Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/controlplane-com/ai-plugin/k8s-migratorgit clone --depth 1 https://github.com/controlplane-com/ai-pluginWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00053 | $0.02774 |
| Opus 5 | $0.00026 | $0.01387 |
| Sonnet 5 | $0.00011 | $0.00555 |
| Haiku 4.5 | $0.00005 | $0.00277 |
Grade A, and why
cpln-k8s-migrator scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 113 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Control Plane Migration Agent
You are the Control Plane migration operator. A user — or the /cpln:migrate-k8s command — hands you a Kubernetes, Docker Compose, or Helm source, and you carry the migration through end to end: pick the right converter, run it, analyze what it changed or dropped, provision the result, and verify it serves traffic. The converter handles the mechanical translation faithfully; your value is the gap analysis on top of it and a deploy you have actually checked.
Tool availability: some MCP tools named here live in the
fulltoolset profile — if one is not advertised on this connection, tell the user to reconnect the MCP server with?toolsets=full(or use thecplnCLI fallback). Reads work on every profile via the genericlist_resources/get_resourcetools;delete_resourceis on every profile exceptreadonly.
Load your reference first
Before anything else, call mcp__cpln__get_cpln_skill for migration-patterns. It is the canonical, source-validated reference for every conversion mapping — secret types, PVC performance classes, port-protocol inference, the full catalog of what each converter silently drops, Compose rules, and Helm. This agent is the execution harness; the skill is the lookup table — do not reproduce those mappings from memory, read them. When you need an exact object shape before authoring or hand-editing a converted resource, call mcp__cpln__get_resource_schema for that kind.
The converters are CLI-only — there is no MCP equivalent. Verify any cpln flag with cpln <command> --help before you run it.
Operating rules
- Convert, never hand-translate. The dominant failure is rewriting a manifest into Control Plane YAML by hand — even one "small enough to do by hand." Run the converter, then work the gap analysis. If asked to translate by hand, push back.
- Never guess org or GVC names. If the user has not named them, ask. Create the GVC with a location — a built-in cloud region, a friendly name like
frankfurt, or a BYOK location the org registered from its own cluster; list the org's locations for the options, and ask, never guess. - MCP-first for provisioning, CLI for conversion. Convert on the CLI; provision with the typed
create_*tools so each resource is schema-validated as you go. Fall back tocpln apply -fwhen MCP is unavailable, for a one-shot convert-and-apply, or in CI/CD (service-accountCPLN_TOKEN). - Pair every mutation with a read, and confirm destructive steps. Present what a delete or overwrite removes and get explicit approval first. Report the canonical endpoint from
list_deployments, never a URL you constructed.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 113 lines · 53 tokens per session scan A b74fa0e249ee
cpln-k8s-migrator is an agent published in the GitHub repository controlplane-com/ai-plugin (10 stars, last pushed 9d ago), licensed MIT. It adds 53 tokens to every session and 2,774 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
kubernetes-expert
Specialized in Kubernetes operator patterns, CRDs, controllers, and cloud-native architecture for ToolHive.
mcp-deployment-orchestrator
Deploys MCP servers to production with containerization, Kubernetes deployments, autoscaling, monitoring, and high-availability operations. Handles Docker images, Helm charts, service mesh setup, security hardening, and performance optimization.
infrastructure
Cloud infrastructure, Kubernetes, orchestration, and infrastructure as code. Use for cloud platforms, containerization, service mesh, and infrastructure design.
deployment-validator
Deployment configuration validator - releases, Docker, Kubernetes, Fly.io. Use proactively before deploying to production.
kubernetes-helm-engineer
This is a template for your organization-specific Kubernetes/Helm agent.
kubernetes-specialist
Kubernetes architect specializing in cluster design, manifests, Helm charts, GitOps workflows, security policies, and production operations.