/SecurityMarketData

name: SecurityMarketData
evals:
  manual:
    reason: "Figure fidelity needs each answer compared with the records and metadata the authenticated MCP returned, and no permitted fixture corpus exists yet."
    falsifier: "An answer changes the returned entity, scope, taxonomy or figures; presents a forecast or score as an observed event; invents undisclosed data; or drops returned freshness or quota metadata."
metadata:
  short-description: "Query curated cybersecurity funding, M&A, companies, investors, market maps, and deal activity. Excludes vulnerabilities, security news, and investment advice."
version: 1.1.2
description: Query curated cybersecurity market and company intelligence. USE WHEN security market data OR cybersecurity funding OR cyber M&A OR security-company/investor research OR market maps OR deal activity OR Return on Security OR The Signal. NOT FOR vulnerability research, security news, or investment advice.

SecurityMarketData

Query Return on Security's Signal data through its live MCP interface, with evidence, freshness, and analytical boundaries intact.

Ideal State

• Every answer comes from live Signal records reached through an authenticated `signal-mcp` (or the REST fallback when `ROS_API_KEY` exists), never from scraping, memory or an invented taxonomy.
• A reader can tell observed records from analytical outputs (forecasts, scores, suggestions) and sees the provider's freshness and quota as returned.

Intent Routing

| Intent | Trigger | File | |---|---|---| | **QueryMarket** | Any supported market, company, investor, funding, M&A, or lifecycle query | `Intents/QueryMarket.md` |

| File | Read when | |------|-----------| | `References/ToolCatalog.md` | selecting tools, confirming tiers, or using the REST fallback; not needed for routing | | `Tools/SignalCheck.help.md` | probing setup or checking an answer's Output format parts | | `Setup.md` | first-time setup: connecting `signal-mcp`, the account and OAuth sign-in, and the optional REST key |

Data & Config

Before executing, check `<configRoot>/LIFEOS/USER/CUSTOMIZATIONS/SKILLS/SecurityMarketData/`. If present, load enabled preferences and configuration; otherwise use these defaults. (configRoot is `$CLAUDE_CONFIG_DIR` when set, else `~/.claude`)

First-time setup (the MCP server, the account, the sign-in) is in [Setup.md](Setup.md).

Gotchas

• OAuth 2.1 tokens last 24 hours, so a session that worked yesterday may need the interactive flow again.
• Free access provides 180 calls/day and 12 tools; Pro adds 21 tools; Enterprise adds one.
• `suggest_acquirers`, `forecast_funding`, `exit_score`, and consolidation or growth scores are analytical outputs, not observed facts, even though they come back from the same API.

Examples

• **Funding trend:** “Show quarterly funding trends for cloud security and distinguish observed rounds from forecasts.”

• **Company enrichment:** “Enrich this security company and report its category, funding, investors, lifecycle, and data freshness.”

• **Category M&A:** “Map identity-security M&A activity, acquirers, and observed consolidation signals for the last three years.”