Compatibility escalation reviewer. Invoked when tool/prompt/resource API signatures change, SDK version bumps, or backward-compatibility is at risk. Evaluates breaking changes, deprecation paths, and version constraint consistency. Read-only — never modifies files.
Operational safety escalation reviewer. Invoked when changes touch mutating tool guards, safety parameters, audit logging, or blast-radius logic. Critical for cluster management tools — a missed guard can trigger destructive operations across an entire fleet. Read-only — never modifies files.
Architecture escalation reviewer. Invoked by staff-reviewer when a change involves new packages, API surface changes, or structural refactors. Evaluates package design, API contracts, and dependency choices. Can escalate further to security or performance reviewers. Read-only — never modifies files.
Provenance and supply-chain escalation reviewer. Invoked when go.mod or go.sum changes. Evaluates new dependency licenses, maintenance status, version pins, and SDK version constraints. Read-only — never modifies files.
Read-only research agent for resolving uncertainty. Searches repo first, then official documentation. Use when implementation or review encounters unknowns.
Security escalation reviewer. Invoked when auth/mTLS/token handling changes, input validation or sanitization logic is modified, hook or enforcement mechanisms change, or file path allowlist logic is touched. Read-only — never modifies files.
Single entry-point reviewer. Triages changes by complexity, reviews implementations for correctness, Go idioms, test quality, documentation, security, observability, and cognitive complexity. Escalates to domain reviewers only when concrete risk is identified. Read-only — never modifies files.
Runs before the agent uses a tool for Bash, mcp__github__push_files and mcp__github__create_or_update_file tool calls, executing require-review.sh via bash (3 commands). From Nosmoht/talos-mcp-server.
Scaffold a new Talos MCP tool handler with correct signature, args struct, safety-guard defaults, registration, inventory update, and a test stub. Use when adding a new talos tool to internal/tools/.
Extract the current tool/prompt/resource inventory from internal/{tools,prompts,resources} and update the inventory tables in AGENTS.md and README.md. Defaults to dry-run. Use when handlers are added, renamed, or removed.
Pre-tag validation for talos-mcp releases — resolve release range, scan conventional commit prefixes, derive expected bump, run goreleaser check, verify release.yml npm OIDC invariants (node-version "24", no registry-url, --provenance). Run before pushing a v tag.
Instructions for Nosmoht/talos-mcp-server, covering agents.md, scope and source of truth, do not put in agents.md, commands and operator install / upgrade.
MCP server for Talos Linux — resources, services, logs, health, config, lifecycle via gRPC. Runs locally from the talos-mcp npm package. Needs 13 environment variables to run.