Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/matanryngler/deployshield/deployshield-statusgit clone --depth 1 https://github.com/matanryngler/deployshieldWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.00820 |
| Opus 5 | $0.00000 | $0.00410 |
| Sonnet 5 | $0.00000 | $0.00164 |
| Haiku 4.5 | $0.00000 | $0.00082 |
Grade A, and why
deployshield-status scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 67 lines — stays where its author put it; the contents beside it link to each section on GitHub.
DeployShield Status
DeployShield is active. All Bash commands are validated before execution.
Guarded CLIs by Category
Cloud Providers
| CLI | Provider | Read-only examples |
|---|---|---|
aws |
AWS | describe-*, get-*, list-*, s3 ls, sts get-* |
gcloud |
GCP | describe, list, info, config list |
az |
Azure | show, list, get, account show |
kubectl |
Kubernetes | get, describe, logs, top, --dry-run |
helm |
Helm | list, get, show, status, template, --dry-run |
Databases
| CLI | Provider | Read-only examples |
|---|---|---|
psql |
PostgreSQL | -l, -c "SELECT ...", -c "\dt" |
mysql |
MySQL | -e "SELECT ...", -e "SHOW ..." |
mongosh / mongo |
MongoDB | --eval "db.col.find()" |
redis-cli |
Redis | GET, KEYS, SCAN, INFO, PING |
IaC & Deployment
| CLI | Provider | Read-only examples |
|---|---|---|
terraform |
Terraform | plan, show, output, validate, fmt, init |
pulumi |
Pulumi | preview, stack ls, config get, whoami |
cdk |
AWS CDK | diff, synth, list, doctor |
sam |
AWS SAM | validate, build, local, logs |
serverless / sls |
Serverless | info, print, package, invoke local |
ansible-playbook |
Ansible | --check, --syntax-check, --list-hosts |
Secrets, GitHub, Containers & Publishing
| CLI | Provider | Read-only examples |
|---|---|---|
vault |
HashiCorp Vault | read, list, status, kv get |
gh |
GitHub CLI | pr view/list, issue view/list, api (GET) |
docker / podman |
Docker | ps, images, logs, inspect, info |
npm / yarn / pnpm |
npm | Everything except publish/unpublish |
twine |
PyPI | Everything except upload |
gem |
RubyGems | Everything except push/yank |
cargo |
Cargo | Everything except publish |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 67 lines · 0 tokens per session scan A 48f4e0e8ba33
deployshield-status is a command published in the GitHub repository matanryngler/deployshield (3 stars, last pushed 5mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 820 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
OPSX: Sync
Sync delta specs from a change to main specs.
research-extension
Research additional components for an existing SuperPlane integration. Usability-focused: use cases, what the API allows—then suggest what to add. Conversational.
VibeGuard: ExecPlan
Long-term task execution plan — generates self-contained execution documents from SPEC, supports cross-session recovery.
github-actions
Design, review, secure, and debug GitHub Actions workflows — reusable workflows, OIDC federation, SHA pinning, token scoping, promotion orchestration, and CI failure diagnosis.
fluxcd
FluxCD entry point — routes to the right workflow based on what you need. Live cluster issue → structured 5-workflow debug trace. Repo health check → 6-phase audit (discovery, validation, API compliance, best practices, security). Helm chart review → helmchart. Starts by asking one question to confirm the right mode.
VibeGuard: Review
Structured code review - first run the guard to obtain the baseline, then review according to security → logic → quality → performance priority.