A connection to Coroot, a monitoring platform that observes servers, containers, networks, and services without requiring application code changes. It uses eBPF, a Linux feature that collects system activity from the operating system.

Use it to investigate incidents through service maps, traces, logs, deployments, infrastructure data, costs, and risk information. It can also show activity from databases and other common network services.

It helps reveal problems that application logs may miss, such as failed connections, slow networks, disk delays, resource limits, and service dependencies.

coroot — Skill for Claude Code and Codex by Arvo-AI: A connection to Coroot, a monitoring platform that observes…

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add skills/arvo-ai/aurora/coroot

Any agent

npx skills add Arvo-AI/aurora --skill coroot

Clone the repo

git clone --depth 1 https://github.com/Arvo-AI/aurora

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/arvo-ai/aurora/coroot.svg)](https://agentmods.dev/skills/arvo-ai/aurora/coroot)

Your own site

<a href="https://agentmods.dev/skills/arvo-ai/aurora/coroot"><img src="https://agentmods.dev/badge/skills/arvo-ai/aurora/coroot.svg" alt="Measured on agentmods" height="20"></a>

Per session 35 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,607 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00035	$0.01607
Opus 5	$0.00017	$0.00804
Sonnet 5	$0.00007	$0.00321
Haiku 4.5	$0.00003	$0.00161

Measured 5d ago against content hash b36192a394e9, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-05, from the pricing page.

Security

Grade A, and why

coroot scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

server/chat/backend/agent/skills/integrations/coroot/SKILL.md · 124 lines

How it starts

The opening of the file, as written. The whole thing — 124 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Coroot Integration

Overview

Coroot is an eBPF-powered observability platform. Its node agent instruments at the KERNEL level, capturing data that applications cannot self-report and requires NO code changes or SDK integration.

What eBPF Gives You (data invisible to application logs)

TCP connections: every connect/accept/close between services, including failed connects and retransmissions
Network latency: actual round-trip time measured at the kernel, not application-reported
DNS queries: every resolution with latency, NXDOMAIN errors, and server failures
Disk I/O: per-process read/write latency and throughput at the block device level
Container resources: CPU usage, memory RSS, OOM kills, throttling -- from cgroups
L7 protocol parsing: HTTP, PostgreSQL, MySQL, Redis, MongoDB, Memcached request/response metrics extracted from TCP streams without application instrumentation
Service map: automatically discovered from observed TCP connections -- not configured manually

Issues Coroot Sees BEFORE Application Logs

A service failing to connect to a dependency (TCP connect failures)
Network packet loss and retransmissions between pods/nodes
DNS resolution failures causing timeouts
Disk I/O saturation causing slow queries
OOM kills that happen before the app can log anything
Container CPU throttling invisible to the application

Instructions

Incident Investigation Flow

coroot_get_incidents(lookback_hours=24) -- List incidents with RCA summaries, root cause, and fixes
coroot_get_overview_logs(severity='Error', limit=50) -- Search all logs cluster-wide for errors (includes Kubernetes Events: OOMKilled, Evicted, CrashLoopBackOff, FailedScheduling)
coroot_get_incident_detail(incident_key='KEY') -- Full incident detail with propagation map
coroot_get_app_detail(app_id='ID') -- Audit reports for affected app (35+ health checks)
coroot_get_app_logs(app_id='ID', severity='Error') -- Error logs with trace correlation
coroot_get_traces(service_name='svc', status_error=True) -- Error traces across services
coroot_get_traces(trace_id='ID') -- Full trace tree for a specific request

Read the full file on GitHub · 124 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

5d ago First seen · 124 lines · 35 tokens per session scan A b36192a394e9

Subscribe to this mod's changes

coroot is a skill published in the GitHub repository Arvo-AI/aurora (404 stars, last pushed today), licensed Apache-2.0. It adds 35 tokens to every session and 1,607 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Backend and APIs DevOps and cloud aiops aws azure datadog gcp observability

cloud-iam-deep

GCP/AWS/Azure cloud exploitation -- Cloud Functions, Firestore, Cloud Run, S3, MinIO, Blob Storage, SA keys.

uphiago/recon-skills · 35 tokens

isaac-automator

Deploy and operate a cloud Isaac Workstation with Isaac Automator: provision a GPU VM running Isaac Sim, Isaac Lab, and/or Isaac Lab Arena on AWS, GCP, Azure, or Alibaba Cloud, connect to it, move data in and out, control cost with stop/start, repair, import existing deployments, and destroy. Use when the user wants a…

isaac-sim/IsaacAutomator · 123 tokens

awesome-kubernetes-ops

This skill documents the local verification, editing, and deployment procedures for the Antigravity AI Agent when pair-programming with the repository maintainer.

nubenetes/awesome-kubernetes · 0 tokens

Cloud Security & Container Hardening

AWS/Azure/GCP security auditing, container and Kubernetes hardening, Infrastructure as Code scanning, and cloud compliance assessment.

Masriyan/Claude-Code-CyberSecurity-Skill · 30 tokens

console-audit

Audit the running app via chrome-devtools MCP — console errors/warnings + failed/slow network by default; perf (LCP/CLS) and Lighthouse (a11y/SEO) are opt-in. Token-efficient (compacts findings in-browser via a console/network hook); the report is shown inline in the response — no files to open. Target one tab / an…

nudgebee/nudgebee · 0 tokens

create-issue

Create GitHub issues using repo templates (feature, bug, spike).

nudgebee/nudgebee · 14 tokens