Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/Sagart-cactus/claude-k8s-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/sagart-cactus/claude-k8s-plugin/checklist)<a href="https://agentmods.dev/commands/sagart-cactus/claude-k8s-plugin/checklist"><img src="https://agentmods.dev/badge/commands/sagart-cactus/claude-k8s-plugin/checklist/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/sagart-cactus/claude-k8s-plugin/checklist"><img src="https://agentmods.dev/badge/commands/sagart-cactus/claude-k8s-plugin/checklist.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00011 | $0.00537 |
| Opus 5 | $0.00005 | $0.00269 |
| Sonnet 5 | $0.00002 | $0.00107 |
| Haiku 4.5 | $0.00001 | $0.00054 |
Grade A, and why
checklist scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 63 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Kubernetes Operator Quality Checklist
Evaluate the current project against each item below. For each item, report PASS, FAIL, or N/A with a brief explanation.
Safety (dev-only)
- Target cluster is kind or explicitly allowed dev cluster
- Leader election disabled for dev overlay
- Single replica manager in dev
- Webhook timeouts are short for dev (e.g., 10s)
- Webhook only mutates resources it owns or is explicitly allowed to modify
CRD
- Structural schema is valid (
kubectl get crd <name> -o yamlshows no errors) - Required fields are marked in the schema
- Default values are defined where possible
- Status subresource is enabled (if status is used)
- Printer columns are defined for useful
kubectl getoutput
Webhooks
- Validating webhook covers all invariants from requirements
- Mutating webhook only defaults safe fields
- Failure policy is appropriate (Fail for prod safety, Ignore for dev flexibility)
- Certificates exist and are mounted correctly
- Webhook service endpoints resolve
RBAC
- Minimal verbs (only what the controller needs)
- Minimal resources (no wildcards unless justified)
- No unnecessary cluster-wide permissions
- Separate roles for manager and webhook if needed
Fast Loop
-
make dev/tilt upstarts without errors - Local compile succeeds
- Binary sync into running pod works
- Process restart is reliable after sync
- Logs show new version after code edit
- CRD changes are applied through Kustomize
Tests
- Unit tests exist for core reconcile logic
- Envtest or integration tests exist for webhook validation
- Example CR manifests exist for manual testing
Troubleshooting (verify if any failures above)
- Check Tilt logs for sync errors
- Check pod logs for crash loops (
kubectl logs -n <ns> <pod>) - Verify webhook service endpoints (
kubectl get endpoints -n <ns>) - Check certificate secrets exist
- Verify RBAC with
kubectl auth can-i --as system:serviceaccount:<ns>:<sa>
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 63 lines · 11 tokens per session scan A 4a46f1a07aab
checklist is a command published in the GitHub repository Sagart-cactus/claude-k8s-plugin (34 stars, last pushed 6mo ago), licensed MIT. It adds 11 tokens to every session and 537 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
create-docker-mcp-tunnel
Stand up an Anthropic MCP tunnel locally with Docker Compose so Claude can call a private MCP server (manual-credentials quickstart).
cisco-isovalent-platform-setup
Install the Isovalent platform on Kubernetes (Cilium CNI, Hubble observability, Tetragon eBPF runtime security) in either OSS or Enterprise edition. Renders Helm values and install/upgrade scripts; this is the platform install prerequisite for the Splunk Observability + Splunk Platform integration done by…
build-agent
Build Docker images for Golden Armada agents.
application-crud
A command reference for creating and managing Coolify applications connected to private GitHub repositories. It covers application records, deployment settings, and common API errors.
review-helm
Run Helm chart review for structure, best practices, and K8s security/operational issues in templates.
docker-harden
Audits and hardens Dockerfiles for size and security.