stacklok

@stacklok source repo

64 skills
0 followers
6 hours ago last updated

▌
Respond To Rfc Comments · stacklok
Help respond to review comments on an RFC pull request. Use when the user wants to address, reply to, or resolve feedback on an open RFC PR for toolhive, toolhive-studio, toolhive-registry, toolhive-registry-server, toolhive-cloud-ui, or dockyard projects.

0
installs
▌
Matlatl · stacklok
Operate matlatl, the CLI that maps a repo's markdown into a link graph and reports broken links/anchors, orphans, and unreachable, under-linked, or dead-end docs. Use it to: gate docs in CI / fail a PR on broken links ("check the docs", "are there broken links"); find or fix doc-link rot ("find orphaned docs", "fix the doc links", "fix-prompt"); make a repo legible to agents by emitting graph.json / llms.txt / findings.json ("generate llms.txt", "emit the doc graph"); get a suggested reading order to onboard to a repo's docs ("where do I start", "reading order"); audit a knowledge base's health and mine the doc graph for insights ("audit our docs", "documentation health", "load-bearing docs", "suggest links", "missing links between docs", "stale section references", "doc graph insights"); or query the doc graph live over MCP ("what links to X", "path between docs", "matlatl serve"). NOT a prose/style markdown linter and NOT for non-markdown files.

0
installs
▌
AI Scoping · stacklok bundle
Transform an OpenAPI 3.x spec and workflow descriptions into a validated mcp-scope.yaml that ultimately gets used to generate an MCP server. Guides the AI through spec analysis, semantic grouping, tool naming, description writing, and auth detection with interactive user gates. Use when a user wants to scope an API for MCP server generation.

0
installs
▌
AI Validation · stacklok bundle
Validate a generated MCP server project against the mcp-scope.yaml and OpenAPI spec that drove its generation, then suggest hint-driven improvements. Part of the mcp-builder pipeline that transforms an OpenAPI 3.x spec into a ToolHive-ready MCP server across four phases — AI Scoping, Human Review, Deterministic Code Generation, and AI Validation & Polish (this skill). Use when a user has a generated MCP server project (Phase 3 output) and wants to validate it before deployment.

0
installs
▌
Deploy Assist · stacklok bundle
Place generated MCP server deployment manifests into a cluster repo, fill in placeholders by inferring values from existing cluster configuration, and explain remaining manual steps. Use when you have a generated MCP server project and a cluster repo where you want to deploy it.

0
installs
▌
Grill With Docs · stacklok
A relentless interview to sharpen a plan or design, capturing decisions in this repo's canonical homes as they land. Use when the user wants to stress-test a design and record what comes out of it.

0
installs
▌
Domain Model Lint · stacklok
Run modelith lint on a domain model and explain the findings — a read-only review pass. Use when the user asks to check, validate, or review a *.modelith.yaml file, or wants to know what is missing or inconsistent. Turns the linter output into a prioritized, actionable summary. To actually change the model (add or edit entities, fix the gaps), use domain-model-author.

0
installs
▌
Domain Model Author · stacklok
Build or update a domain model by conversation. Use when the user wants to add or change an entity, relationship, attribute, action, invariant, or scenario in a *.modelith.yaml file, or describes product concepts they want captured in the model. Drafts the YAML, asks clarifying questions where a definition is fuzzy, runs the linter, and regenerates the committed Markdown. For a read-only check that explains findings without editing, use domain-model-lint instead.

0
installs
▌
Domain Model Context · stacklok
Load a domain model into the working context before a coding task. Use at the start of a session that will touch product concepts, when the user says "use the domain model" or "load the model," or before implementing a feature in a repo that has a *.modelith.yaml. Makes the agent reason in the team's vocabulary — entity names, relationships, and invariants.

0
installs
▌
Package Skill · stacklok bundle
Creates spec.yaml configurations for packaging agent skills as OCI artifacts. Use when adding a new agent skill to Dockyard, creating a skills/*/spec.yaml file, or vendoring a third-party skill repository (e.g. from Anthropic, Datadog, HashiCorp, Hugging Face). Not for writing a brand-new skill's own content, or for MCP server packaging (use package-mcp-server for that).

0
installs
▌
Scan MCP Servers · stacklok
Scans MCP servers in the Dockyard repository for security issues using Cisco AI Defense mcp-scanner. Evaluates findings, identifies false positives, and updates security allowlists in spec.yaml files.

0
installs
▌
Review MCP Update · stacklok bundle
Reviews pull requests for MCP server updates in the Dockyard repository. Use when reviewing PRs that update MCP server versions (spec.yaml changes), add new MCP servers, or modify security allowlists. Evaluates against ToolHive registry criteria including security, provenance, and quality.

0
installs
▌
Package MCP Server · stacklok bundle
Creates spec.yaml configurations for packaging MCP servers as containers. Use when adding a new MCP server to Dockyard, creating a spec.yaml file, or packaging npm/PyPI/Go MCP servers.

0
installs
▌
Smoke Test · stacklok
Start the Registry Server via docker compose and run a suite of curl-based smoke tests covering system, read-only MCP API, admin API, entry lifecycle, and OAuth/auth enforcement scenarios.

0
installs
▌
Deploy Registry Server With Cnpg · stacklok
Deploy the ToolHive Registry Server to a Kind cluster with CloudNativePG (CNPG) PostgreSQL database. Use when you need a production-like PostgreSQL setup with the CNPG operator.

0
installs
▌
Deploy Registry Server With Otel · stacklok
Deploy the ToolHive Registry Server to a Kind cluster with telemetry enabled. Use when you need to deploy the registry server for testing with OTEL metrics and tracing.

0
installs
▌
Deep Links · stacklok bundle
Deep links in ToolHive Studio. Use when implementing, debugging, or asking about deep link features (toolhive-gui:// protocol), adding new deep link intents, understanding the deep link architecture, IPC model, or platform/packaging support.

0
installs
▌
Bug Fix Tdd · stacklok
Reproduce and fix bugs using TDD. Use when analyzing a bug report, writing a regression test, or applying a minimal fix. Covers test placement, mock patterns, and the red-green-refactor workflow for automated bug fixing.

0
installs
▌
Devcontainer Dev · stacklok
Containerized Dev Environment

0
installs
▌
Testing With API Mocks · stacklok
Start here for all API mocking in tests. Covers auto-generation, fixtures, and when to use other skills. Required reading before creating, refactoring, or modifying any test involving API calls.

0
installs
▌
Security Vuln Remediation · stacklok
Remediate security vulnerabilities found by Grype or pnpm audit. Use when a security scan fails, a CVE needs fixing, or you need to analyze, upgrade, override, or ignore a vulnerable dependency.

0
installs
▌
MCP Review · stacklok bundle
Review MCP server specifications and updates for compliance, security, and quality. Use when evaluating server.json files, PRs adding/updating servers, or assessing MCP server changes. NOT for creating new entries (use add-mcp-server instead).

0
installs
▌
Skill Review · stacklok bundle
Review skill submissions and updates for compliance, security, and quality. Use when evaluating skill.json files, SKILL.md content, PRs adding/updating skills, or assessing skill changes in the ToolHive registry. NOT for reviewing MCP server entries (use mcp-review) or creating new skills (use add-mcp-server).

0
installs
▌
Catalog Audit · stacklok bundle
Audit existing ToolHive catalog server entries for drift: whether the pinned image still exists, the upstream repo is still alive and active, and the declared env vars and network-permission profile still match what the server actually needs. Use whenever asked to audit, health-check, sweep, or spot-check catalog entries / server.json files for staleness, broken images, dead repos, abandoned projects, or wrong env-vars/permissions - for the community tier, the official tier, the whole registry, or a named subset. Report-only; it never edits entries. NOT for reviewing a new submission (use mcp-review) or creating one (use add-mcp-server).

0
installs
▌
Add MCP Server · stacklok bundle
Add new MCP server entries to the ToolHive registry. Creates server.json and icon.svg files with correct schema, _meta extensions, and validation. Use when adding a server, creating a registry entry, onboarding an MCP server, or writing server.json. NOT for reviewing existing entries (use mcp-review).

0
installs
▌
Code Review · stacklok
Reviews pull requests by analyzing code changes, checking for common issues, and providing structured feedback with suggestions.

0
installs
▌
Skill Creator · stacklok bundle
Guide for creating effective skills. Use when users want to create a new skill, update an existing skill, build a slash command, or extend agent capabilities with specialized knowledge, workflows, tool integrations, or custom commands.

0
installs
▌
CI Agent Hardening · stacklok bundle
Audit and harden GitHub Actions workflows against prompt injection, pull_request_target exploits (Pwn Requests), expression injection, cache poisoning, credential theft, and supply chain attacks. Based on Clinejection and hackerbot-claw campaigns. Use when reviewing CI/CD security, securing AI agent workflows, hardening publishing pipelines, or checking for GitHub Actions misconfigurations. Also covers slash command authorization, CLAUDE.md protection, and network egress. NOT for general CI/CD optimization or non-security workflow issues.

0
installs
▌
Move Page · stacklok
Move or rename a documentation page safely: relocate the file, update sidebars.ts, sweep and fix inbound links, add a vercel.json redirect from the old URL, and verify the build. Use whenever a docs page's file path or URL changes for any reason: moving a page to another section, renaming a file or slug, restructuring or consolidating a section, or retiring a page in favor of another. E.g. "move the vault guide into integrations", "rename quickstart-cli to quickstart", "fold the ngrok tutorial into the integrations guide".

0
installs
▌
Test Docs · stacklok bundle
Test ToolHive documentation by executing the steps in tutorials and guides against a real environment, verifying that examples are correct and ToolHive has not regressed. Use when the user asks to test, validate, or verify documentation such as: "test the vault integration tutorial", "verify the K8s quickstart", "check the CLI install docs", "test toolhive vault integration in kubernetes", or any request to run through a doc's instructions to confirm they work. Supports both Kubernetes-based docs (tutorials, K8s guides) and CLI-based docs.

0
installs
▌
Docs Review · stacklok
Perform comprehensive editorial reviews of documentation with a tech writer / copyeditor lens. Use when asked to review docs, documentation changes, or a set of changed files - especially net-new documentation or LLM-generated content. Reviews can be for single documents or multiple related documents. Focuses on information architecture, clarity, conciseness, structure, readability, and style. Identifies common LLM writing patterns that harm documentation quality and catches multi-document issues like content duplication or misplaced content. For reviewing a pull request end-to-end (fetching the PR branch, checking review threads, drafting a review to post), use the review-docs-pr skill, which applies these criteria as one of its steps.

0
installs
▌
Tech Writer · stacklok bundle
Write clear, focused technical documentation following the Diataxis framework and the project style guide. Use whenever writing or substantively editing a documentation page: drafting a new page, rewriting or restructuring an existing one, adding a major section, or turning engineering material (PR descriptions, specs, release notes, rough notes) into user-facing docs. Use it even when the request doesn't mention writing quality; it governs how pages get written here. Other authoring skills (mcp-guide-writer, upstream-release-docs) should apply this skill's references during their drafting steps. Not for editorial review of finished work (use docs-review or review-docs-pr) and not for relocating pages (use move-page).

0
installs
▌
Review Docs Pr · stacklok
Review a docs-website pull request as a subject matter expert and tech writer: read the PR at its head ref, apply the docs-review criteria to the changed pages, verify factual claims against source, and draft a body-level review for approval. Use whenever the user wants a PR evaluated, even informally: "review PR 1069", "take a look at the registry docs PR", "thoughts on this?" with a PR URL, or an initial reaction to a PR they want checked. For reviewing loose files or uncommitted changes (no PR involved), use docs-review directly.

0
installs
▌
MCP Guide Writer · stacklok
Create usage guides for MCP servers in the ToolHive documentation (docs/toolhive/guides-mcp/). Use when asked to write, create, or update a usage guide for an MCP server, e.g. "write a usage guide for the filesystem MCP server" or "document the sqlite MCP server from the registry".

0
installs
▌
Test Docs Dryrun · stacklok bundle
Fast CRD schema validation for ToolHive documentation. Extracts all YAML blocks from K8s and vMCP docs, runs kubectl apply --dry-run=server to catch field name errors, type mismatches, and schema drift. No cluster resources are created. Use for: "dry-run the docs", "validate the YAML", "check for schema issues", "run a quick doc check", or after any CRD/API change to catch doc rot. Requires a Kubernetes cluster with ToolHive CRDs installed.

0
installs
▌
Upstream Release Docs · stacklok
Analyze an upstream project's new release, verify changes against source code, and update documentation. Covers discovery, deep-dive into PRs/issues, docs audit, source-verified implementation, and review feedback handling.

0
installs
▌
Weekly Product Updates · stacklok
Generate weekly product updates by analyzing GitHub activity across ToolHive repositories and transforming technical changes into marketing-ready content. Use when you need to create product announcements, blog posts, or customer communications summarizing what shipped.

0
installs
▌
Update Vmcp YAML Example · stacklok
Updates vMCP YAML examples in documentation, verifies against toolhive source, and creates e2e tests

0
installs
▌
Deflake · stacklok bundle
Finds flaky tests on the main branch by analyzing GitHub Actions failures, ranks them by frequency, and enters parallel plan mode to design deflake strategies. Use when you want to find and fix the flakiest tests.

0
installs
▌
Add Rule · stacklok
Captures a team convention or best practice and adds it to the appropriate .claude/rules/ or .claude/agents/ file

0
installs
▌
Toolhive CLI User · stacklok bundle
Guide for using ToolHive CLI (thv) to run and manage MCP servers, skills, and AI-client plugins. Use when managing `thv ai-plugin` installs, project sync or upgrades, or plugin publishing for Claude Code or Codex; also use for MCP server and skill lifecycle commands. Covers server lifecycle, registries, secrets, client registration, builds, permissions, skills, and AI plugins. NOT for Kubernetes operator usage, ToolHive development/contributing, or general AI-client configuration unrelated to ToolHive.

0
installs
▌
Doc Review · stacklok bundle
Reviews documentation for factual accuracy

0
installs
▌
Deploy Otel · stacklok
Deploy the OpenTelemetry observability stack (Prometheus, Grafana, OTEL Collector) to a Kind cluster for testing toolhive telemetry. Use when you need to set up monitoring, metrics collection, or observability infrastructure.

0
installs
▌
Vmcp Review · stacklok
Reviews vMCP code changes for known anti-patterns that make the codebase harder to understand or more brittle. Use when reviewing PRs, planning features, or refactoring vMCP code.

0
installs
▌
Release Notes · stacklok bundle
Generates polished GitHub release notes for a ToolHive release by analyzing every merged PR, cross-referencing linked issues, dispatching expert agents to assess breaking changes, and producing a formatted release body. Use when the user provides a GitHub release URL, tag name, or says "release notes".

0
installs
▌
Implement Story · stacklok
Implements a GitHub user story from planning through PR creation, with research, codebase analysis, and structured commits.

0
installs
▌
Toolhive Release · stacklok bundle
Creates ToolHive release PRs by analyzing commits since the last release, categorizing changes, recommending semantic version bump type (major/minor/patch), and triggering the release workflow. Use when cutting a release, preparing a new version, checking what changed since last release, or when the user mentions "release", "version bump", or "cut a release".

0
installs
▌
Check Contribution · stacklok
Validates operator chart contribution practices (helm template, ct lint, docs generation) before committing changes.

0
installs
▌
Code Review Assist · stacklok
Augments human code review by summarizing changes, surfacing key review questions, assessing test coverage, and identifying low-risk sections. Use when reviewing a diff, PR, or code snippet as a senior review partner.

0
installs
▌
User Docs · stacklok
Authors or updates Mecatl's public user documentation. Use when a change affects user-docs/, the Docusaurus site content, or a user-facing behavior that needs documentation. It follows the repository's lightweight authoring contract.

0
installs
▌
Onboarding · stacklok
Route contributors through mecatl's human-reviewed development spine: contract PR, approved baseline, autonomous TDD implementation, final code-review PR. A router, not an executor. Use for onboarding or workflow questions.

0
installs
▌
Greet · stacklok
Use when asked to greet someone with the ceremonial mecatl greeting. Loads the exact greeting format.

0
installs
▌
Cut Release · stacklok
Cut a tagged release of mecatl — dispatch the Create Release PR workflow, review and merge the release PR, then verify the tag and the artifacts it publishes (ko images + Helm chart to GHCR, plus a GitHub Release with signed archives and a Homebrew formula bump). Use when asked to cut/ship/tag/publish a release or bump the version. NOT for general git tagging unrelated to a mecatl release.

0
installs
▌
Test Writer · stacklok
Writes tests in mecatl (hexagonal / strict DDD, two Go modules) following the invariant-first discipline. Picks the right layer, the right naming convention, and the right fake pattern (offline reference adapters — mockllm / memfs / memstore — plus the shared conformance suites, never a live network call or a mock-framework mock of a port). Use when adding tests, writing a new package's test surface, porting a failing scenario into a regression test, or pinning an ADR rule / AGENTS.md invariant. NOT for authoring the acceptance plan (use /to-acceptance-plan).

0
installs
▌
Panel Review · stacklok bundle
Review completed non-trivial code across four independent axes: Spec, Standards, Test adequacy, and installed Domain specialists. Use proactively after implementation, modification, refactoring, bug fixes, feature work, or when asked to review/audit/check a diff, issue, PRD, finished change, or PR. Fans reviewers out in parallel, preserves each axis, and ends with the stable PANEL machine summary. NOT for drafting code, trivial edits (use /code-review), cloud review (/code-review ultra), pure config, or posting GitHub comments (/pr-review-post).

0
installs
▌
Repo Fact · stacklok
Use when asked for this repository's registered fact or codeword. Loads the canonical answer format.

0
installs
▌
Plan Orchestrate · stacklok
Implement an approved mecatl acceptance plan with run-local decomposition, isolated TDD workers, aggregate gates, strict AC tracing, panel review, and an Implementation PR. Split work requires a merged approved plan and recorded baseline. Combined work requires an explicit no-interface rationale. Never drafts contracts, merges, or runs beyond the PR.

0
installs
▌
Perf Optimization · stacklok bundle
Profile-driven performance optimization of mecatl using the offline benchmark + scenario harness. Use when optimizing allocations or latency, reducing allocs/op or memory, profiling a Go benchmark, pinpointing a hotspot with pprof, proving a win with benchstat, adding a regression benchmark, wiring profile-guided optimization (PGO), or investigating "why is this slow / allocating" or a suspected perf regression. Covers task bench, task perf:scenarios, memprofile -> pprof, benchstat A/B, allocs-first gating, PGO setup, and the discipline (follow the profile not the hypothesis; keep pure-perf changes byte-identical; mutation-test cache guards; skip the wrong abstraction). NOT for the live perf MCP server (use perf-mcp-interpretation) or non-mecatl Go profiling.

0
installs
▌
To Acceptance Plan · stacklok bundle
Turn Bounded or Architectural work into a concise scenario-first acceptance plan with exact interfaces and a decision-record outcome, then hand off at the selected Split or Combined checkpoint. Stops before implementation or orchestration. NOT for Spike, Routine, or task decomposition.

0
installs
▌
Commit Style · stacklok
Write Conventional-Commits messages for this repo, with the required Co-Authored-By trailer.

0
installs
▌
Go Table Tests · stacklok
Write idiomatic table-driven Go tests that stay offline and follow this repo's conventions.

0
installs
▌
Mecatl Learning Config · stacklok bundle
Configure, write, or tune the mecatl learning: settings policy, including learning.mode, sensitivity, reflection budgets, and validated/evaluated activation. NOT for running /reflect, reviewing proposals or memories, drafting skills, model routing, credentials, evaluator implementation, or other harnesses.

0
installs
▌
Perf MCP Interpretation · stacklok bundle
Interpret the mecatl perf MCP server's output to diagnose latency, goroutine leaks, GC pressure, allocation churn, and memory growth in a running mecatl harness. Use when connected to the mecatl perf MCP server (the perf:// resources or the query_metric / top_cpu_functions / capture_cpu_profile / top_allocations / list_slow_turns / capture_flight_recorder tools) and investigating why mecatl is slow, leaking, or growing. Covers tool routing/cost, reading pprof rankings and runtime metrics, and the leak/contention/GC signatures. NOT for generic Go profiling or non-mecatl MCP servers.

0
installs
▌
Mecatl Model Router Config · stacklok bundle
Designs and writes a mecatl model router configuration (the `models:` subtree of ~/.config/mecatl/settings.yaml) tailored to the operator's preferences. Asks about priorities (cost vs capability, open vs proprietary, provider, multimodal) then searches the latest model benchmarks/pricing and recommends a complete alias + slot + router-category taxonomy. Use when setting up or revising model routing, picking models per slot, or building a subagent router taxonomy. NOT for provider/key wiring, permission config, or non-mecatl harnesses.

0
installs

64 published skills