feat(cbinsights): add CB Insights API v2 integration by waleedlatif1 · Pull Request #6879 · simstudioai/sim

waleedlatif1 · 2026-08-20T00:58:53Z

Summary

Adds a CB Insights block backed by 25 tools covering every non-streaming v2 endpoint
Free Look Up Organizations resolves names and domains to org IDs without charging credits, so records can be matched before spending anything
Firmographics search across markets, taxonomy, geography, headcount, funding, and valuation
Financial transactions (fundings + cap tables, investments, portfolio exits), business relationships, and management/board — each in single-org and 100-org bulk form
Outlook: Mosaic Score, Commercial Maturity, and Exit Probability, plus a history operation for each, funding windows, and revenue by year
Strategy maps, AI Scouting Reports, ChatCBI, and RAG context retrieval

Auth. CB Insights uses a client-credential exchange rather than a static key, so the tools run through directExecution. The shared executor trades the credentials for a bearer token, caches it briefly keyed by a digest (never the credentials), and re-authorizes once on a 401 — the token's lifetime is undocumented, so expiry is discovered rather than predicted.

Model input. ChatCBI and RAG declare request.modelInput with mode: 'project' so an activated Sim secret inside the message is projected to its canonical label before it reaches a third party's model. directExecution still runs projectToolModelInputParams (tools/index.ts:1985), so the two compose. The ID-only endpoints are deliberately left unprojected — a resource ID is not model-visible content, even on an AI-backed endpoint.

Every path, request field, and response shape was taken from the published Swagger document rather than inferred.

Type of Change

New feature

Testing

Tested manually. 33 unit tests across the block and the tools, covering the credential exchange, token reuse, the 401 re-authorize retry and its give-up path, org-ID path validation, the 100-ID and 1-100 limit bounds, filter compaction, and every response projection. Each test was mutation-verified by reverting its fix and watching it go red. bun run lint, bun run check:audits (30 audits), and bun run type-check all pass.

Note: the live API cannot be exercised without client credentials, so the wire contract is verified against the Swagger spec and unit tests, not a real round trip.

Notes

The two streaming endpoints (chatcbichunked, scoutingreportstream) are intentionally excluded — they deliver incremental JSON chunks that are not valid single JSON when accumulated, and their non-streaming counterparts return the same content in one piece.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-08-20T00:58:56Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 20, 2026 1:25am

cursor · 2026-08-20T00:59:05Z

PR Summary

^{Cursor Bugbot is generating a summary for commit a86468f. Configure here.}

greptile-apps · 2026-08-20T01:02:22Z

Greptile Summary

The PR adds a CB Insights API v2 integration with credential exchange, bounded bearer-token caching, strict organization-ID validation, model-input projection for generative endpoints, block/tool registration, generated metadata, tests, and documentation.

Adds 25 non-streaming CB Insights operations spanning organization lookup, firmographics, transactions, relationships, outlook data, and generative research.
Adds shared authenticated request handling with one-time 401 reauthorization, deadlines, bounded response reads, and a capped token cache.
Adds block configuration, registry entries, icons, generated tool contracts, deployment configuration, documentation, and unit coverage.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/tools/cbinsights/utils.ts	Implements shared authorization, bounded token caching, retries, request limits, strict ID parsing, filter normalization, and response helpers; the previously reported validation and cache issues are resolved.
apps/sim/tools/cbinsights/cbinsights.test.ts	Covers authorization, cache bounds, malformed and unsafe IDs, filter handling, request construction, response projection, and model-input selection.
apps/sim/blocks/blocks/cbinsights.ts	Defines the CB Insights workflow block, operation-specific fields, tool selection, parameter mapping, outputs, and credential visibility.
apps/sim/tools/cbinsights/search_firmographics.ts	Builds validated firmographics searches while preventing filterless credit-consuming requests.
apps/sim/tools/registry.ts	Registers the new CB Insights tools for runtime dispatch.
apps/docs/content/docs/en/integrations/cbinsights.mdx	Documents authentication, licensing, credit-aware usage, all exposed operations, and their input/output contracts.

Sequence Diagram

sequenceDiagram
  participant Workflow
  participant Tool as CB Insights Tool
  participant Cache as Token Cache
  participant Auth as CB Insights Authorization
  participant API as CB Insights API v2
  Workflow->>Tool: Execute operation
  Tool->>Cache: Look up credential digest
  alt Token absent or expired
    Tool->>Auth: Exchange client credentials
    Auth-->>Tool: Bearer token
    Tool->>Cache: Store token and prune cache
  end
  Tool->>API: Authorized API request
  alt API returns 401
    Tool->>Cache: Delete cached token
    Tool->>Auth: Reauthorize once
    Auth-->>Tool: Fresh bearer token
    Tool->>API: Retry request once
  end
  API-->>Tool: JSON response
  Tool-->>Workflow: Projected tool output

_{Reviews (6): Last reviewed commit: "fix(cbinsights): bound a numeric organiz..." | Re-trigger Greptile}

waleedlatif1 · 2026-08-20T01:05:53Z

@greptile

waleedlatif1 · 2026-08-20T01:05:54Z

@cursor review

Covers every non-streaming v2 endpoint across 25 tools: free organization lookup, firmographics search, funding rounds and cap tables, investments, portfolio exits, business relationships, management and board, the Mosaic / Commercial Maturity / Exit Probability outlooks and their histories, funding windows, revenue, strategy maps, Scouting Reports, ChatCBI, and RAG context. CB Insights authorizes by client-credential exchange rather than a static key, so the tools run through directExecution: the shared executor trades the credentials for a bearer token, caches it briefly, and re-authorizes once on a 401 — the token lifetime is undocumented, so expiry is discovered rather than predicted. ChatCBI and RAG declare request.modelInput so an activated Sim secret in the message is projected to its canonical label before reaching a third party's model. directExecution still runs projectToolModelInputParams, so the two are compatible. The two streaming endpoints are deliberately excluded; they deliver incremental JSON chunks and their non-streaming counterparts return the same content in one piece.

- Reject an organization ID list containing an invalid entry instead of dropping it. Silently filtering meant a typo ran the request against a narrower set — spending credits on the wrong organizations, or quietly widening a filtered search — and still reported success. - Apply the same rule to the optional firmographics ID filters, where a dropped filter broadens the search rather than narrowing it. - Bound the process-wide token cache so a long-lived worker serving many CB Insights accounts does not grow with the cumulative number of accounts seen. Expired entries are swept on write, then the oldest evicted.

waleedlatif1 · 2026-08-20T01:07:49Z

@greptile

waleedlatif1 · 2026-08-20T01:07:49Z

@cursor review

- Measure the firmographics empty-search guard against the filters alone. limit, nextPageToken, and sort were in the same object, so a request carrying only paging slipped past it and issued an unfiltered search over the whole database — which still spends credits. - Reject a mistyped numeric bound instead of dropping it. A bad headcount, funding, or valuation filter silently widened the search, the same failure mode already fixed for ID lists. - Treat an empty comma segment identically on the required and optional paths. A trailing or doubled comma is a separator artifact that cannot change which records are requested, so both paths now discard it; every other malformed entry is still rejected.

waleedlatif1 · 2026-08-20T01:15:01Z

@greptile

waleedlatif1 · 2026-08-20T01:15:03Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 5222387. Configure here.}

Number reads "0x10" as 16 and "1e2" as 100, so either notation resolved to a real but unintended organization and the request spent credits on it. Both the path-scoped and the bulk validators now require a plain run of digits, and use Number.isSafeInteger so an ID past the precision limit cannot round to a neighbouring one.

waleedlatif1 · 2026-08-20T01:20:29Z

@greptile

waleedlatif1 · 2026-08-20T01:20:30Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 474b86f. Configure here.}

…range The string path already required a safe integer; the numeric path still used Number.isInteger, which accepts a value past the precision limit. JSON parsing has already rounded such a value, so the request would target a different organization than the caller supplied.

waleedlatif1 · 2026-08-20T01:25:49Z

@greptile

waleedlatif1 · 2026-08-20T01:25:50Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit e5b8380. Configure here.}

cursor Bot reviewed Aug 20, 2026

View reviewed changes

Comment thread apps/sim/tools/cbinsights/utils.ts Outdated

greptile-apps Bot reviewed Aug 20, 2026

View reviewed changes

Comment thread apps/sim/tools/cbinsights/utils.ts Outdated

Comment thread apps/sim/tools/cbinsights/utils.ts

vercel Bot deployed to Preview August 20, 2026 01:03 View deployment

vercel Bot temporarily deployed to Preview August 20, 2026 01:05 Inactive

waleedlatif1 added 2 commits August 19, 2026 18:06

waleedlatif1 force-pushed the feat/cbinsights-integration branch from f98dbfa to 803a3ec Compare August 20, 2026 01:07

cursor Bot reviewed Aug 20, 2026

View reviewed changes

Comment thread apps/sim/tools/cbinsights/utils.ts

greptile-apps Bot reviewed Aug 20, 2026

View reviewed changes

Comment thread apps/sim/tools/cbinsights/utils.ts Outdated

cursor Bot reviewed Aug 20, 2026

View reviewed changes

Comment thread apps/sim/tools/cbinsights/search_firmographics.ts Outdated

Comment thread apps/sim/tools/cbinsights/utils.ts

vercel Bot deployed to Preview August 20, 2026 01:12 View deployment

vercel Bot temporarily deployed to Preview August 20, 2026 01:14 Inactive

cursor Bot reviewed Aug 20, 2026

View reviewed changes

greptile-apps Bot reviewed Aug 20, 2026

View reviewed changes

Comment thread apps/sim/tools/cbinsights/utils.ts Outdated

vercel Bot temporarily deployed to Preview August 20, 2026 01:20 Inactive

cursor Bot reviewed Aug 20, 2026

View reviewed changes

greptile-apps Bot reviewed Aug 20, 2026

View reviewed changes

Comment thread apps/sim/tools/cbinsights/utils.ts

vercel Bot temporarily deployed to Preview August 20, 2026 01:25 Inactive

cursor Bot reviewed Aug 20, 2026

View reviewed changes

waleedlatif1 merged commit f17938c into staging Aug 20, 2026
30 checks passed

waleedlatif1 deleted the feat/cbinsights-integration branch August 20, 2026 01:31

waleedlatif1 mentioned this pull request Aug 20, 2026

v0.8.7: perf improvements, custom blocks improvements, crunchbase, pitchbook, bitbucket integrations #6885

Merged

Uh oh!

Conversation

waleedlatif1 commented Aug 20, 2026

Summary

Type of Change

Testing

Notes

Checklist

Uh oh!

vercel Bot commented Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Aug 20, 2026

PR Summary

Uh oh!

Uh oh!

greptile-apps Bot commented Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Sequence Diagram

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Aug 20, 2026

Uh oh!

waleedlatif1 commented Aug 20, 2026

Uh oh!

waleedlatif1 commented Aug 20, 2026

Uh oh!

waleedlatif1 commented Aug 20, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Aug 20, 2026

Uh oh!

waleedlatif1 commented Aug 20, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

waleedlatif1 commented Aug 20, 2026

Uh oh!

waleedlatif1 commented Aug 20, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

waleedlatif1 commented Aug 20, 2026

Uh oh!

waleedlatif1 commented Aug 20, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Aug 20, 2026 •

edited

Loading

greptile-apps Bot commented Aug 20, 2026 •

edited

Loading