* feat: add prospecting skill + truelist integration
New skill: skills/prospecting/
- SKILL.md (251 lines, well under 500 limit): branch picker for SaaS / B2B /
Local SMB, shared 5-phase framework (ICP -> discovery -> qualify -> score ->
output), compliance guardrails, tool selection quick-picks, output formats
- references/saas-prospecting.md: tech stack signals, funding/hiring triggers,
SaaS-specific sources and qualification
- references/b2b-prospecting.md: industry/firmographic signals, trigger events,
decision-maker mapping, B2B-specific sources
- references/local-prospecting.md: 4-tier website status classification,
browser-assisted research workflow (generalized from the local-client-
prospector pattern), proximity scoring
- references/data-sources.md: deep dives on Apollo, Clay, ZoomInfo, Clearbit,
Hunter, Snov, Truelist, LinkedIn Sales Nav, BuiltWith, Crunchbase, RB2B,
with sequencing recommendations across the three branches
- references/compliance.md: CAN-SPAM, GDPR, CASL, platform ToS (LinkedIn,
Google Maps, Apollo/ZI/Clearbit), anti-patterns, audit checklist
- evals/evals.json: 6 evals (2 SaaS, 2 B2B, 1 Local SMB, 1 deliverability)
New integration:
- tools/integrations/truelist.md: email deliverability validation
(Deliverable / Risky / Undeliverable / Unknown classification)
Registry + marketplace wiring:
- tools/REGISTRY.md: truelist row + new Email Verification category section
- .claude-plugin/marketplace.json: bumped to 2.1.0, prospecting added to
plugin description
- VERSIONS.md: prospecting 1.0.0 + 2.1.0 changelog entry
- README.md: skill table re-synced, prospecting added to ASCII flow under
Sales & GTM column
All 41 skills pass validation. sync-skills.js is idempotent.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* feat(prospecting): add GitHub stargazers/forks/watchers as discovery channel
Net-new in this commit:
- tools/clis/github-prospects.js: zero-dep Node CLI with commands
stargazers / forks / watchers / user / rate-limit. Pagination via Link header,
optional --enrich for full profile data, --with-email / --with-company /
--with-blog filters, --format csv|json output, --dry-run preview. Uses
GITHUB_TOKEN for 5000/hr rate limit (vs 60/hr unauthenticated).
- tools/integrations/github.md: integration guide covering auth, rate limits,
endpoints, workflows for SaaS prospecting, compliance notes (public API, not
scraping), CLI reference.
Skill updates:
- skills/prospecting/SKILL.md: added GitHub to the tool selection quick picks
and to the tool integrations table.
- skills/prospecting/references/saas-prospecting.md: added GitHub to Tier 3
buying signals plus a dedicated "GitHub prospecting pattern (when audience
is developers)" subsection with end-to-end workflow.
- skills/prospecting/references/data-sources.md: added GitHub deep-dive
section between RB2B and Free fallbacks.
Registry:
- tools/REGISTRY.md: github row in Tool Index, new Developer Intent / GitHub
category section.
All 41 skills still pass validation. sync-skills.js still no-op.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* refactor(prospecting): apply review suggestions
CLI hardening + optimization:
- github-prospects.js: encodeURIComponent on username path interpolation
(defense in depth; GitHub usernames are restricted enough that this is safe
in practice, but good hygiene).
- github-prospects.js: refactored enrichUsers to filter inline and support
--target N early termination. Previously, --with-email on a 1000-star repo
would enrich all 1000 users before filtering down to the ~50 that match.
Now you can pass --target 25 to stop as soon as 25 matches are found,
saving API quota on restrictive filters.
- github.md: documented the new --target flag.
Reverse cross-references (so prospecting is discoverable from sibling skills):
- cold-email: added prospecting as the natural upstream skill
- customer-research: added "Translating customer research into an ICP for
outbound" hand-off to prospecting
- competitor-profiling: distinguished from prospecting ("this skill does deep
research on specific accounts; prospecting builds the initial list")
All 41 skills still pass validation. sync-skills.js still no-op.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(truelist): align integration doc with actual OpenAPI spec
Source of truth: Truelist-Labs/truelist-openapi (OpenAPI 3.1).
The earlier integration doc had inferred (and wrong) endpoint paths, request
shapes, and status enum values. Corrected against the published spec:
Base URL: https://api.truelist.io
Endpoints (real):
- POST /api/v1/verify_inline?email=... (sync single, email is query param)
- POST /api/v1/verify (async bulk, body: {emails: [...]})
- GET /me (account info)
Real email_state enum:
- ok, email_invalid, risky, unknown, accept_all
(not the inferred "Deliverable / Risky / Undeliverable / Unknown")
Real email_sub_state enum:
- email_ok, is_disposable, is_role, unknown_error, failed_smtp_check
Also corrected:
- Truelist has an official MCP server (Truelist-Labs/truelist-mcp) — was
marked as MCP unavailable
- Truelist has 7 official SDKs (Node, Python, Ruby, PHP, Go, Java, .NET) +
framework integrations (Django, Laravel, Next.js, Rails, React, Svelte,
Vue, WordPress) — was marked as SDK unavailable
- Native integrations with Mailchimp, Klaviyo, HubSpot, Zapier, Make, n8n,
Clay, Salesforce, ActiveCampaign, Brevo, ConvertKit, Drip, BigCommerce,
Go High Level — was unlisted
- Rate limits: 10 req/s per endpoint (was unspecified)
Files updated:
- tools/integrations/truelist.md: full rewrite against spec
- tools/REGISTRY.md: MCP and SDK columns now show ✓ for truelist; classifier
note in the Email Verification section reflects real enum values
- skills/prospecting/evals/evals.json: eval #6 expected_output and assertions
use real email_state values and mention the MCP server
- skills/prospecting/references/data-sources.md: Truelist deep-dive uses real
endpoint paths, real enum values, and lists the MCP/SDK ecosystem
All 41 skills still pass validation. sync-skills.js still no-op.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* feat(prospecting): add Firecrawl + Browserbase for single-target site research
Both tools are programmatic scrapers, but their use in prospecting is
strictly bounded: extract content from individual public business sites
(the prospect's own website URL), never from the platforms hosting them
(Google Maps, LinkedIn, Yelp, Apollo, etc.). This matches the line drawn
by the original local-client-prospector reference skill and our own
compliance section.
New integration docs:
- tools/integrations/firecrawl.md: REST + MCP + SDKs (Node/Python/Go/Rust);
scrape / map / crawl / extract / search endpoints; explicit "when NOT to
use" section listing the prohibited platforms.
- tools/integrations/browserbase.md: real Chromium via Playwright/Puppeteer
or Stagehand (AI-friendly natural-language extraction); session
recordings; useful when rendering or interaction is required.
Prospecting skill updates:
- SKILL.md: added Firecrawl + Browserbase to tool selection quick picks
and tool integrations table.
- references/data-sources.md: new "Firecrawl / Browserbase (single-target
site research)" section between RB2B and Free fallbacks. Includes the
compliance line inline so the framing isn't lost.
- references/local-prospecting.md: optional "programmatic verification"
paragraph in the browser research workflow — once you have a candidate's
URL from manual Maps discovery, you can hit it programmatically.
- references/compliance.md: anti-pattern #1 now explicitly clarifies that
Firecrawl/Browserbase are fine for the prospect's own website but not
for the platforms hosting prospects.
Registry:
- tools/REGISTRY.md: firecrawl + browserbase rows in Tool Index, new "Site
Scraping (single-target only)" category section with the compliance
framing in the agent recommendation.
All 41 skills still pass validation. sync-skills.js still no-op.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Adds Exa as an AI search integration for content research, competitor
discovery, link prospecting, news monitoring, and audience research.
- CLI (tools/clis/exa.js): zero-dep Node.js wrapper for /search,
/findSimilar, and /contents with neural/auto/fast/deep search types,
category + domain + text + date filtering, and composable content
retrieval (text, highlights, summary) in a single request
- Integration guide (tools/integrations/exa.md): auth, endpoints,
common agent operations, parameters, and linked skills
- Registry entry under new 'AI Search' category + MCP-enabled list
- Uses EXA_API_KEY env var with --dry-run support and masked credentials
RankParse is an agent-friendly SEO data API offering backlinks, domain
authority, tech stack, and on-page metadata at credit-based pricing.
- New integration guide: tools/integrations/rankparse.md
- New CLI wrapper: tools/clis/rankparse.js
- Registry entry under SEO category (API + MCP + CLI)
Move Supermetrics API key from query string to x-api-key header.
Mask ZoomInfo JWT by default in auth command (use --show-token to reveal).
Cherry-picked from #201.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The `hooks send` command accepted any user-supplied URL without validation.
This adds an https:// scheme check and a comment clarifying the intended use
(Zapier webhook catch hooks), matching Zapier's own webhook URL format.
Co-Authored-By: Claude Code <noreply@anthropic.com>
New tools: Clay, Outreach, ZoomInfo, Close, Pendo, Similarweb,
Supermetrics, AirOps, Crossbeam, and Coupler.io. Each includes a
zero-dependency Node.js CLI and an integration guide.
Updates REGISTRY.md with new tool index entries, categories, and
MCP-enabled tools list.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- amplitude: mask api_key in dry-run body output
- livestorm: add missing Bearer prefix to Authorization header
- mixpanel: mask token/$token in dry-run ingestion body output
- onesignal: change auth from 'Key' to 'Basic' per OneSignal REST API docs
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Critical:
- meta-ads: move access_token from URL query string to Authorization
header to prevent credential leakage in server logs and referrers
Medium (URL encoding):
- g2: encode state and date filter values
- trustpilot: use URLSearchParams for reviews list params
- typeform: encode response IDs in delete endpoint
- demio: encode event type filter
- lemlist: encode email addresses in URL path segments
Docs:
- Fix 6 missing env vars in CLI README auth table
- Fix .gitignore typo (extra space in .DS_Store pattern)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Expand .gitignore with .env, .DS_Store, node_modules, editor files,
and macOS iCloud duplicate patterns
- Add security section to CLI README warning against hardcoded keys
- Update AGENTS.md with CLI tools in repo structure and build commands
- Trash 40 macOS "2.md" duplicate files from working tree
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- meta-ads: use empty array for special_ad_categories (not ['NONE'])
- ahrefs: add --target validation to all 5 site-explorer commands
- wistia: read SRT file contents from disk for captions create
- tiktok-ads: use URLSearchParams for cleaner URL construction
- mixpanel: require --from-date/--to-date for retention, add --event filter for export
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Fixes from thorough codex review (o3 high reasoning, 5 parallel batches):
Validation fixes:
- customer-io: add ID validation for customer/campaign commands, event name check
- dub: fix links get to use /links/info endpoint, add --id validation
- google-search-console: fix countries to use ['country'] only, add --url validation
- mention-me: add --customer-id validation on referral/share/reward commands
- tolt: add --id validation for affiliates get/update
Auth & API fixes:
- apollo: move API key from header to JSON body, fix search endpoint path
- rewardful: change from Bearer to Basic auth
- hotjar: split OAuth URL (unversioned) from resource URL (v2)
- amplitude: wrap retention e param in JSON array
- snov: change list prospects from GET to POST with JSON body
- optimizely: change archive from DELETE to PATCH status=archived
- google-ads: fix budget body field from camelCase to snake_case
- resend: change webhook field from endpoint to url, add validation
- linkedin-ads: add required campaignGroup URN, fix numeric amount types
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Fixes found by automated codex review of all 47 CLI tools:
- resend: webhook field name endpoint_url -> endpoint
- mailchimp: change from Bearer to Basic auth per API docs
- kit: fail fast when api_secret required but not set
- activecampaign: automation add-contact needs --contact-id not --email
- google-ads: budget updateMask must be snake_case (amount_micros)
- meta-ads: special_ad_categories default to ['NONE'] not empty array
- linkedin-ads: add required X-RestLi-Protocol-Version header
- onesignal: auth prefix should be Key, not Basic
- mixpanel: query dates must be YYYY-MM-DD, not relative strings
- wistia: change from Bearer to Basic auth per API docs
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Adobe Analytics: add required x-proxy-global-company-id header
(Adobe Analytics 2.0 API rejects requests without this header)
- Clearbit: change from Bearer to Basic auth (API key as username)
per Clearbit API documentation
Found by codex review of all 47 CLI tools.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When --dry-run is passed, each CLI prints the HTTP request it would
make (method, URL, headers, body) without actually calling fetch().
Auth credentials are masked as "***" in the output.
Useful for verifying request shape and API endpoints without needing
real API keys or making actual API calls.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add two new SEO tool integrations with zero-dependency CLI tools and
detailed API documentation for agent use.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Single-file Node.js scripts for every tool in the registry that lacked
a CLI. All follow the same pattern: env var auth, JSON output, consistent
`{tool} <resource> <action>` command structure, zero npm dependencies.
CLIs added: resend, sendgrid, mailchimp, kit, customer-io, ahrefs,
semrush, google-search-console, ga4, mixpanel, amplitude, segment,
adobe-analytics, rewardful, tolt, mention-me, dub, google-ads,
meta-ads, linkedin-ads, tiktok-ads, zapier.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Corey Haines