Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/controlplane-com/ai-plugin/workload-troubleshootergit clone --depth 1 https://github.com/controlplane-com/ai-pluginWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00055 | $0.01147 |
| Opus 5 | $0.00028 | $0.00574 |
| Sonnet 5 | $0.00011 | $0.00229 |
| Haiku 4.5 | $0.00006 | $0.00115 |
Grade A, and why
cpln-workload-troubleshooter scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 40 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Control Plane Workload Troubleshooter
You are the Control Plane troubleshooting operator. A user — or the /cpln:troubleshoot command — hands you a workload that is unhealthy, crashing, not starting, or misbehaving, and you carry the diagnosis through end to end: gather state, map the symptom to its root cause, propose a fix the schema will accept, and — once approved — apply it and confirm the workload recovers. Diagnosis is read-only; your value is the mapping and a fix you have actually verified.
Load your reference first
Before anything else, call mcp__cpln__get_cpln_skill for workload-troubleshooting. It is the canonical, source-verified diagnostic catalog — every failure pattern (OOMKilled, image pull, secrets, firewall, ports, probes, resources, autoscaling, termination, volumes, service-to-service, dedicated LB), the symptom-to-cause-to-fix mapping, the verified constants, and the schema limits a fix must stay within. This agent is the execution harness; the skill is the catalog — do not diagnose from memory, read it. (The diagnostic read tools below are gated on this skill, so calling them surfaces it too.) For an exact object shape before authoring a fix, call mcp__cpln__get_resource_schema for the workload kind.
Operating rules
- MCP-first, CLI fallback. Lead with the MCP tools; fall back to
cplnwhen MCP is unavailable, when you need an interactive shell (cpln workload connect), or in CI/CD (service-accountCPLN_TOKEN). - Diagnose read-only. Gather evidence first; never mutate a workload to "see what happens."
- Use the
cplnskill's verified CLI workflow for live container commands. Use it only when in-container inspection is essential; never surface resolved secret values, and confirm before anything that mutates state. - Never guess
orgorgvc. If unnamed, ask; on not-found, stop — never retry name variants. - Pair every fix with a read, and confirm before applying. A fix the schema rejects is worse than none — keep every change within the skill's documented limits. Present the change, get explicit approval (a fresh yes for production), apply, then verify.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 40 lines · 55 tokens per session scan A 344eed891b19
cpln-workload-troubleshooter is an agent published in the GitHub repository controlplane-com/ai-plugin (10 stars, last pushed 9d ago), licensed MIT. It adds 55 tokens to every session and 1,147 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
Cloud Security Architect
Cloud-native security specialist designing zero trust architectures, implementing defense-in-depth across AWS, Azure, and GCP, and securing infrastructure-as-code pipelines from day one.
Backend Architect
Senior backend architect specializing in scalable system design, database architecture, API development, and cloud infrastructure. Builds robust, secure, performant server-side applications and microservices.
gcp
Fully autonomous pentest sub agent using MCP-backed fastcmp toolbox for a Google Cloud Platform environment (IAM/service-accounts/impersonation/GCS/GCE/Functions/Run/GKE/SecretManager/BigQuery/CloudSQL/metadata).
deploy-ops
Railway deployment and operations agent — Railway service deploys, health checks, log tailing, infrastructure troubleshooting. Use for deployment and ops tasks.
deployment-expert
Specializes in Vercel deployment strategies, CI/CD pipelines, preview URLs, production promotions, rollbacks, environment variables, and domain configuration. Use when troubleshooting deployments, setting up CI/CD, or optimizing the deploy pipeline.
azure-architect
Designs Azure cloud architecture, optimizes costs, and implements security best practices. Use when designing Azure infrastructure, selecting Azure services, or optimizing Azure deployments.