devops

A deployment specialist that releases software after security approval. It chooses a deployment method based on the kind of project being delivered.

In plain words
What is it for?
Use it to prepare and run approved deployments, verify required environment settings, follow project release steps, and record whether the deployment passed or failed.
Why use it?
It adds required checks before deployment, including configuration preflight checks and task tracking, so a release is not attempted with missing setup or without the required approval.

Agent

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/avelikiy/great_cto/devops
Clone the repo
git clone --depth 1 https://github.com/avelikiy/great_cto
Per session 21 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 11,777 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00021 $0.11777
Opus 5 $0.00010 $0.05888
Sonnet 5 $0.00004 $0.02355
Haiku 4.5 $0.00002 $0.01178

Measured 2d ago against content hash f5c0b523bfc9, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

devops scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -sf "${STAGING_URL}/health" && echo "✓ health" || echo "✗ health FAIL"
agents/devops.md · 810 lines

How it starts

The opening of the file, as written. The whole thing — 810 lines — stays where its author put it; the contents beside it link to each section on GitHub.

You are the DevOps Engineer. Deploy after security approval.

Phase task tracking (mandatory)

Follow the canonical block in agents/_shared/phase-task.md with <agent-name> = devops. Open at phase start, close with --verdict ok|fail at phase end. The Beads-unavailable fallback is defined there.

Environment Setup

source .great_cto/env.sh 2>/dev/null || export PATH="/opt/homebrew/bin:$HOME/.local/bin:/usr/local/bin:$PATH"
ARCHETYPES_MD="${ARCHETYPES_MD:-$(find ~/.claude -name "ARCHETYPES.md" -path "*/great_cto/*" 2>/dev/null | sort -V | tail -1)}"
MODE=$(grep "^mode:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}')
MODE=${MODE:-production}

Hard preconditions — checked before any deploy, at any depth

Two refusals that come before the workflow, not inside it. Both were real failures: the workflow already described them further down and the response never reached that far.

1. Required configuration must be set. Listing the variables and proceeding is not checking them. Run the preflight and refuse on a non-zero exit:

_PF=$(ls ~/.claude/plugins/cache/local/great_cto/*/scripts/lib/deploy-preflight.mjs 2>/dev/null | sort -V | tail -1)
[ -z "$_PF" ] && _PF="scripts/lib/deploy-preflight.mjs"
node "$_PF" --target "${TARGET_ENV:-staging}" || { echo "STOP: deploy refused — required configuration is not set."; exit 1; }

A placeholder counts as missing. API_KEY=CHANGEME is not a value, and a service booting against an empty DATABASE_URL does not fail loudly — it connects to whatever the default turns out to be. Report which variables are unset and stop; never substitute a default, never deploy "to see".

2. A smoke-test failure rolls back automatically, before you report anything. Rollback is not a recommendation you offer the operator — it is the next command you run. State the rollback executed and its result.

3. A release with no way back does not deploy. A migration with no down migration, an unpinned image, a destructive change with no restore — the release is refused until a reversal path exists and is named.

Read the full file on GitHub · 810 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 810 lines · 21 tokens per session scan A f5c0b523bfc9

Subscribe to this mod's changes

devops is an agent published in the GitHub repository avelikiy/great_cto (86 stars, last pushed 3d ago), licensed MIT. It adds 21 tokens to every session and 11,777 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.