A deployment procedure for the DataToRAG MCP gateway running in Docker on an AWS Lightsail server. It covers connecting to the server, pulling code, loading configuration from AWS Parameter Store, rebuilding Docker, and checking health.

Use it to deploy gateway changes, rebuild the production containers, verify the service, and optionally reinstall a plugin.

It provides the required order for updating production and keeps deployment secrets in the configured AWS secret store instead of relying on hand-edited server files.

deploy — Skill by datatorag

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add skills/datatorag/mcp-gateway/deploy

Any agent

npx skills add datatorag/mcp-gateway --skill deploy

Clone the repo

git clone --depth 1 https://github.com/datatorag/mcp-gateway

Made for: Claude Code, Codex.

Per session 35 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,500 The whole file, excluding the scripts and references it only reads on demand.

Security scan B 2 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00035	$0.01500
Opus 5	$0.00017	$0.00750
Sonnet 5	$0.00007	$0.00300
Haiku 4.5	$0.00003	$0.00150

Measured 2d ago against content hash 2828c1cdcb01, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade B, and why

deploy scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Asks for rootmediumPrivilege escalation

A mod that escalates privileges can change anything on the machine, not only the project.

- Save to a temp file with `chmod 600`, connect as `ubuntu@<instance-ip>`

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -s https://datatorag.com/health

.claude/skills/deploy/SKILL.md · 112 lines

How it starts

The opening of the file, as written. The whole thing — 112 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Deploy DataToRAG MCP Gateway

Prerequisites

AWS CLI configured with a profile that has Lightsail access
The production instance runs Docker Compose on AWS Lightsail

Steps

Resolve SSH access
- Use aws lightsail get-instances to find the instance IP
- Use aws lightsail download-default-key-pair to get the SSH key if needed
- Save to a temp file with chmod 600, connect as ubuntu@<instance-ip>
- If AWS CLI has SSL issues, set AWS_CA_BUNDLE="" as a workaround

Pull latest code on the server

ssh -i <key> ubuntu@<ip> "cd ~/datatorag-mcp && git pull origin main"

2b. Render .env from SSM (secrets source of truth)

ssh -i <key> ubuntu@<ip> \
  "cd ~/datatorag-mcp && AWS_PROFILE=ssm-read bash scripts/render-env.sh /datatorag-mcp/prd .env"

Secrets live in SSM Parameter Store under /datatorag-mcp/prd/* (us-west-2). Hand-editing .env on the server is retired — edit the parameter (aws ssm put-parameter ... --overwrite with the datatorag profile) and re-render.
The server reads via the ssm-read AWS profile (read-only IAM user datatorag-mcp-server).
The server runs AWS CLI v2 (installed via the official installer — the apt awscli package no longer exists on Ubuntu 24.04).
Safe to skip only when no secrets changed since the last render.

Rebuild and restart the gateway
```
ssh -i <key> ubuntu@<ip> "cd ~/datatorag-mcp/docker && docker compose --env-file ../.env -f docker-compose.prod.yml up -d --build gateway"
```
- The .env file lives at ~/datatorag-mcp/.env on the server (NOT in docker/)
- Must pass --env-file ../.env to docker compose
- This rebuilds only the gateway container; postgres data is preserved in a volume
Health check
```
curl -s https://datatorag.com/health
```
Wait for {"status":"ok"} before proceeding.

Reinstall plugins if needed The public POST/DELETE endpoints on /api/servers have been removed. To update a plugin:

# SSH into server, then exec into the gateway container
CONTAINER=$(docker ps --filter 'name=gateway' -q)

# Pull latest code and rebuild inside the container
docker exec $CONTAINER bash -c \
  'cd /root/.datatorag/plugins/<slug> && git pull origin main && NODE_ENV=development pnpm install && npx tsc'

# Restart gateway so plugin process picks up new code
cd ~/datatorag-mcp/docker && docker compose -f docker-compose.prod.yml --env-file ../.env restart gateway

# If tools changed: re-discover tools by connecting to plugin MCP endpoint,
# then update the tools table. See reference_plugin_registry memory for details.

Read the full file on GitHub · 112 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago First seen · 112 lines · 35 tokens per session scan B 2828c1cdcb01

Subscribe to this mod's changes

deploy is a skill published in the GitHub repository datatorag/mcp-gateway (3 stars, last pushed 2d ago), licensed MIT. It adds 35 tokens to every session and 1,500 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 2 findings (asks for root, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Cloud DevOps and cloud

kagent-dev

Development guide for kagent's v1alpha3 Harness and AgentTemplate CRDs, AgentInstance gRPC control plane, upstream A2A integration, Substrate runtime provisioning, tests, generation, and PR workflow. Use for any implementation, debugging, review, or CI task in the kagent repository.

kagent-dev/kagent · 65 tokens

timoni

Use when deploying applications to Kubernetes with Timoni. Covers installing and upgrading module instances from OCI registries, composing multi-app deployments with bundles, injecting values from clusters or CI with runtimes, targeting multiple clusters, and authoring, testing, signing and publishing modules with CUE.

stefanprodan/timoni · 59 tokens

azmon-mirroredcatalogs-operations-cli

Brings Azure Monitor, Application Insights, and Log Analytics telemetry into Fabric as Eventhouse external delta tables and correlates it with business data. Use to onboard observability data, judge whether latency or availability affected revenue, or build a Real-Time dashboard and Operations Agent over it.

microsoft/skills-for-fabric · 66 tokens

durable-objects

Create and review Cloudflare Durable Objects. Use when building stateful coordination (chat rooms, multiplayer games, booking systems), implementing RPC methods, SQLite storage, alarms, WebSockets, or reviewing DO code for best practices. Covers Workers integration, wrangler config, and testing with Vitest. Biases…

cloudflare/skills · 76 tokens

ship-web-games

Package, deploy, and verify a playable Three.js or web game. Use for release builds, asset delivery, private/public deployment, production smoke tests, browser proof, release notes, rollback readiness, and cleanup of temporary QA resources.

MengTo/Skills · 50 tokens

hyperpod-version-checker

Check and compare software component versions on SageMaker HyperPod cluster nodes - NVIDIA drivers, CUDA toolkit, cuDNN, NCCL, EFA, AWS OFI NCCL, GDRCopy, MPI, Neuron SDK (Trainium/Inferentia), Python, and PyTorch. Use when checking component versions, verifying CUDA/driver compatibility, detecting version mismatches…

awslabs/agent-plugins · 120 tokens

deploy