There's a better way
The Old Way
- Hardcode the token in a skill file and it lives in git forever
- Read it from a shell variable and it only works on that one machine
- Nothing fires from the web app, the phone, or another routine
- No record of whether the thing you triggered actually ran
The BlackOps Way
- The token is stored server-side once, encrypted at rest
- Any surface that can call the MCP can fire the action
- Headers transcribed from the endpoint, so any webhook works
- Armed, Fired, Returned, Failed, visible in the UI
Why Sorties?
The orchestration layer. Brains store knowledge, notes capture artifacts, sorties fire actions.
The secret never travels
Tokens are encrypted at rest and decrypted only at the moment of firing. They never reach the conversation, a skill file, a client, or a repo, and they are never returned.
Endpoint agnostic
Headers are configured as JSON, transcribed from the endpoint own example. BlackOps adds no vendor-specific magic, so anything that takes an HTTPS request works.
Fire from any surface
Any Claude surface that can reach the BlackOps MCP can fire the action by name. Desktop, web, mobile, another skill, or a scheduled routine.
Visible lifecycle
Armed, Fired, Returned, Failed. You can see whether the thing you triggered actually landed instead of hoping it did.
How It Works
Register it once
Give the sortie a fire URL, the headers the endpoint expects, an optional token, and a default JSON payload. The token goes in with a placeholder, never in the clear.
Fire it by name
One MCP call from whatever session you are in. Pass a payload to override the default, or pass none and take it as configured.
Watch the status
The sortie reports back what happened upstream. Claude Code Routines are first class; Zapier, n8n, GitHub Actions repo dispatch, or your own server work the same way.