Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add controlplane-com/ai-plugin --skill workloadgit clone --depth 1 https://github.com/controlplane-com/ai-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/controlplane-com/ai-plugin/workload)<a href="https://agentmods.dev/skills/controlplane-com/ai-plugin/workload"><img src="https://agentmods.dev/badge/skills/controlplane-com/ai-plugin/workload/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/controlplane-com/ai-plugin/workload"><img src="https://agentmods.dev/badge/skills/controlplane-com/ai-plugin/workload.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00064 | $0.02442 |
| Opus 5.5 | $0.00026 | $0.00977 |
| Sonnet 5.5 | $0.00013 | $0.00488 |
| Haiku 4.5 | $0.00006 | $0.00244 |
Grade A, and why
workload scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 17d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- A workload calls the Control Plane API as its identity: `curl -H "Authorization: Bearer $CPLN_TOKEN" $CPLN_ENDPOINT/org/$CPLN_ORG/...`. `CPLN_ENDPOINT` is plain HTTP, and a call succeeds only where a policy grants the How it starts
The opening of the file, as written. The whole thing — 103 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Workloads
Tool availability: the
configure_workload_*tools need?toolsets=full;create_workload,update_workload, and the job tools are core.
A workload is the unit of deployment: one to eight containers plus how they scale, get exposed, store data, and stay healthy. mcp__cpln__deploy_app covers a single-container HTTP app, image, or repository: a standard workload, with a data directory every replica shares (storage with shared: true), or a stateful workload on one replica when the data directory is per replica (storage without shared). create_workload and update_workload cover the rest: serverless, several containers, cron, non-HTTP ports, custom firewall rules, probes and scaling tuned in depth. restart_workload, rollback_workload, promote_workload, and allow_workload_access do those jobs in one call.
Workload type (immutable, standard by default)
| standard | serverless | stateful | cron | |
|---|---|---|---|---|
| Use for | long-running services, APIs, workers | request-driven HTTP that scales on demand | databases, stable disk or per-replica identity | scheduled jobs |
| Autoscaling metrics | cpu, memory, latency, rps, multi, keda, disabled | concurrency, cpu, memory, rps, disabled | cpu, memory, latency, rps, multi, keda, disabled | none: runs on schedule |
| Capacity AI | on by default | on by default | supported | on by default; lands at the next run |
| Default probes | none | TCP readiness and liveness | none | ignored |
ext4/xfs volumes |
no | no | only here | no |
shared volumes |
yes | yes | yes | yes |
| Scale to zero | KEDA only | yes | KEDA only | no |
concurrency scaling exists only on serverless; on standard or stateful the closest is rps. Since type cannot change, pick it for the metric the user wants.
Which tool sets what
| Spec block | Set with |
|---|---|
containers[]: image, ports, cpu/memory, env, command/args, probes, metrics, volumes |
create_workload / update_workload |
autoscaling, capacityAI, timeoutSeconds, suspend, debug |
create_workload / update_workload |
firewallConfig, or the public shortcut |
create_workload / update_workload |
schedule and job policy (concurrencyPolicy, historyLimit, restartPolicy, activeDeadlineSeconds) |
the same tools with type: cron |
loadBalancer (direct, geo, replicaDirect) |
configure_workload_load_balancer |
sidecar.envoy (JWT auth, Envoy filters) |
configure_workload_sidecar |
extras (BYOK affinity, tolerations, topology) |
configure_workload_extras |
localOptions (per-location overrides, multiZone, capacityAIUpdateMinutes) |
configure_workload_local_options |
rolloutOptions (termination grace, surge) |
configure_workload_rollout |
securityOptions (runAsUser, filesystemGroupId) |
configure_workload_security |
requestRetryPolicy |
configure_workload_retry |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 17d ago Changed · -112 lines 8f0d559fb0ee
- 25d ago Changed · +2 lines 70aedd617b4e
- 1mo ago First seen · 213 lines · 64 tokens per session scan A b5a27afcc36f
workload is a skill published in the GitHub repository controlplane-com/ai-plugin (11 stars, last pushed 3d ago), licensed MIT. It adds 64 tokens to every session and 2,442 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
ak-cloud-deploy
Deploy an Agent Kernel project to AWS, Azure, or GCP using Terraform modules, or to any Kubernetes cluster (on-prem, baremetal, EKS) using the official Helm chart. Supports serverless and containerized modes for all three clouds. AWS supports execution modes (restsync, restasync, async, stream), queue-based scalable…
openpitrix
KubeSphere OpenPitrix application management Skill. Use when users ask about KubeSphere App Store, OpenPitrix, Helm/YAML application templates, application repositories, app versions, app releases, categories, review states, repository sync, or troubleshooting application installation and upgrade issues.
kubesphere-openkruise
KubeSphere OpenKruise management Skill. Use when user asks to install or enable OpenKruise, check OpenKruise status, view kruise pods/logs/CRDs, create or update SidecarSet, manage sidecar injection, create or update CloneSet, perform in-place update or batch rollout, uninstall or remove OpenKruise, or troubleshoot…
kubesphere-volcano
KubeSphere Volcano job management Skill. Use when user asks to create, list, update, delete Jobs (Volcano Jobs), manage Queues, create PyTorch/TensorFlow/MPI training jobs, or troubleshoot Volcano scheduling issues in KubeSphere. Includes built-in YAML templates, scheduling policy recommendations, and best practices…
openshell-cli
Guide agents through using the OpenShell CLI (openshell) for sandbox management, gateway registration, provider configuration and refresh, profile management, policy iteration, settings, service exposure, BYOC workflows, and attached-provider inference. Covers basic through advanced multi-step workflows. Trigger…
azd-deployment
Deploy containerized frontend + backend applications to Azure Container Apps with remote builds, managed identity, and idempotent infrastructure.