# Rightbrain > Builds and operates Rightbrain Tasks, TaskAgents, knowledge, tools, and automations. Use only when the user explicitly asks to work with Rightbrain, the Rightbrain API, rb-api, or a Rightbrain TaskAgent. - Skill: `rightbrainai/rightbrain` (Agent Skill, multi-file: 3 files) - Install (CLI): `npx skillmds@latest add rightbrainai/rightbrain` - Raw SKILL.md: https://api.skillmd.com/api/skills/rightbrainai/rightbrain/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Integrations & APIs - License: MIT - Author: RightbrainAI (https://skillmd.com/u/rightbrainai) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/rightbrainai/rightbrain --- # Rightbrain Turn the user's goal into safe Rightbrain API operations. Live Rightbrain documentation owns endpoint contracts; this skill owns execution and safety. ## Operating loop 1. Resolve the directory containing this activated `SKILL.md`. Never infer it from the process working directory. 2. Run the wrapper's `whoami` command using its quoted absolute path. 3. Confirm the production host, organization, project, target, and intended effect before a write. 4. Read the current operation contract from Rightbrain's live documentation. 5. Execute through the wrapper, inspect the response, and report the result. ```bash node "/absolute/path/to/rightbrain/scripts/rb-api.mjs" whoami ``` For several commands in one shell block: ```bash RB_API="/absolute/path/to/rightbrain/scripts/rb-api.mjs" node "$RB_API" whoami node "$RB_API" METHOD /path [options] ``` Shell variables may not survive later tool calls. Use the literal absolute path again when needed. Never invoke `rb-auth.mjs` directly, inspect credential files, or print secrets. ## Authentication and target This public skill targets: - API: `https://app.rightbrain.ai/api/v1` - OAuth: `https://oauth.rightbrain.ai` `whoami` must report the production API URL before any API operation. Stop if it reports another host. Authentication precedence: 1. `RB_API_KEY` with `RB_ORG_ID` and `RB_PROJECT_ID` 2. `RB_CLIENT_ID` with `RB_CLIENT_SECRET` 3. an authenticated Rightbrain CLI session For a session, require Rightbrain CLI 0.3.0 or newer on `PATH`: ```bash npm install --global rightbrain@latest rightbrain login --non-interactive ``` The user must complete the browser flow. Retry `whoami` once, then stop and surface the error. Headless credentials must come from the caller's secret manager, never from chat. If no organization or project is selected, use the live organization and project list operations, then ask the user to choose when the target is ambiguous. ## Find the current contract Stop as soon as the exact operation is clear: 1. Use Rightbrain Docs MCP when available: `https://docs.rightbrain.ai/v-1/_mcp/server`. 2. Otherwise open the relevant page from `https://docs.rightbrain.ai/v-1/llms.txt`. 3. Use `https://app.rightbrain.ai/api/v1/openapi.json` only when exact method, path, parameter, body, or response details remain unclear. Do not reconstruct request fields from memory. If the live contract is unavailable, do not guess before a write. ## Execute ```text node "/absolute/path/to/rightbrain/scripts/rb-api.mjs" METHOD /path [options] ``` Useful options: - `--query k=v` - `--data ''`, `--data @file`, or `--data -` - `--form k=v` and `--file field=@path` - `--sse` for streams - `--all` for pagination - `--accept mime --output path` for files - `--secret-output ` for a confirmed one-time secret - `--project-scope` for a project-relative suffix - `--org-scope` for an organization-relative suffix - `--dry-run` for a redacted routing preview - `--compact` for single-line JSON - `--timeout ` to bound a slow request Paths are exact by default. Use the canonical path from live docs and replace its path parameters with the selected IDs. Use `--project-scope` or `--org-scope` only when intentionally passing a relative suffix. For example, call a documented `/org/{org_id}/project/{project_id}/task` path with its placeholders replaced, or call `/task --project-scope`. Exit codes: `0` transport success, `2` unauthenticated, `3` rejected authentication, `4` usage/configuration/network error, and `5` API HTTP error. Fix the cause; do not blindly retry. ### Verify the execution outcome HTTP 200 and wrapper exit code 0 do not prove that an agent run completed. For `--sse`, inspect the JSON data events using the current live contract: `error` means failure, `approval_required` means paused, and `done` is the completion event. A stream that closes without a terminal outcome is incomplete. Preserve the session, run, and approval IDs that were returned. After a disconnect or ambiguous response, inspect stored run status and tool execution records before starting more work. A new run is a new execution; do not blindly repeat it. Approval decisions and resuming a paused run are separate operations; resolve their current behavior from live docs. For evals, inspect individual verdicts and pass/fail counts: a completed eval can contain failed cases. Report the observed outcome rather than treating successful transport as a successful test. ## Safety - Reads may proceed. - For reversible writes, show the target and proposed change first. - Ask immediately before deletion, public exposure, sharing, credentials, permissions, IAM, trigger enablement, production activation, external writes, or potentially expensive runs and evals. - Prefer private, draft, disabled, disposable, and bounded resources. - Treat Integrations, MCP tools, triggers, and webhooks as external side effects unless proven otherwise. - Use `--dry-run` for sensitive routing previews, but never include secrets in a dry-run body. - Structured output redacts known secret fields. Write a confirmed one-time secret only with `--secret-output ` and never read that file into the conversation. - Send the minimum required data. Prompts, files, and tool inputs may reach configured model providers or third parties.