For any security-related task — threat triage, incident response, MITRE ATT&CK mapping, CVE lookup, exploit analysis, defensive control validation, red/blue/purple team work — always consult the local corpus first. Assumes the RAG is loaded with security content (cybersecurity preset, MITRE data, threat reports…
Before answering any technical question, code request, architecture decision, or factual claim, call searchknowledge to check the local corpus. Trigger on any query that could be answered with prior work, indexed docs, ADRs, runbooks, or team context. Prevents hallucination and forces reliance on the indexed knowledge…
Every technical claim drawn from the local corpus must ship with a source citation formatted as path:line or path:section. Trigger whenever the response quotes, paraphrases, or acts on knowledge that came from a searchknowledge or getdocument call. Makes answers auditable and lets the user jump to source in one click.
At the start of every new session or when the topic shifts significantly, probe the knowledge base to learn what is indexed. Calls getindexstats + listcategories + a couple of exploratory searchknowledge queries. Prevents the agent from operating blind or making wrong assumptions about what the corpus contains.
Periodically measure the retrieval quality of the knowledge base using evaluateretrieval (MRR@5, Recall@5, Precision@5) plus getindexstats for health metrics. Run weekly, after significant reindex activity, or when the user reports declining answer quality. Prevents silent index rot and grounds "should we tune X"…
After making a non-obvious architectural decision, solving a novel bug, agreeing on a coding standard, or reaching a conclusion worth remembering, index it back into the knowledge base so the next occurrence is one search away. Uses adddocument or addfromurl. Closes the feedback loop that makes a RAG-backed team…
When performing code review on a PR, diff, snippet, or "look at this change" request, first consult the corpus for related ADRs, coding standards, prior patterns, and similar files. Grounds review comments in the team's actual decisions instead of generic best practices. Trigger on any review-style request — "review"…
Three-step multi-tool workflow — search the corpus, fetch the most relevant document in full, then find similar documents. Use when a single searchknowledge hit is not enough because the user asked a "how does X work end to end" or "explain the pattern" or "give me the full picture" question. Prevents shallow answers…
When the user reports a bug, error message, stack trace, unexpected behavior, or "why is this broken" question, search the corpus first for prior occurrences, known fixes, or related runbooks. Prevents re-solving problems the team already solved. Trigger on any error signature, exception name, stack trace snippet, or…
Only reach for external web search when the local corpus comes back empty or clearly insufficient. Forces the agent to try knowledge-rag first, then explicitly document why it needed to escalate. Prevents wasted API cost, latency, and (in air-gapped deployments) accidental network calls.