How do I install the Pscale Audit Log skill?

Run npx skillmds add vince-winkintel/pscale-audit-log in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Pscale Audit Log safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Pscale Audit Log?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Pscale Audit Log free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Pscale Audit Log?

vince-winkintel (@vince-winkintel) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Pscale Audit Log by vince-winkintel

Name: Pscale Audit Log
Rating: 4.2 (5 reviews)
Author: vince-winkintel

Pscale Audit Log

Inspect PlanetScale organization audit events and download filtered authentication-attempt export archives. Use when investigating account activity, allowed or denied database logins, IP allowlist failures, usernames, branches, backend routes, or authentication timelines. Triggers on audit log, auth attempts, login failures, denied database connections, authentication export.

vince-winkintel 8247ac3 2 files · 6.7 KB Updated Sep 10, 2026

File contents

pscale audit-log

Inspect organization audit events and export database authentication attempts.

Common commands

# Existing organization audit events
pscale audit-log list --org <org> --format json

# Export the last 24 hours of denied authentication attempts
pscale audit-log auth-attempts download --org <org> \
  --since 24h --outcome deny --export-format jsonl \
  --output ./auth-attempts.zip

Authentication-attempt exports

Choose exactly one time-window style:

--since <duration> ending now, such as 24h, 7d, or 2w; or
--start-at <time> with optional exclusive --end-at <time>.

Named values (now, today, yesterday) and zone-less timestamps use the local timezone; the API request is normalized to UTC. For repeatable automation across hosts, prefer RFC3339 timestamps with an explicit offset.

# Explicit UTC interval
pscale audit-log auth-attempts download --org <org> \
  --start-at 2026-08-10T00:00:00Z \
  --end-at 2026-08-11T00:00:00Z \
  --outcome deny \
  --failure-reason bad_password \
  --export-format csv \
  --output ./denied-auth-attempts.zip

# Narrow to selected branches and source networks
pscale audit-log auth-attempts download --org <org> \
  --since 7d \
  --branch <branch-public-id> \
  --source-ip 203.0.113.0/24 \
  --backend-route postgres \
  --output ./filtered-auth-attempts.zip

Supported export formats are jsonl, csv, and parquet. Human/CSV CLI output defaults the artifact to CSV; JSON CLI output defaults it to JSONL. Filters include outcome (allow, deny), failure reason, source IP/CIDR, branch, username, startup database, and backend route (postgres, pgbouncer, unknown). Most list filters repeat or accept comma-separated values; --username is repeatable and preserves commas as part of the username.

The command creates an export, waits for readiness, and downloads a ZIP archive. Authentication data can contain usernames, IP addresses, and operational evidence: write it only to an approved path, do not print raw ZIP bytes with --output - into chat/logs, and share it only through approved channels. Confirm organization, interval, and filters before requesting a broad export.

References

See references/commands.md for the command and flag surface.

---name: pscale-audit-logdescription: Inspect PlanetScale organization audit events and download filtered authentication-attempt export archives. Use when investigating account activity, allowed or denied database logins, IP allowlist failures, usernames, branches, backend routes, or authentication timelines. Triggers on audit log, auth attempts, login failures, denied database connections, authentication export.---# pscale audit-logInspect organization audit events and export database authentication attempts.## Common commands```bash# Existing organization audit eventspscale audit-log list --org <org> --format json# Export the last 24 hours of denied authentication attemptspscale audit-log auth-attempts download --org <org> \ --since 24h --outcome deny --export-format jsonl \ --output ./auth-attempts.zip```## Authentication-attempt exportsChoose exactly one time-window style:- `--since <duration>` ending now, such as `24h`, `7d`, or `2w`; or- `--start-at <time>` with optional exclusive `--end-at <time>`.Named values (`now`, `today`, `yesterday`) and zone-less timestamps use the local timezone; the API request is normalized to UTC. For repeatable automation across hosts, prefer RFC3339 timestamps with an explicit offset.```bash# Explicit UTC intervalpscale audit-log auth-attempts download --org <org> \ --start-at 2026-08-10T00:00:00Z \ --end-at 2026-08-11T00:00:00Z \ --outcome deny \ --failure-reason bad_password \ --export-format csv \ --output ./denied-auth-attempts.zip# Narrow to selected branches and source networkspscale audit-log auth-attempts download --org <org> \ --since 7d \ --branch <branch-public-id> \ --source-ip 203.0.113.0/24 \ --backend-route postgres \ --output ./filtered-auth-attempts.zip```Supported export formats are `jsonl`, `csv`, and `parquet`. Human/CSV CLI output defaults the artifact to CSV; JSON CLI output defaults it to JSONL. Filters include outcome (`allow`, `deny`), failure reason, source IP/CIDR, branch, username, startup database, and backend route (`postgres`, `pgbouncer`, `unknown`). Most list filters repeat or accept comma-separated values; `--username` is repeatable and preserves commas as part of the username.The command creates an export, waits for readiness, and downloads a ZIP archive. Authentication data can contain usernames, IP addresses, and operational evidence: write it only to an approved path, do not print raw ZIP bytes with `--output -` into chat/logs, and share it only through approved channels. Confirm organization, interval, and filters before requesting a broad export.## ReferencesSee `references/commands.md` for the command and flag surface.

Frequently asked questions