XData AgentHub104 curated skills for Claude Code, Codex, OpenCode and any Agent Skills client — every one security-reviewed, sealed and signed. Instructions only, no bundled scripts.
/plugin marketplace add XData-si/xdata-agenthub/plugin install xdata-agenthub@xdata-agenthubgit clone https://github.com/XData-si/xdata-agenthubpython3 xdata-agenthub/cli/xah.py add <skill> --agent codex --scope userYour skill goes through the same security review and gets the same seal. How to contribute · How seals work
Pick the right XData AgentHub skill (or a short sequence of skills) for the task at hand and apply it with its acceptance checks. Use at the start of any non-trivial engineering, security, operations or AI task when several AgentHub skills are installed, or when the user asks which skill or workflow to use.
python3 cli/xah.py add agenthub-router --agent claude --scope userSystematically find the root cause of a bug, failing test or production error through reproduction, hypotheses and evidence before changing code. Use when something fails and the cause is not yet proven.
python3 cli/xah.py add debugging-root-cause --agent claude --scope userPlan and execute major dependency, framework or runtime upgrades in verified incremental steps with changelog review and rollback. Use when bumping a framework major version, language runtime, base image or a dependency with breaking changes.
python3 cli/xah.py add dependency-upgrade --agent claude --scope userPrepare clean branches, atomic commits and reviewable pull or merge requests without rewriting shared history or leaking secrets. Use when committing, branching, rebasing, resolving conflicts or preparing a change for review.
python3 cli/xah.py add git-workflow --agent claude --scope userRestructure code without changing behaviour, using characterization tests, small reversible steps and explicit verification. Use when cleaning up, extracting modules, renaming or simplifying code that already works.
python3 cli/xah.py add refactoring-safety --agent claude --scope userWrite accurate, user-focused release notes and changelogs from commits, merged pull requests and issues — grouped changes, breaking changes with migration steps, security fixes, deprecations and known issues. Use when preparing a release, a changelog entry or customer-facing update notes.
python3 cli/xah.py add release-notes --agent claude --scope userBuild an accurate mental model of an unfamiliar codebase — entry points, architecture, build, tests, conventions and risky areas — before making changes. Use at the start of work in a new repository or before a large change in an unfamiliar area.
python3 cli/xah.py add repository-onboarding --agent claude --scope userWrite or improve an agent skill (SKILL.md) so that agents load it at the right time and follow it reliably — trigger-focused description, scoped procedure, examples, acceptance checks and safety boundaries. Use when creating a new skill for this hub or a private catalog, or when a skill is ignored or misapplied.
python3 cli/xah.py add skill-authoring --agent claude --scope userTurn a feature request into a reviewed specification, technical plan and ordered task list before writing code. Use when starting a new feature, a multi-step change, or when requirements are vague or disputed.
python3 cli/xah.py add spec-driven-development --agent claude --scope userImplement features and bug fixes test-first with the red-green-refactor cycle, choosing the right test level and proving each test can fail. Use when writing new logic or fixing a bug where behaviour can be specified in advance.
python3 cli/xah.py add test-driven-development --agent claude --scope userWrite and review idiomatic, safe Go — error handling, context propagation, goroutine and channel lifecycles, data races, table-driven tests and module hygiene. Use when writing or reviewing Go services, CLIs or libraries, or when debugging leaks, races and hangs in Go code.
python3 cli/xah.py add go-development --agent claude --scope userReview Java and Spring Boot services for security, transactions, persistence performance and operability — Spring Security configuration, input validation, JPA N+1 queries, transaction boundaries, Actuator exposure and dependency risk. Use when reviewing or hardening a Spring Boot application or upgrading Spring versions.
python3 cli/xah.py add java-spring-review --agent claude --scope userReview iOS and Android apps for security, privacy and release readiness — secure storage, network security, authentication flows, permissions, privacy disclosures, logging, and store requirements. Use when reviewing a mobile app before release, after adding SDKs, or when handling personal data on devices.
python3 cli/xah.py add mobile-app-review --agent claude --scope userReview Node.js backends (Express, Fastify, NestJS) for security and reliability — input validation, authentication middleware, async error handling, event-loop blocking, dependency risk, and secure HTTP defaults. Use when reviewing or hardening a Node.js API, or when it crashes on unhandled rejections or stalls under load.
python3 cli/xah.py add node-backend-review --agent claude --scope userReview Python web applications built with Django or FastAPI for security, data access and deployment correctness — settings, authentication and permissions, ORM queries, async pitfalls, input validation and production server configuration. Use when reviewing or hardening a Django or FastAPI service.
python3 cli/xah.py add python-web-review --agent claude --scope userReview React components and hooks for correctness, rendering performance, accessibility and XSS safety — effect dependencies, state ownership, keys, memoization, server/client boundaries and dangerouslySetInnerHTML. Use when reviewing React or Next.js UI code, or when a component re-renders too often, flickers or loses state.
python3 cli/xah.py add react-component-review --agent claude --scope userReview Rust code for soundness and robustness — unsafe blocks, panics and unwrap, error types, ownership in async code, Send/Sync, dependency and feature hygiene. Use when reviewing Rust crates, services or FFI code, or before publishing a crate.
python3 cli/xah.py add rust-review --agent claude --scope userDesign and review caching (Redis, Memcached, CDN, HTTP and in-process caches) — what to cache, keys and invalidation, TTLs, stampede protection, per-user data isolation and failure behaviour. Use when adding a cache to fix latency or load, or when stale data, cache stampedes or data leaks between users appear.
python3 cli/xah.py add caching-strategy --agent claude --scope userReview batch and streaming data pipelines (ETL/ELT, dbt, Airflow, Dagster, Spark) for correctness and operability — idempotent re-runs, incremental logic, late data, schema drift, backfills, lineage and data protection. Use when building or reviewing a data pipeline or investigating wrong or missing numbers in reports.
python3 cli/xah.py add data-pipeline-review --agent claude --scope userDefine and implement data quality checks and data contracts — freshness, volume, schema, uniqueness, validity, referential integrity and reconciliation — with owners, thresholds and alerting. Use when stakeholders distrust a dataset, before exposing data to ML or reports, or when introducing data contracts between teams.
python3 cli/xah.py add data-quality-checks --agent claude --scope userDesign and review event-driven systems and message queues (Kafka, RabbitMQ, SQS, NATS) — delivery guarantees, idempotent consumers, the transactional outbox, ordering, retries and dead-letter queues, schema evolution and replay. Use when introducing asynchronous messaging, debugging duplicate or lost messages, or reviewing consumers and producers.
python3 cli/xah.py add event-driven-architecture --agent claude --scope userUse feature flags safely for progressive delivery, experiments and kill switches — flag types, targeting, defaults when the flag service fails, ownership, audit and removal of stale flags. Use when introducing a flag system, rolling out risky changes gradually, or cleaning up flag debt.
python3 cli/xah.py add feature-flags --agent claude --scope userReview GraphQL APIs for authorization, abuse resistance and performance — field-level authorization, query depth and cost limits, introspection in production, batching, N+1 resolvers and schema evolution. Use when building or reviewing a GraphQL server or gateway.
python3 cli/xah.py add graphql-api-review --agent claude --scope userInternationalize and localize software correctly — externalized strings, ICU message format with plurals, locale-aware dates, numbers and currencies, Unicode and text direction, translation workflow and pseudo-localization tests. Use when an application must support several languages (for example the official languages of EU markets) or when translations break layouts or grammar.
python3 cli/xah.py add i18n-localization --agent claude --scope userReview web and app interfaces for accessibility (WCAG) with observable evidence — keyboard use, focus, screen readers, contrast and forms. Use when reviewing UI changes, before a release, or when accessibility issues are reported.
python3 cli/xah.py add accessibility-review --agent claude --scope userDesign and review stable HTTP APIs with explicit contracts, authorization and operational behaviour. Use when adding or changing endpoints, writing an OpenAPI specification, or reviewing breaking changes.
python3 cli/xah.py add api-design --agent claude --scope userDesign and review reliable third-party API integrations — authentication, timeouts, retries, rate limits, idempotency and failure handling. Use when connecting to an external service or debugging a flaky integration.
python3 cli/xah.py add api-integration --agent claude --scope userReview code changes for correctness, security, maintainability and test coverage with evidence-based findings. Use when reviewing a pull or merge request, a diff or a patch before merge.
python3 cli/xah.py add code-review --agent claude --scope userPlan and review schema and data migrations that deploy without downtime or data loss, using expand-contract, batching and tested rollback. Use when adding, renaming or removing columns, tables, indexes or constraints, or backfilling data.
python3 cli/xah.py add database-migrations --agent claude --scope userUpdate technical documentation so it matches verified implementation — READMEs, setup steps, configuration and changelogs. Use after changing behaviour, interfaces or setup, or when documentation is reported as outdated.
python3 cli/xah.py add documentation --agent claude --scope userReview how code detects, propagates, reports and recovers from errors — exceptions, retries, timeouts, partial failure and user-facing messages. Use when reviewing service code, integrations, background jobs or after incidents caused by swallowed or misleading errors.
python3 cli/xah.py add error-handling-review --agent claude --scope userReview frontend code for correctness and resilience — state and async transitions, forms and validation, untrusted rendering, keyboard and responsive layout, loading and network failures. Use when reviewing UI changes or a new frontend component.
python3 cli/xah.py add frontend-review --agent claude --scope userDiagnose performance problems with controlled, reproducible measurements and profilers before optimising. Use when something is slow, CPU or memory usage is high, or before and after optimisation work.
python3 cli/xah.py add performance-profiling --agent claude --scope userDesign and run reproducible Python tests with isolated fixtures, regression cases and evidence-based reporting (pytest or unittest). Use when adding tests, fixing a bug in Python code, or making a test suite reliable.
python3 cli/xah.py add python-testing --agent claude --scope userReview and harden Bash/POSIX shell scripts for quoting, error handling, injection, portability and safe file operations. Use when writing or reviewing install scripts, CI steps, cron jobs or any script that runs with elevated privileges.
python3 cli/xah.py add shell-script-review --agent claude --scope userReview SQL for correctness, security and performance — injection, transactions, NULL handling, indexes and query plans. Use when writing or reviewing queries, views or stored procedures.
python3 cli/xah.py add sql-review --agent claude --scope userWrite executable, maintainable technical documentation for a defined audience — prerequisites, minimal working examples, expected output, troubleshooting and verified commands. Use when writing a guide, tutorial or setup instructions for others to follow.
python3 cli/xah.py add technical-writing --agent claude --scope userDesign reproducible TypeScript tests for runtime behaviour, types and asynchronous failure paths (Vitest, Jest or node:test). Use when adding tests to TypeScript or JavaScript code or making them reliable.
python3 cli/xah.py add typescript-testing --agent claude --scope userRecord architectural decisions as ADRs with context, options, trade-offs and consequences. Use when choosing between technologies, patterns or designs that are expensive to reverse.
python3 cli/xah.py add architecture-decision --agent claude --scope userReview and reduce cloud and platform permissions to least privilege — human and workload identities, wildcard policies, long-lived keys, cross-account trust, privilege escalation paths, break-glass and access reviews. Use when auditing AWS, Azure, GCP or Kubernetes RBAC permissions, after an incident, or when onboarding automation such as CI or AI agents.
python3 cli/xah.py add cloud-iam-least-privilege --agent claude --scope userReview personal-data handling — data inventory, legal basis, minimisation, retention, access and deletion of data subject requests (GDPR-style). Use when a feature collects, stores or shares personal data.
python3 cli/xah.py add data-privacy --agent claude --scope userAudit direct and transitive dependencies against advisories, with reachability, provenance, integrity and licence checks, and minimal update proposals. Use when adding a dependency, before a release, or when a vulnerability advisory appears.
python3 cli/xah.py add dependency-audit --agent claude --scope userAssess Model Context Protocol (MCP) servers before agent integration — tool side effects, trust boundaries, permissions and failure modes. Use when connecting an agent to an MCP server or reviewing one.
python3 cli/xah.py add mcp-review --agent claude --scope userDesign and review network segmentation and firewall rules — zones, allowed flows, management access, east-west traffic, Kubernetes network policies, VPN and zero-trust access — with verification from outside and inside. Use when planning network layout, reviewing firewall or security-group rules, or containing lateral movement after an incident.
python3 cli/xah.py add network-segmentation --agent claude --scope userReview OAuth 2.x and OpenID Connect integrations — flows, PKCE, redirect URIs, token validation, scopes, sessions and logout — for common security mistakes. Use when adding SSO or social login, building an API that accepts bearer tokens, or connecting clients such as MCP servers or SPAs to an identity provider.
python3 cli/xah.py add oauth-oidc-review --agent claude --scope userCheck open-source licence compliance for software you distribute or offer as a service — dependency licence inventory (SBOM, SPDX identifiers), compatibility, copyleft obligations (GPL, LGPL, AGPL, MPL), attribution and notice files, and policy exceptions. Use before releasing software, shipping containers or devices, accepting new dependencies, or answering customer due-diligence questions. Not legal advice.
python3 cli/xah.py add open-source-license-compliance --agent claude --scope userAssess a web application or API against the OWASP Application Security Verification Standard (ASVS) — choose the level, map requirements to evidence, test key controls and report gaps. Use when security requirements must be verifiable (procurement, customers, certification preparation) or as a structured complement to code review and penetration tests.
python3 cli/xah.py add owasp-asvs-review --agent claude --scope userDefend LLM applications and agents against prompt injection — separating instructions from untrusted data, limiting tool permissions and testing with attack cases. Use when an LLM processes user input, documents, web pages or tool output.
python3 cli/xah.py add prompt-injection-defense --agent claude --scope userReview the lifecycle of secrets and credentials — storage, injection, scoping, rotation, revocation and leak detection. Use when adding credentials to an application or CI, after a suspected leak, or when auditing access.
python3 cli/xah.py add secrets-management --agent claude --scope userPerform an evidence-based security review of code or a design — injection, authentication, authorization, data exposure and unsafe defaults. Use when reviewing security-sensitive changes or before exposing a service.
python3 cli/xah.py add security-review --agent claude --scope userPrepare an authorized security test or penetration test engagement — scope, rules of engagement, written authorization, test windows, data handling, communication and stop conditions — and review the resulting report. Use before commissioning or running penetration tests, red-team exercises or bug bounty programs, or when an AI agent is asked to perform security testing.
python3 cli/xah.py add security-testing-scope --agent claude --scope userEstablish build provenance for software artefacts — pinned inputs, SBOMs, signatures, attestations and verification at deploy time (SLSA-style). Use when hardening CI/CD release pipelines, publishing container images or packages, or deciding whether an artefact can be trusted.
python3 cli/xah.py add supply-chain-provenance --agent claude --scope userProduce a lightweight, evidence-based threat model — data flows, trust boundaries, STRIDE threats, risk ranking and mitigations — for a system or feature. Use when designing a new service, exposing an API, adding an AI agent or tool integration, or before a security review.
python3 cli/xah.py add threat-modeling --agent claude --scope userTriage and remediate vulnerabilities from scanners, advisories and reports with risk-based prioritisation — CVSS plus exploitation evidence (EPSS, CISA KEV), reachability, exposure and asset criticality — with SLAs, exceptions and verification. Use when scanner backlogs grow, a critical CVE is announced, or a vulnerability process must satisfy NIS2, CRA or customers.
python3 cli/xah.py add vulnerability-management --agent claude --scope userPrepare software and connected products for the EU Cyber Resilience Act (Regulation (EU) 2024/2847) — scope and role, essential security requirements, vulnerability handling, SBOM, support period, conformity assessment, and the reporting of actively exploited vulnerabilities and severe incidents. Use when you sell or distribute software or devices in the EU, maintain open-source software used commercially, or plan secure development and release processes. Not legal advice.
python3 cli/xah.py add cyber-resilience-act --agent claude --scope userPrepare an engineering-level readiness assessment for DORA, the EU Digital Operational Resilience Act (Regulation (EU) 2022/2554) — ICT risk management, major incident classification and reporting, resilience testing, ICT third-party risk and the register of information. Use when you are a financial entity in the EU or an ICT provider serving one, or when preparing for DORA supervision or audits. Not legal advice.
python3 cli/xah.py add dora-readiness --agent claude --scope userPrepare a GDPR Data Protection Impact Assessment (DPIA) for high-risk processing — screening, systematic description, necessity and proportionality, risks to individuals, mitigating measures and consultation — producing evidence for the controller and DPO. Use when introducing processing likely to be high risk (large-scale personal data, monitoring, profiling, new technologies such as AI, sensitive data). Not legal advice.
python3 cli/xah.py add dpia --agent claude --scope userPrepare an engineering-level readiness assessment for the EU AI Act (Regulation (EU) 2024/1689) — inventory AI systems, determine role and risk category, map obligations and evidence gaps. Use when an AI feature is offered in or to users in the EU, or when compliance, procurement or customers ask about AI Act status. Not legal advice.
python3 cli/xah.py add eu-ai-act-readiness --agent claude --scope userAssess and improve the digital sovereignty of a system for European organisations — where data, keys, operations and AI processing reside, exposure to non-EU jurisdiction, GDPR international transfers, provider lock-in and exit plans. Use when choosing cloud, SaaS or AI providers, handling personal or confidential data in the EU, or answering customer and procurement questions about sovereignty. Not legal advice.
python3 cli/xah.py add eu-data-sovereignty --agent claude --scope userPrepare digital products and services for the European Accessibility Act (Directive (EU) 2019/882) — scope (e-commerce, banking, e-books, transport, electronic communications, certain devices), accessibility requirements via EN 301 549 and WCAG, microenterprise exemptions, accessibility statements and ongoing testing. Use when an organisation offers in-scope products or services to consumers in the EU. Not legal advice.
python3 cli/xah.py add european-accessibility-act --agent claude --scope userHandle GDPR data subject requests end to end — access, rectification, erasure, restriction, portability and objection — with identity verification, data discovery across systems, deadlines, exemptions and evidence. Use when building a request process, automating erasure or export across services, or answering a specific request. Not legal advice.
python3 cli/xah.py add gdpr-dsar-handling --agent claude --scope userPrepare an engineering-level NIS2 readiness assessment — scope and entity type, management accountability, the cybersecurity risk-management measures, supply-chain security, and the 24-hour / 72-hour / one-month incident reporting process. Use when an organisation operates in a NIS2 sector in the EU, supplies such organisations, or is asked by customers or regulators about NIS2. Not legal advice.
python3 cli/xah.py add nis2-readiness --agent claude --scope userReview Ansible playbooks and roles for idempotency, safety and secret handling — check mode and diff, privilege escalation, module choice over shell commands, Ansible Vault, inventory hygiene and testing with Molecule. Use when writing or reviewing configuration management code or before running playbooks against production hosts.
python3 cli/xah.py add ansible-review --agent claude --scope userEvaluate recoverability through real restore tests — RPO/RTO, backup coverage, off-site copies and restore duration. Use when setting up backups, auditing a backup system, or after data loss.
python3 cli/xah.py add backup-restore --agent claude --scope userDesign CI/CD pipelines that are fast, reproducible and safe to deploy from — stage layout, caching, test pyramid in CI, artifact promotion across environments, approvals, secrets handling and rollback. Use when creating or restructuring a pipeline on any CI system (GitLab CI, GitHub Actions, Jenkins, Woodpecker) or when pipelines are slow, flaky or deploy untested builds.
python3 cli/xah.py add ci-cd-pipeline-design --agent claude --scope userFind and reduce cloud and hosting spend with evidence (FinOps) — cost allocation and tagging, idle and oversized resources, storage lifecycle, data transfer, commitments, and AI/LLM usage costs — without hurting reliability. Use when bills grow unexpectedly, before budgeting, or when asked to cut infrastructure costs.
python3 cli/xah.py add cloud-cost-optimization --agent claude --scope userMake container images smaller, faster to build and pull, and with fewer vulnerabilities — multi-stage builds, minimal base images, layer ordering and cache mounts, .dockerignore, non-root runtime and reproducible tags. Use when images are large or slow to build, when scanners report many base-image CVEs, or when preparing images for production.
python3 cli/xah.py add container-image-optimization --agent claude --scope userHarden Dockerfiles, images and container runtime settings — minimal base images, non-root users, pinned digests, capabilities and secrets handling. Use when writing or reviewing a Dockerfile or Compose file, or before deploying containers.
python3 cli/xah.py add docker-hardening --agent claude --scope userDiagnose and configure email authentication and deliverability — SPF, DKIM, DMARC, reverse DNS, MTA-STS and bounce handling — for a domain or application sender. Use when emails land in spam, a new sending service is added, or a domain needs protection against spoofing.
python3 cli/xah.py add email-deliverability --agent claude --scope userReview GitHub Actions workflows for security and reproducibility — token permissions, pinned actions, untrusted pull-request triggers and secret exposure. Use when adding or changing workflows in .github/workflows.
python3 cli/xah.py add github-actions --agent claude --scope userReview GitLab CI/CD pipelines for security and reproducibility — job permissions, protected variables, untrusted merge-request pipelines, pinned images and deploy approvals. Use when adding or changing .gitlab-ci.yml.
python3 cli/xah.py add gitlab-ci --agent claude --scope userReview Helm charts for safe defaults and maintainability — values schema, templating pitfalls, security context, resources and probes, secrets handling, upgrade and rollback behaviour, and chart dependencies. Use when writing, upgrading or consuming a Helm chart, including third-party charts before installing them in a cluster.
python3 cli/xah.py add helm-chart-review --agent claude --scope userReview Kubernetes workload and cluster manifests for security, resilience and operability — resources, probes, security context, network policies and RBAC. Use when writing or reviewing manifests, Helm charts or Kustomize overlays.
python3 cli/xah.py add kubernetes-review --agent claude --scope userAudit and harden a Linux server — SSH, users and sudo, patching, firewall, exposed services, logging and file permissions — with verification and a safe rollback path. Use when provisioning a new server or VPS, after an incident, or when reviewing an existing host's security baseline.
python3 cli/xah.py add linux-server-hardening --agent claude --scope userDiagnose PostgreSQL latency with evidence — EXPLAIN (ANALYZE, BUFFERS) on a safe replica, estimate vs actual rows, index selectivity, autovacuum, bloat and lock waits. Use when queries are slow, the database is overloaded, or before adding indexes.
python3 cli/xah.py add postgres-performance --agent claude --scope userPlan safe, reproducible releases — versioning, changelog, artefacts, staged rollout, verification and rollback. Use when preparing a release, tagging a version or defining a release process.
python3 cli/xah.py add release-management --agent claude --scope userReview reverse proxy and TLS configuration (nginx, Caddy, Traefik, HAProxy, managed proxies) — certificates, protocols, headers, timeouts, forwarded headers and exposure of upstreams. Use when publishing a service on a domain, debugging 502/504 or certificate errors, or auditing edge security.
python3 cli/xah.py add reverse-proxy-tls --agent claude --scope userReview Terraform plans and code — state boundaries, destructive changes, provider pinning, secrets and least-privilege IAM. Use before terraform apply or when reviewing infrastructure-as-code changes.
python3 cli/xah.py add terraform-review --agent claude --scope userRun controlled failure experiments to verify resilience — steady-state hypotheses, blast-radius control, fault injection (instance loss, latency, dependency failure, DNS, disk), abort conditions and learning reviews. Use when validating redundancy, failover, timeouts and alerts before relying on them, or after resilience-related incidents.
python3 cli/xah.py add chaos-engineering --agent claude --scope userPlan and run disaster recovery exercises that prove recovery time and data loss objectives — scenarios, recovery runbooks, dependencies and credentials, restore in an isolated environment, timing and gaps. Use when DR plans exist only on paper, before audits (NIS2, DORA, ISO 27001), or after major infrastructure changes.
python3 cli/xah.py add disaster-recovery-drill --agent claude --scope userCoordinate authorised incident triage, containment and recovery while preserving evidence and communicating status. Use during an active outage or security incident.
python3 cli/xah.py add incident-response --agent claude --scope userPlan, run and interpret load and performance tests (k6, Locust, Gatling, JMeter) — realistic workload models, test types, environment parity, metrics and bottleneck analysis. Use before launches or traffic peaks, after architecture changes, or when capacity limits are unknown.
python3 cli/xah.py add load-testing --agent claude --scope userInvestigate application, proxy and system logs to establish what happened — correlating timestamps and request IDs, quantifying error patterns and separating signal from noise. Use when triaging an incident, explaining a failed job or request, or verifying that a fix worked.
python3 cli/xah.py add log-analysis --agent claude --scope userDefine logging standards for applications and services — structured JSON logs, levels, correlation IDs, what to log for security and audit, redaction of secrets and personal data, retention and log pipeline reliability. Use when designing logging for a new service, cleaning up noisy or leaky logs, or preparing for security monitoring and GDPR compliance.
python3 cli/xah.py add logging-standards --agent claude --scope userDesign actionable telemetry — metrics, logs, traces, dashboards and alerts tied to user impact. Use when instrumenting a service, building dashboards, or when incidents were detected late.
python3 cli/xah.py add observability --agent claude --scope userWrite a blameless incident postmortem with an accurate timeline, impact, contributing factors and tracked corrective actions. Use after an outage, security incident, data issue or near miss once the service is stable.
python3 cli/xah.py add postmortem --agent claude --scope userWrite operational runbooks that an on-call engineer or agent can follow under pressure — triggers, diagnosis, safe actions, escalation and verification. Use when creating alerts, after an incident revealed missing procedures, or when handing over a service to operations.
python3 cli/xah.py add runbook-authoring --agent claude --scope userDefine user-centred service level indicators and objectives, error budgets and burn-rate alerts that reflect real user experience. Use when setting reliability targets, reducing noisy alerts, or deciding between feature work and reliability work.
python3 cli/xah.py add slo-error-budgets --agent claude --scope userEvaluate AI agent behaviour on reproducible tasks — task success, tool use, safety, cost and failure modes. Use when comparing agent configurations, models or prompts, or before giving an agent more autonomy.
python3 cli/xah.py add agent-evaluation --agent claude --scope userDesign permissions, approvals, sandboxing, budgets and audit for autonomous or semi-autonomous AI agents so that mistakes and prompt injection have bounded impact. Use when deploying coding agents, ops agents or tool-using assistants, or when granting an agent new credentials or tools.
python3 cli/xah.py add agent-guardrails --agent claude --scope userPlan and run authorized red-team testing of LLM applications and agents — threat-driven test plans for prompt injection, jailbreaks, data leakage, tool misuse, harmful outputs and denial of wallet — with reproducible cases, severity ratings and regression suites. Use before launching an LLM feature or agent, after model or prompt changes, or when preparing AI Act or customer security evidence.
python3 cli/xah.py add ai-red-teaming --agent claude --scope userChoose and evaluate embedding models for search, RAG and clustering — multilingual quality, dimensions and cost, context length, licence and hosting (EU or self-hosted), benchmarking on your own queries, and safe migration between models. Use when building a vector search or RAG index, when retrieval quality is poor in some languages, or when planning to switch embedding models.
python3 cli/xah.py add embedding-model-selection --agent claude --scope userModel LLM cost and latency with transparent assumptions — token volumes, pricing, caching, model choice and quality trade-offs. Use when budgeting an LLM feature, choosing a model, or investigating rising spend.
python3 cli/xah.py add llm-cost-analysis --agent claude --scope userDesign an LLM gateway layer — one OpenAI-compatible endpoint with per-team keys, model aliases, routing and fallbacks, budgets, rate limits, caching and logging policy (for example LiteLLM, Portkey, Envoy AI Gateway or a cloud gateway). Use when several applications or agents consume models from multiple providers, or when costs and keys are getting out of control.
python3 cli/xah.py add llm-gateway-routing --agent claude --scope userInstrument LLM applications and agents for production — traces of prompts, retrieval and tool calls, token usage and cost, latency, errors, user feedback and quality signals — with privacy controls and sampling (for example with OpenTelemetry GenAI conventions, Langfuse or similar). Use when running LLM features in production, debugging agent behaviour, or controlling AI costs.
python3 cli/xah.py add llm-observability --agent claude --scope userBuild an evaluation harness for LLM features — test sets, deterministic checks, rubric or LLM-as-judge scoring with calibration, and release thresholds. Use when changing models, prompts or parameters, comparing providers, or proving an LLM feature meets quality targets.
python3 cli/xah.py add llm-output-evaluation --agent claude --scope userExtract structured data from documents and text with LLMs reliably — JSON schemas, constrained decoding or tool calling, field-level validation, confidence and abstention, chunking for long documents, human review queues and accuracy measurement. Use when turning invoices, contracts, emails, tickets or forms into structured records with an LLM.
python3 cli/xah.py add llm-structured-extraction --agent claude --scope userPlan and operate self-hosted LLM inference (vLLM, llama.cpp, Ollama, TGI) — GPU memory sizing, quantization, context length, concurrency, an OpenAI-compatible API and benchmarking. Use when choosing hardware or models for on-premise or private inference, or when a local model server is slow or runs out of memory.
python3 cli/xah.py add local-llm-serving --agent claude --scope userDesign and build a Model Context Protocol (MCP) server with well-scoped tools, input validation, authentication, safe defaults and tests. Use when exposing an internal API, database or service to AI agents through MCP, or when extending an existing MCP server.
python3 cli/xah.py add mcp-server-development --agent claude --scope userDeploy and operate machine-learning models in production (MLOps) — model registry and versioning, reproducible training, packaging and serving, staged rollout (shadow, canary), monitoring for data and prediction drift, retraining triggers and rollback. Use when taking a trained model to production or when a deployed model degrades silently.
python3 cli/xah.py add ml-model-deployment --agent claude --scope userDesign and review multi-agent systems — when to split work across agents, orchestrator and worker roles, task contracts, shared state, isolation of tools and credentials, budgets, human checkpoints and evaluation. Use when building agent teams (planner/coder/reviewer, research swarms, support triage) or when a multi-agent setup is slow, expensive or unpredictable.
python3 cli/xah.py add multi-agent-orchestration --agent claude --scope userDesign and review system prompts and prompt templates for clarity, structure, grounding, output format and injection resistance, with a small regression set. Use when writing or changing prompts for an LLM feature, chatbot, agent or extraction pipeline.
python3 cli/xah.py add prompt-design-review --agent claude --scope userEvaluate retrieval-augmented generation — retrieval recall, answer faithfulness, citations, abstention and access control on a fixed question set. Use when building or changing a RAG assistant, its index or its prompts.
python3 cli/xah.py add rag-evaluation --agent claude --scope userDesign the ingestion side of retrieval-augmented generation — source connectors, parsing, chunking, metadata, access control, embeddings, hybrid search and incremental updates. Use when building or rebuilding a knowledge index for an assistant, or when retrieval quality is poor. Pair with rag-evaluation to measure results.
python3 cli/xah.py add rag-ingestion-design --agent claude --scope userListed servers are metadata from the official MCP Registry, pinned to one version. L0 means listed only: not reviewed, scanned or tested. Verification levels
Connect to Atlassian Jira, Confluence, Loom, and more to search, create, and manage your work.
com.atlassian/atlassian-mcp-server 2.0.0 · streamable-httpAll Azure MCP tools to create a seamless connection between AI agents and Azure services.
com.microsoft/azure 3.0.0-beta.48 · stdioBrave Search MCP Server: web results, images, videos, rich results, AI summaries, and more.
io.github.brave/brave-search-mcp-server 2.1.3 · stdioOfficial ClickHouse MCP server for querying and exploring ClickHouse clusters and chDB.
io.github.ClickHouse/mcp-clickhouse 0.7.0 · stdioCloudflare MCP servers
com.cloudflare.mcp/mcp 1.0.0 · sse, streamable-httpUp-to-date docs for AI agents
io.github.upstash/context7 4.4.4 · stdio, streamable-httpConnect AI agents to Exa for web search, content fetching, and multi-step research.
ai.exa/exa 3.4.1 · streamable-httpThe Figma MCP server brings Figma design context directly into your AI workflow.
com.figma.mcp/mcp 1.0.3 · streamable-httpFirecrawl, the context API for AI agents: search, scrape, interact with the web, plus paper search.
io.github.firecrawl/firecrawl-mcp-server 3.36.0 · stdio, streamable-httpConnect AI assistants to GitHub - manage repos, issues, PRs, and workflows through natural language.
io.github.github/github-mcp-server 2.0.3 · stdio, streamable-httpOfficial GitLab MCP Server
com.gitlab/mcp 0.0.1 · streamable-httpAn MCP server giving access to Grafana dashboards, data and more.
io.github.grafana/mcp-grafana v2.1.1 · stdio, streamable-httpAccess 100+ LLMs with one API: GPT-4, Claude, Gemini, Mistral, and more.
io.github.BerriAI/litellm-mcp 1.0.2 · stdioJira and Confluence for Cloud and Server/Data Center (self-hosted). Community server, not published by Atlassian.
io.github.sooperset/mcp-atlassian 0.23.1 · stdioOfficial Microsoft Learn MCP Server – real-time, trusted docs & code samples for AI and LLMs.
com.microsoft/microsoft-learn-mcp 1.0.0 · streamable-httpMongoDB Model Context Protocol Server
io.github.mongodb-js/mongodb-mcp-server 3.2.1 · stdioOfficial Notion MCP server
com.notion/mcp 1.0.1 · sse, streamable-httpPlaywright Tools for MCP
io.github.microsoft/playwright-mcp 0.0.82 · stdioMCP server for Sentry - error monitoring, issue tracking, and debugging for AI assistants
io.github.getsentry/sentry-mcp 0.42.0 · stdio, streamable-httpMCP server integrating with Stripe - tools for customers, products, payments, and more.
com.stripe/mcp 0.2.4 · streamable-httpMCP server for interacting with the Supabase platform
com.supabase/mcp 0.14.0 · stdio, streamable-httpMCP server for advanced web search using Tavily
io.github.tavily-ai/tavily-mcp 0.2.15 · stdioGenerate more accurate Terraform and automate workflows for HCP Terraform and Terraform Enterprise
io.github.hashicorp/terraform-mcp-server 1.4.1 · stdio