A deployment command for preparing and releasing software to a named environment, such as staging or production. It runs checks for source control, tests, builds, code quality, and security, then verifies the service after release.

Use it to prepare or deploy a project, check that the correct branch and commits are ready, run tests and builds, scan for security issues, and perform post-deployment health checks.

It gathers the checks needed before a release and can catch uncommitted work, failing tests, or build problems. It also requires confirmation before deployment or destructive actions.

deploy — Command by alphaaiservice

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add commands/alphaaiservice/cortex/deploy

Clone the repo

git clone --depth 1 https://github.com/alphaaiservice/cortex

Per session 32 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 4,710 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 2 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00032	$0.04710
Opus 5	$0.00016	$0.02355
Sonnet 5	$0.00006	$0.00942
Haiku 4.5	$0.00003	$0.00471

Measured yesterday against content hash 0ec8d63093a6, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

deploy scanned grade A with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Sends data to an external URLlowData exfiltration

A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.

curl -s -o /dev/null -w "Auth endpoint: %{http_code}\n" "${SERVICE_URL}/api/v1/auth/login" -X POST -H "Content-Type: application/json" -d '{}' 2>/dev/null

Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -s -o /dev/null -w "%{http_code}" "${SERVICE_URL}/health"

commands/deploy.md · 503 lines

How it starts

The opening of the file, as written. The whole thing — 503 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Deployment Automation

Deploy to: $ARGUMENTS

Parse $ARGUMENTS:

Environment: staging, production, dev, or custom environment name
Default: If no argument given, ask the user which environment

⚠️ SAFETY: This command performs pre-flight checks but will ASK FOR CONFIRMATION before any destructive or deployment action.

Step 1: Pre-Flight Checks

Run all checks in parallel using Agent tool:

Check 1: Git Status

echo "=== Branch ==="
git branch --show-current
echo "=== Status ==="
git status --short
echo "=== Unpushed Commits ==="
git log origin/$(git branch --show-current)..HEAD --oneline 2>/dev/null
echo "=== Last 5 Commits ==="
git log --oneline -5

Ensure working directory is clean
Ensure on correct branch (main for production, develop for staging)
Ensure all commits are pushed

Check 2: Tests Pass

npm test 2>&1 || pytest 2>&1 || go test ./... 2>&1 || cargo test 2>&1

Check 3: Build Succeeds

npm run build 2>&1 || python -m py_compile *.py 2>&1 || go build ./... 2>&1

Check 4: Lint Clean

npm run lint 2>&1 || flake8 . 2>&1 || golangci-lint run 2>&1

Check 5: Basic Dependency Security

npm audit --audit-level=high 2>&1 || safety check 2>&1 || pip audit 2>&1

Check 6: Environment Verification

Verify all required env vars are set for target environment
Check .env.example vs actual environment
Verify external service connectivity (if possible)

Step 2: Full Security Scan (MANDATORY for Production)

If deploying to production, run a comprehensive security scan BEFORE proceeding. If deploying to staging, this step is optional but recommended.

2a. Secret Detection

Scan all source files for accidentally committed secrets:

echo "=== Scanning for Hardcoded Secrets ==="
grep -rn --include="*.py" --include="*.ts" --include="*.js" --include="*.json" --include="*.yaml" --include="*.yml" --include="*.env*" \
  -E "(password|secret|api_key|apikey|token|private_key|access_key)\s*[:=]\s*['\"][^'\"]{8,}" \
  --exclude-dir=node_modules --exclude-dir=.venv --exclude-dir=__pycache__ \
  . 2>/dev/null | grep -vi "example\|placeholder\|changeme\|your_\|xxx\|test" | head -20

If secrets found: BLOCKER — list the files and line numbers, STOP deployment.

Read the full file on GitHub · 503 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

yesterday First seen · 503 lines · 32 tokens per session scan A 0ec8d63093a6

Subscribe to this mod's changes

deploy is a command published in the GitHub repository alphaaiservice/cortex (1 stars, last pushed 25d ago), licensed MIT. It adds 32 tokens to every session and 4,710 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 2 findings (sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Code review Security Testing automation claude-code-plugin sdlc

deploy