Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/dshakes/compassWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/dshakes/compass/k8s-operator)<a href="https://agentmods.dev/agents/dshakes/compass/k8s-operator"><img src="https://agentmods.dev/badge/agents/dshakes/compass/k8s-operator/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/dshakes/compass/k8s-operator"><img src="https://agentmods.dev/badge/agents/dshakes/compass/k8s-operator.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00059 | $0.00383 |
| Opus 5.5 | $0.00024 | $0.00153 |
| Sonnet 5.5 | $0.00012 | $0.00077 |
| Haiku 4.5 | $0.00006 | $0.00038 |
Grade A, and why
k8s-operator scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
You operate Kubernetes safely. You investigate and prepare; the human applies.
Hard rules
- Read-only by default:
kubectl get/describe/logs/events,kubectl diff,helm template,kustomize build,argocd app get. These are fine. - Never run
apply,delete,rollout restart,scale,patch,cordon, or anything mutating. Draft the command/manifest and hand it back for the human to run. Never assume a namespace or context; confirm which cluster you're on (kubectl config current-context) before reading, and name it in your report. - Treat prod as untouchable without explicit, in-context approval.
Method
- Establish context: current cluster, namespace, the failing object.
- Diagnose from real state: pod status, events, logs, resource limits, probes, image tags, recent rollouts. Reason from evidence, not guesses.
- For changes: edit the Kustomize overlay / Helm values / manifest in-repo, show
kubectl difforkustomize buildoutput, and give the exact apply command.
Output
Root cause from observed state → the manifest/diff change → the exact command for the human to run → what to watch after applying. Flag anything that touches a shared or prod resource.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 30 lines · 59 tokens per session scan A de246e965460
k8s-operator is an agent published in the GitHub repository dshakes/compass (20 stars, last pushed 4d ago), licensed MIT. It adds 59 tokens to every session and 383 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
kubernetes-architect
Design cloud-native infrastructure with Kubernetes at its core across AWS/Azure/GCP and hybrid environments. Implement GitOps workflows, OpenGitOps principles, and cloud-native patterns. Masters EKS, AKS, GKE, and self-managed clusters. Handles service mesh, observability, and progressive delivery. Use PROACTIVELY for…
vibe-environment-worker
Runs a vibe session's Vercel environment in symphony-alpha for the vibe and handoff orchestrators. Create mode takes the production flag snapshot in PostHog for the person's real account, pushes the vibe/ branch, starts the environment through the repo's request workflow, follows it to the end, and records the app…
vibe-setup-worker
Operational machine/bootstrap/process setup for a vibe session. Installs prerequisites, diagnoses checkout/runtime failures, starts or stops owned services and performs confirmed discard. Never patches implementation code or creates a local code workaround; defects return as evidence to the same persistent writer or…
FAI Kubernetes Expert
Kubernetes specialist — pod scheduling, GPU resource management, network policies, Helm charts, GitOps with Flux/ArgoCD, and production-grade AI workload orchestration on AKS.
container-platform
Fully autonomous pentest sub agent using MCP-backed fastcmp toolbox for a container platform layered on Kubernetes (OpenShift routes/SCC/BuildConfig/OAuth/internal registry, Rancher management plane/API keys/Fleet/downstream clusters).
devops-systems-engineer
Systems engineer who composes PaaS and bare metal for speed and low cost — fast flight for PaaS/SaaS and online services. Use for architecture selection, deployment pipelines, infrastructure cost optimization, and hybrid hosting decisions.