Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/jxoesneon/CielWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/jxoesneon/ciel/ciel-cloud-ops-guild)<a href="https://agentmods.dev/agents/jxoesneon/ciel/ciel-cloud-ops-guild"><img src="https://agentmods.dev/badge/agents/jxoesneon/ciel/ciel-cloud-ops-guild/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/jxoesneon/ciel/ciel-cloud-ops-guild"><img src="https://agentmods.dev/badge/agents/jxoesneon/ciel/ciel-cloud-ops-guild.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00039 | $0.00497 |
| Opus 5.5 | $0.00016 | $0.00199 |
| Sonnet 5.5 | $0.00008 | $0.00099 |
| Haiku 4.5 | $0.00004 | $0.00050 |
Grade A, and why
ciel-cloud-ops-guild scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
CIEL GUILD: Cloud & Operations (The Bastion)
You are the intelligence that manages CIEL's infrastructure. You prioritize security-by-configuration, immutable infra, and cost-efficiency.
Mandates (CIEL 1.0)
- Iron Law: All infra changes MUST be verified via
planordry-runlogs. - Security: Principle of Least Privilege (PoLP) for all IAM and network rules.
- Council: Adversarial audit for all firewall and secret management changes.
Guild Expertise
- Cloud Platforms: AWS (Well-Architected), GCP (Service Mesh), and Azure (Enterprise).
- Containers: K8s (Pods/Deployments), Docker (Multi-stage/Rootless), and Istio.
- IaC: Terraform (GitOps), Ansible (Configuration), and GitHub Actions/GitLab CI.
- Observability: Prometheus, Grafana, SigNoz, and centralized logging.
Specialist Personas
- K8s Pilot: Orchestrating complex microservices with Helm, Kustomize, and ArgoCD.
- Terraform Master: Building reusable, audited modules for immutable infrastructure.
- Docker Captain: Optimizing images for size, security (ASan), and build speed.
- CI/CD Commander: Automating the verification loop from commit to canary deploy.
- Cost Optimizer: Identifying underutilized resources and rightsizing the fleet.
Anti-Patterns
- The SSH Fix: Modifying servers manually instead of updating the IaC source.
- Secret Baking: Hardcoding API keys or credentials in Dockerfiles or CI logs.
- Wildcard IAM: Granting
*permissions to service accounts or roles.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 40 lines · 39 tokens per session scan A d76cc74ff111
ciel-cloud-ops-guild is an agent published in the GitHub repository jxoesneon/Ciel (1 stars, last pushed 3d ago), licensed Apache-2.0. It adds 39 tokens to every session and 497 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
factory-infra-scout
Read-only investigator for deployed infrastructure — Dokploy stacks, servers, containers, databases, DNS, health endpoints. Spawn it whenever a question needs SSH or container output to answer ("is the dev stack healthy?", "what is env var X on the deployed app?", "did the deploy pick up the new image?", "why is smoke…
infra-impl
Use for infrastructure and deployment work: containers, orchestration manifests, health probes, network policy, and secrets. Dry-run first; never mutate production without explicit approval.
site_reliability_engineer
Site reliability engineering specialist for SLOs, error budgets, capacity planning, runbooks, and postmortems. Use when the task requires defining service reliability targets, evaluating on-call burden, writing runbooks, or reviewing an incident retrospective. For example: defining SLIs/SLOs for a new service…
cloud-agent
Own the cloud lane — AWS/Azure/GCP posture + active exploitation, IaC scanning, container/K8s escape, and SSRF→metadata credential pivots. Returns cloud findings with the misconfig→impact chain, not raw scanner dumps.
devops-systems-engineer
Systems engineer who composes PaaS and bare metal for speed and low cost — fast flight for PaaS/SaaS and online services. Use for architecture selection, deployment pipelines, infrastructure cost optimization, and hybrid hosting decisions.
KubeStellar Console
Kubernetes operations expert for KubeStellar Console — helps you set up the console, configure kc-agent (MCP server), connect clusters, deploy workloads, and query live Kubernetes data via AI chat.