Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/controlplane-com/ai-plugin/domainnpx skills add controlplane-com/ai-plugin --skill domaingit clone --depth 1 https://github.com/controlplane-com/ai-pluginWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00048 | $0.03370 |
| Opus 5 | $0.00024 | $0.01685 |
| Sonnet 5 | $0.00010 | $0.00674 |
| Haiku 4.5 | $0.00005 | $0.00337 |
Grade A, and why
domain scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
3. Once `ready`: `curl -I https://DOMAIN/PATH` and confirm each prefix lands on the intended workload. How it starts
The opening of the file, as written. The whole thing — 136 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Custom Domains
Tool availability: the default
coreprofile covers the entire domain workflow —create_domain,update_domain, the route-edit trio (add_domain_route/update_domain_route/remove_domain_route), listener ports (add_domain_port/remove_domain_port), TLS (set_domain_tls/clear_domain_tls), and the genericlist_resources/get_resource/delete_resource. Only CORS edits (set_domain_cors/clear_domain_cors) live in thefullprofile — if one is not advertised, reconnect with?toolsets=fullor use thecplnCLI fallback.
A domain is an org-level resource that binds a DNS name to workloads in one GVC. Created ≠ live: after the resource exists, the user still adds records at their DNS provider — read exactly which from status.dnsConfig and hand them over verbatim, never guessed. Every shape decision below is platform-enforced and a wrong combination is a rejected mutation, so decide BEFORE calling mcp__cpln__create_domain (the tool requires dnsMode and ports explicitly). Never set spec.domain on a GVC — that legacy field is deprecated; the Domain resource is the only path.
Decide the shape first
1. Apex or subdomain? The apex is the registrable root (example.com, example.co.uk); anything deeper is a subdomain (app.example.com).
2. dnsMode — who runs DNS:
| Mode | Valid for | Wiring | Cert challenge |
|---|---|---|---|
cname |
apex (required) and subdomains | User adds CNAME records per status.dnsConfig |
http01 default, dns01 opt-in |
ns |
subdomains only | Delegates the subdomain zone via 4 NS records (ns1/ns2.cpln.cloud, ns1/ns2.cpln.live) |
dns01 only — http01 rejected |
dnsMode defaults to cname (to ns when gvcLink is set). The platform rejects ns on an apex, and rejects a cname domain nested under an existing NS domain (parent_ns_domain_exists).
3. Routing — exactly ONE of three. All routes in a domain must target workloads in the same GVC.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 136 lines · 48 tokens per session scan A 03db3d6436ec
domain is a skill published in the GitHub repository controlplane-com/ai-plugin (10 stars, last pushed 9d ago), licensed MIT. It adds 48 tokens to every session and 3,370 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
higress-openclaw-integration
Deploy and configure Higress AI Gateway for OpenClaw integration. Use when: (1) User wants to deploy Higress AI Gateway, (2) User wants to configure OpenClaw to use more model providers, (3) User mentions 'higress', 'ai gateway', 'model gateway', 'AI网关', (4) User wants to set up model routing or auto-routing, (5) User…
ak-cloud-deploy
Deploy an Agent Kernel project to AWS, Azure, or GCP using Terraform modules, or to any Kubernetes cluster (on-prem, baremetal, EKS) using the official Helm chart. Supports serverless and containerized modes for all three clouds. AWS supports execution modes (restsync, restasync, async, stream), queue-based scalable…
kubernetes-expert
Expert-level Kubernetes cluster management, deployment strategies, networking, and production operations.
k8s-generator
Generate production-ready Kubernetes manifests with Deployments, Services, ConfigMaps, and Ingress.
application-design-center-design-deploy
Processes GCP infrastructure design and deployment workflows within Application Design Center (ADC). Use when: - Designing GCP infrastructure with Terraform. - Validating local HCL. - Performing best-practice plan scans. - Importing templates to Application Design Center (ADC). - Deploying templates. - Troubleshooting…
interactive-login
How to complete browser/interactive logins (aws / gh / glab / gcloud). The platform backgrounds the login poller so it survives the human's browser round-trip — and when that does NOT work.