stack-drift
              method: POST
    - type: http
      namespace: servicenow
      baseUri: "https://lockheedmartin.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.snow_user"
        password: "$secrets.snow_password"
      resources:
        - name: changes
          path: "/table/change_request"
          operations:
            - name: create-change
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Aggregates Jira engineering review items, generates an Engineering Review Board agenda in Confluence, schedules the review meeting via Teams, and notifies board members.

naftiko: "0.5"
info:
  label: "Confluence Engineering Review Board Publisher"
  description: "Aggregates Jira engineering review items, generates an Engineering Review Board agenda in Confluence, schedules the review meeting via Teams, and notifies board members."
  tags:
    - engineering
    - jira
    - confluence
    - microsoft-teams
    - review-board
capability:
  exposes:
    - type: mcp
      namespace: engineering
      port: 8080
      tools:
        - name: trigger-erb-meeting
          description: "Given a Jira filter ID for ERB items and a meeting date, aggregate review items, publish a Confluence agenda, and notify board members via Teams."
          inputParameters:
            - name: filter_id
              in: body
              type: string
              description: "The Jira filter ID for ERB review items."
            - name: meeting_date
              in: body
              type: string
              description: "Proposed meeting date in YYYY-MM-DD format."
          steps:
            - name: get-items
              type: call
              call: jira.get-filter-results
              with:
                filter_id: "{{filter_id}}"
            - name: create-agenda
              type: call
              call: confluence.create-page
              with:
                space_key: "ERB"
                title: "ERB Agenda - {{meeting_date}}"
                body: "Review items: {{get-items.total}}. See Jira filter for details."
            - name: notify-board
              type: call
              call: msteams.post-message
              with:
                channel_id: "erb-channel"
                text: "ERB meeting scheduled for {{meeting_date}}. {{get-items.total}} items to review. Agenda: {{create-agenda.url}}."
  consumes:
    - type: http
      namespace: jira
      baseUri: "https://lockheedmartin.atlassian.net/rest/api/3"
      authentication:
        type: bearer
        token: "$secrets.jira_token"
      resources:
        - name: filters
          path: "/filter/{{filter_id}}/search"
          inputParameters:
            - name: filter_id
              in: path
          operations:
            - name: get-filter-results
              method: GET
    - type: http
      namespace: confluence
      baseUri: "https://lockheedmartin.atlassian.net/wiki/rest/api"
      authentication:
        type: bearer
        token: "$secrets.confluence_token"
      resources:
        - name: content
          path: "/content"
          operations:
            - name: create-page
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Retrieves a Confluence wiki page by space key and title, returning page content used for program documentation, engineering standards, and technical procedures.

naftiko: "0.5"
info:
  label: "Confluence Program Wiki Page Lookup"
  description: "Retrieves a Confluence wiki page by space key and title, returning page content used for program documentation, engineering standards, and technical procedures."
  tags:
    - documentation
    - confluence
    - engineering
    - knowledge-management
capability:
  exposes:
    - type: mcp
      namespace: documentation
      port: 8080
      tools:
        - name: get-wiki-page
          description: "Given a Confluence space key and page title, return the page body content and last-modified metadata. Use for looking up program documentation and engineering procedures."
          inputParameters:
            - name: space_key
              in: body
              type: string
              description: "The Confluence space key, e.g. AERO_ENG."
            - name: title
              in: body
              type: string
              description: "The page title to search for."
          call: confluence.get-page
          with:
            space_key: "{{space_key}}"
            title: "{{title}}"
          outputParameters:
            - name: page_id
              type: string
              mapping: "$.results[0].id"
            - name: body
              type: string
              mapping: "$.results[0].body.storage.value"
            - name: last_modified
              type: string
              mapping: "$.results[0].version.when"
  consumes:
    - type: http
      namespace: confluence
      baseUri: "https://lockheedmartin.atlassian.net/wiki/rest/api"
      authentication:
        type: bearer
        token: "$secrets.confluence_token"
      resources:
        - name: content
          path: "/content?spaceKey={{space_key}}&title={{title}}"
          inputParameters:
            - name: space_key
              in: path
            - name: title
              in: path
          operations:
            - name: get-page
              method: GET

Queries Datadog logs by service name and time range, returning log entries for mission-critical system troubleshooting and security event investigation.

naftiko: "0.5"
info:
  label: "Datadog Log Query Lookup"
  description: "Queries Datadog logs by service name and time range, returning log entries for mission-critical system troubleshooting and security event investigation."
  tags:
    - observability
    - datadog
    - incident-management
    - security
capability:
  exposes:
    - type: mcp
      namespace: observability
      port: 8080
      tools:
        - name: query-logs
          description: "Given a Datadog log query string and time range, return matching log entries with timestamps, service, and message content. Use for incident investigation on mission-critical systems."
          inputParameters:
            - name: query
              in: body
              type: string
              description: "Datadog log query string, e.g. service:f35-avionics status:error."
            - name: from_ts
              in: body
              type: string
              description: "Start timestamp in ISO 8601 format."
            - name: to_ts
              in: body
              type: string
              description: "End timestamp in ISO 8601 format."
          call: datadog.query-logs
          with:
            query: "{{query}}"
            from: "{{from_ts}}"
            to: "{{to_ts}}"
          outputParameters:
            - name: logs
              type: array
              mapping: "$.data"
            - name: total_count
              type: integer
              mapping: "$.meta.page.total_count"
  consumes:
    - type: http
      namespace: datadog
      baseUri: "https://api.datadoghq.com/api/v2"
      authentication:
        type: bearer
        token: "$secrets.datadog_api_key"
      resources:
        - name: logs
          path: "/logs/events/search"
          operations:
            - name: query-logs
              method: POST

On a Datadog critical alert for mission-critical Lockheed Martin systems (ERP, PLM, secure networks), creates a ServiceNow incident and alerts the security operations Teams channel.

naftiko: "0.5"
info:
  label: "Datadog Mission-Critical System Monitoring Alert"
  description: "On a Datadog critical alert for mission-critical Lockheed Martin systems (ERP, PLM, secure networks), creates a ServiceNow incident and alerts the security operations Teams channel."
  tags:
    - observability
    - monitoring
    - datadog
    - servicenow
    - microsoft-teams
    - security
capability:
  exposes:
    - type: mcp
      namespace: secops-monitoring
      port: 8080
      tools:
        - name: handle-critical-system-alert
          description: "Given a Datadog alert ID and system name, retrieve alert details, create a ServiceNow high-priority incident, and post to the security operations Teams channel. Use for monitoring ERP, classified system gateways, and production infrastructure."
          inputParameters:
            - name: alert_id
              in: body
              type: string
              description: "The Datadog event or alert ID."
            - name: system_name
              in: body
              type: string
              description: "The name of the affected mission-critical system."
          steps:
            - name: get-event
              type: call
              call: datadog.get-event
              with:
                alert_id: "{{alert_id}}"
            - name: create-incident
              type: call
              call: servicenow.create-incident
              with:
                short_description: "Critical system alert: {{system_name}}"
                category: "mission_critical"
                priority: "1"
            - name: alert-secops
              type: call
              call: msteams.post-message
              with:
                channel_id: "$secrets.teams_secops_channel_id"
                text: "Critical Alert: {{system_name}} | Datadog: {{alert_id}} | SNOW: {{create-incident.number}}"
  consumes:
    - type: http
      namespace: datadog
      baseUri: "https://api.datadoghq.com/api/v1"
      authentication:
        type: apikey
        key: "DD-API-KEY"
        value: "$secrets.datadog_api_key"
        placement: header
      resources:
        - name: events
          path: "/events/{{alert_id}}"
          inputParameters:
            - name: alert_id
              in: path
          operations:
            - name: get-event
              method: GET
    - type: http
      namespace: servicenow
      baseUri: "https://lockheedmartin.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.snow_user"
        password: "$secrets.snow_password"
      resources:
        - name: incidents
          path: "/table/incident"
          operations:
            - name: create-incident
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: channel-messages
          path: "/teams/{{channel_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

When Datadog fires a critical alert for a mission system, retrieves alert details, creates a ServiceNow P1 incident, pages the on-call engineer, and posts to the incident Teams channel.

naftiko: "0.5"
info:
  label: "Datadog to ServiceNow Auto Incident Creator"
  description: "When Datadog fires a critical alert for a mission system, retrieves alert details, creates a ServiceNow P1 incident, pages the on-call engineer, and posts to the incident Teams channel."
  tags:
    - incident-management
    - datadog
    - servicenow
    - microsoft-teams
    - mission-systems
capability:
  exposes:
    - type: mcp
      namespace: incident-management
      port: 8080
      tools:
        - name: trigger-auto-incident
          description: "Given a Datadog alert ID for a critical mission system alert, create a ServiceNow P1 incident, page the on-call via Teams, and acknowledge the alert."
          inputParameters:
            - name: alert_id
              in: body
              type: string
              description: "The Datadog alert ID."
            - name: service_name
              in: body
              type: string
              description: "The affected service name."
          steps:
            - name: get-alert
              type: call
              call: datadog.get-alert
              with:
                alert_id: "{{alert_id}}"
            - name: create-incident
              type: call
              call: servicenow.create-incident
              with:
                short_description: "Critical: {{service_name}} - {{get-alert.title}}"
                impact: "1"
                urgency: "1"
            - name: page-oncall
              type: call
              call: msteams.post-message
              with:
                channel_id: "incident-response"
                text: "@oncall CRITICAL: {{service_name}} down. Alert: {{get-alert.title}}. Ticket: {{create-incident.number}}."
  consumes:
    - type: http
      namespace: datadog
      baseUri: "https://api.datadoghq.com/api/v1"
      authentication:
        type: bearer
        token: "$secrets.datadog_api_key"
      resources:
        - name: alerts
          path: "/monitor/{{alert_id}}"
          inputParameters:
            - name: alert_id
              in: path
          operations:
            - name: get-alert
              method: GET
    - type: http
      namespace: servicenow
      baseUri: "https://lockheedmartin.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.snow_user"
        password: "$secrets.snow_password"
      resources:
        - name: incidents
          path: "/table/incident"
          operations:
            - name: create-incident
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

When a subcontractor invoice arrives in SAP Ariba, validates it against the associated SAP S/4HANA contract purchase order and routes discrepancies for program manager approval via Teams.

naftiko: "0.5"
info:
  label: "Defense Contract Invoice Validation"
  description: "When a subcontractor invoice arrives in SAP Ariba, validates it against the associated SAP S/4HANA contract purchase order and routes discrepancies for program manager approval via Teams."
  tags:
    - finance
    - procurement
    - sap-ariba
    - sap
    - invoice
    - defense-contracts
capability:
  exposes:
    - type: mcp
      namespace: contract-finance
      port: 8080
      tools:
        - name: validate-subcontractor-invoice
          description: "Given an Ariba invoice ID and SAP PO number, retrieve invoice details from SAP Ariba, compare with the SAP contract PO, and notify the program manager via Teams if discrepancies exist. Use for defense subcontract invoice three-way match."
          inputParameters:
            - name: invoice_id
              in: body
              type: string
              description: "The SAP Ariba invoice ID."
            - name: po_number
              in: body
              type: string
              description: "The associated SAP contract purchase order number."
          steps:
            - name: get-invoice
              type: call
              call: ariba.get-invoice
              with:
                invoice_id: "{{invoice_id}}"
            - name: get-po
              type: call
              call: sap.get-po
              with:
                po_number: "{{po_number}}"
            - name: notify-pm
              type: call
              call: msteams.post-message
              with:
                channel_id: "$secrets.teams_contracts_channel_id"
                text: "Invoice {{invoice_id}} discrepancy: Invoiced {{get-invoice.total_amount}} vs PO {{get-po.total_value}} on contract {{po_number}}."
  consumes:
    - type: http
      namespace: ariba
      baseUri: "https://openapi.ariba.com/api/invoice/v1"
      authentication:
        type: bearer
        token: "$secrets.ariba_token"
      resources:
        - name: invoices
          path: "/invoices/{{invoice_id}}"
          inputParameters:
            - name: invoice_id
              in: path
          operations:
            - name: get-invoice
              method: GET
    - type: http
      namespace: sap
      baseUri: "https://lockheed-martin-s4.sap.com/sap/opu/odata/sap/MM_PUR_PO_MAINT_V2_SRV"
      authentication:
        type: basic
        username: "$secrets.sap_user"
        password: "$secrets.sap_password"
      resources:
        - name: purchase-orders
          path: "/A_PurchaseOrder('{{po_number}}')"
          inputParameters:
            - name: po_number
              in: path
          operations:
            - name: get-po
              method: GET
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: channel-messages
          path: "/teams/{{channel_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Retrieves service health status from Dynatrace for a monitored entity, returning health state, response time, and failure rate for mission-critical application monitoring.

naftiko: "0.5"
info:
  label: "Dynatrace Service Health Lookup"
  description: "Retrieves service health status from Dynatrace for a monitored entity, returning health state, response time, and failure rate for mission-critical application monitoring."
  tags:
    - observability
    - dynatrace
    - mission-systems
    - monitoring
capability:
  exposes:
    - type: mcp
      namespace: observability
      port: 8080
      tools:
        - name: get-service-health
          description: "Given a Dynatrace entity ID for a service, return the current health state, response time, and failure rate. Use for real-time mission system health checks."
          inputParameters:
            - name: entity_id
              in: body
              type: string
              description: "The Dynatrace monitored entity ID, e.g. SERVICE-ABC123."
          call: dynatrace.get-entity
          with:
            entity_id: "{{entity_id}}"
          outputParameters:
            - name: display_name
              type: string
              mapping: "$.displayName"
            - name: health_state
              type: string
              mapping: "$.properties.healthState"
            - name: response_time
              type: number
              mapping: "$.properties.responseTime"
  consumes:
    - type: http
      namespace: dynatrace
      baseUri: "https://lockheedmartin.live.dynatrace.com/api/v2"
      authentication:
        type: bearer
        token: "$secrets.dynatrace_token"
      resources:
        - name: entities
          path: "/entities/{{entity_id}}"
          inputParameters:
            - name: entity_id
              in: path
          operations:
            - name: get-entity
              method: GET

When a Lockheed Martin employee separation is recorded in Workday, disables their Microsoft 365 account, revokes Okta sessions, suspends clearance access, and closes all ServiceNow tickets.

naftiko: "0.5"
info:
  label: "Employee Offboarding and Clearance Suspension"
  description: "When a Lockheed Martin employee separation is recorded in Workday, disables their Microsoft 365 account, revokes Okta sessions, suspends clearance access, and closes all ServiceNow tickets."
  tags:
    - hr
    - offboarding
    - workday
    - okta
    - servicenow
    - security-clearance
    - access-management
capability:
  exposes:
    - type: mcp
      namespace: hr-offboarding
      port: 8080
      tools:
        - name: trigger-offboarding
          description: "Given a Workday employee ID for a separating employee, disable Microsoft 365, revoke all Okta sessions, and close their ServiceNow tickets. Invoke immediately on confirmed separation events from Workday."
          inputParameters:
            - name: employee_id
              in: body
              type: string
              description: "The Workday worker ID of the separating employee."
            - name: separation_date
              in: body
              type: string
              description: "The employee's last day in YYYY-MM-DD format."
          steps:
            - name: get-worker
              type: call
              call: workday.get-worker
              with:
                worker_id: "{{employee_id}}"
            - name: disable-m365
              type: call
              call: msgraph.disable-user
              with:
                user_id: "{{get-worker.work_email}}"
            - name: revoke-okta
              type: call
              call: okta.clear-sessions
              with:
                login: "{{get-worker.work_email}}"
            - name: close-snow-tickets
              type: call
              call: servicenow.close-user-tickets
              with:
                assigned_to: "{{get-worker.work_email}}"
  consumes:
    - type: http
      namespace: workday
      baseUri: "https://wd2-impl-services1.workday.com/ccx/api/v1"
      authentication:
        type: bearer
        token: "$secrets.workday_token"
      resources:
        - name: workers
          path: "/lockheed-martin/workers/{{worker_id}}"
          inputParameters:
            - name: worker_id
              in: path
          operations:
            - name: get-worker
              method: GET
    - type: http
      namespace: msgraph
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: users
          path: "/users/{{user_id}}"
          inputParameters:
            - name: user_id
              in: path
          operations:
            - name: disable-user
              method: PATCH
    - type: http
      namespace: okta
      baseUri: "https://lockheedmartin.okta.com/api/v1"
      authentication:
        type: apikey
        key: "Authorization"
        value: "$secrets.okta_api_token"
        placement: header
      resources:
        - name: user-sessions
          path: "/users/{{login}}/sessions"
          inputParameters:
            - name: login
              in: path
          operations:
            - name: clear-sessions
              method: DELETE
    - type: http
      namespace: servicenow
      baseUri: "https://lockheedmartin.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.snow_user"
        password: "$secrets.snow_password"
      resources:
        - name: incidents
          path: "/table/incident"
          operations:
            - name: close-user-tickets
              method: PATCH

Performs health checks on F5 load balancer virtual servers, identifies degraded pools, creates a ServiceNow incident, and notifies the network team via Teams.

naftiko: "0.5"
info:
  label: "F5 Load Balancer Health Check Orchestrator"
  description: "Performs health checks on F5 load balancer virtual servers, identifies degraded pools, creates a ServiceNow incident, and notifies the network team via Teams."
  tags:
    - network-operations
    - f5-networks
    - servicenow
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: network-operations
      port: 8080
      tools:
        - name: trigger-lb-health-check
          description: "Given an F5 virtual server name, check pool member health, create a ServiceNow incident for degraded members, and notify the network team."
          inputParameters:
            - name: virtual_server
              in: body
              type: string
              description: "The F5 virtual server name."
          steps:
            - name: get-pool-status
              type: call
              call: f5.get-pool-members
              with:
                virtual_server: "{{virtual_server}}"
            - name: create-incident
              type: call
              call: servicenow.create-incident
              with:
                short_description: "F5 pool degradation: {{virtual_server}}"
                category: "network"
            - name: notify-netops
              type: call
              call: msteams.post-message
              with:
                channel_id: "network-ops"
                text: "F5 health check: {{virtual_server}}. Active: {{get-pool-status.active_count}}/{{get-pool-status.total_count}}. Ticket: {{create-incident.number}}."
  consumes:
    - type: http
      namespace: f5
      baseUri: "https://f5.lockheedmartin.com/mgmt/tm"
      authentication:
        type: basic
        username: "$secrets.f5_user"
        password: "$secrets.f5_password"
      resources:
        - name: pools
          path: "/ltm/virtual/{{virtual_server}}/pool/members"
          inputParameters:
            - name: virtual_server
              in: path
          operations:
            - name: get-pool-members
              method: GET
    - type: http
      namespace: servicenow
      baseUri: "https://lockheedmartin.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.snow_user"
        password: "$secrets.snow_password"
      resources:
        - name: incidents
          path: "/table/incident"
          operations:
            - name: create-incident
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Scans GitHub repositories for critical security vulnerabilities using GitHub Advanced Security, creates Jira security issues, and notifies the cybersecurity team via Teams.

naftiko: "0.5"
info:
  label: "GitHub Advanced Security Vulnerability Triage"
  description: "Scans GitHub repositories for critical security vulnerabilities using GitHub Advanced Security, creates Jira security issues, and notifies the cybersecurity team via Teams."
  tags:
    - security
    - devops
    - github
    - jira
    - microsoft-teams
    - cybersecurity
capability:
  exposes:
    - type: mcp
      namespace: security-scanning
      port: 8080
      tools:
        - name: triage-code-vulnerabilities
          description: "Given a GitHub repository, retrieve critical and high-severity code scanning alerts from GitHub Advanced Security, create a Jira security issue, and alert the cybersecurity team in Teams. Use for weekly security posture reviews across defense software programs."
          inputParameters:
            - name: repo_name
              in: body
              type: string
              description: "GitHub repository in owner/repo format, e.g. lockheed-martin/f35-avionics-sw."
            - name: program_code
              in: body
              type: string
              description: "The defense program code for Jira project routing, e.g. F35."
          steps:
            - name: get-alerts
              type: call
              call: github.get-code-scanning-alerts
              with:
                repo: "{{repo_name}}"
            - name: create-jira-security-issue
              type: call
              call: jira.create-issue
              with:
                project_key: "SECSCAN"
                issuetype: "Security"
                summary: "[{{program_code}}] Security findings: {{get-alerts.count}} in {{repo_name}}"
                description: "GitHub Advanced Security: {{get-alerts.count}} critical vulnerabilities detected in {{repo_name}} for program {{program_code}}."
            - name: notify-cybersec
              type: call
              call: msteams.post-message
              with:
                channel_id: "$secrets.teams_cybersec_channel_id"
                text: "Security Alert [{{program_code}}]: {{repo_name}} has {{get-alerts.count}} critical findings. Jira: {{create-jira-security-issue.key}}"
  consumes:
    - type: http
      namespace: github
      baseUri: "https://api.github.com"
      authentication:
        type: bearer
        token: "$secrets.github_token"
      resources:
        - name: code-scanning-alerts
          path: "/repos/{{repo}}/code-scanning/alerts"
          inputParameters:
            - name: repo
              in: path
          operations:
            - name: get-code-scanning-alerts
              method: GET
    - type: http
      namespace: jira
      baseUri: "https://lockheed-martin.atlassian.net/rest/api/3"
      authentication:
        type: basic
        username: "$secrets.jira_user"
        password: "$secrets.jira_api_token"
      resources:
        - name: issues
          path: "/issue"
          operations:
            - name: create-issue
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: channel-messages
          path: "/teams/{{channel_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

On a GitHub Actions workflow failure in a protected engineering branch, creates a Jira bug and posts an alert to the aerospace engineering Teams channel.

naftiko: "0.5"
info:
  label: "GitHub CI/CD Pipeline Failure Handler"
  description: "On a GitHub Actions workflow failure in a protected engineering branch, creates a Jira bug and posts an alert to the aerospace engineering Teams channel."
  tags:
    - devops
    - cicd
    - github
    - jira
    - microsoft-teams
    - engineering
capability:
  exposes:
    - type: mcp
      namespace: devops
      port: 8080
      tools:
        - name: handle-pipeline-failure
          description: "Given a GitHub Actions workflow run ID and repository that failed on a protected branch, create a Jira bug and alert the engineering Teams channel. Invoke when CI/CD workflows fail on main or release branches in defense software programs."
          inputParameters:
            - name: repo_name
              in: body
              type: string
              description: "The GitHub repository in owner/repo format."
            - name: workflow_run_id
              in: body
              type: string
              description: "The GitHub Actions workflow run ID that failed."
            - name: branch
              in: body
              type: string
              description: "The branch where the failure occurred."
            - name: program_code
              in: body
              type: string
              description: "The defense program code associated with this repository, e.g. F35, LRSO."
          steps:
            - name: get-run-details
              type: call
              call: github.get-workflow-run
              with:
                repo: "{{repo_name}}"
                run_id: "{{workflow_run_id}}"
            - name: create-jira-bug
              type: call
              call: jira.create-issue
              with:
                project_key: "{{program_code}}"
                issuetype: "Bug"
                summary: "[CI Failure] {{repo_name}} / {{branch}} — Run {{workflow_run_id}}"
                description: "GitHub Actions failed on {{branch}}. Program: {{program_code}}. Run: {{workflow_run_id}}"
            - name: post-alert
              type: call
              call: msteams.post-message
              with:
                channel_id: "$secrets.teams_engineering_channel_id"
                text: "CI Failure [{{program_code}}]: {{repo_name}} | Branch: {{branch}} | Jira: {{create-jira-bug.key}}"
  consumes:
    - type: http
      namespace: github
      baseUri: "https://api.github.com"
      authentication:
        type: bearer
        token: "$secrets.github_token"
      resources:
        - name: workflow-runs
          path: "/repos/{{repo}}/actions/runs/{{run_id}}"
          inputParameters:
            - name: repo
              in: path
            - name: run_id
              in: path
          operations:
            - name: get-workflow-run
              method: GET
    - type: http
      namespace: jira
      baseUri: "https://lockheed-martin.atlassian.net/rest/api/3"
      authentication:
        type: basic
        username: "$secrets.jira_user"
        password: "$secrets.jira_api_token"
      resources:
        - name: issues
          path: "/issue"
          operations:
            - name: create-issue
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: channel-messages
          path: "/teams/{{channel_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

When GitHub Dependabot identifies a critical vulnerability, retrieves the advisory, creates a Jira remediation ticket, triggers an Azure DevOps security scan, and alerts the AppSec team via Teams.

naftiko: "0.5"
info:
  label: "GitHub Dependabot Vulnerability Remediation"
  description: "When GitHub Dependabot identifies a critical vulnerability, retrieves the advisory, creates a Jira remediation ticket, triggers an Azure DevOps security scan, and alerts the AppSec team via Teams."
  tags:
    - security
    - github
    - jira
    - azure-devops
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: security
      port: 8080
      tools:
        - name: trigger-vuln-remediation
          description: "Given a GitHub repository and Dependabot alert ID, fetch advisory details, create a Jira remediation ticket, trigger a security scan, and notify AppSec."
          inputParameters:
            - name: repo
              in: body
              type: string
              description: "The GitHub repository name."
            - name: alert_id
              in: body
              type: string
              description: "The Dependabot alert ID."
          steps:
            - name: get-advisory
              type: call
              call: github.get-dependabot-alert
              with:
                repo: "{{repo}}"
                alert_id: "{{alert_id}}"
            - name: create-ticket
              type: call
              call: jira.create-issue
              with:
                project: "APPSEC"
                summary: "Dependabot CVE: {{get-advisory.cve_id}} in {{repo}}"
                priority: "Critical"
            - name: trigger-scan
              type: call
              call: azuredevops.queue-build
              with:
                project: "{{repo}}"
                definition_name: "security-scan"
            - name: notify-appsec
              type: call
              call: msteams.post-message
              with:
                channel_id: "appsec-alerts"
                text: "Critical CVE {{get-advisory.cve_id}} in {{repo}}. Severity: {{get-advisory.severity}}. Jira: {{create-ticket.key}}."
  consumes:
    - type: http
      namespace: github
      baseUri: "https://api.github.com"
      authentication:
        type: bearer
        token: "$secrets.github_token"
      resources:
        - name: dependabot-alerts
          path: "/repos/lockheed-martin/{{repo}}/dependabot/alerts/{{alert_id}}"
          inputParameters:
            - name: repo
              in: path
            - name: alert_id
              in: path
          operations:
            - name: get-dependabot-alert
              method: GET
    - type: http
      namespace: jira
      baseUri: "https://lockheedmartin.atlassian.net/rest/api/3"
      authentication:
        type: bearer
        token: "$secrets.jira_token"
      resources:
        - name: issues
          path: "/issue"
          operations:
            - name: create-issue
              method: POST
    - type: http
      namespace: azuredevops
      baseUri: "https://dev.azure.com/lockheedmartin"
      authentication:
        type: bearer
        token: "$secrets.azuredevops_token"
      resources:
        - name: builds
          path: "/{{project}}/_apis/build/builds?api-version=7.0"
          inputParameters:
            - name: project
              in: path
          operations:
            - name: queue-build
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

When a GitHub pull request is merged on a defense software repo, triggers an Azure DevOps release pipeline, runs SonarQube quality gate, and posts results to the engineering Teams channel.

naftiko: "0.5"
info:
  label: "GitHub to Azure DevOps Code Promotion"
  description: "When a GitHub pull request is merged on a defense software repo, triggers an Azure DevOps release pipeline, runs SonarQube quality gate, and posts results to the engineering Teams channel."
  tags:
    - devops
    - github
    - azure-devops
    - sonarqube
    - microsoft-teams
    - cicd
capability:
  exposes:
    - type: mcp
      namespace: devops
      port: 8080
      tools:
        - name: trigger-code-promotion
          description: "Given a GitHub repository and merged PR number, trigger the Azure DevOps release pipeline, check SonarQube quality gate, and notify the engineering team with results."
          inputParameters:
            - name: repo
              in: body
              type: string
              description: "The GitHub repository name."
            - name: pr_number
              in: body
              type: string
              description: "The merged pull request number."
          steps:
            - name: get-pr
              type: call
              call: github.get-pr
              with:
                repo: "{{repo}}"
                pr_number: "{{pr_number}}"
            - name: trigger-release
              type: call
              call: azuredevops.queue-build
              with:
                project: "{{repo}}"
                source_branch: "{{get-pr.merge_commit_sha}}"
            - name: check-quality
              type: call
              call: sonarqube.get-quality-gate
              with:
                project_key: "{{repo}}"
            - name: notify-team
              type: call
              call: msteams.post-message
              with:
                channel_id: "engineering-releases"
                text: "PR #{{pr_number}} merged in {{repo}}. Release: {{trigger-release.build_number}}. Quality gate: {{check-quality.status}}."
  consumes:
    - type: http
      namespace: github
      baseUri: "https://api.github.com"
      authentication:
        type: bearer
        token: "$secrets.github_token"
      resources:
        - name: pulls
          path: "/repos/lockheed-martin/{{repo}}/pulls/{{pr_number}}"
          inputParameters:
            - name: repo
              in: path
            - name: pr_number
              in: path
          operations:
            - name: get-pr
              method: GET
    - type: http
      namespace: azuredevops
      baseUri: "https://dev.azure.com/lockheedmartin"
      authentication:
        type: bearer
        token: "$secrets.azuredevops_token"
      resources:
        - name: builds
          path: "/{{project}}/_apis/build/builds?api-version=7.0"
          inputParameters:
            - name: project
              in: path
          operations:
            - name: queue-build
              method: POST
    - type: http
      namespace: sonarqube
      baseUri: "https://sonarqube.lockheedmartin.com/api"
      authentication:
        type: bearer
        token: "$secrets.sonarqube_token"
      resources:
        - name: quality-gates
          path: "/qualitygates/project_status?projectKey={{project_key}}"
          inputParameters:
            - name: project_key
              in: path
          operations:
            - name: get-quality-gate
              method: GET
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Pulls web traffic analytics from Google Analytics for defense program public-facing sites, generates a Confluence report, and sends a weekly digest to the marketing team via Teams.

naftiko: "0.5"
info:
  label: "Google Analytics Defense Web Traffic Report"
  description: "Pulls web traffic analytics from Google Analytics for defense program public-facing sites, generates a Confluence report, and sends a weekly digest to the marketing team via Teams."
  tags:
    - marketing
    - google-analytics
    - confluence
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: marketing
      port: 8080
      tools:
        - name: trigger-traffic-report
          description: "Given a Google Analytics property ID and date range, pull traffic metrics, publish a Confluence report, and notify the marketing team via Teams."
          inputParameters:
            - name: property_id
              in: body
              type: string
              description: "The Google Analytics property ID."
            - name: start_date
              in: body
              type: string
              description: "Report start date in YYYY-MM-DD format."
            - name: end_date
              in: body
              type: string
              description: "Report end date in YYYY-MM-DD format."
          steps:
            - name: get-traffic
              type: call
              call: google-analytics.get-report
              with:
                property_id: "{{property_id}}"
                start_date: "{{start_date}}"
                end_date: "{{end_date}}"
            - name: publish-report
              type: call
              call: confluence.create-page
              with:
                space_key: "MARKETING"
                title: "Web Traffic Report {{start_date}} to {{end_date}}"
                body: "Sessions: {{get-traffic.sessions}}. Users: {{get-traffic.users}}. Bounce rate: {{get-traffic.bounce_rate}}."
            - name: notify-marketing
              type: call
              call: msteams.post-message
              with:
                channel_id: "marketing-analytics"
                text: "Weekly traffic report published. Sessions: {{get-traffic.sessions}}. Report: {{publish-report.url}}."
  consumes:
    - type: http
      namespace: google-analytics
      baseUri: "https://analyticsdata.googleapis.com/v1beta"
      authentication:
        type: bearer
        token: "$secrets.google_analytics_token"
      resources:
        - name: reports
          path: "/properties/{{property_id}}:runReport"
          inputParameters:
            - name: property_id
              in: path
          operations:
            - name: get-report
              method: POST
    - type: http
      namespace: confluence
      baseUri: "https://lockheedmartin.atlassian.net/wiki/rest/api"
      authentication:
        type: bearer
        token: "$secrets.confluence_token"
      resources:
        - name: content
          path: "/content"
          operations:
            - name: create-page
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

When a Grafana alert fires from Prometheus metrics on mission systems, retrieves alert details, creates a Jira issue for the responsible team, and notifies the SRE channel via Teams.

naftiko: "0.5"
info:
  label: "Grafana Prometheus Alert to Jira Escalation"
  description: "When a Grafana alert fires from Prometheus metrics on mission systems, retrieves alert details, creates a Jira issue for the responsible team, and notifies the SRE channel via Teams."
  tags:
    - observability
    - grafana
    - jira
    - microsoft-teams
    - sre
capability:
  exposes:
    - type: mcp
      namespace: observability
      port: 8080
      tools:
        - name: trigger-grafana-escalation
          description: "Given a Grafana alert ID, retrieve Prometheus metric details, create a Jira issue for the owning team, and notify the SRE channel via Teams."
          inputParameters:
            - name: alert_id
              in: body
              type: string
              description: "The Grafana alert ID."
            - name: owning_team
              in: body
              type: string
              description: "The Jira project key for the owning team."
          steps:
            - name: get-alert
              type: call
              call: grafana.get-alert
              with:
                alert_id: "{{alert_id}}"
            - name: create-issue
              type: call
              call: jira.create-issue
              with:
                project: "{{owning_team}}"
                summary: "Grafana alert: {{get-alert.name}} - {{get-alert.state}}"
            - name: notify-sre
              type: call
              call: msteams.post-message
              with:
                channel_id: "sre-alerts"
                text: "Grafana alert {{get-alert.name}} fired. State: {{get-alert.state}}. Jira: {{create-issue.key}}."
  consumes:
    - type: http
      namespace: grafana
      baseUri: "https://grafana.lockheedmartin.com/api"
      authentication:
        type: bearer
        token: "$secrets.grafana_token"
      resources:
        - name: alerts
          path: "/alerts/{{alert_id}}"
          inputParameters:
            - name: alert_id
              in: path
          operations:
            - name: get-alert
              method: GET
    - type: http
      namespace: jira
      baseUri: "https://lockheedmartin.atlassian.net/rest/api/3"
      authentication:
        type: bearer
        token: "$secrets.jira_token"
      resources:
        - name: issues
          path: "/issue"
          operations:
            - name: create-issue
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Triggers a Harness deployment pipeline for a defense application, creates a ServiceNow change request, monitors deployment health via Datadog, and notifies the release team via Teams.

naftiko: "0.5"
info:
  label: "Harness Deployment Pipeline Orchestrator"
  description: "Triggers a Harness deployment pipeline for a defense application, creates a ServiceNow change request, monitors deployment health via Datadog, and notifies the release team via Teams."
  tags:
    - devops
    - harness
    - servicenow
    - datadog
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: devops
      port: 8080
      tools:
        - name: trigger-harness-deployment
          description: "Given a Harness pipeline ID and target environment, trigger deployment, create a ServiceNow change, monitor via Datadog, and notify the release team."
          inputParameters:
            - name: pipeline_id
              in: body
              type: string
              description: "The Harness deployment pipeline ID."
            - name: environment
              in: body
              type: string
              description: "Target environment: staging, production, or govcloud."
          steps:
            - name: create-change
              type: call
              call: servicenow.create-change
              with:
                short_description: "Harness deployment: {{pipeline_id}} to {{environment}}"
                category: "deployment"
            - name: trigger-pipeline
              type: call
              call: harness.execute-pipeline
              with:
                pipeline_id: "{{pipeline_id}}"
                environment: "{{environment}}"
            - name: check-health
              type: call
              call: datadog.get-monitors
              with:
                tags: "env:{{environment}}"
            - name: notify-release
              type: call
              call: msteams.post-message
              with:
                channel_id: "release-management"
                text: "Deployment to {{environment}} initiated. Change: {{create-change.number}}. Health: {{check-health.overall_status}}."
  consumes:
    - type: http
      namespace: servicenow
      baseUri: "https://lockheedmartin.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.snow_user"
        password: "$secrets.snow_password"
      resources:
        - name: changes
          path: "/table/change_request"
          operations:
            - name: create-change
              method: POST
    - type: http
      namespace: harness
      baseUri: "https://app.harness.io/gateway/pipeline/api"
      authentication:
        type: bearer
        token: "$secrets.harness_token"
      resources:
        - name: pipelines
          path: "/pipelines/execute/{{pipeline_id}}"
          inputParameters:
            - name: pipeline_id
              in: path
          operations:
            - name: execute-pipeline
              method: POST
    - type: http
      namespace: datadog
      baseUri: "https://api.datadoghq.com/api/v1"
      authentication:
        type: bearer
        token: "$secrets.datadog_api_key"
      resources:
        - name: monitors
          path: "/monitor"
          operations:
            - name: get-monitors
              method: GET
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Syncs marketing-qualified leads from HubSpot to Salesforce, enriches with ZoomInfo company data, creates a Jira follow-up task, and notifies the sales team via Teams.

naftiko: "0.5"
info:
  label: "HubSpot to Salesforce Lead Sync Orchestrator"
  description: "Syncs marketing-qualified leads from HubSpot to Salesforce, enriches with ZoomInfo company data, creates a Jira follow-up task, and notifies the sales team via Teams."
  tags:
    - marketing
    - hubspot
    - salesforce
    - zoominfo
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: marketing
      port: 8080
      tools:
        - name: trigger-lead-sync
          description: "Given a HubSpot contact ID marked as MQL, sync to Salesforce, enrich with ZoomInfo, and notify the sales team."
          inputParameters:
            - name: contact_id
              in: body
              type: string
              description: "The HubSpot contact ID."
          steps:
            - name: get-contact
              type: call
              call: hubspot.get-contact
              with:
                contact_id: "{{contact_id}}"
            - name: enrich-data
              type: call
              call: zoominfo.enrich-company
              with:
                company_name: "{{get-contact.company}}"
            - name: create-lead
              type: call
              call: salesforce.create-lead
              with:
                first_name: "{{get-contact.first_name}}"
                last_name: "{{get-contact.last_name}}"
                company: "{{get-contact.company}}"
            - name: notify-sales
              type: call
              call: msteams.post-message
              with:
                channel_id: "sales-leads"
                text: "New MQL synced: {{get-contact.first_name}} {{get-contact.last_name}} at {{get-contact.company}}. SF Lead: {{create-lead.id}}."
  consumes:
    - type: http
      namespace: hubspot
      baseUri: "https://api.hubapi.com"
      authentication:
        type: bearer
        token: "$secrets.hubspot_token"
      resources:
        - name: contacts
          path: "/crm/v3/objects/contacts/{{contact_id}}"
          inputParameters:
            - name: contact_id
              in: path
          operations:
            - name: get-contact
              method: GET
    - type: http
      namespace: zoominfo
      baseUri: "https://api.zoominfo.com"
      authentication:
        type: bearer
        token: "$secrets.zoominfo_token"
      resources:
        - name: companies
          path: "/search/company"
          operations:
            - name: enrich-company
              method: POST
    - type: http
      namespace: salesforce
      baseUri: "https://lockheedmartin.my.salesforce.com/services/data/v58.0"
      authentication:
        type: bearer
        token: "$secrets.salesforce_token"
      resources:
        - name: leads
          path: "/sobjects/Lead"
          operations:
            - name: create-lead
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

On a PagerDuty critical alert for Lockheed Martin production systems, creates a ServiceNow P1 incident, pages the on-call team, and opens a Teams war room for rapid coordination.

naftiko: "0.5"
info:
  label: "IT P1 Incident Response and War Room"
  description: "On a PagerDuty critical alert for Lockheed Martin production systems, creates a ServiceNow P1 incident, pages the on-call team, and opens a Teams war room for rapid coordination."
  tags:
    - itsm
    - incident-response
    - pagerduty
    - servicenow
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: itsm-ops
      port: 8080
      tools:
        - name: handle-p1-incident
          description: "Given a PagerDuty alert ID and affected service, create a P1 ServiceNow incident, trigger an on-call PagerDuty escalation, and post a war-room message to the IT operations Teams channel. Invoke on critical production alerts."
          inputParameters:
            - name: alert_id
              in: body
              type: string
              description: "The PagerDuty alert ID for the critical production event."
            - name: service_name
              in: body
              type: string
              description: "The name of the affected system or service."
            - name: alert_summary
              in: body
              type: string
              description: "A brief description of the alert condition."
          steps:
            - name: create-snow-incident
              type: call
              call: servicenow.create-incident
              with:
                priority: "1"
                short_description: "P1: {{alert_summary}} — {{service_name}}"
                category: "production_outage"
            - name: trigger-page
              type: call
              call: pagerduty.create-incident
              with:
                title: "P1: {{alert_summary}}"
                service_id: "$secrets.pagerduty_service_id"
                body_details: "SNOW: {{create-snow-incident.number}}"
            - name: open-war-room
              type: call
              call: msteams.post-message
              with:
                channel_id: "$secrets.teams_it_ops_channel_id"
                text: "P1 INCIDENT OPEN | {{service_name}} | {{alert_summary}} | SNOW: {{create-snow-incident.number}} | PD: {{trigger-page.incident_key}}"
  consumes:
    - type: http
      namespace: servicenow
      baseUri: "https://lockheedmartin.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.snow_user"
        password: "$secrets.snow_password"
      resources:
        - name: incidents
          path: "/table/incident"
          operations:
            - name: create-incident
              method: POST
    - type: http
      namespace: pagerduty
      baseUri: "https://api.pagerduty.com"
      authentication:
        type: apikey
        key: "Authorization"
        value: "$secrets.pagerduty_api_key"
        placement: header
      resources:
        - name: incidents
          path: "/incidents"
          operations:
            - name: create-incident
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: channel-messages
          path: "/teams/{{channel_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Retrieves detailed information about a Jira issue including status, assignee, priority, and linked program milestones for defense program tracking.

naftiko: "0.5"
info:
  label: "Jira Issue Details Lookup"
  description: "Retrieves detailed information about a Jira issue including status, assignee, priority, and linked program milestones for defense program tracking."
  tags:
    - project-management
    - jira
    - program-delivery
    - defense
capability:
  exposes:
    - type: mcp
      namespace: project-management
      port: 8080
      tools:
        - name: get-issue
          description: "Given a Jira issue key, return issue summary, status, assignee, priority, and custom fields for program milestone tracking. Use for program delivery status checks."
          inputParameters:
            - name: issue_key
              in: body
              type: string
              description: "The Jira issue key, e.g. F35-1234."
          call: jira.get-issue
          with:
            issue_key: "{{issue_key}}"
          outputParameters:
            - name: summary
              type: string
              mapping: "$.fields.summary"
            - name: status
              type: string
              mapping: "$.fields.status.name"
            - name: assignee
              type: string
              mapping: "$.fields.assignee.displayName"
            - name: priority
              type: string
              mapping: "$.fields.priority.name"
  consumes:
    - type: http
      namespace: jira
      baseUri: "https://lockheedmartin.atlassian.net/rest/api/3"
      authentication:
        type: bearer
        token: "$secrets.jira_token"
      resources:
        - name: issues
          path: "/issue/{{issue_key}}"
          inputParameters:
            - name: issue_key
              in: path
          operations:
            - name: get-issue
              method: GET

Retrieves sprint completion and delivery metrics from Jira for defense engineering program teams and posts a weekly delivery summary to the program management Teams channel.

naftiko: "0.5"
info:
  label: "Jira Program Delivery Sprint Report"
  description: "Retrieves sprint completion and delivery metrics from Jira for defense engineering program teams and posts a weekly delivery summary to the program management Teams channel."
  tags:
    - devops
    - engineering
    - jira
    - reporting
    - program-management
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: program-delivery-reporting
      port: 8080
      tools:
        - name: publish-program-sprint-report
          description: "Given a Jira project key and sprint ID, retrieve sprint velocity metrics and post a program delivery summary to the program management Teams channel. Use for weekly delivery reviews and integrated program reviews (IPR)."
          inputParameters:
            - name: project_key
              in: body
              type: string
              description: "The Jira project key for the defense program, e.g. F35."
            - name: sprint_id
              in: body
              type: integer
              description: "The Jira sprint ID to report on."
          steps:
            - name: get-sprint
              type: call
              call: jira.get-sprint-report
              with:
                sprint_id: "{{sprint_id}}"
                project: "{{project_key}}"
            - name: post-report
              type: call
              call: msteams.post-message
              with:
                channel_id: "$secrets.teams_programs_channel_id"
                text: "Sprint {{sprint_id}} [{{project_key}}]: {{get-sprint.completed_points}}/{{get-sprint.committed_points}} story points. Velocity: {{get-sprint.velocity}}"
  consumes:
    - type: http
      namespace: jira
      baseUri: "https://lockheed-martin.atlassian.net/rest/api/3"
      authentication:
        type: basic
        username: "$secrets.jira_user"
        password: "$secrets.jira_api_token"
      resources:
        - name: sprint-reports
          path: "/board/{{sprint_id}}/sprint/{{sprint_id}}/report"
          inputParameters:
            - name: sprint_id
              in: path
          operations:
            - name: get-sprint-report
              method: GET
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: channel-messages
          path: "/teams/{{channel_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Aggregates Jira sprint metrics for a defense program, generates a formatted status report, publishes to Confluence, and sends a summary digest to program leadership via Teams.

naftiko: "0.5"
info:
  label: "Jira to Confluence Program Status Publisher"
  description: "Aggregates Jira sprint metrics for a defense program, generates a formatted status report, publishes to Confluence, and sends a summary digest to program leadership via Teams."
  tags:
    - program-management
    - jira
    - confluence
    - microsoft-teams
    - defense
capability:
  exposes:
    - type: mcp
      namespace: program-management
      port: 8080
      tools:
        - name: publish-program-status
          description: "Given a Jira project key and sprint ID, aggregate sprint metrics, publish a formatted report to Confluence, and notify program leadership via Teams."
          inputParameters:
            - name: project_key
              in: body
              type: string
              description: "The Jira project key, e.g. F35."
            - name: sprint_id
              in: body
              type: string
              description: "The Jira sprint ID."
          steps:
            - name: get-sprint-report
              type: call
              call: jira.get-sprint-report
              with:
                project_key: "{{project_key}}"
                sprint_id: "{{sprint_id}}"
            - name: publish-report
              type: call
              call: confluence.create-page
              with:
                space_key: "{{project_key}}"
                title: "Sprint Report {{sprint_id}} - {{project_key}}"
                body: "Completed: {{get-sprint-report.completed}}. Remaining: {{get-sprint-report.remaining}}. Velocity: {{get-sprint-report.velocity}}."
            - name: notify-leadership
              type: call
              call: msteams.post-message
              with:
                channel_id: "program-leadership"
                text: "Sprint {{sprint_id}} report for {{project_key}} published. Velocity: {{get-sprint-report.velocity}}."
  consumes:
    - type: http
      namespace: jira
      baseUri: "https://lockheedmartin.atlassian.net/rest/agile/1.0"
      authentication:
        type: bearer
        token: "$secrets.jira_token"
      resources:
        - name: sprints
          path: "/board/{{project_key}}/sprint/{{sprint_id}}/report"
          inputParameters:
            - name: project_key
              in: path
            - name: sprint_id
              in: path
          operations:
            - name: get-sprint-report
              method: GET
    - type: http
      namespace: confluence
      baseUri: "https://lockheedmartin.atlassian.net/wiki/rest/api"
      authentication:
        type: bearer
        token: "$secrets.confluence_token"
      resources:
        - name: content
          path: "/content"
          operations:
            - name: create-page
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Audits Microsoft 365 license assignments against Workday active employees, identifies unused licenses, creates a ServiceNow reclamation task, and notifies IT finance via Teams.

naftiko: "0.5"
info:
  label: "Microsoft 365 License Optimization Orchestrator"
  description: "Audits Microsoft 365 license assignments against Workday active employees, identifies unused licenses, creates a ServiceNow reclamation task, and notifies IT finance via Teams."
  tags:
    - it-operations
    - microsoft-365
    - workday
    - servicenow
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: it-operations
      port: 8080
      tools:
        - name: trigger-license-audit
          description: "Given a Microsoft 365 license SKU, audit assignments against Workday active employees, identify unused licenses, create a ServiceNow reclamation task, and notify IT finance."
          inputParameters:
            - name: sku_id
              in: body
              type: string
              description: "The Microsoft 365 license SKU ID."
          steps:
            - name: get-assignments
              type: call
              call: msgraph.get-license-assignments
              with:
                sku_id: "{{sku_id}}"
            - name: get-active-workers
              type: call
              call: workday.get-active-workers
              with:
                business_unit: "all"
            - name: create-reclamation
              type: call
              call: servicenow.create-incident
              with:
                short_description: "License optimization: {{sku_id}} - unused licenses identified"
                category: "license_management"
            - name: notify-it-finance
              type: call
              call: msteams.post-message
              with:
                channel_id: "it-finance"
                text: "License audit for {{sku_id}}: Assigned: {{get-assignments.total}}. Potential savings identified. Ticket: {{create-reclamation.number}}."
  consumes:
    - type: http
      namespace: msgraph
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: licenses
          path: "/subscribedSkus/{{sku_id}}"
          inputParameters:
            - name: sku_id
              in: path
          operations:
            - name: get-license-assignments
              method: GET
    - type: http
      namespace: workday
      baseUri: "https://wd2-impl-services1.workday.com/ccx/api/v1"
      authentication:
        type: bearer
        token: "$secrets.workday_token"
      resources:
        - name: workers
          path: "/lockheed-martin/workers"
          operations:
            - name: get-active-workers
              method: GET
    - type: http
      namespace: servicenow
      baseUri: "https://lockheedmartin.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.snow_user"
        password: "$secrets.snow_password"
      resources:
        - name: incidents
          path: "/table/incident"
          operations:
            - name: create-incident
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Synchronizes Microsoft Planner task boards with Jira program epics, creates missing Jira issues from Planner tasks, and posts a sync summary to the program Teams channel.

naftiko: "0.5"
info:
  label: "Microsoft Planner Program Task Sync"
  description: "Synchronizes Microsoft Planner task boards with Jira program epics, creates missing Jira issues from Planner tasks, and posts a sync summary to the program Teams channel."
  tags:
    - project-management
    - microsoft-planner
    - jira
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: project-management
      port: 8080
      tools:
        - name: trigger-planner-sync
          description: "Given a Microsoft Planner plan ID and Jira project key, sync tasks to Jira issues, create missing items, and post a summary to the program channel."
          inputParameters:
            - name: plan_id
              in: body
              type: string
              description: "The Microsoft Planner plan ID."
            - name: jira_project
              in: body
              type: string
              description: "The Jira project key to sync with."
          steps:
            - name: get-planner-tasks
              type: call
              call: msgraph.get-planner-tasks
              with:
                plan_id: "{{plan_id}}"
            - name: create-jira-issues
              type: call
              call: jira.create-issue
              with:
                project: "{{jira_project}}"
                summary: "Synced from Planner: {{get-planner-tasks.new_count}} tasks"
            - name: notify-program
              type: call
              call: msteams.post-message
              with:
                channel_id: "program-tasks"
                text: "Planner-Jira sync complete. Total tasks: {{get-planner-tasks.total}}. New Jira issues: {{get-planner-tasks.new_count}}."
  consumes:
    - type: http
      namespace: msgraph
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: planner-tasks
          path: "/planner/plans/{{plan_id}}/tasks"
          inputParameters:
            - name: plan_id
              in: path
          operations:
            - name: get-planner-tasks
              method: GET
    - type: http
      namespace: jira
      baseUri: "https://lockheedmartin.atlassian.net/rest/api/3"
      authentication:
        type: bearer
        token: "$secrets.jira_token"
      resources:
        - name: issues
          path: "/issue"
          operations:
            - name: create-issue
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Retrieves a Microsoft Sentinel security incident by ID, returning severity, status, tactics, and affected entities for security operations center investigations.

naftiko: "0.5"
info:
  label: "Microsoft Sentinel Incident Lookup"
  description: "Retrieves a Microsoft Sentinel security incident by ID, returning severity, status, tactics, and affected entities for security operations center investigations."
  tags:
    - security-operations
    - microsoft-sentinel
    - soc
    - threat-detection
capability:
  exposes:
    - type: mcp
      namespace: security-operations
      port: 8080
      tools:
        - name: get-sentinel-incident
          description: "Given a Microsoft Sentinel incident ID, return severity, status, title, tactics, and entities involved. Use for SOC investigation on classified and unclassified networks."
          inputParameters:
            - name: incident_id
              in: body
              type: string
              description: "The Microsoft Sentinel incident ID."
          call: sentinel.get-incident
          with:
            incident_id: "{{incident_id}}"
          outputParameters:
            - name: title
              type: string
              mapping: "$.properties.title"
            - name: severity
              type: string
              mapping: "$.properties.severity"
            - name: status
              type: string
              mapping: "$.properties.status"
  consumes:
    - type: http
      namespace: sentinel
      baseUri: "https://management.usgovcloudapi.net"
      authentication:
        type: bearer
        token: "$secrets.azure_gov_token"
      resources:
        - name: incidents
          path: "/providers/Microsoft.SecurityInsights/incidents/{{incident_id}}"
          inputParameters:
            - name: incident_id
              in: path
          operations:
            - name: get-incident
              method: GET

When Microsoft Sentinel detects a high-severity threat, retrieves incident details, suspends the affected Okta account, creates a ServiceNow P1 incident, and alerts the SOC team via Teams.

naftiko: "0.5"
info:
  label: "Microsoft Sentinel Threat Response Orchestrator"
  description: "When Microsoft Sentinel detects a high-severity threat, retrieves incident details, suspends the affected Okta account, creates a ServiceNow P1 incident, and alerts the SOC team via Teams."
  tags:
    - security-operations
    - microsoft-sentinel
    - okta
    - servicenow
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: security-operations
      port: 8080
      tools:
        - name: trigger-threat-response
          description: "Given a Sentinel incident ID with high severity, retrieve threat details, suspend affected Okta user, create a P1 ServiceNow incident, and alert the SOC via Teams."
          inputParameters:
            - name: incident_id
              in: body
              type: string
              description: "The Microsoft Sentinel incident ID."
          steps:
            - name: get-incident
              type: call
              call: sentinel.get-incident
              with:
                incident_id: "{{incident_id}}"
            - name: suspend-user
              type: call
              call: okta.suspend-user
              with:
                user_id: "{{get-incident.affected_user}}"
            - name: create-p1
              type: call
              call: servicenow.create-incident
              with:
                short_description: "Sentinel Threat: {{get-incident.title}}"
                impact: "1"
                urgency: "1"
            - name: alert-soc
              type: call
              call: msteams.post-message
              with:
                channel_id: "soc-critical"
                text: "CRITICAL THREAT: {{get-incident.title}}. Affected user suspended. P1 Ticket: {{create-p1.number}}."
  consumes:
    - type: http
      namespace: sentinel
      baseUri: "https://management.usgovcloudapi.net"
      authentication:
        type: bearer
        token: "$secrets.azure_gov_token"
      resources:
        - name: incidents
          path: "/providers/Microsoft.SecurityInsights/incidents/{{incident_id}}"
          inputParameters:
            - name: incident_id
              in: path
          operations:
            - name: get-incident
              method: GET
    - type: http
      namespace: okta
      baseUri: "https://lockheedmartin.okta.com/api/v1"
      authentication:
        type: bearer
        token: "$secrets.okta_token"
      resources:
        - name: users
          path: "/users/{{user_id}}/lifecycle/suspend"
          inputParameters:
            - name: user_id
              in: path
          operations:
            - name: suspend-user
              method: POST
    - type: http
      namespace: servicenow
      baseUri: "https://lockheedmartin.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.snow_user"
        password: "$secrets.snow_password"
      resources:
        - name: incidents
          path: "/table/incident"
          operations:
            - name: create-incident
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Retrieves recent messages from a Microsoft Teams channel, used for monitoring program communication channels and extracting action items from engineering discussions.

naftiko: "0.5"
info:
  label: "Microsoft Teams Channel Message Lookup"
  description: "Retrieves recent messages from a Microsoft Teams channel, used for monitoring program communication channels and extracting action items from engineering discussions."
  tags:
    - communications
    - microsoft-teams
    - program-management
capability:
  exposes:
    - type: mcp
      namespace: communications
      port: 8080
      tools:
        - name: get-channel-messages
          description: "Given a Teams team ID and channel ID, return the most recent messages with sender, timestamp, and content. Use for program communication monitoring and action item extraction."
          inputParameters:
            - name: team_id
              in: body
              type: string
              description: "The Microsoft Teams team ID."
            - name: channel_id
              in: body
              type: string
              description: "The Teams channel ID."
          call: msteams.get-messages
          with:
            team_id: "{{team_id}}"
            channel_id: "{{channel_id}}"
          outputParameters:
            - name: messages
              type: array
              mapping: "$.value"
            - name: count
              type: integer
              mapping: "$.@odata.count"
  consumes:
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: channel-messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: team_id
              in: path
            - name: channel_id
              in: path
          operations:
            - name: get-messages
              method: GET

When NetApp storage capacity exceeds a threshold, retrieves volume details, creates a ServiceNow capacity request, updates the CMDB, and notifies the storage team via Teams.

naftiko: "0.5"
info:
  label: "NetApp Storage Capacity Alert Handler"
  description: "When NetApp storage capacity exceeds a threshold, retrieves volume details, creates a ServiceNow capacity request, updates the CMDB, and notifies the storage team via Teams."
  tags:
    - infrastructure
    - netapp
    - servicenow
    - microsoft-teams
    - storage
capability:
  exposes:
    - type: mcp
      namespace: infrastructure
      port: 8080
      tools:
        - name: trigger-storage-alert
          description: "Given a NetApp volume name with capacity alert, retrieve volume metrics, create a ServiceNow request, and notify the storage team."
          inputParameters:
            - name: volume_name
              in: body
              type: string
              description: "The NetApp volume name."
            - name: threshold_pct
              in: body
              type: string
              description: "The capacity threshold percentage exceeded."
          steps:
            - name: get-volume
              type: call
              call: netapp.get-volume
              with:
                volume_name: "{{volume_name}}"
            - name: create-request
              type: call
              call: servicenow.create-incident
              with:
                short_description: "Storage capacity alert: {{volume_name}} at {{threshold_pct}}%"
                category: "storage"
            - name: notify-storage
              type: call
              call: msteams.post-message
              with:
                channel_id: "storage-ops"
                text: "Storage alert: {{volume_name}} at {{threshold_pct}}% capacity. Used: {{get-volume.used_gb}}GB / {{get-volume.total_gb}}GB. Ticket: {{create-request.number}}."
  consumes:
    - type: http
      namespace: netapp
      baseUri: "https://netapp.lockheedmartin.com/api/storage"
      authentication:
        type: basic
        username: "$secrets.netapp_user"
        password: "$secrets.netapp_password"
      resources:
        - name: volumes
          path: "/volumes?name={{volume_name}}"
          inputParameters:
            - name: volume_name
              in: path
          operations:
            - name: get-volume
              method: GET
    - type: http
      namespace: servicenow
      baseUri: "https://lockheedmartin.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.snow_user"
        password: "$secrets.snow_password"
      resources:
        - name: incidents
          path: "/table/incident"
          operations:
            - name: create-incident
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Retrieves application health metrics from New Relic for a given application ID, returning Apdex score, error rate, and throughput for mission systems monitoring.

naftiko: "0.5"
info:
  label: "New Relic Application Health Lookup"
  description: "Retrieves application health metrics from New Relic for a given application ID, returning Apdex score, error rate, and throughput for mission systems monitoring."
  tags:
    - observability
    - new-relic
    - mission-systems
    - monitoring
capability:
  exposes:
    - type: mcp
      namespace: observability
      port: 8080
      tools:
        - name: get-app-health
          description: "Given a New Relic application ID, return the current Apdex score, error rate, response time, and throughput. Use for mission-critical application health verification."
          inputParameters:
            - name: app_id
              in: body
              type: string
              description: "The New Relic application ID."
          call: newrelic.get-app
          with:
            app_id: "{{app_id}}"
          outputParameters:
            - name: apdex_score
              type: number
              mapping: "$.application.application_summary.apdex_score"
            - name: error_rate
              type: number
              mapping: "$.application.application_summary.error_rate"
            - name: throughput
              type: number
              mapping: "$.application.application_summary.throughput"
  consumes:
    - type: http
      namespace: newrelic
      baseUri: "https://api.newrelic.com/v2"
      authentication:
        type: bearer
        token: "$secrets.newrelic_api_key"
      resources:
        - name: applications
          path: "/applications/{{app_id}}.json"
          inputParameters:
            - name: app_id
              in: path
          operations:
            - name: get-app
              method: GET

When a Lockheed Martin employee changes roles or programs in Workday, updates their Okta group memberships to match the new role's access entitlements, respecting clearance-level constraints.

naftiko: "0.5"
info:
  label: "Okta Cleared Personnel Access Provisioning"
  description: "When a Lockheed Martin employee changes roles or programs in Workday, updates their Okta group memberships to match the new role's access entitlements, respecting clearance-level constraints."
  tags:
    - identity
    - security
    - okta
    - workday
    - access-management
    - security-clearance
capability:
  exposes:
    - type: mcp
      namespace: identity-ops
      port: 8080
      tools:
        - name: sync-cleared-role-access
          description: "Given a Workday employee ID and new job profile or program assignment, update Okta group memberships to reflect the new access level. Invoke on role change or program transfer events to enforce least-privilege access for cleared personnel."
          inputParameters:
            - name: employee_id
              in: body
              type: string
              description: "The Workday worker ID of the employee changing roles."
            - name: new_role
              in: body
              type: string
              description: "The new job profile or program code, e.g. F35_SW_ENGINEER."
          steps:
            - name: get-worker
              type: call
              call: workday.get-worker
              with:
                worker_id: "{{employee_id}}"
            - name: get-okta-user
              type: call
              call: okta.get-user
              with:
                login: "{{get-worker.work_email}}"
            - name: update-access
              type: call
              call: okta.update-user-profile
              with:
                user_id: "{{get-okta-user.id}}"
                role: "{{new_role}}"
  consumes:
    - type: http
      namespace: workday
      baseUri: "https://wd2-impl-services1.workday.com/ccx/api/v1"
      authentication:
        type: bearer
        token: "$secrets.workday_token"
      resources:
        - name: workers
          path: "/lockheed-martin/workers/{{worker_id}}"
          inputParameters:
            - name: worker_id
              in: path
          operations:
            - name: get-worker
              method: GET
    - type: http
      namespace: okta
      baseUri: "https://lockheedmartin.okta.com/api/v1"
      authentication:
        type: apikey
        key: "Authorization"
        value: "$secrets.okta_api_token"
        placement: header
      resources:
        - name: users
          path: "/users/{{login}}"
          inputParameters:
            - name: login
              in: path
          operations:
            - name: get-user
              method: GET
        - name: user-profile
          path: "/users/{{user_id}}"
          inputParameters:
            - name: user_id
              in: path
          operations:
            - name: update-user-profile
              method: POST

Initiates a privileged access review by pulling Okta admin group memberships, cross-referencing with Workday active employees, creating a Jira review task, and notifying the IAM team via Teams.

naftiko: "0.5"
info:
  label: "Okta Privileged Access Review Orchestrator"
  description: "Initiates a privileged access review by pulling Okta admin group memberships, cross-referencing with Workday active employees, creating a Jira review task, and notifying the IAM team via Teams."
  tags:
    - identity
    - okta
    - workday
    - jira
    - microsoft-teams
    - access-review
capability:
  exposes:
    - type: mcp
      namespace: identity
      port: 8080
      tools:
        - name: trigger-access-review
          description: "Given an Okta admin group ID, pull all members, verify employment status in Workday, create a Jira access review task for discrepancies, and notify the IAM team."
          inputParameters:
            - name: group_id
              in: body
              type: string
              description: "The Okta admin group ID to review."
            - name: review_period
              in: body
              type: string
              description: "Review period label, e.g. Q1-2026."
          steps:
            - name: get-group-members
              type: call
              call: okta.get-group-members
              with:
                group_id: "{{group_id}}"
            - name: verify-employment
              type: call
              call: workday.get-active-workers
              with:
                business_unit: "all"
            - name: create-review-task
              type: call
              call: jira.create-issue
              with:
                project: "IAM"
                summary: "Privileged access review {{review_period}}: {{get-group-members.member_count}} members"
            - name: notify-iam
              type: call
              call: msteams.post-message
              with:
                channel_id: "iam-reviews"
                text: "Privileged access review initiated for {{review_period}}. Members: {{get-group-members.member_count}}. Jira: {{create-review-task.key}}."
  consumes:
    - type: http
      namespace: okta
      baseUri: "https://lockheedmartin.okta.com/api/v1"
      authentication:
        type: bearer
        token: "$secrets.okta_token"
      resources:
        - name: group-members
          path: "/groups/{{group_id}}/users"
          inputParameters:
            - name: group_id
              in: path
          operations:
            - name: get-group-members
              method: GET
    - type: http
      namespace: workday
      baseUri: "https://wd2-impl-services1.workday.com/ccx/api/v1"
      authentication:
        type: bearer
        token: "$secrets.workday_token"
      resources:
        - name: workers
          path: "/lockheed-martin/workers"
          operations:
            - name: get-active-workers
              method: GET
    - type: http
      namespace: jira
      baseUri: "https://lockheedmartin.atlassian.net/rest/api/3"
      authentication:
        type: bearer
        token: "$secrets.jira_token"
      resources:
        - name: issues
          path: "/issue"
          operations:
            - name: create-issue
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Looks up an Okta user's group memberships to verify access entitlements for classified programs and DCSA compliance auditing.

naftiko: "0.5"
info:
  label: "Okta User Group Membership Lookup"
  description: "Looks up an Okta user's group memberships to verify access entitlements for classified programs and DCSA compliance auditing."
  tags:
    - identity
    - okta
    - security-clearance
    - compliance
    - access-management
capability:
  exposes:
    - type: mcp
      namespace: identity
      port: 8080
      tools:
        - name: get-user-groups
          description: "Given an Okta user ID or email, return all group memberships including program-specific security groups. Use for access reviews and DCSA compliance verification."
          inputParameters:
            - name: user_id
              in: body
              type: string
              description: "The Okta user ID or email address."
          call: okta.get-user-groups
          with:
            user_id: "{{user_id}}"
          outputParameters:
            - name: groups
              type: array
              mapping: "$"
            - name: group_count
              type: integer
              mapping: "$.length"
  consumes:
    - type: http
      namespace: okta
      baseUri: "https://lockheedmartin.okta.com/api/v1"
      authentication:
        type: bearer
        token: "$secrets.okta_token"
      resources:
        - name: user-groups
          path: "/users/{{user_id}}/groups"
          inputParameters:
            - name: user_id
              in: path
          operations:
            - name: get-user-groups
              method: GET

Retrieves project cost summary from Oracle E-Business Suite by project number, returning total costs, budget, and earned value for defense program financial oversight.

naftiko: "0.5"
info:
  label: "Oracle EBS Project Cost Lookup"
  description: "Retrieves project cost summary from Oracle E-Business Suite by project number, returning total costs, budget, and earned value for defense program financial oversight."
  tags:
    - finance
    - oracle
    - defense
    - earned-value
    - program-management
capability:
  exposes:
    - type: mcp
      namespace: finance
      port: 8080
      tools:
        - name: get-project-costs
          description: "Given an Oracle EBS project number, return total burdened cost, budget amount, and cost-to-date. Use for defense program Earned Value Management inquiries."
          inputParameters:
            - name: project_number
              in: body
              type: string
              description: "The Oracle EBS project number."
          call: oracleebs.get-project-costs
          with:
            project_number: "{{project_number}}"
          outputParameters:
            - name: total_cost
              type: number
              mapping: "$.ProjectCost.TotalBurdenedCost"
            - name: budget
              type: number
              mapping: "$.ProjectCost.BudgetAmount"
            - name: earned_value
              type: number
              mapping: "$.ProjectCost.EarnedValue"
  consumes:
    - type: http
      namespace: oracleebs
      baseUri: "https://oracleebs.lockheedmartin.com/webservices/rest"
      authentication:
        type: basic
        username: "$secrets.oracle_user"
        password: "$secrets.oracle_password"
      resources:
        - name: project-costs
          path: "/projects/{{project_number}}/costs"
          inputParameters:
            - name: project_number
              in: path
          operations:
            - name: get-project-costs
              method: GET

During period close, pulls financial data from Oracle EBS, loads into Snowflake staging, refreshes the Power BI close dashboard, and notifies the finance team via Teams.

naftiko: "0.5"
info:
  label: "Oracle EBS to Power BI Financial Close Reporter"
  description: "During period close, pulls financial data from Oracle EBS, loads into Snowflake staging, refreshes the Power BI close dashboard, and notifies the finance team via Teams."
  tags:
    - finance
    - oracle
    - snowflake
    - power-bi
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: finance
      port: 8080
      tools:
        - name: trigger-close-report
          description: "Given a fiscal period, extract Oracle EBS financial data, stage in Snowflake, refresh Power BI dashboard, and notify the finance close team."
          inputParameters:
            - name: fiscal_period
              in: body
              type: string
              description: "The fiscal period, e.g. 2026-03."
            - name: ledger_name
              in: body
              type: string
              description: "The Oracle ledger name."
          steps:
            - name: extract-data
              type: call
              call: oracleebs.get-gl-balances
              with:
                period: "{{fiscal_period}}"
                ledger: "{{ledger_name}}"
            - name: load-snowflake
              type: call
              call: snowflake.run-query
              with:
                query: "CALL stage_gl_balances('{{fiscal_period}}', '{{ledger_name}}')"
            - name: refresh-dashboard
              type: call
              call: powerbi.refresh-dataset
              with:
                dataset_id: "financial-close"
            - name: notify-finance
              type: call
              call: msteams.post-message
              with:
                channel_id: "finance-close"
                text: "Period {{fiscal_period}} close data loaded. GL balances: {{extract-data.balance_count}}. Dashboard refreshed."
  consumes:
    - type: http
      namespace: oracleebs
      baseUri: "https://oracleebs.lockheedmartin.com/webservices/rest"
      authentication:
        type: basic
        username: "$secrets.oracle_user"
        password: "$secrets.oracle_password"
      resources:
        - name: gl-balances
          path: "/gl/balances?period={{period}}&ledger={{ledger}}"
          inputParameters:
            - name: period
              in: path
            - name: ledger
              in: path
          operations:
            - name: get-gl-balances
              method: GET
    - type: http
      namespace: snowflake
      baseUri: "https://lockheedmartin.snowflakecomputing.com/api/v2"
      authentication:
        type: bearer
        token: "$secrets.snowflake_token"
      resources:
        - name: statements
          path: "/statements"
          operations:
            - name: run-query
              method: POST
    - type: http
      namespace: powerbi
      baseUri: "https://api.powerbi.com/v1.0/myorg"
      authentication:
        type: bearer
        token: "$secrets.powerbi_token"
      resources:
        - name: datasets
          path: "/datasets/{{dataset_id}}/refreshes"
          inputParameters:
            - name: dataset_id
              in: path
          operations:
            - name: refresh-dataset
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Retrieves firewall security policy rules from Palo Alto Networks Panorama by rule name, returning source and destination zones, applications, and action for network security audits.

naftiko: "0.5"
info:
  label: "Palo Alto Firewall Rule Lookup"
  description: "Retrieves firewall security policy rules from Palo Alto Networks Panorama by rule name, returning source and destination zones, applications, and action for network security audits."
  tags:
    - network-security
    - palo-alto-networks
    - compliance
    - firewall
capability:
  exposes:
    - type: mcp
      namespace: network-security
      port: 8080
      tools:
        - name: get-firewall-rule
          description: "Given a Palo Alto policy rule name, return source zones, destination zones, applications, and action. Use for network security compliance audits on classified networks."
          inputParameters:
            - name: rule_name
              in: body
              type: string
              description: "The firewall security policy rule name."
          call: paloalto.get-rule
          with:
            rule_name: "{{rule_name}}"
          outputParameters:
            - name: source_zone
              type: array
              mapping: "$.result.entry.from.member"
            - name: dest_zone
              type: array
              mapping: "$.result.entry.to.member"
            - name: application
              type: array
              mapping: "$.result.entry.application.member"
            - name: action
              type: string
              mapping: "$.result.entry.action"
  consumes:
    - type: http
      namespace: paloalto
      baseUri: "https://panorama.lockheedmartin.com/restapi/v10.2"
      authentication:
        type: bearer
        token: "$secrets.paloalto_token"
      resources:
        - name: security-rules
          path: "/Policies/SecurityRules?name={{rule_name}}"
          inputParameters:
            - name: rule_name
              in: path
          operations:
            - name: get-rule
              method: GET

Refreshes a Power BI executive briefing dataset, exports it to PDF, uploads to SharePoint, and sends the briefing link to executives via Microsoft Teams.

naftiko: "0.5"
info:
  label: "Power BI Executive Briefing Refresh and Distribute"
  description: "Refreshes a Power BI executive briefing dataset, exports it to PDF, uploads to SharePoint, and sends the briefing link to executives via Microsoft Teams."
  tags:
    - analytics
    - power-bi
    - sharepoint
    - microsoft-teams
    - executive-reporting
capability:
  exposes:
    - type: mcp
      namespace: analytics
      port: 8080
      tools:
        - name: trigger-exec-briefing
          description: "Given a Power BI dataset ID and report ID, refresh the dataset, export to PDF, upload to SharePoint, and distribute to executives via Teams."
          inputParameters:
            - name: dataset_id
              in: body
              type: string
              description: "The Power BI dataset ID."
            - name: report_id
              in: body
              type: string
              description: "The Power BI report ID."
          steps:
            - name: refresh-dataset
              type: call
              call: powerbi.refresh-dataset
              with:
                dataset_id: "{{dataset_id}}"
            - name: export-pdf
              type: call
              call: powerbi.export-report
              with:
                report_id: "{{report_id}}"
                format: "PDF"
            - name: upload-sharepoint
              type: call
              call: sharepoint.upload-file
              with:
                site_id: "exec-briefings"
                file_name: "briefing-{{report_id}}.pdf"
            - name: notify-execs
              type: call
              call: msteams.post-message
              with:
                channel_id: "executive-briefings"
                text: "Executive briefing updated. View: {{upload-sharepoint.web_url}}"
  consumes:
    - type: http
      namespace: powerbi
      baseUri: "https://api.powerbi.com/v1.0/myorg"
      authentication:
        type: bearer
        token: "$secrets.powerbi_token"
      resources:
        - name: datasets
          path: "/datasets/{{dataset_id}}/refreshes"
          inputParameters:
            - name: dataset_id
              in: path
          operations:
            - name: refresh-dataset
              method: POST
        - name: reports
          path: "/reports/{{report_id}}/ExportTo"
          inputParameters:
            - name: report_id
              in: path
          operations:
            - name: export-report
              method: POST
    - type: http
      namespace: sharepoint
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: drive-items
          path: "/sites/{{site_id}}/drive/root:/{{file_name}}:/content"
          inputParameters:
            - name: site_id
              in: path
            - name: file_name
              in: path
          operations:
            - name: upload-file
              method: PUT
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Triggers a Power BI dataset refresh for the Estimate at Completion (EAC) program finance dashboard and notifies program controllers via Teams on completion.

naftiko: "0.5"
info:
  label: "Power BI Program EAC Dashboard Refresh"
  description: "Triggers a Power BI dataset refresh for the Estimate at Completion (EAC) program finance dashboard and notifies program controllers via Teams on completion."
  tags:
    - finance
    - analytics
    - power-bi
    - program-management
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: program-reporting
      port: 8080
      tools:
        - name: refresh-eac-dashboard
          description: "Trigger a Power BI dataset refresh for the EAC program finance workspace and notify program controllers in Teams. Use at the close of each accounting period or on demand for program review gates."
          inputParameters:
            - name: workspace_id
              in: body
              type: string
              description: "The Power BI workspace ID for the EAC program finance dashboards."
            - name: dataset_id
              in: body
              type: string
              description: "The Power BI dataset ID to refresh."
          steps:
            - name: trigger-refresh
              type: call
              call: powerbi.trigger-refresh
              with:
                workspace_id: "{{workspace_id}}"
                dataset_id: "{{dataset_id}}"
            - name: notify-controllers
              type: call
              call: msteams.post-message
              with:
                channel_id: "$secrets.teams_finance_channel_id"
                text: "EAC dashboard dataset {{dataset_id}} refresh triggered. Refresh ID: {{trigger-refresh.refresh_id}}"
  consumes:
    - type: http
      namespace: powerbi
      baseUri: "https://api.powerbi.com/v1.0/myorg"
      authentication:
        type: bearer
        token: "$secrets.powerbi_token"
      resources:
        - name: dataset-refreshes
          path: "/groups/{{workspace_id}}/datasets/{{dataset_id}}/refreshes"
          inputParameters:
            - name: workspace_id
              in: path
            - name: dataset_id
              in: path
          operations:
            - name: trigger-refresh
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: channel-messages
          path: "/teams/{{channel_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Generates a weekly Earned Value Management report by pulling cost data from SAP, schedule data from Microsoft Project, and publishing the combined EVM report to Confluence and Power BI.

naftiko: "0.5"
info:
  label: "Program Earned Value Report Generator"
  description: "Generates a weekly Earned Value Management report by pulling cost data from SAP, schedule data from Microsoft Project, and publishing the combined EVM report to Confluence and Power BI."
  tags:
    - program-management
    - sap
    - microsoft-project
    - confluence
    - power-bi
    - earned-value
capability:
  exposes:
    - type: mcp
      namespace: program-management
      port: 8080
      tools:
        - name: generate-evm-report
          description: "Given a program code and reporting period, pull cost data from SAP, schedule data from MS Project, publish to Confluence, and refresh the Power BI dashboard."
          inputParameters:
            - name: program_code
              in: body
              type: string
              description: "The defense program code, e.g. F35-PROD."
            - name: period_end
              in: body
              type: string
              description: "Reporting period end date in YYYY-MM-DD format."
          steps:
            - name: get-sap-costs
              type: call
              call: sap.get-program-costs
              with:
                program_code: "{{program_code}}"
                period_end: "{{period_end}}"
            - name: get-schedule
              type: call
              call: msproject.get-schedule
              with:
                program_code: "{{program_code}}"
            - name: publish-confluence
              type: call
              call: confluence.create-page
              with:
                space_key: "EVM"
                title: "EVM Report {{program_code}} - {{period_end}}"
                body: "BCWP: {{get-sap-costs.earned_value}} | ACWP: {{get-sap-costs.actual_cost}} | Schedule Variance: {{get-schedule.variance}}"
            - name: refresh-powerbi
              type: call
              call: powerbi.refresh-dataset
              with:
                dataset_id: "evm-{{program_code}}"
  consumes:
    - type: http
      namespace: sap
      baseUri: "https://lockheed-martin-s4.sap.com/sap/opu/odata/sap/API_PROJECT_COST"
      authentication:
        type: basic
        username: "$secrets.sap_user"
        password: "$secrets.sap_password"
      resources:
        - name: costs
          path: "/ProjectCosts(program='{{program_code}}')"
          inputParameters:
            - name: program_code
              in: path
          operations:
            - name: get-program-costs
              method: GET
    - type: http
      namespace: msproject
      baseUri: "https://project.lockheedmartin.com/api/v1"
      authentication:
        type: bearer
        token: "$secrets.msproject_token"
      resources:
        - name: schedules
          path: "/projects/{{program_code}}/schedule"
          inputParameters:
            - name: program_code
              in: path
          operations:
            - name: get-schedule
              method: GET
    - type: http
      namespace: confluence
      baseUri: "https://lockheedmartin.atlassian.net/wiki/rest/api"
      authentication:
        type: bearer
        token: "$secrets.confluence_token"
      resources:
        - name: content
          path: "/content"
          operations:
            - name: create-page
              method: POST
    - type: http
      namespace: powerbi
      baseUri: "https://api.powerbi.com/v1.0/myorg"
      authentication:
        type: bearer
        token: "$secrets.powerbi_token"
      resources:
        - name: datasets
          path: "/datasets/{{dataset_id}}/refreshes"
          inputParameters:
            - name: dataset_id
              in: path
          operations:
            - name: refresh-dataset
              method: POST

When a Jira program milestone epic is completed, updates the corresponding Salesforce opportunity stage and notifies the business development team via Teams.

naftiko: "0.5"
info:
  label: "Program Milestone Jira to Salesforce Sync"
  description: "When a Jira program milestone epic is completed, updates the corresponding Salesforce opportunity stage and notifies the business development team via Teams."
  tags:
    - programs
    - crm
    - salesforce
    - jira
    - microsoft-teams
    - defense-contracts
capability:
  exposes:
    - type: mcp
      namespace: program-sync
      port: 8080
      tools:
        - name: sync-milestone-to-salesforce
          description: "Given a Jira epic ID representing a program delivery milestone, retrieve milestone completion status and update the associated Salesforce opportunity stage. Notify the BD team channel in Teams. Use when key program milestones close."
          inputParameters:
            - name: epic_key
              in: body
              type: string
              description: "The Jira epic key for the completed program milestone, e.g. F35-1024."
            - name: opportunity_id
              in: body
              type: string
              description: "The Salesforce opportunity ID linked to this program."
          steps:
            - name: get-epic
              type: call
              call: jira.get-issue
              with:
                issue_key: "{{epic_key}}"
            - name: update-opportunity
              type: call
              call: salesforce.update-opportunity
              with:
                opportunity_id: "{{opportunity_id}}"
                stage: "Milestone Delivered"
                milestone: "{{get-epic.summary}}"
            - name: notify-bd
              type: call
              call: msteams.post-message
              with:
                channel_id: "$secrets.teams_bd_channel_id"
                text: "Program milestone complete: {{get-epic.summary}} | SF Opportunity updated: {{opportunity_id}}"
  consumes:
    - type: http
      namespace: jira
      baseUri: "https://lockheed-martin.atlassian.net/rest/api/3"
      authentication:
        type: basic
        username: "$secrets.jira_user"
        password: "$secrets.jira_api_token"
      resources:
        - name: issues
          path: "/issue/{{issue_key}}"
          inputParameters:
            - name: issue_key
              in: path
          operations:
            - name: get-issue
              method: GET
    - type: http
      namespace: salesforce
      baseUri: "https://lockheed-martin.my.salesforce.com/services/data/v58.0"
      authentication:
        type: bearer
        token: "$secrets.salesforce_token"
      resources:
        - name: opportunities
          path: "/sobjects/Opportunity/{{opportunity_id}}"
          inputParameters:
            - name: opportunity_id
              in: path
          operations:
            - name: update-opportunity
              method: PATCH
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: channel-messages
          path: "/teams/{{channel_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Triggers a Qlik Sense app reload for defense program analytics, validates data freshness in Snowflake, and distributes a summary notification to program managers via Teams.

naftiko: "0.5"
info:
  label: "Qlik Sense Defense Analytics Refresh Orchestrator"
  description: "Triggers a Qlik Sense app reload for defense program analytics, validates data freshness in Snowflake, and distributes a summary notification to program managers via Teams."
  tags:
    - analytics
    - qlik-sense
    - snowflake
    - microsoft-teams
    - defense
capability:
  exposes:
    - type: mcp
      namespace: analytics
      port: 8080
      tools:
        - name: trigger-qlik-refresh
          description: "Given a Qlik Sense app ID and program code, reload the app, validate Snowflake data freshness, and notify program managers via Teams."
          inputParameters:
            - name: app_id
              in: body
              type: string
              description: "The Qlik Sense app ID."
            - name: program_code
              in: body
              type: string
              description: "The defense program code."
          steps:
            - name: reload-app
              type: call
              call: qliksense.reload-app
              with:
                app_id: "{{app_id}}"
            - name: check-freshness
              type: call
              call: snowflake.run-query
              with:
                query: "SELECT MAX(updated_at) as last_update FROM program_data WHERE program='{{program_code}}'"
            - name: notify-managers
              type: call
              call: msteams.post-message
              with:
                channel_id: "program-analytics"
                text: "Qlik Sense analytics refreshed for {{program_code}}. Data as of: {{check-freshness.last_update}}."
  consumes:
    - type: http
      namespace: qliksense
      baseUri: "https://qlik.lockheedmartin.com/api/v1"
      authentication:
        type: bearer
        token: "$secrets.qlik_token"
      resources:
        - name: apps
          path: "/apps/{{app_id}}/reload"
          inputParameters:
            - name: app_id
              in: path
          operations:
            - name: reload-app
              method: POST
    - type: http
      namespace: snowflake
      baseUri: "https://lockheedmartin.snowflakecomputing.com/api/v2"
      authentication:
        type: bearer
        token: "$secrets.snowflake_token"
      resources:
        - name: statements
          path: "/statements"
          operations:
            - name: run-query
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Triggers an Ansible Automation Platform patch deployment job for classified infrastructure, creates a ServiceNow change record, monitors via Datadog, and sends completion status to Teams.

naftiko: "0.5"
info:
  label: "Red Hat Ansible Patch Deployment Orchestrator"
  description: "Triggers an Ansible Automation Platform patch deployment job for classified infrastructure, creates a ServiceNow change record, monitors via Datadog, and sends completion status to Teams."
  tags:
    - infrastructure
    - ansible
    - servicenow
    - datadog
    - microsoft-teams
    - patching
capability:
  exposes:
    - type: mcp
      namespace: infrastructure
      port: 8080
      tools:
        - name: trigger-patch-deployment
          description: "Given an Ansible job template ID and target inventory, trigger patch deployment, create a ServiceNow change record, verify system health via Datadog, and notify operations."
          inputParameters:
            - name: template_id
              in: body
              type: string
              description: "The Ansible Automation Platform job template ID."
            - name: inventory
              in: body
              type: string
              description: "Target inventory name for patching."
          steps:
            - name: create-change
              type: call
              call: servicenow.create-change
              with:
                short_description: "Ansible patch deployment: {{inventory}}"
                category: "infrastructure"
            - name: launch-job
              type: call
              call: ansible.launch-job
              with:
                template_id: "{{template_id}}"
                inventory: "{{inventory}}"
            - name: check-health
              type: call
              call: datadog.get-monitors
              with:
                tags: "inventory:{{inventory}}"
            - name: notify-ops
              type: call
              call: msteams.post-message
              with:
                channel_id: "infra-ops"
                text: "Patch deployment {{launch-job.id}} for {{inventory}} initiated. Change: {{create-change.number}}. Health: {{check-health.overall_status}}."
  consumes:
    - type: http
      namespace: servicenow
      baseUri: "https://lockheedmartin.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.snow_user"
        password: "$secrets.snow_password"
      resources:
        - name: changes
          path: "/table/change_request"
          operations:
            - name: create-change
              method: POST
    - type: http
      namespace: ansible
      baseUri: "https://ansible.lockheedmartin.com/api/v2"
      authentication:
        type: bearer
        token: "$secrets.ansible_token"
      resources:
        - name: jobs
          path: "/job_templates/{{template_id}}/launch/"
          inputParameters:
            - name: template_id
              in: path
          operations:
            - name: launch-job
              method: POST
    - type: http
      namespace: datadog
      baseUri: "https://api.datadoghq.com/api/v1"
      authentication:
        type: bearer
        token: "$secrets.datadog_api_key"
      resources:
        - name: monitors
          path: "/monitor"
          operations:
            - name: get-monitors
              method: GET
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

When a Salesforce government contract opportunity closes as Won, creates a corresponding SAP project/WBS element in S/4HANA and notifies the program management team via Teams.

naftiko: "0.5"
info:
  label: "Salesforce Contract Opportunity to SAP Project Sync"
  description: "When a Salesforce government contract opportunity closes as Won, creates a corresponding SAP project/WBS element in S/4HANA and notifies the program management team via Teams."
  tags:
    - sales
    - crm
    - erp
    - salesforce
    - sap
    - program-management
    - defense-contracts
capability:
  exposes:
    - type: mcp
      namespace: contract-program-sync
      port: 8080
      tools:
        - name: create-program-from-contract-win
          description: "Given a Salesforce opportunity ID for a Closed Won government contract, retrieve contract details, create a SAP S/4HANA project with WBS structure, and notify the program management team in Teams. Use when a defense contract award is confirmed."
          inputParameters:
            - name: opportunity_id
              in: body
              type: string
              description: "The 18-character Salesforce opportunity ID for the contract win."
          steps:
            - name: get-opportunity
              type: call
              call: salesforce.get-opportunity
              with:
                opportunity_id: "{{opportunity_id}}"
            - name: create-sap-project
              type: call
              call: sap.create-project
              with:
                project_name: "{{get-opportunity.name}}"
                customer_id: "{{get-opportunity.account_id}}"
                contract_value: "{{get-opportunity.amount}}"
            - name: notify-program-mgmt
              type: call
              call: msteams.post-message
              with:
                channel_id: "$secrets.teams_programs_channel_id"
                text: "Contract Won: {{get-opportunity.name}} | SAP Project: {{create-sap-project.project_id}} | Value: ${{get-opportunity.amount}}"
  consumes:
    - type: http
      namespace: salesforce
      baseUri: "https://lockheed-martin.my.salesforce.com/services/data/v58.0"
      authentication:
        type: bearer
        token: "$secrets.salesforce_token"
      resources:
        - name: opportunities
          path: "/sobjects/Opportunity/{{opportunity_id}}"
          inputParameters:
            - name: opportunity_id
              in: path
          operations:
            - name: get-opportunity
              method: GET
    - type: http
      namespace: sap
      baseUri: "https://lockheed-martin-s4.sap.com/sap/opu/odata/sap/API_PROJECT_SRV"
      authentication:
        type: basic
        username: "$secrets.sap_user"
        password: "$secrets.sap_password"
      resources:
        - name: projects
          path: "/A_Project"
          operations:
            - name: create-project
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: channel-messages
          path: "/teams/{{channel_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

When a government contract opportunity is marked as Closed Won in Salesforce, creates a SAP project, generates a Confluence program charter, and broadcasts the win announcement via Teams.

naftiko: "0.5"
info:
  label: "Salesforce Government Contract Win Notification"
  description: "When a government contract opportunity is marked as Closed Won in Salesforce, creates a SAP project, generates a Confluence program charter, and broadcasts the win announcement via Teams."
  tags:
    - sales
    - salesforce
    - sap
    - confluence
    - microsoft-teams
    - government-contracts
capability:
  exposes:
    - type: mcp
      namespace: sales
      port: 8080
      tools:
        - name: trigger-contract-win
          description: "Given a Salesforce opportunity ID marked Closed Won, create a SAP project structure, generate a Confluence program charter page, and broadcast the win to leadership via Teams."
          inputParameters:
            - name: opportunity_id
              in: body
              type: string
              description: "The Salesforce opportunity ID."
          steps:
            - name: get-opportunity
              type: call
              call: salesforce.get-opportunity
              with:
                opportunity_id: "{{opportunity_id}}"
            - name: create-sap-project
              type: call
              call: sap.create-project
              with:
                project_name: "{{get-opportunity.Name}}"
                customer: "{{get-opportunity.Account.Name}}"
                value: "{{get-opportunity.Amount}}"
            - name: create-charter
              type: call
              call: confluence.create-page
              with:
                space_key: "PROGRAMS"
                title: "Program Charter: {{get-opportunity.Name}}"
                body: "Contract value: {{get-opportunity.Amount}}. Customer: {{get-opportunity.Account.Name}}."
            - name: announce-win
              type: call
              call: msteams.post-message
              with:
                channel_id: "leadership-wins"
                text: "CONTRACT WIN: {{get-opportunity.Name}} valued at {{get-opportunity.Amount}}."
  consumes:
    - type: http
      namespace: salesforce
      baseUri: "https://lockheedmartin.my.salesforce.com/services/data/v58.0"
      authentication:
        type: bearer
        token: "$secrets.salesforce_token"
      resources:
        - name: opportunities
          path: "/sobjects/Opportunity/{{opportunity_id}}"
          inputParameters:
            - name: opportunity_id
              in: path
          operations:
            - name: get-opportunity
              method: GET
    - type: http
      namespace: sap
      baseUri: "https://lockheed-martin-s4.sap.com/sap/opu/odata/sap/API_PROJECT"
      authentication:
        type: basic
        username: "$secrets.sap_user"
        password: "$secrets.sap_password"
      resources:
        - name: projects
          path: "/A_Project"
          operations:
            - name: create-project
              method: POST
    - type: http
      namespace: confluence
      baseUri: "https://lockheedmartin.atlassian.net/wiki/rest/api"
      authentication:
        type: bearer
        token: "$secrets.confluence_token"
      resources:
        - name: content
          path: "/content"
          operations:
            - name: create-page
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Generates a weekly digest of Lockheed Martin's active government contract opportunities from Salesforce CRM and posts the pipeline summary to the business development Teams channel.

naftiko: "0.5"
info:
  label: "Salesforce Government Opportunity Pipeline Digest"
  description: "Generates a weekly digest of Lockheed Martin's active government contract opportunities from Salesforce CRM and posts the pipeline summary to the business development Teams channel."
  tags:
    - sales
    - crm
    - salesforce
    - business-development
    - microsoft-teams
    - defense-contracts
capability:
  exposes:
    - type: mcp
      namespace: crm-reporting
      port: 8080
      tools:
        - name: digest-opportunity-pipeline
          description: "Retrieve active government contract opportunities from Salesforce CRM with stage, expected value, and close date, then post a weekly pipeline summary to the BD leadership Teams channel. Use for weekly program development reviews."
          inputParameters:
            - name: days_back
              in: body
              type: integer
              description: "Number of days of activity to include in the digest."
          steps:
            - name: get-opportunities
              type: call
              call: salesforce.query-opportunities
              with:
                days_back: "{{days_back}}"
            - name: post-digest
              type: call
              call: msteams.post-message
              with:
                channel_id: "$secrets.teams_bd_channel_id"
                text: "BD Pipeline Digest (last {{days_back}} days): {{get-opportunities.count}} active opportunities. Pipeline value: ${{get-opportunities.total_value}}"
  consumes:
    - type: http
      namespace: salesforce
      baseUri: "https://lockheed-martin.my.salesforce.com/services/data/v58.0"
      authentication:
        type: bearer
        token: "$secrets.salesforce_token"
      resources:
        - name: opportunities
          path: "/query"
          operations:
            - name: query-opportunities
              method: GET
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: channel-messages
          path: "/teams/{{channel_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

When a defense proposal reaches final review in Salesforce, syncs pricing data to SAP, generates a Confluence proposal summary, and notifies the business development team via Teams.

naftiko: "0.5"
info:
  label: "Salesforce to SAP Defense Proposal Sync"
  description: "When a defense proposal reaches final review in Salesforce, syncs pricing data to SAP, generates a Confluence proposal summary, and notifies the business development team via Teams."
  tags:
    - sales
    - salesforce
    - sap
    - confluence
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: sales
      port: 8080
      tools:
        - name: trigger-proposal-sync
          description: "Given a Salesforce opportunity ID at final review stage, sync pricing to SAP, create a Confluence summary, and notify business development."
          inputParameters:
            - name: opportunity_id
              in: body
              type: string
              description: "The Salesforce opportunity ID."
          steps:
            - name: get-opportunity
              type: call
              call: salesforce.get-opportunity
              with:
                opportunity_id: "{{opportunity_id}}"
            - name: sync-pricing
              type: call
              call: sap.create-quotation
              with:
                customer: "{{get-opportunity.Account.Name}}"
                amount: "{{get-opportunity.Amount}}"
            - name: create-summary
              type: call
              call: confluence.create-page
              with:
                space_key: "BD"
                title: "Proposal: {{get-opportunity.Name}}"
                body: "Value: {{get-opportunity.Amount}}. SAP Quote: {{sync-pricing.quotation_id}}."
            - name: notify-bd
              type: call
              call: msteams.post-message
              with:
                channel_id: "business-development"
                text: "Proposal {{get-opportunity.Name}} synced to SAP. Quote: {{sync-pricing.quotation_id}}."
  consumes:
    - type: http
      namespace: salesforce
      baseUri: "https://lockheedmartin.my.salesforce.com/services/data/v58.0"
      authentication:
        type: bearer
        token: "$secrets.salesforce_token"
      resources:
        - name: opportunities
          path: "/sobjects/Opportunity/{{opportunity_id}}"
          inputParameters:
            - name: opportunity_id
              in: path
          operations:
            - name: get-opportunity
              method: GET
    - type: http
      namespace: sap
      baseUri: "https://lockheed-martin-s4.sap.com/sap/opu/odata/sap/API_SALES_QUOTATION"
      authentication:
        type: basic
        username: "$secrets.sap_user"
        password: "$secrets.sap_password"
      resources:
        - name: quotations
          path: "/A_SalesQuotation"
          operations:
            - name: create-quotation
              method: POST
    - type: http
      namespace: confluence
      baseUri: "https://lockheedmartin.atlassian.net/wiki/rest/api"
      authentication:
        type: bearer
        token: "$secrets.confluence_token"
      resources:
        - name: content
          path: "/content"
          operations:
            - name: create-page
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

When a defense subcontractor contract nears expiration, retrieves contract details from SAP Ariba, creates a Jira renewal task, notifies the procurement team via Teams, and logs the renewal in Salesforce.

naftiko: "0.5"
info:
  label: "SAP Ariba Contract Renewal Workflow"
  description: "When a defense subcontractor contract nears expiration, retrieves contract details from SAP Ariba, creates a Jira renewal task, notifies the procurement team via Teams, and logs the renewal in Salesforce."
  tags:
    - procurement
    - sap-ariba
    - jira
    - microsoft-teams
    - salesforce
    - contracts
capability:
  exposes:
    - type: mcp
      namespace: procurement
      port: 8080
      tools:
        - name: trigger-contract-renewal
          description: "Given a SAP Ariba contract ID nearing expiration, orchestrate renewal by fetching contract details, creating a Jira task, notifying procurement via Teams, and updating Salesforce."
          inputParameters:
            - name: contract_id
              in: body
              type: string
              description: "The SAP Ariba contract ID."
            - name: expiry_date
              in: body
              type: string
              description: "Contract expiration date in YYYY-MM-DD format."
          steps:
            - name: get-contract
              type: call
              call: ariba.get-contract
              with:
                contract_id: "{{contract_id}}"
            - name: create-jira-task
              type: call
              call: jira.create-issue
              with:
                project: "PROC"
                summary: "Contract renewal: {{get-contract.supplier_name}} expiring {{expiry_date}}"
                issue_type: "Task"
            - name: notify-procurement
              type: call
              call: msteams.post-message
              with:
                channel_id: "procurement-ops"
                text: "Contract {{contract_id}} with {{get-contract.supplier_name}} expires {{expiry_date}}. Jira: {{create-jira-task.key}}"
            - name: update-salesforce
              type: call
              call: salesforce.update-opportunity
              with:
                contract_id: "{{contract_id}}"
                stage: "Renewal"
  consumes:
    - type: http
      namespace: ariba
      baseUri: "https://api.ariba.com/v2"
      authentication:
        type: bearer
        token: "$secrets.ariba_token"
      resources:
        - name: contracts
          path: "/contracts/{{contract_id}}"
          inputParameters:
            - name: contract_id
              in: path
          operations:
            - name: get-contract
              method: GET
    - type: http
      namespace: jira
      baseUri: "https://lockheedmartin.atlassian.net/rest/api/3"
      authentication:
        type: bearer
        token: "$secrets.jira_token"
      resources:
        - name: issues
          path: "/issue"
          operations:
            - name: create-issue
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST
    - type: http
      namespace: salesforce
      baseUri: "https://lockheedmartin.my.salesforce.com/services/data/v58.0"
      authentication:
        type: bearer
        token: "$secrets.salesforce_token"
      resources:
        - name: opportunities
          path: "/sobjects/Opportunity"
          operations:
            - name: update-opportunity
              method: PATCH

Registers a new defense subcontractor in SAP Ariba, creates a vendor master record in SAP S/4HANA, and notifies the contracts and procurement Teams channel.

naftiko: "0.5"
info:
  label: "SAP Ariba Defense Subcontractor Onboarding"
  description: "Registers a new defense subcontractor in SAP Ariba, creates a vendor master record in SAP S/4HANA, and notifies the contracts and procurement Teams channel."
  tags:
    - procurement
    - sap-ariba
    - sap
    - supplier-management
    - defense-contracts
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: supplier-ops
      port: 8080
      tools:
        - name: onboard-subcontractor
          description: "Given defense subcontractor details, register in SAP Ariba, create a vendor master in SAP S/4HANA, and notify the contracts and procurement Teams channel. Use for onboarding new defense subcontractors and suppliers."
          inputParameters:
            - name: supplier_name
              in: body
              type: string
              description: "Legal name of the defense subcontractor."
            - name: cage_code
              in: body
              type: string
              description: "The DoD CAGE code for the subcontractor."
            - name: contact_email
              in: body
              type: string
              description: "Primary contact email for the subcontractor."
          steps:
            - name: register-in-ariba
              type: call
              call: ariba.create-supplier
              with:
                name: "{{supplier_name}}"
                customField1: "{{cage_code}}"
                contactEmail: "{{contact_email}}"
            - name: create-sap-vendor
              type: call
              call: sap.create-vendor
              with:
                supplierName: "{{supplier_name}}"
                aribaId: "{{register-in-ariba.supplier_id}}"
                cageCode: "{{cage_code}}"
            - name: notify-contracts
              type: call
              call: msteams.post-message
              with:
                channel_id: "$secrets.teams_contracts_channel_id"
                text: "Subcontractor onboarded: {{supplier_name}} (CAGE: {{cage_code}}) | Ariba: {{register-in-ariba.supplier_id}} | SAP Vendor: {{create-sap-vendor.vendor_id}}"
  consumes:
    - type: http
      namespace: ariba
      baseUri: "https://openapi.ariba.com/api/supplier/v1"
      authentication:
        type: bearer
        token: "$secrets.ariba_token"
      resources:
        - name: suppliers
          path: "/suppliers"
          operations:
            - name: create-supplier
              method: POST
    - type: http
      namespace: sap
      baseUri: "https://lockheed-martin-s4.sap.com/sap/opu/odata/sap/API_BUSINESS_PARTNER"
      authentication:
        type: basic
        username: "$secrets.sap_user"
        password: "$secrets.sap_password"
      resources:
        - name: vendors
          path: "/A_Supplier"
          operations:
            - name: create-vendor
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: channel-messages
          path: "/teams/{{channel_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

When a new RFP is received in SAP Ariba, creates a Jira epic for response coordination, generates a Confluence response template, assigns the capture team, and notifies via Teams.

naftiko: "0.5"
info:
  label: "SAP Ariba RFP Response Coordinator"
  description: "When a new RFP is received in SAP Ariba, creates a Jira epic for response coordination, generates a Confluence response template, assigns the capture team, and notifies via Teams."
  tags:
    - procurement
    - sap-ariba
    - jira
    - confluence
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: procurement
      port: 8080
      tools:
        - name: trigger-rfp-response
          description: "Given a SAP Ariba sourcing event ID, create a Jira epic for RFP coordination, generate a Confluence template, and notify the capture team via Teams."
          inputParameters:
            - name: event_id
              in: body
              type: string
              description: "The SAP Ariba sourcing event ID."
            - name: capture_team
              in: body
              type: string
              description: "The capture team channel ID."
          steps:
            - name: get-event
              type: call
              call: ariba.get-sourcing-event
              with:
                event_id: "{{event_id}}"
            - name: create-epic
              type: call
              call: jira.create-issue
              with:
                project: "CAPTURE"
                summary: "RFP Response: {{get-event.title}}"
                issue_type: "Epic"
            - name: create-template
              type: call
              call: confluence.create-page
              with:
                space_key: "CAPTURE"
                title: "RFP Template: {{get-event.title}}"
                body: "Due: {{get-event.due_date}}. Jira Epic: {{create-epic.key}}."
            - name: notify-team
              type: call
              call: msteams.post-message
              with:
                channel_id: "{{capture_team}}"
                text: "New RFP: {{get-event.title}}. Due: {{get-event.due_date}}. Epic: {{create-epic.key}}."
  consumes:
    - type: http
      namespace: ariba
      baseUri: "https://api.ariba.com/v2"
      authentication:
        type: bearer
        token: "$secrets.ariba_token"
      resources:
        - name: sourcing-events
          path: "/sourcing/events/{{event_id}}"
          inputParameters:
            - name: event_id
              in: path
          operations:
            - name: get-sourcing-event
              method: GET
    - type: http
      namespace: jira
      baseUri: "https://lockheedmartin.atlassian.net/rest/api/3"
      authentication:
        type: bearer
        token: "$secrets.jira_token"
      resources:
        - name: issues
          path: "/issue"
          operations:
            - name: create-issue
              method: POST
    - type: http
      namespace: confluence
      baseUri: "https://lockheedmartin.atlassian.net/wiki/rest/api"
      authentication:
        type: bearer
        token: "$secrets.confluence_token"
      resources:
        - name: content
          path: "/content"
          operations:
            - name: create-page
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Assesses defense supplier risk by pulling SAP Ariba supplier data, checking Salesforce contract history, generating a Confluence risk report, and notifying the procurement risk team via Teams.

naftiko: "0.5"
info:
  label: "SAP Ariba Supplier Risk Assessment"
  description: "Assesses defense supplier risk by pulling SAP Ariba supplier data, checking Salesforce contract history, generating a Confluence risk report, and notifying the procurement risk team via Teams."
  tags:
    - procurement
    - sap-ariba
    - salesforce
    - confluence
    - microsoft-teams
    - risk-management
capability:
  exposes:
    - type: mcp
      namespace: procurement
      port: 8080
      tools:
        - name: trigger-supplier-risk
          description: "Given a SAP Ariba supplier ID, pull supplier data, check Salesforce contract history, publish a Confluence risk report, and notify procurement risk team."
          inputParameters:
            - name: supplier_id
              in: body
              type: string
              description: "The SAP Ariba supplier ID."
          steps:
            - name: get-supplier
              type: call
              call: ariba.get-supplier
              with:
                supplier_id: "{{supplier_id}}"
            - name: get-contracts
              type: call
              call: salesforce.get-contracts
              with:
                supplier_name: "{{get-supplier.name}}"
            - name: create-report
              type: call
              call: confluence.create-page
              with:
                space_key: "RISK"
                title: "Supplier Risk: {{get-supplier.name}}"
                body: "Active contracts: {{get-contracts.count}}. Total value: {{get-contracts.total_value}}."
            - name: notify-risk-team
              type: call
              call: msteams.post-message
              with:
                channel_id: "procurement-risk"
                text: "Supplier risk assessment: {{get-supplier.name}}. Contracts: {{get-contracts.count}}. Report: {{create-report.url}}."
  consumes:
    - type: http
      namespace: ariba
      baseUri: "https://api.ariba.com/v2"
      authentication:
        type: bearer
        token: "$secrets.ariba_token"
      resources:
        - name: suppliers
          path: "/suppliers/{{supplier_id}}"
          inputParameters:
            - name: supplier_id
              in: path
          operations:
            - name: get-supplier
              method: GET
    - type: http
      namespace: salesforce
      baseUri: "https://lockheedmartin.my.salesforce.com/services/data/v58.0"
      authentication:
        type: bearer
        token: "$secrets.salesforce_token"
      resources:
        - name: contracts
          path: "/query?q=SELECT+Id,Name+FROM+Contract+WHERE+Account.Name='{{supplier_name}}'"
          inputParameters:
            - name: supplier_name
              in: path
          operations:
            - name: get-contracts
              method: GET
    - type: http
      namespace: confluence
      baseUri: "https://lockheedmartin.atlassian.net/wiki/rest/api"
      authentication:
        type: bearer
        token: "$secrets.confluence_token"
      resources:
        - name: content
          path: "/content"
          operations:
            - name: create-page
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

When SAP detects a program budget overrun threshold breach, retrieves cost details, creates a Jira escalation issue, sends a Datadog custom event, and notifies program finance leadership via Teams.

naftiko: "0.5"
info:
  label: "SAP Budget Overrun Alert and Escalation"
  description: "When SAP detects a program budget overrun threshold breach, retrieves cost details, creates a Jira escalation issue, sends a Datadog custom event, and notifies program finance leadership via Teams."
  tags:
    - finance
    - sap
    - jira
    - datadog
    - microsoft-teams
    - budget
capability:
  exposes:
    - type: mcp
      namespace: finance
      port: 8080
      tools:
        - name: trigger-budget-overrun
          description: "Given a SAP program code with a budget overrun, fetch cost breakdown, create a Jira escalation, emit a Datadog event, and alert finance leadership via Teams."
          inputParameters:
            - name: program_code
              in: body
              type: string
              description: "The defense program code."
            - name: threshold_pct
              in: body
              type: string
              description: "The budget overrun percentage threshold breached."
          steps:
            - name: get-costs
              type: call
              call: sap.get-program-costs
              with:
                program_code: "{{program_code}}"
            - name: create-escalation
              type: call
              call: jira.create-issue
              with:
                project: "FIN"
                summary: "Budget overrun {{threshold_pct}}%: {{program_code}}"
                priority: "Critical"
            - name: emit-event
              type: call
              call: datadog.post-event
              with:
                title: "Budget overrun: {{program_code}}"
                text: "Overrun {{threshold_pct}}%. Actual: {{get-costs.actual_cost}}. Budget: {{get-costs.budget}}."
            - name: notify-finance
              type: call
              call: msteams.post-message
              with:
                channel_id: "finance-leadership"
                text: "BUDGET ALERT: {{program_code}} overrun by {{threshold_pct}}%. Jira: {{create-escalation.key}}."
  consumes:
    - type: http
      namespace: sap
      baseUri: "https://lockheed-martin-s4.sap.com/sap/opu/odata/sap/API_PROJECT_COST"
      authentication:
        type: basic
        username: "$secrets.sap_user"
        password: "$secrets.sap_password"
      resources:
        - name: costs
          path: "/ProjectCosts(program='{{program_code}}')"
          inputParameters:
            - name: program_code
              in: path
          operations:
            - name: get-program-costs
              method: GET
    - type: http
      namespace: jira
      baseUri: "https://lockheedmartin.atlassian.net/rest/api/3"
      authentication:
        type: bearer
        token: "$secrets.jira_token"
      resources:
        - name: issues
          path: "/issue"
          operations:
            - name: create-issue
              method: POST
    - type: http
      namespace: datadog
      baseUri: "https://api.datadoghq.com/api/v1"
      authentication:
        type: bearer
        token: "$secrets.datadog_api_key"
      resources:
        - name: events
          path: "/events"
          operations:
            - name: post-event
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

When a defense program travel request is submitted in SAP Concur, validates ITAR travel compliance, checks traveler clearance in Workday, and creates a security briefing task in ServiceNow.

naftiko: "0.5"
info:
  label: "SAP Concur Defense Travel Request Orchestrator"
  description: "When a defense program travel request is submitted in SAP Concur, validates ITAR travel compliance, checks traveler clearance in Workday, and creates a security briefing task in ServiceNow."
  tags:
    - travel
    - sap-concur
    - workday
    - servicenow
    - microsoft-teams
    - itar
capability:
  exposes:
    - type: mcp
      namespace: travel
      port: 8080
      tools:
        - name: trigger-travel-compliance
          description: "Given a Concur travel request ID, validate ITAR destination compliance, verify traveler clearance status in Workday, and create a pre-travel security briefing task in ServiceNow."
          inputParameters:
            - name: request_id
              in: body
              type: string
              description: "The SAP Concur travel request ID."
            - name: traveler_id
              in: body
              type: string
              description: "The Workday worker ID of the traveler."
          steps:
            - name: get-request
              type: call
              call: concur.get-travel-request
              with:
                request_id: "{{request_id}}"
            - name: check-clearance
              type: call
              call: workday.get-worker
              with:
                worker_id: "{{traveler_id}}"
            - name: create-briefing-task
              type: call
              call: servicenow.create-incident
              with:
                short_description: "Pre-travel security briefing: {{check-clearance.full_name}} to {{get-request.destination}}"
                category: "security_travel"
            - name: notify-traveler
              type: call
              call: msteams.post-message
              with:
                recipient_upn: "{{check-clearance.work_email}}"
                text: "Your travel to {{get-request.destination}} requires a security briefing. Ticket: {{create-briefing-task.number}}."
  consumes:
    - type: http
      namespace: concur
      baseUri: "https://us.api.concursolutions.com/api/v3.0"
      authentication:
        type: bearer
        token: "$secrets.concur_token"
      resources:
        - name: travel-requests
          path: "/travelrequest/requests/{{request_id}}"
          inputParameters:
            - name: request_id
              in: path
          operations:
            - name: get-travel-request
              method: GET
    - type: http
      namespace: workday
      baseUri: "https://wd2-impl-services1.workday.com/ccx/api/v1"
      authentication:
        type: bearer
        token: "$secrets.workday_token"
      resources:
        - name: workers
          path: "/lockheed-martin/workers/{{worker_id}}"
          inputParameters:
            - name: worker_id
              in: path
          operations:
            - name: get-worker
              method: GET
    - type: http
      namespace: servicenow
      baseUri: "https://lockheedmartin.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.snow_user"
        password: "$secrets.snow_password"
      resources:
        - name: incidents
          path: "/table/incident"
          operations:
            - name: create-incident
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/users/{{recipient_upn}}/sendMail"
          inputParameters:
            - name: recipient_upn
              in: path
          operations:
            - name: post-message
              method: POST

Retrieves submitted SAP Concur expense reports above policy thresholds, flags policy violations, and routes exception reports to the travel and expense compliance team via Teams.

naftiko: "0.5"
info:
  label: "SAP Concur Travel Policy Compliance Audit"
  description: "Retrieves submitted SAP Concur expense reports above policy thresholds, flags policy violations, and routes exception reports to the travel and expense compliance team via Teams."
  tags:
    - finance
    - compliance
    - sap-concur
    - servicenow
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: travel-compliance
      port: 8080
      tools:
        - name: audit-travel-expenses
          description: "Retrieve SAP Concur expense reports exceeding the per-diem or total travel policy limits and create ServiceNow approval tasks for finance review. Alert the T&E compliance team in Teams. Run nightly or before period close."
          inputParameters:
            - name: threshold_amount
              in: body
              type: number
              description: "Dollar amount above which expense reports require secondary review."
            - name: report_date
              in: body
              type: string
              description: "Filter for expense reports submitted on or after this date in YYYY-MM-DD format."
          steps:
            - name: get-expense-reports
              type: call
              call: concur.list-reports
              with:
                submitDateAfter: "{{report_date}}"
            - name: create-review-tasks
              type: call
              call: servicenow.create-approval
              with:
                short_description: "Travel expense reports exceeding ${{threshold_amount}} — compliance review required"
                category: "travel_expense_audit"
            - name: notify-compliance
              type: call
              call: msteams.post-message
              with:
                channel_id: "$secrets.teams_finance_channel_id"
                text: "T&E Audit: Reports exceeding ${{threshold_amount}} have been routed to ServiceNow for review. SNOW: {{create-review-tasks.number}}"
  consumes:
    - type: http
      namespace: concur
      baseUri: "https://www.concursolutions.com/api/v3.0"
      authentication:
        type: bearer
        token: "$secrets.concur_token"
      resources:
        - name: expense-reports
          path: "/expense/reports"
          operations:
            - name: list-reports
              method: GET
    - type: http
      namespace: servicenow
      baseUri: "https://lockheedmartin.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.snow_user"
        password: "$secrets.snow_password"
      resources:
        - name: approvals
          path: "/table/sysapproval_approver"
          operations:
            - name: create-approval
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: channel-messages
          path: "/teams/{{channel_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Looks up a SAP S/4HANA purchase order by number and returns header status, contractor name, total value, and contract line items for program finance and procurement review.

naftiko: "0.5"
info:
  label: "SAP Contract Purchase Order Lookup"
  description: "Looks up a SAP S/4HANA purchase order by number and returns header status, contractor name, total value, and contract line items for program finance and procurement review."
  tags:
    - procurement
    - erp
    - sap
    - finance
    - contracts
capability:
  exposes:
    - type: mcp
      namespace: erp
      port: 8080
      tools:
        - name: get-purchase-order
          description: "Given a SAP purchase order number, return the PO status, supplier name, total amount, and currency. Use for defense contract procurement audits, spend analysis, and subcontractor reconciliation."
          inputParameters:
            - name: po_number
              in: body
              type: string
              description: "The SAP purchase order number, e.g. 4500099001."
          call: sap.get-po
          with:
            po_number: "{{po_number}}"
          outputParameters:
            - name: status
              type: string
              mapping: "$.d.OverallStatus"
            - name: vendor
              type: string
              mapping: "$.d.Supplier.CompanyName"
            - name: total_value
              type: string
              mapping: "$.d.TotalAmount"
            - name: currency
              type: string
              mapping: "$.d.TransactionCurrency"
  consumes:
    - type: http
      namespace: sap
      baseUri: "https://lockheed-martin-s4.sap.com/sap/opu/odata/sap/MM_PUR_PO_MAINT_V2_SRV"
      authentication:
        type: basic
        username: "$secrets.sap_user"
        password: "$secrets.sap_password"
      resources:
        - name: purchase-orders
          path: "/A_PurchaseOrder('{{po_number}}')"
          inputParameters:
            - name: po_number
              in: path
          operations:
            - name: get-po
              method: GET

Reconciles SAP goods receipts against supplier invoices, flags discrepancies, creates a Jira investigation task for procurement, and sends a summary to the AP team via Teams.

naftiko: "0.5"
info:
  label: "SAP Goods Receipt to Invoice Reconciliation"
  description: "Reconciles SAP goods receipts against supplier invoices, flags discrepancies, creates a Jira investigation task for procurement, and sends a summary to the AP team via Teams."
  tags:
    - finance
    - sap
    - jira
    - microsoft-teams
    - accounts-payable
capability:
  exposes:
    - type: mcp
      namespace: finance
      port: 8080
      tools:
        - name: trigger-gr-ir-reconciliation
          description: "Given a SAP purchase order number, reconcile goods receipts against invoices, flag discrepancies, create a Jira task, and notify the accounts payable team."
          inputParameters:
            - name: po_number
              in: body
              type: string
              description: "The SAP purchase order number."
            - name: fiscal_year
              in: body
              type: string
              description: "The fiscal year to reconcile."
          steps:
            - name: get-receipts
              type: call
              call: sap.get-goods-receipts
              with:
                po_number: "{{po_number}}"
            - name: get-invoices
              type: call
              call: sap.get-invoices
              with:
                po_number: "{{po_number}}"
            - name: create-task
              type: call
              call: jira.create-issue
              with:
                project: "AP"
                summary: "GR/IR reconciliation: PO {{po_number}} (FY{{fiscal_year}})"
            - name: notify-ap
              type: call
              call: msteams.post-message
              with:
                channel_id: "accounts-payable"
                text: "GR/IR reconciliation for PO {{po_number}}: Receipts: {{get-receipts.total_amount}}. Invoices: {{get-invoices.total_amount}}. Jira: {{create-task.key}}."
  consumes:
    - type: http
      namespace: sap
      baseUri: "https://lockheed-martin-s4.sap.com/sap/opu/odata/sap/MM_PUR_PO_MAINT_V2_SRV"
      authentication:
        type: basic
        username: "$secrets.sap_user"
        password: "$secrets.sap_password"
      resources:
        - name: goods-receipts
          path: "/A_PurchaseOrder('{{po_number}}')/to_PurchaseOrderItem"
          inputParameters:
            - name: po_number
              in: path
          operations:
            - name: get-goods-receipts
              method: GET
        - name: invoices
          path: "/A_PurOrdAccountAssignment?$filter=PurchaseOrder eq '{{po_number}}'"
          inputParameters:
            - name: po_number
              in: path
          operations:
            - name: get-invoices
              method: GET
    - type: http
      namespace: jira
      baseUri: "https://lockheedmartin.atlassian.net/rest/api/3"
      authentication:
        type: bearer
        token: "$secrets.jira_token"
      resources:
        - name: issues
          path: "/issue"
          operations:
            - name: create-issue
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Executes a read-only SQL query against SAP HANA to retrieve program financial data, returning result set for ad-hoc defense program cost analysis.

naftiko: "0.5"
info:
  label: "SAP HANA Data Query Lookup"
  description: "Executes a read-only SQL query against SAP HANA to retrieve program financial data, returning result set for ad-hoc defense program cost analysis."
  tags:
    - data-analytics
    - sap-hana
    - finance
    - program-management
capability:
  exposes:
    - type: mcp
      namespace: data-analytics
      port: 8080
      tools:
        - name: run-hana-query
          description: "Given a SQL SELECT statement, execute it against SAP HANA and return the result set. Use for ad-hoc program cost queries and financial data extraction."
          inputParameters:
            - name: sql_query
              in: body
              type: string
              description: "A read-only SQL SELECT statement."
          call: saphana.execute-query
          with:
            query: "{{sql_query}}"
          outputParameters:
            - name: rows
              type: array
              mapping: "$.results"
            - name: row_count
              type: integer
              mapping: "$.rowCount"
  consumes:
    - type: http
      namespace: saphana
      baseUri: "https://hana.lockheedmartin.com/api/v1"
      authentication:
        type: basic
        username: "$secrets.hana_user"
        password: "$secrets.hana_password"
      resources:
        - name: sql
          path: "/sql/execute"
          operations:
            - name: execute-query
              method: POST

Retrieves material master data from SAP S/4HANA by material number, returning description, unit of measure, and material group for defense procurement and logistics.

naftiko: "0.5"
info:
  label: "SAP Material Master Lookup"
  description: "Retrieves material master data from SAP S/4HANA by material number, returning description, unit of measure, and material group for defense procurement and logistics."
  tags:
    - logistics
    - sap
    - procurement
    - supply-chain
    - defense
capability:
  exposes:
    - type: mcp
      namespace: logistics
      port: 8080
      tools:
        - name: get-material
          description: "Given a SAP material number, return material description, base unit of measure, and material group. Use for parts procurement and supply chain queries."
          inputParameters:
            - name: material_number
              in: body
              type: string
              description: "The SAP material number."
          call: sap.get-material
          with:
            material_number: "{{material_number}}"
          outputParameters:
            - name: description
              type: string
              mapping: "$.d.MaterialDescription"
            - name: uom
              type: string
              mapping: "$.d.BaseUnitOfMeasure"
            - name: material_group
              type: string
              mapping: "$.d.MaterialGroup"
  consumes:
    - type: http
      namespace: sap
      baseUri: "https://lockheed-martin-s4.sap.com/sap/opu/odata/sap/API_PRODUCT_SRV"
      authentication:
        type: basic
        username: "$secrets.sap_user"
        password: "$secrets.sap_password"
      resources:
        - name: materials
          path: "/A_Product('{{material_number}}')"
          inputParameters:
            - name: material_number
              in: path
          operations:
            - name: get-material
              method: GET

Validates SAP S/4HANA posting periods for program-level company codes at month-end, checks open items, and posts a close-readiness report to the program finance Teams channel.

naftiko: "0.5"
info:
  label: "SAP Period Close and Program Financial Review"
  description: "Validates SAP S/4HANA posting periods for program-level company codes at month-end, checks open items, and posts a close-readiness report to the program finance Teams channel."
  tags:
    - finance
    - erp
    - sap
    - period-close
    - program-management
capability:
  exposes:
    - type: mcp
      namespace: period-close
      port: 8080
      tools:
        - name: validate-program-period-close
          description: "Given a fiscal period and SAP company code, check posting period status and count open items in SAP S/4HANA for defense program financial reporting. Post a close-readiness summary to the program finance Teams channel."
          inputParameters:
            - name: fiscal_period
              in: body
              type: string
              description: "The fiscal period in YYYYMM format, e.g. 202503."
            - name: company_code
              in: body
              type: string
              description: "SAP company code for the program, e.g. LM01."
          steps:
            - name: check-periods
              type: call
              call: sap.get-posting-periods
              with:
                period: "{{fiscal_period}}"
                companyCode: "{{company_code}}"
            - name: get-open-items
              type: call
              call: sap.get-open-items
              with:
                period: "{{fiscal_period}}"
                companyCode: "{{company_code}}"
            - name: post-report
              type: call
              call: msteams.post-message
              with:
                channel_id: "$secrets.teams_finance_channel_id"
                text: "Period Close {{fiscal_period}} ({{company_code}}): Status={{check-periods.status}} | Open Items={{get-open-items.count}}"
  consumes:
    - type: http
      namespace: sap
      baseUri: "https://lockheed-martin-s4.sap.com/sap/opu/odata/sap/API_FINANCIALPLANDATA_SRV"
      authentication:
        type: basic
        username: "$secrets.sap_user"
        password: "$secrets.sap_password"
      resources:
        - name: posting-periods
          path: "/PostingPeriods"
          operations:
            - name: get-posting-periods
              method: GET
        - name: open-items
          path: "/OpenItems"
          operations:
            - name: get-open-items
              method: GET
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: channel-messages
          path: "/teams/{{channel_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Validates SAP timesheet entries against DCAA compliance rules, flags exceptions, creates a Jira audit task, and notifies the compliance team via Teams.

naftiko: "0.5"
info:
  label: "SAP Timesheet to DCAA Compliance Checker"
  description: "Validates SAP timesheet entries against DCAA compliance rules, flags exceptions, creates a Jira audit task, and notifies the compliance team via Teams."
  tags:
    - compliance
    - sap
    - jira
    - microsoft-teams
    - dcaa
capability:
  exposes:
    - type: mcp
      namespace: compliance
      port: 8080
      tools:
        - name: trigger-timesheet-audit
          description: "Given a SAP pay period and program code, validate timesheet entries against DCAA rules, flag exceptions, create a Jira audit task, and notify compliance."
          inputParameters:
            - name: pay_period
              in: body
              type: string
              description: "The pay period end date in YYYY-MM-DD format."
            - name: program_code
              in: body
              type: string
              description: "The defense program code."
          steps:
            - name: get-timesheets
              type: call
              call: sap.get-timesheets
              with:
                pay_period: "{{pay_period}}"
                program_code: "{{program_code}}"
            - name: create-audit-task
              type: call
              call: jira.create-issue
              with:
                project: "COMPLY"
                summary: "DCAA timesheet audit: {{program_code}} ({{pay_period}})"
            - name: notify-compliance
              type: call
              call: msteams.post-message
              with:
                channel_id: "dcaa-compliance"
                text: "Timesheet audit for {{program_code}} ({{pay_period}}): {{get-timesheets.entry_count}} entries, {{get-timesheets.exception_count}} exceptions. Jira: {{create-audit-task.key}}."
  consumes:
    - type: http
      namespace: sap
      baseUri: "https://lockheed-martin-s4.sap.com/sap/opu/odata/sap/API_MANAGE_WORKFORCE_TIMESHEET"
      authentication:
        type: basic
        username: "$secrets.sap_user"
        password: "$secrets.sap_password"
      resources:
        - name: timesheets
          path: "/TimeSheetEntry?$filter=PayPeriod eq '{{pay_period}}' and Program eq '{{program_code}}'"
          inputParameters:
            - name: pay_period
              in: path
            - name: program_code
              in: path
          operations:
            - name: get-timesheets
              method: GET
    - type: http
      namespace: jira
      baseUri: "https://lockheedmartin.atlassian.net/rest/api/3"
      authentication:
        type: bearer
        token: "$secrets.jira_token"
      resources:
        - name: issues
          path: "/issue"
          operations:
            - name: create-issue
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Synchronizes program revenue recognition data from SAP to Salesforce, updates the opportunity stage and amount, refreshes the Snowflake analytics view, and notifies finance via Teams.

naftiko: "0.5"
info:
  label: "SAP to Salesforce Program Revenue Sync"
  description: "Synchronizes program revenue recognition data from SAP to Salesforce, updates the opportunity stage and amount, refreshes the Snowflake analytics view, and notifies finance via Teams."
  tags:
    - finance
    - sap
    - salesforce
    - snowflake
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: finance
      port: 8080
      tools:
        - name: trigger-revenue-sync
          description: "Given a SAP program code, pull revenue recognition data, update the corresponding Salesforce opportunity, refresh Snowflake analytics, and notify finance."
          inputParameters:
            - name: program_code
              in: body
              type: string
              description: "The SAP program code."
            - name: fiscal_period
              in: body
              type: string
              description: "The fiscal period, e.g. 2026-Q1."
          steps:
            - name: get-revenue
              type: call
              call: sap.get-revenue
              with:
                program_code: "{{program_code}}"
                period: "{{fiscal_period}}"
            - name: update-salesforce
              type: call
              call: salesforce.update-opportunity
              with:
                program_code: "{{program_code}}"
                amount: "{{get-revenue.recognized_revenue}}"
            - name: refresh-analytics
              type: call
              call: snowflake.run-query
              with:
                query: "CALL refresh_revenue_view('{{program_code}}')"
            - name: notify-finance
              type: call
              call: msteams.post-message
              with:
                channel_id: "finance-ops"
                text: "Revenue sync complete for {{program_code}} ({{fiscal_period}}). Recognized: {{get-revenue.recognized_revenue}}."
  consumes:
    - type: http
      namespace: sap
      baseUri: "https://lockheed-martin-s4.sap.com/sap/opu/odata/sap/API_REVENUE"
      authentication:
        type: basic
        username: "$secrets.sap_user"
        password: "$secrets.sap_password"
      resources:
        - name: revenue
          path: "/Revenue(program='{{program_code}}')"
          inputParameters:
            - name: program_code
              in: path
          operations:
            - name: get-revenue
              method: GET
    - type: http
      namespace: salesforce
      baseUri: "https://lockheedmartin.my.salesforce.com/services/data/v58.0"
      authentication:
        type: bearer
        token: "$secrets.salesforce_token"
      resources:
        - name: opportunities
          path: "/sobjects/Opportunity"
          operations:
            - name: update-opportunity
              method: PATCH
    - type: http
      namespace: snowflake
      baseUri: "https://lockheedmartin.snowflakecomputing.com/api/v2"
      authentication:
        type: bearer
        token: "$secrets.snowflake_token"
      resources:
        - name: statements
          path: "/statements"
          operations:
            - name: run-query
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Retrieves vendor master data from SAP S/4HANA by vendor number, returning company details, payment terms, and CAGE code for defense subcontractor verification.

naftiko: "0.5"
info:
  label: "SAP Vendor Master Lookup"
  description: "Retrieves vendor master data from SAP S/4HANA by vendor number, returning company details, payment terms, and CAGE code for defense subcontractor verification."
  tags:
    - procurement
    - sap
    - defense
    - subcontractor
    - compliance
capability:
  exposes:
    - type: mcp
      namespace: procurement
      port: 8080
      tools:
        - name: get-vendor
          description: "Given a SAP vendor number, return vendor name, address, payment terms, and CAGE code. Use for subcontractor verification and procurement compliance."
          inputParameters:
            - name: vendor_number
              in: body
              type: string
              description: "The SAP vendor number, e.g. 0001000123."
          call: sap.get-vendor
          with:
            vendor_number: "{{vendor_number}}"
          outputParameters:
            - name: vendor_name
              type: string
              mapping: "$.d.SupplierName"
            - name: cage_code
              type: string
              mapping: "$.d.CageCode"
            - name: payment_terms
              type: string
              mapping: "$.d.PaymentTerms"
  consumes:
    - type: http
      namespace: sap
      baseUri: "https://lockheed-martin-s4.sap.com/sap/opu/odata/sap/API_BUSINESS_PARTNER"
      authentication:
        type: basic
        username: "$secrets.sap_user"
        password: "$secrets.sap_password"
      resources:
        - name: suppliers
          path: "/A_Supplier('{{vendor_number}}')"
          inputParameters:
            - name: vendor_number
              in: path
          operations:
            - name: get-vendor
              method: GET

When a security clearance nears expiration in Workday, creates a ServiceNow reinvestigation request, suspends program-specific Okta access, and notifies the employee and FSO via Teams.

naftiko: "0.5"
info:
  label: "Security Clearance Expiry Renewal Orchestrator"
  description: "When a security clearance nears expiration in Workday, creates a ServiceNow reinvestigation request, suspends program-specific Okta access, and notifies the employee and FSO via Teams."
  tags:
    - security-clearance
    - workday
    - servicenow
    - okta
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: security-clearance
      port: 8080
      tools:
        - name: trigger-clearance-renewal
          description: "Given a worker ID with an expiring clearance, create a ServiceNow reinvestigation ticket, temporarily restrict Okta program access, and notify the employee and Facility Security Officer."
          inputParameters:
            - name: worker_id
              in: body
              type: string
              description: "The Workday worker ID with expiring clearance."
            - name: clearance_type
              in: body
              type: string
              description: "Clearance type: SECRET, TOP_SECRET, or TS_SCI."
          steps:
            - name: get-worker
              type: call
              call: workday.get-worker
              with:
                worker_id: "{{worker_id}}"
            - name: create-reinvestigation
              type: call
              call: servicenow.create-incident
              with:
                short_description: "Clearance reinvestigation: {{get-worker.full_name}} ({{clearance_type}})"
                category: "security_clearance"
                assigned_group: "FSO_Operations"
            - name: restrict-access
              type: call
              call: okta.suspend-group
              with:
                user_id: "{{get-worker.work_email}}"
                group: "program-classified-{{clearance_type}}"
            - name: notify-employee
              type: call
              call: msteams.post-message
              with:
                recipient_upn: "{{get-worker.work_email}}"
                text: "Your {{clearance_type}} clearance reinvestigation has been initiated. Ticket: {{create-reinvestigation.number}}. Contact FSO for next steps."
  consumes:
    - type: http
      namespace: workday
      baseUri: "https://wd2-impl-services1.workday.com/ccx/api/v1"
      authentication:
        type: bearer
        token: "$secrets.workday_token"
      resources:
        - name: workers
          path: "/lockheed-martin/workers/{{worker_id}}"
          inputParameters:
            - name: worker_id
              in: path
          operations:
            - name: get-worker
              method: GET
    - type: http
      namespace: servicenow
      baseUri: "https://lockheedmartin.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.snow_user"
        password: "$secrets.snow_password"
      resources:
        - name: incidents
          path: "/table/incident"
          operations:
            - name: create-incident
              method: POST
    - type: http
      namespace: okta
      baseUri: "https://lockheedmartin.okta.com/api/v1"
      authentication:
        type: bearer
        token: "$secrets.okta_token"
      resources:
        - name: groups
          path: "/groups/{{group}}/users/{{user_id}}"
          inputParameters:
            - name: user_id
              in: path
            - name: group
              in: path
          operations:
            - name: suspend-group
              method: DELETE
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/users/{{recipient_upn}}/sendMail"
          inputParameters:
            - name: recipient_upn
              in: path
          operations:
            - name: post-message
              method: POST

Aggregates pending ServiceNow change requests, creates a Confluence CAB agenda, schedules the review meeting via Teams, and notifies CAB members with change summaries.

naftiko: "0.5"
info:
  label: "ServiceNow Change Advisory Board Scheduler"
  description: "Aggregates pending ServiceNow change requests, creates a Confluence CAB agenda, schedules the review meeting via Teams, and notifies CAB members with change summaries."
  tags:
    - change-management
    - servicenow
    - confluence
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: change-management
      port: 8080
      tools:
        - name: trigger-cab-meeting
          description: "Given a CAB meeting date, aggregate pending ServiceNow changes, publish a Confluence agenda, and notify CAB members via Teams."
          inputParameters:
            - name: meeting_date
              in: body
              type: string
              description: "The CAB meeting date in YYYY-MM-DD format."
          steps:
            - name: get-pending-changes
              type: call
              call: servicenow.get-changes
              with:
                status: "pending_approval"
            - name: create-agenda
              type: call
              call: confluence.create-page
              with:
                space_key: "CAB"
                title: "CAB Agenda - {{meeting_date}}"
                body: "Pending changes: {{get-pending-changes.total_count}}. Review scheduled for {{meeting_date}}."
            - name: notify-cab
              type: call
              call: msteams.post-message
              with:
                channel_id: "cab-members"
                text: "CAB meeting {{meeting_date}}: {{get-pending-changes.total_count}} changes to review. Agenda: {{create-agenda.url}}."
  consumes:
    - type: http
      namespace: servicenow
      baseUri: "https://lockheedmartin.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.snow_user"
        password: "$secrets.snow_password"
      resources:
        - name: changes
          path: "/table/change_request?sysparm_query=state=pending_approval"
          operations:
            - name: get-changes
              method: GET
    - type: http
      namespace: confluence
      baseUri: "https://lockheedmartin.atlassian.net/wiki/rest/api"
      authentication:
        type: bearer
        token: "$secrets.confluence_token"
      resources:
        - name: content
          path: "/content"
          operations:
            - name: create-page
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Looks up a configuration item in the ServiceNow CMDB by asset tag or hostname, returning asset details, owner, classification, and support group for IT operations.

naftiko: "0.5"
info:
  label: "ServiceNow CMDB Asset Lookup"
  description: "Looks up a configuration item in the ServiceNow CMDB by asset tag or hostname, returning asset details, owner, classification, and support group for IT operations."
  tags:
    - it-operations
    - servicenow
    - cmdb
    - asset-management
capability:
  exposes:
    - type: mcp
      namespace: it-asset-management
      port: 8080
      tools:
        - name: get-cmdb-ci
          description: "Given a ServiceNow asset tag or hostname, return the configuration item details including owner, support group, environment, and classification. Use for IT asset verification and incident triage."
          inputParameters:
            - name: asset_tag
              in: body
              type: string
              description: "The asset tag or hostname to look up."
          call: servicenow.get-ci
          with:
            asset_tag: "{{asset_tag}}"
          outputParameters:
            - name: ci_name
              type: string
              mapping: "$.result[0].name"
            - name: owner
              type: string
              mapping: "$.result[0].owned_by.display_value"
            - name: support_group
              type: string
              mapping: "$.result[0].support_group.display_value"
            - name: environment
              type: string
              mapping: "$.result[0].u_environment"
  consumes:
    - type: http
      namespace: servicenow
      baseUri: "https://lockheedmartin.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.snow_user"
        password: "$secrets.snow_password"
      resources:
        - name: cmdb-ci
          path: "/table/cmdb_ci?sysparm_query=asset_tag={{asset_tag}}"
          inputParameters:
            - name: asset_tag
              in: path
          operations:
            - name: get-ci
              method: GET

Creates a ServiceNow change request for IT infrastructure modifications in classified or sensitive environments, requiring security team sign-off before CAB approval.

naftiko: "0.5"
info:
  label: "ServiceNow IT Change Request with Security Review"
  description: "Creates a ServiceNow change request for IT infrastructure modifications in classified or sensitive environments, requiring security team sign-off before CAB approval."
  tags:
    - itsm
    - change-management
    - servicenow
    - microsoft-teams
    - security
capability:
  exposes:
    - type: mcp
      namespace: secure-change-mgmt
      port: 8080
      tools:
        - name: create-secure-change-request
          description: "Given a change description, environment classification, and implementation window, create a ServiceNow change request and notify the change advisory board and security review team via Teams. Use for all changes affecting classified or sensitive systems."
          inputParameters:
            - name: change_description
              in: body
              type: string
              description: "Description of the planned change and business justification."
            - name: environment_class
              in: body
              type: string
              description: "Environment classification: unclassified, sensitive, or classified."
            - name: implementation_window
              in: body
              type: string
              description: "Planned maintenance window in ISO 8601 format."
          steps:
            - name: create-cr
              type: call
              call: servicenow.create-change-request
              with:
                short_description: "{{change_description}}"
                environment: "{{environment_class}}"
                start_date: "{{implementation_window}}"
            - name: notify-cab
              type: call
              call: msteams.post-message
              with:
                channel_id: "$secrets.teams_cab_channel_id"
                text: "New Change Request {{create-cr.number}} [{{environment_class}}]: {{change_description}} | Window: {{implementation_window}}"
  consumes:
    - type: http
      namespace: servicenow
      baseUri: "https://lockheedmartin.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.snow_user"
        password: "$secrets.snow_password"
      resources:
        - name: change-requests
          path: "/table/change_request"
          operations:
            - name: create-change-request
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: channel-messages
          path: "/teams/{{channel_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

After a major incident is resolved in ServiceNow, generates a postmortem report, publishes to Confluence, creates Jira follow-up actions, and distributes to stakeholders via Teams.

naftiko: "0.5"
info:
  label: "ServiceNow Major Incident Postmortem Generator"
  description: "After a major incident is resolved in ServiceNow, generates a postmortem report, publishes to Confluence, creates Jira follow-up actions, and distributes to stakeholders via Teams."
  tags:
    - incident-management
    - servicenow
    - confluence
    - jira
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: incident-management
      port: 8080
      tools:
        - name: trigger-postmortem
          description: "Given a ServiceNow major incident number, generate a postmortem, publish to Confluence, create Jira follow-up items, and notify stakeholders via Teams."
          inputParameters:
            - name: incident_number
              in: body
              type: string
              description: "The ServiceNow incident number, e.g. INC0012345."
          steps:
            - name: get-incident
              type: call
              call: servicenow.get-incident
              with:
                number: "{{incident_number}}"
            - name: publish-postmortem
              type: call
              call: confluence.create-page
              with:
                space_key: "POSTMORTEM"
                title: "Postmortem: {{incident_number}} - {{get-incident.short_description}}"
                body: "Duration: {{get-incident.duration}}. Root cause: {{get-incident.root_cause}}."
            - name: create-actions
              type: call
              call: jira.create-issue
              with:
                project: "FOLLOWUP"
                summary: "Post-incident actions: {{incident_number}}"
            - name: notify-stakeholders
              type: call
              call: msteams.post-message
              with:
                channel_id: "incident-postmortems"
                text: "Postmortem published for {{incident_number}}. Report: {{publish-postmortem.url}}. Follow-ups: {{create-actions.key}}."
  consumes:
    - type: http
      namespace: servicenow
      baseUri: "https://lockheedmartin.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.snow_user"
        password: "$secrets.snow_password"
      resources:
        - name: incidents
          path: "/table/incident?sysparm_query=number={{number}}"
          inputParameters:
            - name: number
              in: path
          operations:
            - name: get-incident
              method: GET
    - type: http
      namespace: confluence
      baseUri: "https://lockheedmartin.atlassian.net/wiki/rest/api"
      authentication:
        type: bearer
        token: "$secrets.confluence_token"
      resources:
        - name: content
          path: "/content"
          operations:
            - name: create-page
              method: POST
    - type: http
      namespace: jira
      baseUri: "https://lockheedmartin.atlassian.net/rest/api/3"
      authentication:
        type: bearer
        token: "$secrets.jira_token"
      resources:
        - name: issues
          path: "/issue"
          operations:
            - name: create-issue
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Searches a SharePoint document library for classified or CUI documents by filename or metadata, returning document location and classification markings.

naftiko: "0.5"
info:
  label: "SharePoint Classified Document Lookup"
  description: "Searches a SharePoint document library for classified or CUI documents by filename or metadata, returning document location and classification markings."
  tags:
    - document-management
    - sharepoint
    - security-clearance
    - itar
    - compliance
capability:
  exposes:
    - type: mcp
      namespace: document-management
      port: 8080
      tools:
        - name: search-classified-docs
          description: "Given a search query and SharePoint site, return matching documents with their classification level, file path, and last modified date. Use for ITAR and CUI document retrieval."
          inputParameters:
            - name: site_id
              in: body
              type: string
              description: "The SharePoint site ID."
            - name: query
              in: body
              type: string
              description: "Search query for document name or metadata."
          call: sharepoint.search-docs
          with:
            site_id: "{{site_id}}"
            query: "{{query}}"
          outputParameters:
            - name: results
              type: array
              mapping: "$.value"
            - name: total_count
              type: integer
              mapping: "$.@odata.count"
  consumes:
    - type: http
      namespace: sharepoint
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: drive-items
          path: "/sites/{{site_id}}/drive/root/search(q='{{query}}')"
          inputParameters:
            - name: site_id
              in: path
            - name: query
              in: path
          operations:
            - name: search-docs
              method: GET

Monitors Snowflake task execution for the program analytics, cost, and supply chain data pipelines, creates a ServiceNow incident if jobs fail, and alerts the data engineering team via Teams.

naftiko: "0.5"
info:
  label: "Snowflake Data Pipeline Health Monitor"
  description: "Monitors Snowflake task execution for the program analytics, cost, and supply chain data pipelines, creates a ServiceNow incident if jobs fail, and alerts the data engineering team via Teams."
  tags:
    - data
    - analytics
    - snowflake
    - servicenow
    - monitoring
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: data-ops
      port: 8080
      tools:
        - name: monitor-program-data-pipelines
          description: "Query Snowflake task execution history for failures in program analytics, EAC, and supply chain pipelines over the last N hours. Open a ServiceNow incident and alert the data engineering Teams channel if critical jobs have failed."
          inputParameters:
            - name: hours_back
              in: body
              type: integer
              description: "Number of hours of task history to check, e.g. 6."
          steps:
            - name: get-failed-tasks
              type: call
              call: snowflake.query-task-history
              with:
                hours_back: "{{hours_back}}"
            - name: create-incident
              type: call
              call: servicenow.create-incident
              with:
                short_description: "Snowflake pipeline failures over last {{hours_back}} hours"
                category: "data_platform"
                priority: "2"
            - name: notify-data-team
              type: call
              call: msteams.post-message
              with:
                channel_id: "$secrets.teams_data_channel_id"
                text: "Snowflake pipeline failures detected (last {{hours_back}}h). SNOW: {{create-incident.number}}"
  consumes:
    - type: http
      namespace: snowflake
      baseUri: "https://lockheed-martin.snowflakecomputing.com/api/v2"
      authentication:
        type: bearer
        token: "$secrets.snowflake_token"
      resources:
        - name: task-history
          path: "/statements"
          operations:
            - name: query-task-history
              method: POST
    - type: http
      namespace: servicenow
      baseUri: "https://lockheedmartin.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.snow_user"
        password: "$secrets.snow_password"
      resources:
        - name: incidents
          path: "/table/incident"
          operations:
            - name: create-incident
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: channel-messages
          path: "/teams/{{channel_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Queries SAP S/4HANA for program-level cost actuals and writes a structured snapshot to Snowflake for program finance analytics and EAC reporting.

naftiko: "0.5"
info:
  label: "Snowflake Program Cost Analytics Snapshot"
  description: "Queries SAP S/4HANA for program-level cost actuals and writes a structured snapshot to Snowflake for program finance analytics and EAC reporting."
  tags:
    - finance
    - analytics
    - sap
    - snowflake
    - program-management
capability:
  exposes:
    - type: mcp
      namespace: program-finance-ops
      port: 8080
      tools:
        - name: capture-program-cost-snapshot
          description: "Given a SAP program WBS element and fiscal period, retrieve program cost actuals from SAP S/4HANA and write a timestamped snapshot to Snowflake for EAC and EVMS analytics. Use for daily program cost data ingestion."
          inputParameters:
            - name: wbs_element
              in: body
              type: string
              description: "The SAP WBS element code for the program, e.g. LM-F35-2025."
            - name: fiscal_period
              in: body
              type: string
              description: "Fiscal period in YYYYMM format."
          steps:
            - name: get-cost-actuals
              type: call
              call: sap.get-wbs-actuals
              with:
                wbs_element: "{{wbs_element}}"
                period: "{{fiscal_period}}"
            - name: write-to-snowflake
              type: call
              call: snowflake.insert-program-snapshot
              with:
                wbs: "{{wbs_element}}"
                period: "{{fiscal_period}}"
                data: "{{get-cost-actuals.results}}"
  consumes:
    - type: http
      namespace: sap
      baseUri: "https://lockheed-martin-s4.sap.com/sap/opu/odata/sap/API_COPROJECTACTIVITYITEM_SRV"
      authentication:
        type: basic
        username: "$secrets.sap_user"
        password: "$secrets.sap_password"
      resources:
        - name: wbs-actuals
          path: "/A_EnterpriseProjectElement"
          operations:
            - name: get-wbs-actuals
              method: GET
    - type: http
      namespace: snowflake
      baseUri: "https://lockheed-martin.snowflakecomputing.com/api/v2"
      authentication:
        type: bearer
        token: "$secrets.snowflake_token"
      resources:
        - name: statements
          path: "/statements"
          operations:
            - name: insert-program-snapshot
              method: POST

Triggers a Snowflake data pipeline refresh for program analytics, validates data quality thresholds, and sends a Datadog custom metric and Teams notification on completion.

naftiko: "0.5"
info:
  label: "Snowflake Program Data Refresh and Alert"
  description: "Triggers a Snowflake data pipeline refresh for program analytics, validates data quality thresholds, and sends a Datadog custom metric and Teams notification on completion."
  tags:
    - data-analytics
    - snowflake
    - datadog
    - microsoft-teams
    - data-pipeline
capability:
  exposes:
    - type: mcp
      namespace: data-analytics
      port: 8080
      tools:
        - name: trigger-data-refresh
          description: "Given a Snowflake warehouse and pipeline name, trigger refresh, validate data quality, emit a Datadog metric, and notify the analytics team via Teams."
          inputParameters:
            - name: warehouse
              in: body
              type: string
              description: "The Snowflake warehouse name."
            - name: pipeline_name
              in: body
              type: string
              description: "The data pipeline name to refresh."
          steps:
            - name: trigger-refresh
              type: call
              call: snowflake.execute-task
              with:
                warehouse: "{{warehouse}}"
                task_name: "{{pipeline_name}}"
            - name: check-quality
              type: call
              call: snowflake.run-query
              with:
                query: "SELECT COUNT(*) as row_count FROM {{pipeline_name}}_output"
            - name: emit-metric
              type: call
              call: datadog.post-metric
              with:
                metric: "pipeline.refresh.row_count"
                value: "{{check-quality.row_count}}"
            - name: notify-team
              type: call
              call: msteams.post-message
              with:
                channel_id: "data-analytics"
                text: "Pipeline {{pipeline_name}} refreshed. Rows: {{check-quality.row_count}}."
  consumes:
    - type: http
      namespace: snowflake
      baseUri: "https://lockheedmartin.snowflakecomputing.com/api/v2"
      authentication:
        type: bearer
        token: "$secrets.snowflake_token"
      resources:
        - name: statements
          path: "/statements"
          operations:
            - name: execute-task
              method: POST
            - name: run-query
              method: POST
    - type: http
      namespace: datadog
      baseUri: "https://api.datadoghq.com/api/v2"
      authentication:
        type: bearer
        token: "$secrets.datadog_api_key"
      resources:
        - name: metrics
          path: "/series"
          operations:
            - name: post-metric
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

When SolarWinds detects network performance degradation on classified infrastructure, retrieves node metrics, creates a ServiceNow incident, and alerts the network operations team via Teams.

naftiko: "0.5"
info:
  label: "SolarWinds Network Performance Degradation Handler"
  description: "When SolarWinds detects network performance degradation on classified infrastructure, retrieves node metrics, creates a ServiceNow incident, and alerts the network operations team via Teams."
  tags:
    - network-operations
    - solarwinds
    - servicenow
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: network-operations
      port: 8080
      tools:
        - name: trigger-perf-degradation
          description: "Given a SolarWinds node ID with performance degradation, retrieve metrics, create a ServiceNow incident, and alert network operations via Teams."
          inputParameters:
            - name: node_id
              in: body
              type: string
              description: "The SolarWinds node ID."
            - name: metric_type
              in: body
              type: string
              description: "The degraded metric: latency, packet_loss, or bandwidth."
          steps:
            - name: get-metrics
              type: call
              call: solarwinds.get-node-metrics
              with:
                node_id: "{{node_id}}"
            - name: create-incident
              type: call
              call: servicenow.create-incident
              with:
                short_description: "Network degradation: {{get-metrics.node_name}} - {{metric_type}}"
                impact: "2"
            - name: notify-netops
              type: call
              call: msteams.post-message
              with:
                channel_id: "network-ops"
                text: "Network degradation on {{get-metrics.node_name}}. {{metric_type}}: {{get-metrics.current_value}}. Ticket: {{create-incident.number}}."
  consumes:
    - type: http
      namespace: solarwinds
      baseUri: "https://solarwinds.lockheedmartin.com/SolarWinds/InformationService/v3/Json"
      authentication:
        type: basic
        username: "$secrets.solarwinds_user"
        password: "$secrets.solarwinds_password"
      resources:
        - name: nodes
          path: "/Query?query=SELECT+*+FROM+Orion.Nodes+WHERE+NodeID={{node_id}}"
          inputParameters:
            - name: node_id
              in: path
          operations:
            - name: get-node-metrics
              method: GET
    - type: http
      namespace: servicenow
      baseUri: "https://lockheedmartin.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.snow_user"
        password: "$secrets.snow_password"
      resources:
        - name: incidents
          path: "/table/incident"
          operations:
            - name: create-incident
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Checks the status of a Tableau workbook or data extract refresh on Tableau Server, returning last refresh time and completion status for program reporting dashboards.

naftiko: "0.5"
info:
  label: "Tableau Defense Report Status Lookup"
  description: "Checks the status of a Tableau workbook or data extract refresh on Tableau Server, returning last refresh time and completion status for program reporting dashboards."
  tags:
    - analytics
    - tableau
    - defense
    - reporting
capability:
  exposes:
    - type: mcp
      namespace: analytics
      port: 8080
      tools:
        - name: get-workbook-status
          description: "Given a Tableau workbook ID, return the last extract refresh time, status, and owner. Use for verifying defense program dashboard data freshness."
          inputParameters:
            - name: workbook_id
              in: body
              type: string
              description: "The Tableau workbook ID."
          call: tableau.get-workbook
          with:
            workbook_id: "{{workbook_id}}"
          outputParameters:
            - name: name
              type: string
              mapping: "$.workbook.name"
            - name: updated_at
              type: string
              mapping: "$.workbook.updatedAt"
            - name: owner
              type: string
              mapping: "$.workbook.owner.name"
  consumes:
    - type: http
      namespace: tableau
      baseUri: "https://tableau.lockheedmartin.com/api/3.19"
      authentication:
        type: bearer
        token: "$secrets.tableau_token"
      resources:
        - name: workbooks
          path: "/sites/{{site_id}}/workbooks/{{workbook_id}}"
          inputParameters:
            - name: workbook_id
              in: path
          operations:
            - name: get-workbook
              method: GET

Orchestrates a Teradata to Snowflake data migration by extracting table data, loading into Snowflake, validating row counts, and notifying the data engineering team via Teams.

naftiko: "0.5"
info:
  label: "Teradata to Snowflake Data Migration Orchestrator"
  description: "Orchestrates a Teradata to Snowflake data migration by extracting table data, loading into Snowflake, validating row counts, and notifying the data engineering team via Teams."
  tags:
    - data-engineering
    - teradata
    - snowflake
    - microsoft-teams
    - data-migration
capability:
  exposes:
    - type: mcp
      namespace: data-engineering
      port: 8080
      tools:
        - name: trigger-data-migration
          description: "Given a Teradata database and table name, extract data, load into Snowflake, validate counts, and notify the data engineering team."
          inputParameters:
            - name: source_database
              in: body
              type: string
              description: "The Teradata source database name."
            - name: table_name
              in: body
              type: string
              description: "The table name to migrate."
          steps:
            - name: extract-data
              type: call
              call: teradata.export-table
              with:
                database: "{{source_database}}"
                table: "{{table_name}}"
            - name: load-snowflake
              type: call
              call: snowflake.run-query
              with:
                query: "COPY INTO {{table_name}} FROM @teradata_stage/{{table_name}}.csv"
            - name: validate-counts
              type: call
              call: snowflake.run-query
              with:
                query: "SELECT COUNT(*) as cnt FROM {{table_name}}"
            - name: notify-team
              type: call
              call: msteams.post-message
              with:
                channel_id: "data-migration"
                text: "Migration complete: {{source_database}}.{{table_name}}. Source rows: {{extract-data.row_count}}. Target rows: {{validate-counts.cnt}}."
  consumes:
    - type: http
      namespace: teradata
      baseUri: "https://teradata.lockheedmartin.com/api/v1"
      authentication:
        type: basic
        username: "$secrets.teradata_user"
        password: "$secrets.teradata_password"
      resources:
        - name: exports
          path: "/databases/{{database}}/tables/{{table}}/export"
          inputParameters:
            - name: database
              in: path
            - name: table
              in: path
          operations:
            - name: export-table
              method: POST
    - type: http
      namespace: snowflake
      baseUri: "https://lockheedmartin.snowflakecomputing.com/api/v2"
      authentication:
        type: bearer
        token: "$secrets.snowflake_token"
      resources:
        - name: statements
          path: "/statements"
          operations:
            - name: run-query
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

When a new classified environment is requested, provisions a Terraform Cloud workspace, applies Azure Government infrastructure templates, creates a ServiceNow change record, and notifies the engineering team.

naftiko: "0.5"
info:
  label: "Terraform Classified Workspace Deployment"
  description: "When a new classified environment is requested, provisions a Terraform Cloud workspace, applies Azure Government infrastructure templates, creates a ServiceNow change record, and notifies the engineering team."
  tags:
    - infrastructure
    - terraform
    - azure
    - servicenow
    - microsoft-teams
    - classified-networks
capability:
  exposes:
    - type: mcp
      namespace: infrastructure
      port: 8080
      tools:
        - name: trigger-classified-deployment
          description: "Given a workspace name and classification level, create a Terraform Cloud workspace, trigger Azure Gov infrastructure apply, log a ServiceNow change record, and notify engineering."
          inputParameters:
            - name: workspace_name
              in: body
              type: string
              description: "Name for the new Terraform workspace."
            - name: classification
              in: body
              type: string
              description: "Classification level: CUI, SECRET, or TOP_SECRET."
            - name: region
              in: body
              type: string
              description: "Azure Government region, e.g. usgovvirginia."
          steps:
            - name: create-workspace
              type: call
              call: terraform.create-workspace
              with:
                name: "{{workspace_name}}"
                auto_apply: "false"
            - name: trigger-apply
              type: call
              call: terraform.create-run
              with:
                workspace_id: "{{create-workspace.id}}"
                message: "Classified deployment: {{classification}} in {{region}}"
            - name: create-change
              type: call
              call: servicenow.create-change
              with:
                short_description: "Terraform deployment: {{workspace_name}} ({{classification}})"
                category: "infrastructure"
            - name: notify-team
              type: call
              call: msteams.post-message
              with:
                channel_id: "infra-deployments"
                text: "Classified workspace {{workspace_name}} created. Classification: {{classification}}. Change: {{create-change.number}}."
  consumes:
    - type: http
      namespace: terraform
      baseUri: "https://app.terraform.io/api/v2"
      authentication:
        type: bearer
        token: "$secrets.terraform_token"
      resources:
        - name: workspaces
          path: "/organizations/lockheed-martin/workspaces"
          operations:
            - name: create-workspace
              method: POST
        - name: runs
          path: "/runs"
          operations:
            - name: create-run
              method: POST
    - type: http
      namespace: servicenow
      baseUri: "https://lockheedmartin.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.snow_user"
        password: "$secrets.snow_password"
      resources:
        - name: changes
          path: "/table/change_request"
          operations:
            - name: create-change
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Creates and configures a new Terraform Cloud workspace for secure government cloud infrastructure, links it to a GitHub repository, and notifies the cloud architecture team via Teams.

naftiko: "0.5"
info:
  label: "Terraform Cloud Infrastructure Workspace Provisioning"
  description: "Creates and configures a new Terraform Cloud workspace for secure government cloud infrastructure, links it to a GitHub repository, and notifies the cloud architecture team via Teams."
  tags:
    - cloud
    - infrastructure
    - terraform
    - github
    - microsoft-teams
    - devops
capability:
  exposes:
    - type: mcp
      namespace: infra-provisioning
      port: 8080
      tools:
        - name: provision-secure-workspace
          description: "Given a workspace name, GitHub repository, and environment classification, create a Terraform Cloud workspace linked to the source repo and notify the cloud architecture team in Teams. Use when standing up new program or classified environment infrastructure."
          inputParameters:
            - name: workspace_name
              in: body
              type: string
              description: "The name for the Terraform Cloud workspace in kebab-case."
            - name: github_repo
              in: body
              type: string
              description: "The GitHub repository URL to link to the workspace."
            - name: environment_class
              in: body
              type: string
              description: "Environment classification: unclassified, sensitive, or classified."
          steps:
            - name: create-workspace
              type: call
              call: terraform.create-workspace
              with:
                name: "{{workspace_name}}"
                vcs_repo: "{{github_repo}}"
            - name: notify-cloud-team
              type: call
              call: msteams.post-message
              with:
                channel_id: "$secrets.teams_cloud_channel_id"
                text: "Terraform workspace '{{workspace_name}}' ({{environment_class}}) provisioned. ID: {{create-workspace.id}} | Repo: {{github_repo}}"
  consumes:
    - type: http
      namespace: terraform
      baseUri: "https://app.terraform.io/api/v2"
      authentication:
        type: bearer
        token: "$secrets.terraform_token"
      resources:
        - name: workspaces
          path: "/organizations/lockheed-martin/workspaces"
          operations:
            - name: create-workspace
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: channel-messages
          path: "/teams/{{channel_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Retrieves virtual machine details from VMware vCenter by VM name, returning power state, resource allocation, and host placement for infrastructure capacity planning.

naftiko: "0.5"
info:
  label: "VMware VM Inventory Lookup"
  description: "Retrieves virtual machine details from VMware vCenter by VM name, returning power state, resource allocation, and host placement for infrastructure capacity planning."
  tags:
    - infrastructure
    - vmware
    - capacity-planning
    - classified-networks
capability:
  exposes:
    - type: mcp
      namespace: infrastructure
      port: 8080
      tools:
        - name: get-vm-details
          description: "Given a VMware virtual machine name, return power state, CPU count, memory allocation, and host. Use for classified infrastructure capacity and compliance audits."
          inputParameters:
            - name: vm_name
              in: body
              type: string
              description: "The virtual machine name in vCenter."
          call: vmware.get-vm
          with:
            vm_name: "{{vm_name}}"
          outputParameters:
            - name: power_state
              type: string
              mapping: "$.value[0].power_state"
            - name: cpu_count
              type: integer
              mapping: "$.value[0].cpu_count"
            - name: memory_mb
              type: integer
              mapping: "$.value[0].memory_size_MiB"
  consumes:
    - type: http
      namespace: vmware
      baseUri: "https://vcenter.lockheedmartin.com/api/vcenter"
      authentication:
        type: bearer
        token: "$secrets.vmware_token"
      resources:
        - name: vms
          path: "/vm?filter.names={{vm_name}}"
          inputParameters:
            - name: vm_name
              in: path
          operations:
            - name: get-vm
              method: GET

Provisions a new VMware virtual machine for a classified program, registers it in ServiceNow CMDB, runs a STIG compliance scan, and notifies the infrastructure team via Teams.

naftiko: "0.5"
info:
  label: "VMware VM Provisioning and Compliance Check"
  description: "Provisions a new VMware virtual machine for a classified program, registers it in ServiceNow CMDB, runs a STIG compliance scan, and notifies the infrastructure team via Teams."
  tags:
    - infrastructure
    - vmware
    - servicenow
    - ansible
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: infrastructure
      port: 8080
      tools:
        - name: trigger-vm-provision
          description: "Given VM specifications and program classification, provision via vCenter, register in CMDB, run compliance scan, and notify the infrastructure team."
          inputParameters:
            - name: vm_name
              in: body
              type: string
              description: "The desired VM name."
            - name: cpu_count
              in: body
              type: string
              description: "Number of CPUs."
            - name: memory_gb
              in: body
              type: string
              description: "Memory in GB."
            - name: classification
              in: body
              type: string
              description: "Classification: CUI, SECRET, or TOP_SECRET."
          steps:
            - name: create-vm
              type: call
              call: vmware.create-vm
              with:
                name: "{{vm_name}}"
                cpu: "{{cpu_count}}"
                memory_mb: "{{memory_gb}}000"
            - name: register-cmdb
              type: call
              call: servicenow.create-ci
              with:
                name: "{{vm_name}}"
                category: "virtual_machine"
                classification: "{{classification}}"
            - name: run-compliance
              type: call
              call: ansible.launch-job
              with:
                template_id: "stig-scan"
                extra_vars: "target={{vm_name}}"
            - name: notify-infra
              type: call
              call: msteams.post-message
              with:
                channel_id: "infra-provisioning"
                text: "VM {{vm_name}} provisioned ({{classification}}). CMDB: {{register-cmdb.sys_id}}. STIG scan: {{run-compliance.id}}."
  consumes:
    - type: http
      namespace: vmware
      baseUri: "https://vcenter.lockheedmartin.com/api/vcenter"
      authentication:
        type: bearer
        token: "$secrets.vmware_token"
      resources:
        - name: vms
          path: "/vm"
          operations:
            - name: create-vm
              method: POST
    - type: http
      namespace: servicenow
      baseUri: "https://lockheedmartin.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.snow_user"
        password: "$secrets.snow_password"
      resources:
        - name: cmdb
          path: "/table/cmdb_ci_server"
          operations:
            - name: create-ci
              method: POST
    - type: http
      namespace: ansible
      baseUri: "https://ansible.lockheedmartin.com/api/v2"
      authentication:
        type: bearer
        token: "$secrets.ansible_token"
      resources:
        - name: jobs
          path: "/job_templates/{{template_id}}/launch/"
          inputParameters:
            - name: template_id
              in: path
          operations:
            - name: launch-job
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Initiates the annual compensation review by pulling headcount data from Workday, generating salary band analysis in Snowflake, publishing results to Power BI, and notifying HR leadership via Teams.

naftiko: "0.5"
info:
  label: "Workday Annual Compensation Review Orchestrator"
  description: "Initiates the annual compensation review by pulling headcount data from Workday, generating salary band analysis in Snowflake, publishing results to Power BI, and notifying HR leadership via Teams."
  tags:
    - hr
    - workday
    - snowflake
    - power-bi
    - microsoft-teams
    - compensation
capability:
  exposes:
    - type: mcp
      namespace: hr
      port: 8080
      tools:
        - name: trigger-comp-review
          description: "Given a review cycle year and business unit, pull Workday headcount, run Snowflake salary analytics, refresh Power BI compensation dashboard, and notify HR leadership."
          inputParameters:
            - name: review_year
              in: body
              type: string
              description: "The compensation review year, e.g. 2026."
            - name: business_unit
              in: body
              type: string
              description: "The business unit code, e.g. AERO."
          steps:
            - name: get-headcount
              type: call
              call: workday.get-headcount
              with:
                business_unit: "{{business_unit}}"
                as_of_date: "{{review_year}}-01-01"
            - name: run-analysis
              type: call
              call: snowflake.run-query
              with:
                query: "CALL comp_review_analysis('{{business_unit}}', '{{review_year}}')"
            - name: refresh-dashboard
              type: call
              call: powerbi.refresh-dataset
              with:
                dataset_id: "comp-review-{{business_unit}}"
            - name: notify-hr
              type: call
              call: msteams.post-message
              with:
                channel_id: "hr-leadership"
                text: "{{review_year}} compensation review for {{business_unit}} ready. Headcount: {{get-headcount.total}}. Dashboard refreshed."
  consumes:
    - type: http
      namespace: workday
      baseUri: "https://wd2-impl-services1.workday.com/ccx/api/v1"
      authentication:
        type: bearer
        token: "$secrets.workday_token"
      resources:
        - name: headcount
          path: "/lockheed-martin/workers?business_unit={{business_unit}}"
          inputParameters:
            - name: business_unit
              in: path
          operations:
            - name: get-headcount
              method: GET
    - type: http
      namespace: snowflake
      baseUri: "https://lockheedmartin.snowflakecomputing.com/api/v2"
      authentication:
        type: bearer
        token: "$secrets.snowflake_token"
      resources:
        - name: statements
          path: "/statements"
          operations:
            - name: run-query
              method: POST
    - type: http
      namespace: powerbi
      baseUri: "https://api.powerbi.com/v1.0/myorg"
      authentication:
        type: bearer
        token: "$secrets.powerbi_token"
      resources:
        - name: datasets
          path: "/datasets/{{dataset_id}}/refreshes"
          inputParameters:
            - name: dataset_id
              in: path
          operations:
            - name: refresh-dataset
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

During open enrollment, pulls eligible employees from Workday, sends enrollment reminders via Teams, tracks completion in Jira, and generates a compliance report in Power BI.

naftiko: "0.5"
info:
  label: "Workday Benefits Enrollment Orchestrator"
  description: "During open enrollment, pulls eligible employees from Workday, sends enrollment reminders via Teams, tracks completion in Jira, and generates a compliance report in Power BI."
  tags:
    - hr
    - workday
    - jira
    - microsoft-teams
    - power-bi
    - benefits
capability:
  exposes:
    - type: mcp
      namespace: hr
      port: 8080
      tools:
        - name: trigger-enrollment-reminders
          description: "Given a benefits enrollment period and business unit, pull eligible employees from Workday, send reminders via Teams, track in Jira, and refresh the Power BI report."
          inputParameters:
            - name: enrollment_period
              in: body
              type: string
              description: "The enrollment period label, e.g. OE-2026."
            - name: business_unit
              in: body
              type: string
              description: "The business unit code."
          steps:
            - name: get-eligible
              type: call
              call: workday.get-benefits-eligible
              with:
                business_unit: "{{business_unit}}"
            - name: send-reminders
              type: call
              call: msteams.post-message
              with:
                channel_id: "hr-benefits"
                text: "Open enrollment {{enrollment_period}}: {{get-eligible.pending_count}} employees have not yet enrolled in {{business_unit}}."
            - name: create-tracker
              type: call
              call: jira.create-issue
              with:
                project: "HR"
                summary: "Benefits enrollment tracking: {{enrollment_period}} - {{business_unit}}"
            - name: refresh-report
              type: call
              call: powerbi.refresh-dataset
              with:
                dataset_id: "benefits-enrollment"
  consumes:
    - type: http
      namespace: workday
      baseUri: "https://wd2-impl-services1.workday.com/ccx/api/v1"
      authentication:
        type: bearer
        token: "$secrets.workday_token"
      resources:
        - name: benefits
          path: "/lockheed-martin/benefits/eligible?business_unit={{business_unit}}"
          inputParameters:
            - name: business_unit
              in: path
          operations:
            - name: get-benefits-eligible
              method: GET
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST
    - type: http
      namespace: jira
      baseUri: "https://lockheedmartin.atlassian.net/rest/api/3"
      authentication:
        type: bearer
        token: "$secrets.jira_token"
      resources:
        - name: issues
          path: "/issue"
          operations:
            - name: create-issue
              method: POST
    - type: http
      namespace: powerbi
      baseUri: "https://api.powerbi.com/v1.0/myorg"
      authentication:
        type: bearer
        token: "$secrets.powerbi_token"
      resources:
        - name: datasets
          path: "/datasets/{{dataset_id}}/refreshes"
          inputParameters:
            - name: dataset_id
              in: path
          operations:
            - name: refresh-dataset
              method: POST

When a contractor is converted to full-time in Workday, provisions permanent Okta credentials, updates ServiceNow CMDB records, and initiates the security clearance process via Teams notification to FSO.

naftiko: "0.5"
info:
  label: "Workday Contractor to Employee Conversion Orchestrator"
  description: "When a contractor is converted to full-time in Workday, provisions permanent Okta credentials, updates ServiceNow CMDB records, and initiates the security clearance process via Teams notification to FSO."
  tags:
    - hr
    - workday
    - okta
    - servicenow
    - microsoft-teams
    - security-clearance
capability:
  exposes:
    - type: mcp
      namespace: hr
      port: 8080
      tools:
        - name: trigger-contractor-conversion
          description: "Given a Workday worker ID for a contractor-to-employee conversion, provision permanent Okta identity, update CMDB records, and notify FSO to initiate clearance processing."
          inputParameters:
            - name: worker_id
              in: body
              type: string
              description: "The Workday worker ID being converted."
            - name: target_clearance
              in: body
              type: string
              description: "Target clearance level for the converted employee."
          steps:
            - name: get-worker
              type: call
              call: workday.get-worker
              with:
                worker_id: "{{worker_id}}"
            - name: provision-okta
              type: call
              call: okta.create-user
              with:
                email: "{{get-worker.work_email}}"
                first_name: "{{get-worker.first_name}}"
                last_name: "{{get-worker.last_name}}"
            - name: update-cmdb
              type: call
              call: servicenow.update-ci
              with:
                user_email: "{{get-worker.work_email}}"
                employment_type: "FTE"
            - name: notify-fso
              type: call
              call: msteams.post-message
              with:
                channel_id: "fso-operations"
                text: "Contractor conversion: {{get-worker.full_name}} to FTE. Target clearance: {{target_clearance}}. Okta provisioned."
  consumes:
    - type: http
      namespace: workday
      baseUri: "https://wd2-impl-services1.workday.com/ccx/api/v1"
      authentication:
        type: bearer
        token: "$secrets.workday_token"
      resources:
        - name: workers
          path: "/lockheed-martin/workers/{{worker_id}}"
          inputParameters:
            - name: worker_id
              in: path
          operations:
            - name: get-worker
              method: GET
    - type: http
      namespace: okta
      baseUri: "https://lockheedmartin.okta.com/api/v1"
      authentication:
        type: bearer
        token: "$secrets.okta_token"
      resources:
        - name: users
          path: "/users"
          operations:
            - name: create-user
              method: POST
    - type: http
      namespace: servicenow
      baseUri: "https://lockheedmartin.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.snow_user"
        password: "$secrets.snow_password"
      resources:
        - name: cmdb
          path: "/table/cmdb_ci"
          operations:
            - name: update-ci
              method: PATCH
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Retrieves an employee profile from Workday by worker ID, returning name, title, department, clearance status, and manager for HR and program staffing inquiries.

naftiko: "0.5"
info:
  label: "Workday Employee Profile Lookup"
  description: "Retrieves an employee profile from Workday by worker ID, returning name, title, department, clearance status, and manager for HR and program staffing inquiries."
  tags:
    - hr
    - workday
    - program-management
    - staffing
capability:
  exposes:
    - type: mcp
      namespace: hr
      port: 8080
      tools:
        - name: get-employee-profile
          description: "Given a Workday worker ID, return employee name, job title, department, security clearance level, and direct manager. Use for program staffing verification and org chart queries."
          inputParameters:
            - name: worker_id
              in: body
              type: string
              description: "The Workday worker ID."
          call: workday.get-worker
          with:
            worker_id: "{{worker_id}}"
          outputParameters:
            - name: full_name
              type: string
              mapping: "$.worker.full_name"
            - name: job_title
              type: string
              mapping: "$.worker.job_title"
            - name: department
              type: string
              mapping: "$.worker.department"
            - name: clearance_level
              type: string
              mapping: "$.worker.clearance_level"
  consumes:
    - type: http
      namespace: workday
      baseUri: "https://wd2-impl-services1.workday.com/ccx/api/v1"
      authentication:
        type: bearer
        token: "$secrets.workday_token"
      resources:
        - name: workers
          path: "/lockheed-martin/workers/{{worker_id}}"
          inputParameters:
            - name: worker_id
              in: path
          operations:
            - name: get-worker
              method: GET

Retrieves active employee headcount grouped by program code and cost center from Workday to support DCAA labor cost allocation and government contract compliance reporting.

naftiko: "0.5"
info:
  label: "Workday Headcount Snapshot for DCAA Compliance"
  description: "Retrieves active employee headcount grouped by program code and cost center from Workday to support DCAA labor cost allocation and government contract compliance reporting."
  tags:
    - hr
    - finance
    - workday
    - compliance
    - dcaa
    - headcount
capability:
  exposes:
    - type: mcp
      namespace: hr-compliance
      port: 8080
      tools:
        - name: get-program-headcount
          description: "Return active employee headcount grouped by program code and cost center from Workday. Used for DCAA labor cost allocation, indirect rate calculations, and government contract workforce reporting."
          call: workday.get-headcount
          outputParameters:
            - name: employees
              type: array
              mapping: "$.data"
            - name: total_count
              type: number
              mapping: "$.total"
  consumes:
    - type: http
      namespace: workday
      baseUri: "https://wd2-impl-services1.workday.com/ccx/api/v1"
      authentication:
        type: bearer
        token: "$secrets.workday_token"
      resources:
        - name: workers
          path: "/lockheed-martin/workers"
          operations:
            - name: get-headcount
              method: GET

When an engineering or program job requisition is approved in Workday, creates a Jira tracking issue for the program hiring team and notifies the HR and program management Teams channels.

naftiko: "0.5"
info:
  label: "Workday Job Requisition to Jira Program Tracker"
  description: "When an engineering or program job requisition is approved in Workday, creates a Jira tracking issue for the program hiring team and notifies the HR and program management Teams channels."
  tags:
    - hr
    - recruiting
    - workday
    - jira
    - microsoft-teams
    - engineering
capability:
  exposes:
    - type: mcp
      namespace: recruiting-ops
      port: 8080
      tools:
        - name: sync-requisition-to-jira
          description: "Given a Workday job requisition ID for a cleared or program engineering role, create a Jira task for the hiring team and notify the HR and program Teams channels. Invoke when an approved requisition is confirmed in Workday."
          inputParameters:
            - name: requisition_id
              in: body
              type: string
              description: "The Workday job requisition ID."
            - name: program_code
              in: body
              type: string
              description: "The associated program code for Jira project routing, e.g. F35."
          steps:
            - name: get-requisition
              type: call
              call: workday.get-requisition
              with:
                requisition_id: "{{requisition_id}}"
            - name: create-jira-task
              type: call
              call: jira.create-issue
              with:
                project_key: "HR"
                issuetype: "Task"
                summary: "Hire: {{get-requisition.job_title}} — Program {{program_code}}"
                description: "Req {{requisition_id}}: {{get-requisition.job_title}} | Clearance: {{get-requisition.clearance_required}} | Target: {{get-requisition.target_hire_date}}"
            - name: notify-hr
              type: call
              call: msteams.post-message
              with:
                channel_id: "$secrets.teams_hr_channel_id"
                text: "Req approved: {{get-requisition.job_title}} [{{program_code}}] | Jira: {{create-jira-task.key}} | Clearance: {{get-requisition.clearance_required}}"
  consumes:
    - type: http
      namespace: workday
      baseUri: "https://wd2-impl-services1.workday.com/ccx/api/v1"
      authentication:
        type: bearer
        token: "$secrets.workday_token"
      resources:
        - name: requisitions
          path: "/lockheed-martin/recruiting/jobRequisitions/{{requisition_id}}"
          inputParameters:
            - name: requisition_id
              in: path
          operations:
            - name: get-requisition
              method: GET
    - type: http
      namespace: jira
      baseUri: "https://lockheed-martin.atlassian.net/rest/api/3"
      authentication:
        type: basic
        username: "$secrets.jira_user"
        password: "$secrets.jira_api_token"
      resources:
        - name: issues
          path: "/issue"
          operations:
            - name: create-issue
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: channel-messages
          path: "/teams/{{channel_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Checks Workday Learning for overdue mandatory training assignments, creates ServiceNow compliance tickets for non-compliant employees, and sends escalation notifications to managers via Teams.

naftiko: "0.5"
info:
  label: "Workday Learning Compliance Tracker"
  description: "Checks Workday Learning for overdue mandatory training assignments, creates ServiceNow compliance tickets for non-compliant employees, and sends escalation notifications to managers via Teams."
  tags:
    - compliance
    - workday
    - servicenow
    - microsoft-teams
    - training
capability:
  exposes:
    - type: mcp
      namespace: compliance
      port: 8080
      tools:
        - name: trigger-training-compliance
          description: "Given a training course ID and compliance deadline, check for overdue completions in Workday Learning, create ServiceNow tickets, and notify managers of non-compliant employees."
          inputParameters:
            - name: course_id
              in: body
              type: string
              description: "The Workday Learning course ID."
            - name: deadline
              in: body
              type: string
              description: "Compliance deadline in YYYY-MM-DD format."
          steps:
            - name: get-overdue
              type: call
              call: workday.get-learning-assignments
              with:
                course_id: "{{course_id}}"
                status: "overdue"
            - name: create-tickets
              type: call
              call: servicenow.create-incident
              with:
                short_description: "Overdue training: {{course_id}} - {{get-overdue.overdue_count}} employees"
                category: "compliance"
            - name: notify-managers
              type: call
              call: msteams.post-message
              with:
                channel_id: "manager-alerts"
                text: "Training compliance alert: {{get-overdue.overdue_count}} employees overdue for course {{course_id}}. Deadline: {{deadline}}. Ticket: {{create-tickets.number}}."
  consumes:
    - type: http
      namespace: workday
      baseUri: "https://wd2-impl-services1.workday.com/ccx/api/v1"
      authentication:
        type: bearer
        token: "$secrets.workday_token"
      resources:
        - name: learning
          path: "/lockheed-martin/learning/assignments?course={{course_id}}"
          inputParameters:
            - name: course_id
              in: path
          operations:
            - name: get-learning-assignments
              method: GET
    - type: http
      namespace: servicenow
      baseUri: "https://lockheedmartin.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.snow_user"
        password: "$secrets.snow_password"
      resources:
        - name: incidents
          path: "/table/incident"
          operations:
            - name: create-incident
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

When an organization restructure is approved in Workday, updates Okta group memberships, refreshes ServiceNow CMDB org structures, and notifies affected managers via Teams.

naftiko: "0.5"
info:
  label: "Workday Organization Restructure Propagator"
  description: "When an organization restructure is approved in Workday, updates Okta group memberships, refreshes ServiceNow CMDB org structures, and notifies affected managers via Teams."
  tags:
    - hr
    - workday
    - okta
    - servicenow
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: hr
      port: 8080
      tools:
        - name: trigger-org-restructure
          description: "Given a Workday organization change event ID, propagate changes to Okta groups, update ServiceNow org structures, and notify affected managers."
          inputParameters:
            - name: org_change_id
              in: body
              type: string
              description: "The Workday organization change event ID."
          steps:
            - name: get-org-change
              type: call
              call: workday.get-org-change
              with:
                change_id: "{{org_change_id}}"
            - name: update-okta-groups
              type: call
              call: okta.update-groups
              with:
                org_unit: "{{get-org-change.new_org_unit}}"
                members: "{{get-org-change.affected_workers}}"
            - name: update-cmdb
              type: call
              call: servicenow.update-ci
              with:
                org_unit: "{{get-org-change.new_org_unit}}"
            - name: notify-managers
              type: call
              call: msteams.post-message
              with:
                channel_id: "hr-org-changes"
                text: "Organization restructure: {{get-org-change.description}}. Affected workers: {{get-org-change.worker_count}}. Okta and CMDB updated."
  consumes:
    - type: http
      namespace: workday
      baseUri: "https://wd2-impl-services1.workday.com/ccx/api/v1"
      authentication:
        type: bearer
        token: "$secrets.workday_token"
      resources:
        - name: org-changes
          path: "/lockheed-martin/organizationChanges/{{change_id}}"
          inputParameters:
            - name: change_id
              in: path
          operations:
            - name: get-org-change
              method: GET
    - type: http
      namespace: okta
      baseUri: "https://lockheedmartin.okta.com/api/v1"
      authentication:
        type: bearer
        token: "$secrets.okta_token"
      resources:
        - name: groups
          path: "/groups"
          operations:
            - name: update-groups
              method: PUT
    - type: http
      namespace: servicenow
      baseUri: "https://lockheedmartin.service-now.com/api/now"
      authentication:
        type: basic
        username: "$secrets.snow_user"
        password: "$secrets.snow_password"
      resources:
        - name: cmdb
          path: "/table/cmdb_ci"
          operations:
            - name: update-ci
              method: PATCH
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

Initiates the annual engineering performance review cycle in Workday for all program-aligned engineers and sends kickoff reminders to engineering managers via Teams.

naftiko: "0.5"
info:
  label: "Workday Performance Review Cycle for Engineers"
  description: "Initiates the annual engineering performance review cycle in Workday for all program-aligned engineers and sends kickoff reminders to engineering managers via Teams."
  tags:
    - hr
    - performance-management
    - workday
    - microsoft-teams
    - engineering
capability:
  exposes:
    - type: mcp
      namespace: hr-performance
      port: 8080
      tools:
        - name: launch-engineering-review-cycle
          description: "Given a review cycle name and due date, initiate the Workday performance review process for engineering populations and notify engineering managers via Teams. Use at the start of the annual performance cycle."
          inputParameters:
            - name: cycle_name
              in: body
              type: string
              description: "Name of the performance review cycle, e.g. 2025 Engineering Annual Review."
            - name: due_date
              in: body
              type: string
              description: "Review completion deadline in YYYY-MM-DD format."
          steps:
            - name: start-cycle
              type: call
              call: workday.create-review-cycle
              with:
                name: "{{cycle_name}}"
                dueDate: "{{due_date}}"
                population: "engineering"
            - name: notify-managers
              type: call
              call: msteams.post-message
              with:
                channel_id: "$secrets.teams_engineering_channel_id"
                text: "Engineering Performance Review '{{cycle_name}}' launched in Workday. Complete reviews by {{due_date}}."
  consumes:
    - type: http
      namespace: workday
      baseUri: "https://wd2-impl-services1.workday.com/ccx/api/v1"
      authentication:
        type: bearer
        token: "$secrets.workday_token"
      resources:
        - name: review-cycles
          path: "/lockheed-martin/performanceManagement/reviewCycles"
          operations:
            - name: create-review-cycle
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: channel-messages
          path: "/teams/{{channel_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST

When a new job requisition is approved in Workday, creates a LinkedIn job posting, generates a Jira recruiting task, and notifies the talent acquisition team via Teams.

naftiko: "0.5"
info:
  label: "Workday Requisition to LinkedIn Job Posting"
  description: "When a new job requisition is approved in Workday, creates a LinkedIn job posting, generates a Jira recruiting task, and notifies the talent acquisition team via Teams."
  tags:
    - talent-acquisition
    - workday
    - linkedin
    - jira
    - microsoft-teams
capability:
  exposes:
    - type: mcp
      namespace: talent-acquisition
      port: 8080
      tools:
        - name: trigger-job-posting
          description: "Given a Workday requisition ID, create a LinkedIn job posting, generate a Jira recruiting task, and notify the talent acquisition team."
          inputParameters:
            - name: requisition_id
              in: body
              type: string
              description: "The Workday job requisition ID."
          steps:
            - name: get-requisition
              type: call
              call: workday.get-requisition
              with:
                requisition_id: "{{requisition_id}}"
            - name: post-linkedin
              type: call
              call: linkedin.create-job
              with:
                title: "{{get-requisition.job_title}}"
                location: "{{get-requisition.location}}"
            - name: create-jira-task
              type: call
              call: jira.create-issue
              with:
                project: "RECRUIT"
                summary: "Recruiting: {{get-requisition.job_title}} ({{get-requisition.location}})"
            - name: notify-ta
              type: call
              call: msteams.post-message
              with:
                channel_id: "talent-acquisition"
                text: "New posting: {{get-requisition.job_title}} in {{get-requisition.location}}. Jira: {{create-jira-task.key}}."
  consumes:
    - type: http
      namespace: workday
      baseUri: "https://wd2-impl-services1.workday.com/ccx/api/v1"
      authentication:
        type: bearer
        token: "$secrets.workday_token"
      resources:
        - name: requisitions
          path: "/lockheed-martin/jobRequisitions/{{requisition_id}}"
          inputParameters:
            - name: requisition_id
              in: path
          operations:
            - name: get-requisition
              method: GET
    - type: http
      namespace: linkedin
      baseUri: "https://api.linkedin.com/v2"
      authentication:
        type: bearer
        token: "$secrets.linkedin_token"
      resources:
        - name: jobs
          path: "/simpleJobPostings"
          operations:
            - name: create-job
              method: POST
    - type: http
      namespace: jira
      baseUri: "https://lockheedmartin.atlassian.net/rest/api/3"
      authentication:
        type: bearer
        token: "$secrets.jira_token"
      resources:
        - name: issues
          path: "/issue"
          operations:
            - name: create-issue
              method: POST
    - type: http
      namespace: msteams
      baseUri: "https://graph.microsoft.com/v1.0"
      authentication:
        type: bearer
        token: "$secrets.msgraph_token"
      resources:
        - name: messages
          path: "/teams/{{team_id}}/channels/{{channel_id}}/messages"
          inputParameters:
            - name: channel_id
              in: path
          operations:
            - name: post-message
              method: POST