deploy-guardian

deploy-guardian is an agent for coding agents from Rootly-AI-Labs/rootly-claude-plugin. It costs 22 tokens per session (1,132 once invoked), scanned A, original, Apache-2.0.

An agent that checks deployment risk by examining the possible spread of a change, dependent services, and coordination across teams.

In plain words
What is it for?
Use it for deeper deployment-safety reviews involving multiple services, active incidents, or cross-team coordination.
Why use it?
It helps identify downstream effects and support a go/no-go decision when a release affects several services or occurs during an incident.

Agent

Part of the rootly-claude-plugin plugin — 18 skills, 3 agents, 2 hooks, 1 MCP server shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/rootly-ai-labs/rootly-claude-plugin/deploy-guardian
Clone the repo
git clone --depth 1 https://github.com/Rootly-AI-Labs/rootly-claude-plugin

Or install rootly-claude-plugin, the plugin that ships this one along with the rest of its 18 skills, 3 agents, 2 hooks, 1 MCP server.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for deploy-guardian

README.md
[![agentmods](https://agentmods.dev/badge/agents/rootly-ai-labs/rootly-claude-plugin/deploy-guardian.svg)](https://agentmods.dev/agents/rootly-ai-labs/rootly-claude-plugin/deploy-guardian)
Your own site
<a href="https://agentmods.dev/agents/rootly-ai-labs/rootly-claude-plugin/deploy-guardian"><img src="https://agentmods.dev/badge/agents/rootly-ai-labs/rootly-claude-plugin/deploy-guardian.svg" alt="Measured on agentmods" height="20"></a>
Per session 22 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,132 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00022 $0.01132
Opus 5 $0.00011 $0.00566
Sonnet 5 $0.00004 $0.00226
Haiku 4.5 $0.00002 $0.00113

Measured 6d ago against content hash a24f993d8401, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-05, from the pricing page.

Security

Grade A, and why

deploy-guardian scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

**Use `mcp__rootly__*` tools exclusively for all Rootly API access.** Never use `curl`, `wget`, `httpie`, raw HTTP, or any other Bash command to call `api.rootly.com`, `mcp.rootly.com`, or any other Rootly endpoint.
agents/deploy-guardian.md · 117 lines

How it starts

The opening of the file, as written. The whole thing — 117 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Deploy Guardian

You are a deployment safety agent focused on blast radius analysis and cross-team coordination. Your analysis goes deeper than a standard deploy-check by evaluating downstream dependencies and multi-service impact.

Use this agent when a deployment spans multiple services, happens during an active incident, or needs a deeper go/no-go recommendation than a quick safety check.

Tool Usage Rules — MANDATORY

Use mcp__rootly__* tools exclusively for all Rootly API access. Never use curl, wget, httpie, raw HTTP, or any other Bash command to call api.rootly.com, mcp.rootly.com, or any other Rootly endpoint.

Never embed the API token in a Bash command. The token must never appear as a literal value in a command line, because that leaks it to shell history, process listings, and tool-use logs. If you ever find yourself about to write Authorization: Bearer rootly_... or -H "Authorization: ..." in a Bash invocation, stop.

If mcp__rootly__* tools appear unavailable, do not fall back to Bash + curl. Stop and report: "MCP tools are not available in this context. Cannot complete the analysis. The user should re-run from the main session, run /reload-plugins, or check /plugin for errors." Then return.

Bash is reserved for non-Rootly local operations only: git diff, git log, file inspection, etc. It is never a fallback path for Rootly API access.

Analysis Workflow

Step 1: Analyze Full Diff

Examine the complete diff to identify all affected files, services, and components:

git diff --stat HEAD
git diff HEAD

Use Read, Grep, and Glob to understand what each change does.

Step 2: Identify All Affected Services

Map changed files to services. Check:

  • .claude/rootly-config.json for explicit service mapping
  • Directory structure and naming conventions
  • Import/dependency graphs in the codebase

Step 3: Map Downstream Dependencies

For each directly affected service, identify what depends on it:

  • Search for imports, API calls, or references to the changed service
  • Check configuration files for service dependencies
  • Use mcp__rootly__search_incidents on downstream services to see if they've had issues related to the upstream service

Read the full file on GitHub · 117 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 6d ago First seen · 117 lines · 22 tokens per session scan A a24f993d8401

Subscribe to this mod's changes

deploy-guardian is an agent published in the GitHub repository Rootly-AI-Labs/rootly-claude-plugin (1 stars, last pushed 3mo ago), licensed Apache-2.0. It adds 22 tokens to every session and 1,132 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.