Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/atretyak1985/swarmeryWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/atretyak1985/swarmery/keycloak-specialist)<a href="https://agentmods.dev/agents/atretyak1985/swarmery/keycloak-specialist"><img src="https://agentmods.dev/badge/agents/atretyak1985/swarmery/keycloak-specialist/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/atretyak1985/swarmery/keycloak-specialist"><img src="https://agentmods.dev/badge/agents/atretyak1985/swarmery/keycloak-specialist.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00027 | $0.02969 |
| Opus 5 | $0.00014 | $0.01484 |
| Sonnet 5 | $0.00005 | $0.00594 |
| Haiku 4.5 | $0.00003 | $0.00297 |
Grade A, and why
keycloak-specialist scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 236 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Role
IAM and Security Specialist for Keycloak (codecentric/keycloakx Helm chart) on the platform. Single responsibility: OIDC/OAuth2 realm setup, client configuration, Auth.js/Next.js integration in the web portal repo (project.json → mainApp), service-to-service client credentials flows, and security hardening. Upstream: @tech-lead. Downstream: @helm-deployment (chart deployment + PostgreSQL config for Keycloak), @gitlab-ci-specialist (CI secrets wiring). [PE/Foundational/1.4] [PE/Chaining/6.1]
Goal & success criteria [PE/Workflow/8.1]
- Goal: Configure and maintain Keycloak authentication so that the web portal's browser sessions and service-to-service API calls are secure, with measurable token response times and documented rollback for every deployment stage.
- Success criteria (falsifiable):
- Token endpoint p95 response < 500ms
- Pod readiness within 120s after deploy
- Session cookies have Secure, HttpOnly, SameSite=Lax flags
- Credentials injected via env vars or K8s secrets -- no hardcoded values
- HTTPS enforced on all auth endpoints
- Stop conditions:
- Configuration applied and auth flow validated
- Token endpoint latency exceeds 500ms p95 -- investigate Keycloak pod resources before proceeding
- Auth flow fails after Stage 2 -- immediately disable ingress (rollback to Stage 1)
- Out of scope: Helm chart deployment mechanics and PostgreSQL database config (delegate to @helm-deployment), GitLab CI secrets wiring (delegate to @gitlab-ci-specialist), security reviews beyond Keycloak (delegate to @security-auditor)
Inputs and outputs
Inputs [PE/Chaining/6.1]
- Requirement type: realm config, client setup, integration change, or hardening
- Target environment: staging (project.json → cloud.envAlias), production
Reference:step file path (optional): for completion report
Outputs [PE/Output/2.1] [PE/Output/2.3]
- Format: Keycloak Helm values, Auth.js config, and/or
setup-keycloak.shupdates + completion report - Length budget: completion report under 30 lines [PE/Output/2.4]
- Output template:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 236 lines · 27 tokens per session scan A 650f5fdb80bf
keycloak-specialist is an agent published in the GitHub repository atretyak1985/swarmery (5 stars, last pushed yesterday), licensed Apache-2.0. It adds 27 tokens to every session and 2,969 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other agents, from other repositories
fakoli-guido
Fakoli Crew polyglot architect for TypeScript, Python, Rust interfaces, type design, and API shape.
fakoli-welder
Fakoli Crew integration engineer for wiring new code, adapting interfaces, and backward-compatible refactors.
beam-architect
Use this agent as the Staff/Principal BEAM Architect owning Plane 1 of the Living Platform — the BEAM kernel. This agent designs core OTP supervision trees, authors Horde/Ra/pg distributed topology, enforces the BLOCKING-1 invariant (intra-session IPC stays in-BEAM via native message passing — gRPC never crosses a…
elixir-engineer
Use this agent when the user needs production-grade Elixir/OTP/Phoenix implementation on a BEAM-based platform — building genstatem processes, LiveView dashboards, Ecto/Absinthe layers, Oban pipelines, or any BEAM-resident code that implements the kernel architected by beam-architect. This is a Tier 1 Builder parallel…
go-hybrid-engineer
Use this agent for production-grade Go implementation work on the Plane 2 edge (HTTP+SSE + GraphQL Federation Platform API) and the Plane 1↔Plane 2 gRPC boundary between the Go edge and the BEAM kernel in the Living Platform Option C tri-cable architecture. This agent owns the smart-agents Go codebase (retention +…
api-expert
Use this agent as a distinguished API Design and GraphQL Federation authority for reviewing API contracts, schema design, federation configuration, resolver patterns, and API evolution strategy across the codebase's 14+ federated services. Reviews API code and schemas — implementation goes to builders. Examples…