# Oracle Dba Super

> USE FOR ANY Oracle Database request — whether to UNDERSTAND/DESIGN/WRITE (knowledge) or to OPERATE/CHANGE/RECOVER a database (action). Covers SQL & PL/SQL authoring, tuning, schema design, migrations (from PostgreSQL/MySQL/SQL Server/Mongo/Snowflake), JDBC & frameworks, ORDS, SQLcl/MCP, AND full DBA operations: provisioning, backup & recovery (RMAN/Data Pump), patching & upgrades, RAC, Data Guard, GoldenGate, performance/AWR/ASH, space/ASM, users/ roles/privileges, security/TDE/auditing, PDB/multitenant, monitoring/alerting, jobs, flashback, capacity, networking/listener, cloning/refresh, Exadata, OEM, OCI/Autonomous, decommissioning, and ANY ORA-/RMAN-/CRS- error. Trigger even if the user does not name a task or tool. This is the MASTER ROUTER: it sends knowledge questions to the vendored Oracle knowledge base and operational requests to the right tier-gated action domain, always loading the agent-safety patterns and enforcing the autonomy policy (T1 self-exec / T2 dry-run+execute / T3 runbook + human approv

- Skill: `shreyas70773/oracle-dba-super` (Agent Skill, multi-file: 9 files)
- Install (CLI): `npx skillmds@latest add shreyas70773/oracle-dba-super`
- Raw SKILL.md: https://api.skillmd.com/api/skills/shreyas70773/oracle-dba-super/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Data & Analytics
- Author: Shreyas70773 (https://skillmd.com/u/shreyas70773)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/shreyas70773/oracle-dba-super

---


# Oracle DBA — SUPER Skill Library

A single, self-contained library that fuses two layers:

- **KNOWLEDGE (the brain)** — `knowledge/`: Oracle's official, source-backed guidance
  (vendored from `github.com/oracle/skills`, UPL-1.0 — see `NOTICE.md`). Markdown only; the
  agent reads it and acts through the SQLcl MCP server. Breadth: SQL/PL-SQL, appdev, frameworks,
  migrations, ORDS, design, performance concepts, security concepts, features, containers, and
  **agent-safety patterns**.
- **ACTION (the hands)** — the 24 domain skills at the root (e.g. `backup-and-recovery/`,
  `rac-high-availability/`): our tier-gated, **executable** automation — idempotent `.sh`/`.ps1`
  + `sql/*.sql` + deep T3 runbooks + cron, all sourcing the shared `_common/` harness, wired for
  native SQLcl-MCP (in-DB) and a custom guarded `oracle-dba-ops` MCP (host ops; see playbook).

> **Golden rule:** *knowledge tells you HOW and WHY; action DOES it under the tier policy.* For
> any change, consult the relevant `knowledge/` page first, then execute via the action domain.

## How to Use This Library

1. Classify the request: **knowledge/dev/design** vs **operational action**.
2. Knowledge → open `knowledge/SKILL.md` (its routing table) and read only the file you need.
3. Action → open the matching domain's `SKILL.md`, find the task in its **Scope & risk map**,
   then follow precheck → action (script/sql) → postcheck → rollback. Honor the tier.
4. For ANY destructive/changing operation, also load the agent-safety guidance:
   `knowledge/agent/destructive-op-guards.md`, `knowledge/agent/idempotency-patterns.md`,
   `knowledge/agent/safe-dml-patterns.md`, `knowledge/agent/schema-discovery.md`,
   `knowledge/agent/ora-error-catalog.md`.

## Global Autonomy Policy (enforced by every action domain)

- **T1 — Observe (read-only):** monitoring, health/space/AWR reports, status queries. Self-executes.
- **T2 — Reversible / low blast-radius:** scheduled backups, RMAN CONFIGURE, gather stats,
  Data Pump export, restore-point create, etc. Self-executes **only** with a `--dry-run` preview
  (default ON), structured logging, and a postcheck; explicit `--execute` to act. Capped at T2.
- **T3 — Destructive / recovery / HA / structural:** restore/recover, PITR/TSPITR, switchover/
  failover, DROP/TRUNCATE, patch apply, node eviction, TDE key ops, decommission. **Never
  self-executes** — requires a human approval token AND defaults to a runbook of exact commands.
- *When in doubt, runbook.* This mirrors Oracle's own guidance: least-privilege user (never
  SYS/SYSTEM), sanitized non-prod first, audit LLM activity, **never enable auto-approve**.

## Native Integration (runs on a DB VM through Claude Code)

- In-database SQL/PL-SQL → the **official SQLcl MCP server** (`sql -mcp`, SQLcl 25.2+, JRE 17/21)
  on the saved least-privilege connection `dba_ai_conn` (wallet, `-savepwd`). SQLcl defaults to
  **restrict level 4** (no host commands) and auto-logs to `DBTOOLS$MCP_LOG` + tags
  `V$SESSION.MODULE/ACTION` + `/* LLM in use */`.
- Host/OS ops (RMAN, Data Pump binaries, `dgmgrl`, `srvctl`, AHF/TFA, recovery) → the generated
  `.sh`/`.ps1`, fronted by the custom guarded **`oracle-dba-ops`** MCP — **BUILT** at `mcp-server/`:
  a tier-aware gateway to the action scripts (reads each script's `# TIER:` banner; T1 runs, T2
  dry-run-default, T3 runbook-only; rejects shell metachars + path traversal). Self-test: 12/12.
- **Set up on a VM:** run `bootstrap/bootstrap.sh --register-mcp` (Linux) or
  `bootstrap/bootstrap.ps1 -RegisterMcp` (Windows) — registers BOTH `sqlcl` and `oracle-dba-ops`.
  Or `install.sh` / `install.ps1` to install + validate in one step. MCP server docs: `mcp-server/README.md`.
- Authoritative wiring + restrict levels + tools: `knowledge/sqlcl/sqlcl-mcp-server.md`.
- Merged architecture + gaps: `references/INTEGRATION-PLAYBOOK.md`.

## Routing — ACTION domains (executable, tier-gated)

| If the user wants to… | Action domain |
|---|---|
| install/provision/configure DB, GI, ASM, listener, params, NLS | `provisioning-installation-configuration/` |
| create/reset/lock users, roles, profiles, grants, recertify | `user-role-access-management/` |
| watch up/down, alert log, space, sessions, locks, lag, jobs | `monitoring-alerting/` |
| add/resize datafiles, tablespaces, ASM, reorg, FRA, cleanup | `space-storage-management/` |
| RMAN/Data Pump backups, restore points, crosscheck, recovery | `backup-and-recovery/` |
| AWR/ASH, top-SQL, stats, kill sessions, plan baselines, tuning | `performance-tuning-diagnostics/` |
| OPatch/RU, datapatch, AutoUpgrade, rolling/standby-first patch | `patching-upgrades/` |
| srvctl services, VIP/SCAN, OCR, node add/del, clusterware RCA | `rac-high-availability/` |
| transport/apply lag, broker, switchover/failover, standby build | `data-guard-disaster-recovery/` |
| Extract/Replicat, trail files, initial load, CDR, MViews | `goldengate-replication/` |
| RMAN DUPLICATE clone, PDB clone/refresh, TTS/XTTS, ZDM, masking | `cloning-refresh-migration/` |
| PDB open/close/save-state/clone/plug, resource mgr, lockdown | `multitenant-cdb-pdb/` |
| DBMS_SCHEDULER jobs, chains, external jobs, job failures | `job-scheduling-automation/` |
| recompile invalids, purge recyclebin/audit, index rebuild, MView refresh | `routine-maintenance/` |
| auditing, CIS hardening, TDE/wallet, redaction, VPD, Vault | `security-encryption-auditing/` |
| listener restart/config, tnsnames, CMAN, ORA-12xxx, SQL*Net tuning | `networking-connectivity/` |
| flashback query/table/drop/transaction, restore points, FDA, FDB | `flashback-technologies/` |
| status/space/SLA reports, growth forecasting, chargeback | `capacity-planning-reporting/` |
| triage, ORA-error/RCA, hang/deadlock, AHF/TFA, ORA-600/7445, SR | `incident-problem-management/` |
| Exachk, cell mgmt, IORM, Smart Scan/flash cache, expansion | `exadata-engineered-systems/` |
| compression/HCC, In-Memory, partitioning, sharding, result cache | `advanced-features/` |
| OEM target/agent/blackout/template, repository, Cloud Control | `enterprise-manager-oem-tooling/` |
| Autonomous/Base DB provisioning, cloud backup, auto-scaling, ZDM/DMS | `cloud-autonomous-oci/` |
| final backup, shutdown/decommission, cleanup, archival, secure destroy | `decommissioning-lifecycle-end/` |

## Routing — KNOWLEDGE base (read, then act)

Open `knowledge/SKILL.md` for the full routing table. Highlights:

| Topic | Knowledge path |
|---|---|
| Agent-safe DML, destructive guards, idempotency, schema discovery, ORA- catalog, NL→SQL, intent | `knowledge/agent/` |
| SQL tuning, patterns, dynamic SQL, injection avoidance | `knowledge/sql-dev/` |
| PL/SQL package/error/perf design, collections, cursors, debugging | `knowledge/plsql/` |
| AWR, ASH, explain plan, indexes, optimizer stats, wait events, memory | `knowledge/performance/` |
| Privileges, VPD, masking, auditing, encryption, network security | `knowledge/security/` |
| JDBC, pooling, JSON/XML, spatial, Text, transactions, MLE, drivers | `knowledge/appdev/` |
| SQLAlchemy, Django, Pandas, Spring JPA, MyBatis, TypeORM, GORM | `knowledge/frameworks/` |
| Migrate from PostgreSQL/MySQL/SQL Server/Mongo/Snowflake | `knowledge/migrations/` |
| RAC, Multitenant, Exadata, In-Memory, Data Guard architecture | `knowledge/architecture/` |
| Backup/RMAN, Autonomous Recovery Service, Cloud Protect (concepts) | `knowledge/backup-recovery/` |
| AQ, DBMS_SCHEDULER, MViews, DBLinks, vector search, SELECT AI | `knowledge/features/` |
| SQLcl basics, scripting, Liquibase, formatting, DDL gen, **MCP server** | `knowledge/sqlcl/` |
| ORDS architecture/install/REST/auth/monitoring | `knowledge/ords/` |
| OCR container images and selection | `knowledge/containers/` |
| ERD, data modeling, partitioning, tablespaces | `knowledge/design/` |
| schema migrations, online ops, edition-based redefinition, version control | `knowledge/devops/` |
| Data Guard, redo/undo, user management (admin notes) | `knowledge/admin/` |

## Common Multi-Step Flows (knowledge → action)

| Goal | Sequence |
|---|---|
| **Safe schema change** | `knowledge/agent/schema-discovery` → `knowledge/agent/destructive-op-guards` → `knowledge/agent/idempotency-patterns` → execute via the relevant action domain (T2 dry-run first) |
| **Diagnose a slow query** | `knowledge/performance/explain-plan` → `knowledge/performance/wait-events` → `performance-tuning-diagnostics/` (run AWR/ASH/top-SQL scripts) |
| **Recover from media failure** | `knowledge/backup-recovery/*` (concepts) → `backup-and-recovery/references/runbooks.md` (T3 runbook + approval token) |
| **Stand up AI access on a VM** | `bootstrap/bootstrap.sh|ps1` → `knowledge/security/privilege-management` (least-priv user) → `knowledge/sqlcl/sqlcl-mcp-server` → register MCP → validate T1 read-only |
| **Plan a migration off another DB** | `knowledge/migrations/migration-assessment` → source-specific `knowledge/migrations/migrate-*` → `cloning-refresh-migration/` for cutover mechanics |

## Conventions

- Action skills follow `_common/references/conventions.md` (tier banner, dry-run default, wallet
  creds, structured logging, idempotency). Knowledge skills follow Oracle's authoring guide
  (`knowledge/_AUTHORING_GUIDE.md`): `## Overview` → examples → best practices →
  `## Oracle Version Notes (19c vs 26ai)` → `## Sources`.
- Version baseline: **19c** is the floor; our action automation is verified on **19c & 23ai**;
  Oracle knowledge notes call out **26ai** where newer. Treat version-specific items as
  verify-before-trust against the running release.

See `MANIFEST.md` for the full inventory and `INSTALL.md` for install + VM setup.