Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add controlplane-com/ai-plugin --skill org-managementgit clone --depth 1 https://github.com/controlplane-com/ai-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/controlplane-com/ai-plugin/org-management)<a href="https://agentmods.dev/skills/controlplane-com/ai-plugin/org-management"><img src="https://agentmods.dev/badge/skills/controlplane-com/ai-plugin/org-management/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/controlplane-com/ai-plugin/org-management"><img src="https://agentmods.dev/badge/skills/controlplane-com/ai-plugin/org-management.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00050 | $0.02476 |
| Opus 5.5 | $0.00020 | $0.00990 |
| Sonnet 5.5 | $0.00010 | $0.00495 |
| Haiku 4.5 | $0.00005 | $0.00248 |
Grade A, and why
org-management scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 17d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 135 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Organization & User Management
Tool availability:
update_org,configure_external_logging,invite_user_to_org,edit_group, andadd_key_to_service_accountneed?toolsets=full; reconnect with it or use the CLI.
An org is the top-level isolation boundary: every GVC, workload, secret, policy, image, domain, user, group, and service account lives inside one, with no cross-org sharing. An org cannot be renamed or deleted once created (every DELETE on /org returns 405) and its name is globally unique across all of Control Plane — so the first job is choosing a name you can live with permanently.
Organization
| Rule | Detail |
|---|---|
| Name charset | Lowercase letters, digits, hyphens; must start with a letter, cannot end with a hyphen; max 64 chars |
| Reserved names | Cannot be index; cannot start with xserve- |
| Uniqueness | Globally unique across the whole platform (DB-enforced), not per billing account |
| Immutability | Name is unmodifiable; the org cannot be deleted — plan the name carefully |
Create an org (requires the org_creator or billing_admin role on a billing account — enforced by the billing service, not org policy):
cpln org create --name ORG --accountId BILLING_ACCOUNT_ID \
--invitee [email protected] --invitee [email protected]
--name, --accountId, and --invitee (repeatable) are all required; invitees join the superusers group. Optional: --description, --tag key=value. Console path: Create, then Org. The first billing account can only be created in the Console.
Org-wide settings
Read with mcp__cpln__get_resource (kind org); change with mcp__cpln__update_org (a merge/PATCH — pass only the blocks you change). Settings apply to every member and workload.
| Spec block | Set via update_org? |
Notes |
|---|---|---|
sessionTimeoutSeconds |
Yes | Console inactivity timeout; minimum 900 (15 min); no platform default |
authConfig.domainAutoMembers |
Yes | Email domains whose users auto-join the org |
authConfig.samlOnly |
Yes | Boolean, no default (unset = off); require SAML for all members |
observability.*RetentionDays |
Yes | logs/metrics/traces, 0–3650, default 30; 0 turns that stream off |
observability.defaultAlertEmails |
Yes | Default Grafana alert recipients |
security.threatDetection |
Yes | Forward detected threats to a syslog target (enabled + optional minimumSeverity + syslog host/port) |
logging / extraLogging |
No | Use mcp__cpln__configure_external_logging — see external-logging |
tracing |
No | Escape hatch: mcp__cpln__get_resource_schema (kind org), author the block, cpln apply -f org.yaml |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 17d ago Changed · -24 lines 21ef760e04e9
- 1mo ago First seen · 159 lines · 50 tokens per session scan A b28c5d935d18
org-management is a skill published in the GitHub repository controlplane-com/ai-plugin (11 stars, last pushed 3d ago), licensed MIT. It adds 50 tokens to every session and 2,476 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
saga-orchestration
Implement saga patterns for distributed transactions and cross-aggregate workflows. Use this skill when implementing distributed transactions across microservices where 2PC is unavailable, designing compensating actions for failed order workflows that span inventory, payment, and shipping services, building…
platform-lightning-app-coordinate
Build complete Salesforce Lightning Experience applications from natural language descriptions. Use this skill when a user requests a "complete app", "Lightning app", "business solution", "management system", or describes a scenario requiring multiple interconnected Salesforce components (objects, fields, pages, tabs…
service-agentforce-channel-configure
Wires an existing, active Agentforce agent to a channel by resolving a fallback queue, setting up inbound routing (either PATCH SessionHandlerId on the MessagingChannel, or an inbound RoutingFlow for Voice/Email), and optionally configuring outbound escalation. Use when the user wants to add a channel to an existing…
full-stack-orchestration-full-stack-feature
Coordinate database, backend, frontend, testing, and deployment work for a complete feature. Use when implementing changes that span multiple application layers.
multi-platform-apps-multi-platform
Build and deploy the same feature consistently across web, mobile, and desktop platforms using API-first architecture and parallel implementation strategies.
commerce-app-migrate
Migrate an Adobe Commerce App Builder project from the Integration Starter Kit or Checkout Starter Kit to the new App Management approach. Run from the root of the App Builder project to be migrated. Pass --auto to skip confirmation prompts (suitable for CI or batch use) — auto mode prints a summary of all Q&A…