DevOps & Deployment for Claude Code

Use when working on DevSecOps, cloud security, and compliance frameworks, including security automation, vulnerability management, and zero-trust architecture with emphasis on shift-left security practices.

Use when working on infrastructure as code, multi-cloud provisioning, and modular architecture, including Terraform best practices, state management, and enterprise patterns, with emphasis on reusability, security, and automation.

Use when building robust test frameworks, CI/CD integration, and comprehensive test coverage, including multiple automation tools and frameworks, with emphasis on maintainable, scalable, and efficient automated testing solutions.

Use when working on full-stack development, performance optimization, and enterprise solutions, including custom theme/plugin development, multisite management, security hardening, and scaling WordPress from small sites to enterprise platforms handling millions of visitors.

CI/CD pipeline security hunting — GitHub Actions workflow injection, secret exfiltration, self-hosted runner poisoning, dependency confusion, OIDC token theft, and supply chain attacks. Covers sisakulint scanning, manual workflow analysis, and chaining CI/CD bugs into critical findings. Use when a target has public repos, GitHub Actions, CircleCI, Jenkins, or GitLab CI.

Inspect or rotate hunt-memory JSONL files (audit.jsonl, patterns.jsonl, journal.jsonl). Caps file size and keeps N rotated backups so memory does not grow unbounded.

Run the full recon pipeline by invoking tools/recon_engine.sh — subdomain enum (subfinder + amass + crt.sh + wayback), httpx live host probing with tech detection, nmap port scan, gau URL collection, JS analysis, ffuf directory fuzzing, parameter discovery, config exposure check, CI/CD workflow scan. Outputs to recon/<target>/. Handles FQDN, IP, CIDR, and file-of-hosts targets automatically. Usage: /recon target.com

Hunt leaked credentials in a filesystem path, git history, JS bundles from a recon run, or an entire GitHub org. Wraps trufflehog (verifies live keys against issuer APIs), noseyparker (fast on huge histories), and gitleaks (default rule pack). Falls back to a regex grep if no scanner is installed. Usage: /secrets-hunt --filesystem <dir> | --git <repo> | --js-bundle <recon-dir> | --github-org <org>

Plan vault restructuring from config changes. Compares config.yaml against derivation.md, identifies dimension shifts, shows restructuring plan, executes on approval. Triggers on "/refactor", "restructure vault".

Add a source file to the processing queue. Checks for duplicates, creates archive folder, moves source from inbox, creates extract task, and updates queue. Triggers on "/seed", "/seed [file]", "queue this for processing".

Install, repair, and validate DeepScientist on Windows with WSL2 until the Windows browser can open the DeepScientist Web UI. Use when an agent needs to set up or fix DeepScientist on a Windows machine, including WSL distro creation, Linux-side Node/Python prerequisites, Codex auth/relay configuration, WSL proxy troubleshooting, and final `ds doctor` or Web UI verification.

Adversarial post-deploy verifier. Use IMMEDIATELY after any systemctl restart or service redeploy. Catches silent skip when config was edited but daemon wasn't reloaded; catches accidental cascade restarts of untouched services. Snapshots pre/post timestamps, verifies a config-drift gate logged in the journal, validates expected config keys loaded in-memory (not just on disk), confirms sibling services weren't bumped. Optionally auto-rolls back if a backup_path is provided.

Build a new application from a plain-English description using Shipwright's autonomous 9-phase pipeline

Agent that receives a specific TASK within a WORK and implements the actual code. Automatically invoked by the scheduler. Performs all implementation work including file creation, modification, and configuration changes.

Cancel a running Codex agent (optionally --force to also remove its worktree)

Configure codex-hud statusline display options (guided interactive flow)

Manages the ops background daemon — start, stop, restart services, check health

The Watcher of the dev team. The SRE/security mind with a twist. Thinks about second-order effects, failure modes nobody plans for, and what happens when things go sideways at 3am.

Diagnoses and auto-fixes ops plugin configuration errors, manifest issues, broken permissions, invalid JSON, and stale cache copies.

Developer and Software Architect agent for architecture decisions, full-stack implementation, code writing, testing, infrastructure, CI/CD, and technical documentation. Use for any coding, implementation, architecture, refactoring, or technical task.

Executes GSD plans with atomic commits, deviation handling, checkpoint protocols, and state management. Spawned by execute-phase orchestrator or execute-plan command.

Verifies cross-phase integration and E2E flows. Checks that phases connect properly and user workflows complete end-to-end.

Multi-service infrastructure health checker. Probes every AWS service the caller has IAM access to (ECS, EC2, RDS, Lambda, S3, CloudFront, ALB/NLB, API Gateway, SQS, SNS, DynamoDB, ElastiCache, Route 53, ACM, CloudWatch, Budgets, IAM) plus Vercel and GitHub Actions. Returns structured JSON with service health, accessible/inaccessible service lists, and severity-ranked anomaly flags. Used by ops-fires and ops-deploy.

Autonomous iteration loop — reads progress, selects role, executes, verifies, commits, and moves to next task without waiting

View or set the magic-codex delegation level (minimal/balance/max)

Lightweight APM and metrics probe agent. Queries Datadog, New Relic, and OpenTelemetry backends for active alerts, error traces, and entity health. Returns structured JSON. Read-only — used by ops-monitor skill.

Scaffold an A2A-compliant AG2 agent with server wiring, card settings, and skill definitions

Git, PR, and CI status scanner across all registered repos. Returns structured JSON with branch state, uncommitted files, open PRs, and CI status for each project.

Set up the Qwen Video Bridge (API key + dependencies)

Mechanical scp-and-spawn for autonomous Claude Code agents on a remote host. Use when a task exceeds Claude Code's interactive timeout, when work needs to run on a different machine than the human, or when delegating to a long-running agent. Captures the actual claude binary PID (not the bash wrapper PID — load-bearing detail), saves to a PID file, and returns DISPATCHED or BLOCKED with structured evidence. Does not interpret the spec, modify it, or make strategic decisions — purely a launch pri

Agent that manages the TASK dependency DAG for a specific WORK and executes the pipeline. Must be used for requests like "run WORK-XX", "execute pipeline", "next task". Reads the WORK's PLAN.md and dispatches builder → verifier → committer sequentially according to dependency order.

Configure claude-hud as your Claude Code statusline

Install codex-hud statusline (automatic, idempotent)

Configure or update the OpenAI Admin API key (enables /codex-hud:costs-*)

Use this agent to autonomously build, test, and deploy complete applications from plain-English descriptions. Runs a 9-phase pipeline across 4 stacks with enterprise-grade safety hooks.

Report slop-mop tooling friction with a structured barnacle

Run slop-mop's one-time repository onboarding remediation rail

Quick one-line summary of today's Codex activity (cost shown if Admin key configured)

Issue a free 90-day Let's Encrypt certificate

Verify the TLS Radar plugin's connection and configuration