Borrowing it
Nothing to install: this file belongs to cardstack/boxel. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/cardstack/boxel/main/.claude/skills/tail-logs/SKILL.mdgit clone --depth 1 https://github.com/cardstack/boxelWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cardstack/boxel/tail-logs)<a href="https://agentmods.dev/skills/cardstack/boxel/tail-logs"><img src="https://agentmods.dev/badge/skills/cardstack/boxel/tail-logs/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cardstack/boxel/tail-logs"><img src="https://agentmods.dev/badge/skills/cardstack/boxel/tail-logs.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00082 | $0.01324 |
| Opus 5.5 | $0.00033 | $0.00530 |
| Sonnet 5.5 | $0.00016 | $0.00265 |
| Haiku 4.5 | $0.00008 | $0.00132 |
Grade A, and why
tail-logs scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 90 lines — stays where its author put it; the contents beside it link to each section on GitHub.
tail-logs
Tail Loki logs from a laptop. The script handles auth (SSM bearer token), URL resolution (SSM public URL), the /loki URL gotcha, and LogQL selector construction. You provide environment + service.
When to invoke
- Debugging an incident in staging or production
- Following live realm-server / worker activity while reproducing a bug locally
- Correlating a request id, job id, or realm name across services
- Cross-checking that something just shipped a log line you expect
If the user is asking what changed (deploy diffs, code history) rather than what happened, this is the wrong tool — go to git/PR APIs instead.
How to invoke
packages/observability/scripts/tail-logs.sh --env <local|staging|production> --service <name> [flags]
Common flag patterns:
# What happened to realm-server in the last 15 min on staging?
./scripts/tail-logs.sh --env staging --service realm-server --since 15m --no-follow
# Live tail with an error filter
./scripts/tail-logs.sh --env staging --service worker --regex '(?i)error|exception|fatal'
# Drill to a specific job
./scripts/tail-logs.sh --env staging --service worker --filter 'job_id=42' --since 1h --no-follow
# Production requires --confirm (intentional friction)
./scripts/tail-logs.sh --env production --service synapse --since 30m --no-follow --confirm
| Flag | Default | Notes |
|---|---|---|
--env |
(required) | local, staging, production |
--service |
(required) | realm-server, worker, prerender, prerender-manager, synapse (or any local container name) |
--realm |
unset | Filter to a single realm. Only set on tasks where realm is meaningful. |
--worker-id |
unset | One worker process, <instance-id>-pid-<pid>; only available on workers. |
--filter |
unset | LogQL line-filter (|= literal substring). Mutually exclusive with --regex. |
--regex |
unset | LogQL line-regex (|~). |
--since |
15m |
30s, 15m, 1h, 2d — anything matching ^\d+[smhd]$. |
--limit |
200 |
Max lines per batch. |
--no-follow |
follow on | One-shot mode for diagnostics. Always use --no-follow from a skill — follow mode is interactive. |
--json |
text | Raw Loki response per batch. Use when you need to parse beyond the formatted line. |
--confirm |
n/a | Required for --env production. |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 90 lines · 82 tokens per session scan A 938e672f8bdd
tail-logs is a skill published in the GitHub repository cardstack/boxel (27 stars, last pushed today), licensed MIT. It adds 82 tokens to every session and 1,324 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-21.
Other skills, from other repositories
gke-workload-troubleshooting
Diagnoses GKE workload failures (CrashLoopBackOff, OOMKilled, ImagePullBackOff, Pending, etc.) via logs and events. Use when pods fail to start or crash repeatedly. Don't use for GKE cluster infrastructure provisioning, node pool creation, or non-Kubernetes Google Cloud services.
application-integration-troubleshooting
Diagnoses failed, stuck, or silent Google Cloud Application Integration runs and Integration Connectors tasks using the REST API, Cloud Logging, and Cloud Monitoring. Use when an integration fails, returns HTTP 200 without doing the expected work, hangs in a suspended or retry state, or hits IAM, run-as service…
gke-workload-scaling-troubleshooting
Diagnoses GKE HorizontalPodAutoscaler (HPA) failures — metrics showing as , FailedGetResourceMetric / FailedGetScale / FailedComputeMetricsReplicas events, missing Pod resource requests, custom/external metrics-pipeline breakage (FailedGetExternalMetric / FailedGetCustomMetric, unavailable metrics adapter…
gke-ai-troubleshooting-tpu-mxla-hang
Diagnose GKE Cloud TPU multi-slice training hangs (Megascale HANGDETECTED logs and hang monitored events) using the ML Diagnostics Megascale XLA (MXLA) Hang Analyzer (gcloud alpha mldiagnostics monitored-events) and 1-minute Cloud Monitoring multi-slice latency metrics (kubernetes.io/container/multislice/).…
gke-ai-troubleshooting-tpu-performance-degradation
Diagnose GKE Cloud TPU training throughput drops and step-time regressions (15%+ TPU duty-cycle drop) using ML Diagnostics Workload Monitoring (gcloud alpha mldiagnostics monitored-events / hypercomputecluster.googleapis.com/v1alpha) and 1-minute Cloud Monitoring system metrics (kubernetes.io/node/accelerator/).…
gke-ai-troubleshooting-jobset-interruption
Diagnoses GKE JobSet interruptions, restarts, and preemptions for AI/ML training workloads autonomously. Use when troubleshooting JobSet restart loops, spot VM preemptions, node readiness failures, host VM issues, or coordinator worker crashes. Don't use for general GKE cluster creation, basic workload deployment, or…