Agentic Skills
A Skill is a packaged analysis workflow built on top of the MCP server. Where the server exposes individual tools for a client to call one at a time, a skill knows which of those tools a specific job needs, in what order, and how to weigh the results, so you can ask a plain question and get back a finished report instead of assembling one yourself from raw calls.
Every skill inherits the server’s read only guarantee. None of them can change anything in your account; they only read data that already exists and reason about it.
Using a skill
A client with both the Safetybits MCP server connected and these skill definitions available picks the right skill on its own from what you ask. You do not need to name one: asking what is going on with your alerts triggers alert triage, and asking which of those alerts you can safely ignore triggers noise reduction instead, even though both start from the same alert data. You can also invoke a skill by name if you want to be explicit about which one runs.
Every skill resolves which account it is working against before pulling any data. If you have access to more than one, it asks which one you mean before continuing.
Alert triage
Pulls the alert groups fired over a time window, the last 24 hours by default, and turns them into a triage report. It consolidates alert groups that share the same rule and resource so a repeat detection reads as one line instead of many, resolves each rule’s name, description and MITRE ATT&CK for ICS mapping, and uses that mapping, not raw occurrence count, to assign each finding a High, Medium or Low severity. Where a finding is ambiguous on its own, it looks up the affected resource or drills into the underlying alerts for more context.
The report opens with an executive summary, then a table of findings per severity tier with links back to each alert group in the console, and closes with an ordered list of recommended next steps.
Invoke it explicitly with /safetybits-alert-triage, or ask about alerts, alarms, or the security status of your OT network in your own words.
Noise reduction
Where alert triage tells you what is happening, noise reduction tells you what is safe to stop looking at. It aggregates alerts by rule rather than by resource, so a single detection firing across many devices reads as one row with an asset count, then makes a per rule call: Ignore, Keep, or Needs review.
The bar for Ignore scales with severity. A High severity finding, one mapped to a tactic such as Command and Control or Initial Access, stays Keep unless the evidence that it is spurious is overwhelming, while a Low severity finding such as expected discovery traffic clears the bar with ordinary supporting evidence. Volume on its own never earns an Ignore. The skill only recommends: there is no tool that changes an alert’s status, so acting on a recommendation still happens in the console.
Invoke it with /safetybits-noise-reduction, or ask which alerts you can dismiss, mute, or tune out.
Vulnerability triage
Pulls current CVE data and correlates severity, the CVSS score, the EPSS exploitation probability, and whether CISA lists the CVE as a known exploited vulnerability, against whether the affected resource actually exposes the vulnerable service and whether traffic to it has actually been observed. A severe CVE for a service the resource does not expose, or exposes but nothing uses, is downgraded in the report with the reasoning stated alongside it. A CVE on the CISA Known Exploited Vulnerabilities list stays High regardless of exposure.
You can scope the report to a whole account overview, a single resource’s full CVE list, or a single CVE’s blast radius across the fleet.
Invoke it with /safetybits-vulnerability-triage, or ask about CVEs, patch status, or exposure.
Zone and conduit segmentation
Turns observed network traffic into a segmentation plan aligned with ISA/IEC-62443. It clusters the traffic it pulls into candidate zones, then overlays each resource’s role, criticality, and safety designation, since the standard groups resources by shared security requirement rather than by who happens to talk to whom. The resulting plan names zones and the conduits between them, flags the separations the standard requires (business networks kept apart from industrial control, safety systems kept apart from everything else, temporary and wireless devices in their own zone, anything reaching an external network called out explicitly), and surfaces smells such as a flat network with no segmentation or a resource that talks straight to the internet.
The skill stops at recommending a design. It never changes a resource, a firewall rule, or a VLAN, and any security level it proposes is preliminary, pending your own detailed risk assessment and sign off.
Ask about segmenting your network, drawing zones and conduits, or applying ISA/IEC 62443 to your architecture, or invoke the skill by name.