limacharlie-call

Execute LimaCharlie API operations via dynamically loaded function references.

29|3|Updated Dec 21, 2025
One-click install
npx skills add https://github.com/refractionPOINT/lc-ai --skill limacharlie-call
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: limacharlie-call
Source: https://github.com/refractionPOINT/lc-ai/tree/main/marketplace/plugins/lc-essentials/skills/limacharlie-call
Command: npx skills add https://github.com/refractionPOINT/lc-ai --skill limacharlie-call

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill centralizes LimaCharlie operations by dynamically loading function references and routing calls through the limacharlie-api-executor. It provides a safe, user-level interface to list orgs, sensors, rules, detections, and hundreds of functions without exposing direct MCP calls. The Skill enforces correct OID usage (UUIDs), loads API docs, and loads guidelines via /init-lc before use.

Core Features & Use Cases

  • Load and route LimaCharlie API calls through a single, safe agent
  • Spawn parallel agents for multi-organization operations and aggregate results
  • Access a comprehensive function library (150+ functions) including sensors, outputs, D&R rules, lookups, and more
  • Enforce best practices: never call MCP tools directly, never write LCQL or D&R syntax manually
  • Quick-start conventions: spawn org reporters, generate LCQL queries, validate rules, and deploy

Quick Start

Example: List all accessible organizations and start a parallel data collection job across them.

Frequently Asked Questions about limacharlie-call

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I execute LimaCharlie API operations across multiple organizations?

LimaCharlie API operations execute through dynamically loaded function references routed via limacharlie-api-executor. The Skill spawns parallel sub-agents for multi-organization calls, aggregates results, and returns raw responses or extracted data suitable for downstream processing and RAG pipelines.

Can I automate security workflows and rule deployment with LimaCharlie?

Yes. The Skill accesses 150+ LimaCharlie functions including D&R rules, detections, sensors, and outputs. It enforces best practices by centralizing API calls, validating rules, generating LCQL queries, and deploying configurations without exposing direct MCP calls or manual syntax writing.

What LimaCharlie data sources and operations does this Skill support?

The Skill supports orgs, sensors, outputs, secrets, detections, rules, and 120+ functions across LimaCharlie LCQL, IOCs, and live/historical data workflows. It loads API docs and guidelines via /init-lc before use and enforces correct OID usage as UUIDs.

How do I aggregate security data across multiple LimaCharlie tenants?

Spawn parallel agents for multi-organization operations through the Skill's centralized interface. It routes calls safely, aggregates results from multiple orgs, and returns structured data ready for analysis, reporting, or RAG pipeline ingestion without direct API exposure.

Does this work with existing LimaCharlie deployments and detections?

Yes. The Skill integrates with live LimaCharlie deployments, accessing existing orgs, sensors, rules, and detections. It loads comprehensive function references, enforces best practices for API interaction, and enables safe orchestration of detection-and-response workflows without manual syntax.