An agent that examines recent application logs, groups repeated errors, and creates GitHub issues with reproduction details. Kubernetes is a system for running applications in containers, and pods are its running units.

Use it during production monitoring or maintenance sweeps to find crashes, exceptions, slow queries, timeouts, failed requests, and resource problems.

It turns scattered production errors into a deduplicated list of actionable bugs instead of requiring manual log inspection.

seeker — Agent for Claude Code by randomittin/heimdall

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo

git clone --depth 1 https://github.com/randomittin/heimdall

Made for: Claude Code.

Or install hmd, the plugin that ships this one along with the rest of its 7 skills, 19 commands, 16 agents, 8 hooks, 1 MCP server.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/agents/randomittin/heimdall/seeker/github.svg)](https://agentmods.dev/agents/randomittin/heimdall/seeker)

Your own site

<a href="https://agentmods.dev/agents/randomittin/heimdall/seeker"><img src="https://agentmods.dev/badge/agents/randomittin/heimdall/seeker/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/agents/randomittin/heimdall/seeker"><img src="https://agentmods.dev/badge/agents/randomittin/heimdall/seeker.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 43 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 1,139 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00043	$0.01139
Opus 5.5	$0.00017	$0.00456
Sonnet 5.5	$0.00009	$0.00228
Haiku 4.5	$0.00004	$0.00114

Measured 1mo ago against content hash 346d69dcf361, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

seeker scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

agents/seeker.md · 101 lines

How it starts

The opening of the file, as written. The whole thing — 101 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Seeker — Find Bugs from Production

Pull logs from pods, analyze, raise issues on GitHub.

Process

Pull logs from all pods in the namespace:
```
kubectl logs --all-containers --since=1h -l app=<app> --tail=500
```
If kubectl not available, check for log files in common locations:
- /var/log/, ~/.pm2/logs/, docker logs
- Cloud: gcloud logging read, aws logs, fly logs
Analyze each log stream for:
- Unhandled exceptions / stack traces
- Error-level log lines (ERROR, FATAL, CRITICAL, panic, segfault)
- OOM kills, restart loops, crash backoffs
- Slow queries (>1s), timeout errors
- 5xx HTTP responses, connection refused
- Auth failures, rate limit hits
- Memory/CPU warnings
Deduplicate — group similar errors by stack trace signature. Don't create 10 issues for the same NullPointerException.
Raise GitHub issues for each unique bug:
```
gh issue create \
  --title "[seeker] <error type>: <brief description>" \
  --body "<structured body>" \
  --label "bug,seeker,maintainer"
```
The maintainer label is required, not decorative: the durable autopilot engine's GitHub ingest (sync_queue_from_github in bin/lib/maintain_loop.py) only ingests OPEN issues carrying that exact label (DEFAULT_MAINTAINER_LABEL). gh's real --label filter is a SUPERSET/AND match (an issue must carry EVERY requested label), so dropping this label silently disconnects seeker's issues from that engine again. bug and seeker stay too — bug sets severity via _github_severity, seeker is this file's own dedup/re-check marker (see step 5 below).

Issue body format:
```
## Source
Pod: <pod-name> | Container: <container> | Time: <timestamp>

## Error
<exact error message / stack trace>

## Frequency
<N occurrences in last hour>

## Impact
<what's affected — users, API, jobs>

## Suggested Fix
<initial diagnosis + suggested approach — WebSearch the error signature for a known upstream issue/advisory first, WebFetch the top match to confirm before citing it>
```

Read the full file on GitHub · 101 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago Changed · +1 lines 346d69dcf361
1mo ago Changed · +8 lines 2aa0421cfea3
1mo ago First seen · 92 lines · 43 tokens per session scan A ed28ed37ac68

Subscribe to this mod's changes

seeker is an agent published in the GitHub repository randomittin/heimdall (5 stars, last pushed 6d ago), licensed MIT. It adds 43 tokens to every session and 1,139 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Claude Code Containers Debugging DevOps and cloud ai-coding anthropic claude-plugin cli developer-tools

debugger

Use this agent when you need to investigate issues, analyze system behavior, diagnose performance problems, examine database structures, collect and analyze logs from servers or CI/CD pipelines, run tests for debugging purposes, or optimize system performance. This includes troubleshooting errors, identifying…

opencue/cuecards · 326 tokens

issue-tracer

Use proactively when the user asks to trace, investigate, root-cause, plan, close, or prepare a PR for a GitHub issue or bug report. Produces an evidence-backed root cause and critic-reviewed fix plan before implementation.

ZaxbyHub/opencode-swarm · 51 tokens

devsecops-engineer

CI/CD security, SAST/DAST pipelines, supply chain security, container scanning, and security automation specialist. Use when securing CI/CD pipelines, implementing security scanning, or hardening build processes. Trigger phrases: DevSecOps, SAST, DAST, supply chain security, container scanning, CI/CD security, SBOM…

travisjneuman/.claude · 83 tokens

atomic-investigator

Read-only code locator. Answers "where is X defined", "what calls Y", "list all uses of Z", "map this directory". Returns file:line table, no prose. Refuses to suggest fixes or speculate about design. Use to save main-context tokens on exploration.

damusix/atomic-claude · 61 tokens

devops-engineer

Expert DevOps and cloud infrastructure engineer for AWS, GCP, Azure, Kubernetes, Terraform, and CI/CD pipelines. Use when setting up pipelines, containerizing apps, writing infrastructure as code, or troubleshooting deployments.

travisjneuman/.claude · 48 tokens

atomic-wiki-writer

Writes one wiki page from source. Dispatched per domain by atomic-wiki-inferrer, once for each domain that needs writing or updating, with the page contract and the source path set supplied in the dispatch prompt. Reads the actual files and reports facts a reader can verify, never inferences from filenames. Carries…

damusix/atomic-claude · 141 tokens