{
  "$schema": "https://convoy.security/schemas/agent-manifest.json",
  "name": "Convoy",
  "legalName": "Convoy Security, Inc.",
  "description": "A security platform built on one source of truth. Replaces the SIEM and the tools around it with one platform that detects, investigates and responds across endpoints, identities, email, firewalls, IoT and cloud, worked by Armada, Convoy's AI, and Convoy operators with the customer.",
  "website": "https://convoy.security",
  "llms_txt": "/llms.txt",
  "llms_full_txt": "/llms-full.txt",
  "contact": {
    "briefing": "https://convoy.security/contact",
    "legal": "https://convoy.security/legal/msa"
  },
  "website_tools": {
    "transport": "webmcp",
    "api": "navigator.modelContext / document.modelContext",
    "registered_on": "every page",
    "tools": [
      {
        "name": "convoy_getCompanyOverview",
        "readOnly": true
      },
      {
        "name": "convoy_listProducts",
        "readOnly": true
      },
      {
        "name": "convoy_getProduct",
        "readOnly": true,
        "input": {
          "name": "string"
        }
      },
      {
        "name": "convoy_getAgent",
        "readOnly": true
      },
      {
        "name": "convoy_listIntegrations",
        "readOnly": true
      },
      {
        "name": "convoy_listResponseActions",
        "readOnly": true
      },
      {
        "name": "convoy_listCustomers",
        "readOnly": true,
        "input": {
          "industry": "string (optional)"
        }
      },
      {
        "name": "convoy_getIndustrySolution",
        "readOnly": true,
        "input": {
          "industry": "healthcare | finance | manufacturing | realestate | msp"
        }
      },
      {
        "name": "convoy_getPricingModel",
        "readOnly": true
      },
      {
        "name": "convoy_getSecurityCommitments",
        "readOnly": true
      },
      {
        "name": "convoy_getDeveloperAccess",
        "readOnly": true
      },
      {
        "name": "convoy_getFaq",
        "readOnly": true
      },
      {
        "name": "convoy_getBriefingInfo",
        "readOnly": true
      },
      {
        "name": "convoy_readCurrentPage",
        "readOnly": true
      },
      {
        "name": "convoy_navigate",
        "readOnly": false,
        "input": {
          "page": "home | platform | agent | mcp | solutions | partners | why | resources | trial | company | contact | trust | security"
        }
      },
      {
        "name": "convoy_requestBriefing",
        "readOnly": false,
        "consequential": true,
        "page": "contact",
        "note": "Prefills the briefing form for the visitor; never submits."
      }
    ]
  },
  "product_mcp": {
    "description": "Convoy's MCP server, one per tenant, for operating the platform from any MCP client. Connect with OAuth sign-in or a role-scoped API key from the Convoy console.",
    "auth": "OAuth sign-in or a role-scoped API key",
    "tool_count": "100+",
    "surfaces": [
      "leads",
      "cases",
      "signals",
      "comms",
      "query",
      "posture",
      "detection_rules",
      "automations_and_response",
      "fleet",
      "users"
    ],
    "clients": [
      "any MCP client"
    ]
  },
  "rest_api": {
    "description": "The same surfaces over plain HTTP, with OAuth or an API key and the same permissions as the console.",
    "docs": "https://convoy.security/mcp"
  },
  "webhooks": {
    "description": "Secret-authenticated inbound triggers for Autopilot automations; no API key required."
  },
  "policies": {
    "pricing_published": false,
    "customer_names_public": true,
    "human_in_the_loop": "Consequential website tools request user interaction and never submit on the visitor's behalf."
  }
}