Skip to content
CISO Marketplace Services
Scope an engagement
Offensive SecurityAI SecurityAI ServicesProgramServicesMembershipAgentsBook a scoping call

For AI agents

One front door, whether a person, their agent, or another AI is asking.

Four MCP servers on one login and one wallet let an agent assess, investigate an indicator, remediate and buy, and research compliance, and price the fix from the same evidence our team quotes from. Every engagement still ends with a practitioner.

Connect an agent →Membership: agent runs included

Three doors, one pipeline

However the request arrives, it lands in the same place.

Human

A person

Scope an engagement, share an RFP or book a call. A practitioner answers.

Scope an engagementBook a call
Agent

An agent acting for a person

Connect one of our MCP servers. The agent signs in as the buyer, reads the catalog, works out what the buyer needs, sizes and prices the work with the same engine this website uses, and drafts a proposal or hands the scope to a practitioner.

Connect an agent
AI → AI

Another AI or crawler

Machine-readable catalog, per-service markdown and plain-text context, with no sign-in needed to read.

services.jsonllms.txt

4 MCP servers · live

Assess → investigate → remediate & buy → research & comply.

One identity (id.cisomarketplace.com), one wallet, one reports store. The servers don't call each other; the agent uses whichever are connected.

assess

Micro-Sec Tools

https://mcp.microsec.tools/mcp

Run the security tools, save results to your reports, surface what to buy to fix the gaps, and price the fix — from the guide, or sized exactly with the same numbers engine the website uses (estimate_scope).

  • list_tools
  • run_tool
  • get_report
  • check_balance
  • save_report
  • list_reports
  • read_report
  • find_remediation
  • get_price_guide
  • estimate_scope
  • submit_quote
  • request_proposal_update

investigate

IOC Desk

https://ioc-mcp.cisomarketplace.com/mcp

Passive threat-intel lookups: a verdict (Malicious, Suspicious, Benign or Unknown) with cited evidence and a next step for a suspicious email, a file hash, an IP or a domain/URL. Nothing is scanned, visited or opened. Priced per door (1–3 credits; list_doors has the prices); findings stay on your IOC Desk.

  • check_email
  • check_file
  • check_ip
  • check_domain
  • get_finding
  • list_findings
  • list_doors
  • check_balance

remediate & buy

CISO Marketplace Concierge

https://mcp.cisomarketplace.com/mcp

Membership, all your reports, the 170+ services, vendor sourcing, policy packs and DIY workbooks, Cipher answers, member deals, the price guide, scope estimates from the website's numbers engine, a needs analysis (what they asked for vs what they need vs what rules apply), proposal drafting, and recording a scope for a practitioner.

  • membership_status
  • browse_tools
  • list_reports
  • read_report
  • save_report
  • list_proposals
  • find_remediation
  • list_services
  • get_service
  • get_price_guide
  • estimate_scope
  • analyse_needs
  • submit_scope
  • start_proposal
  • request_proposal_update
  • list_coupons
  • list_policies
  • list_templates
  • recommend_compliance
  • ask_cipher
  • submit_support_ticket
  • submit_bug_bounty

research & comply

Compliance Intelligence

https://mcp.compliancehub.wiki/mcp

Semantic search over the compliance knowledge base (1,000+ templates, 320+ tracked regulations with AI-researched analysis), jurisdiction comparison, gap checks mapped to templates & services, the needs analysis (which rules apply on what the buyer said, with the same rules as the website), and an indicative price or an engine estimate for the done-for-you work. Members unlimited; metered by credits otherwise.

  • search_compliance_knowledge
  • lookup_regulations
  • compare_jurisdictions
  • compliance_gap_check
  • analyse_needs
  • find_templates
  • list_services
  • get_price_guide
  • estimate_scope
  • submit_quote
  • request_proposal_update
  • membership_status
  • save_report
  • list_reports
  • read_report

Connect

Two ways to plug an agent in.

Claude.ai and other OAuth clients

  1. Settings → Connectors → Add custom connector.
  2. Paste one of the /mcp URLs above.
  3. Sign in once with your CISO Marketplace account. It registers itself: no API key, no client ID.

Claude Desktop, Cursor, or your own always-on agent

Mint a key while signed in, then send it as a Bearer token. The agent acts as you, on your wallet, within the spend cap you set.

curl -X POST https://pay.cisomarketplace.com/api/v1/keys \
  -H "Authorization: Bearer <your id.cisomarketplace.com token>" \
  -d '{ "label": "my-agent", "spend_cap_cents": 5000 }'
# → { "key": "csm_sk_live_…" }  shown once, store it

# then, on any MCP server:
Authorization: Bearer csm_sk_live_…

Run the AI services

The same reports, from an agent.

Security Check, SOW and contract review, AI vendor due diligence, questionnaire answers, policy drafts and board summaries run through Micro-Sec Tools on the buyer's wallet, included for members. Each runs in the background: run_tool queues it, get_report waits for the finished report. A failed run is refunded.

run_tool   { "slug": "ai-sow-review", "inputs": { "sow_text": "…" } }
→ { "run_id": "…", "status": "queued" }

get_report { "run_id": "…", "wait_seconds": 45 }
→ { "status": "succeeded", "report_markdown": "# SOW review: …" }

Scope and price the fix

Agents quote from evidence, not guesses.

analyse_needs says what the buyer needs and which rules apply, from their answers. estimate_scope sizes the services against our published tiers and approved rates, giving the same lines and range as the website. get_price_guide gives the market band for a service family. submit_scope hands the scope to a practitioner exactly like the website's doors; start_proposal drafts into the buyer's pipeline.

analyse_needs   { "door": "compliance", "org": { "employees_band": "100-249", "regions": ["us"] },
                  "answers": { "data": ["phi"], "activities": ["business_associate"] } }
→ needs, required (HIPAA: required), not_needed, ladder.lead

estimate_scope  { "items": [{ "service_slug": "hipaa-hitech-compliance-assessment",
                               "counts": { "employees": 180 } }] }
→ lines, range, basis   (the website's receipt figures)

submit_scope    { …the same scope, "contact": {…}, "consent": true }
→ ref + receipt link    (a practitioner replies)

Guardrails

Agents never set a price.
Estimates come from our published tiers and approved rates, the same figures a website receipt shows. Quotes are indicative: the hub checks each against the price guide; inside the range it is accepted, outside it goes to a person, far outside it is refused and nothing is written.
One answer, wherever the buyer asks.
estimate_scope and analyse_needs run the website's own numbers engine and needs rules, so an agent and the scoping pages give the same figures and the same advice. No model picks the services or the price.
Nothing starts without a person.
Drafts, quotes and change requests land in our CRM as records for a practitioner. No engagement, contract or charge is created by an agent.
Same answer for every role.
An admin's token gets exactly what a member's gets. Agent routes never read privileged pricing.
Fixed-scope services only.
Retainers, sponsorships and custom programs always go to a person.

AI → AI

Machine-readable, no sign-in to read.

Crawlers, answer engines and other agents can read the whole catalog directly. Prices here are the published starting prices; a proposal fixes the final one.

/services.jsonEvery service: published starting price, tiers with includes, excludes and limits, scope, deliverables.
/services/<slug>.mdOne service as clean markdown, linked from each service page.
/llms.txtSite map for language models.
/llms-full.txtThe full catalog as text.
/ai.txtPermissions, identity and the rules for agents.
pay.cisomarketplace.com/api/v1/mcp-manifestThe canonical list of MCP servers and their tools.

Membership

Members run the metered tools free, and the Practice license adds agent API and MCP keys on a pooled wallet.

See membership →

Start an engagement

Four ways in. One practitioner-led team on the other side.

Not sureNot sure what you need?Six plain-language questions, about ninety seconds. A person tells you what it actually is, including when you need less than you feared.ScopeScope it yourselfAnswer structured questions about what to cover and how big it is, and see an indicative range as soon as you send it.TalkBook a scoping callA conversation with a practitioner to shape the engagement before you commit to anything.RFPSend us your RFPAlready have an RFP, RFQ or statement of work? Share it and we'll respond to your format.
Talk to an advisor
Advisor