scoutflo

Plugin scoutflo from marketplace scoutflo in Scoutflo/ai-readiness. Commands read from the repo's manifest — today.

Skills (48)

• alert-fatigue

  Read-only, non-scored alert-fatigue analysis from existing audit findings and optional current fire-history or incident counts. Use when the user mentions alert fatigue, noisy paging, flapping alerts, too many alerts, cross-tool alert overlap, or alert-to-incident ratio. Supports local roll-up and b

• audit-alertmanager

  Read-only audit of paging configuration, observed dispatch, and structural alert noise; follows each alert rule through Alertmanager routes to a live receiver, scores delivery gaps, and scores alert-hygiene gaps (flapping, permanently-firing rules, missing `for` debounce, missing grouping or inhibit

• audit-all

  Runs every audit configured in toolkit.yaml and writes one combined summary with per-target scores, estate sizes, score trends from each history ledger, and blocked audits, plus a single combined Slack brief. Use when the user asks to audit everything, run all audits, check overall observability hea

• audit-aws

  Read-only scored audit of AWS observability (CloudWatch alarms, SNS routing, EC2/ECS/EKS/Lambda compute health, RDS/Aurora/DocumentDB, Route53/ELB uptime, log forwarding) that also reports a separate non-scored Cost & Resource Optimization section from Compute Optimizer, Cost Explorer, and Trusted A

• audit-azure

  Read-only scored audit of Azure Monitor observability, covering action groups and alert delivery, metric alerts, scheduled-query (log) alerts, activity-log alerts, VM/VMSS coverage, AKS Container Insights and managed Prometheus, Log Analytics coverage and retention, and App Gateway/Load Balancer dia

• audit-clickstack

  Read-only scored audit of a ClickStack observability deployment (ClickHouse + HyperDX + OpenTelemetry): telemetry-table coverage, ingestion freshness, per-table retention TTL, ClickHouse database health, HyperDX alerting and dashboards/sources, and security posture; writes findings.json and report.m

• audit-cost

  Read-only DEEP, per-resource cloud cost audit across AWS, GCP, Azure, Kubernetes, Datadog, and DigitalOcean; queries each provider's own cost-recommendation surfaces live (AWS Compute Optimizer / Cost Explorer / Cost Optimization Hub, GCP Recommender, Azure Cost Management + Advisor, Datadog usage,

• audit-datadog

  Read-only scored audit of Datadog monitor health across notification delivery, monitor noise controls (recovery thresholds, no-data, renotify, auto-resolve), muting and downtimes, SLO and composite coverage, plus a separate non-scored Cost & Resource Optimization section from Datadog's own usage end

• audit-digitalocean

  Read-only scored audit of DigitalOcean observability across App Platform apps, managed databases, uptime checks, alert policies, Slack and email routing, and log forwarding; writes findings.json and report.md and changes nothing. Use when the user mentions auditing or scoring DigitalOcean, doctl, Ap

• audit-elk

  Read-only scored audit of Kibana Alerting across rule notification delivery, dead connectors, rule execution health (error/warning states), alert noise controls (flapping detection, alert_delay, action throttling, snoozes), and rule-type coverage per Kibana space; writes findings.json and report.md

• audit-gcp

  Read-only scored audit of Google Cloud observability, covering Cloud Monitoring alert policies, notification channels, uptime checks, dashboards, logs-based metrics and sinks, GKE telemetry settings, Compute Engine VM metrics, and load balancer health wiring; writes findings.json and report.md and c

• audit-grafana

  Read-only scored audit of the Grafana application layer: datasource health and credentials, dashboard panel semantics (scope-leak and stale-datasource checks), alert rule wiring and receiver delivery, query hygiene, usage and cost visibility; writes findings.json and report.md and changes nothing. U

• audit-groundcover

  Read-only scored audit of groundcover monitors and alerting hygiene across per-monitor firing controls (pendingFor, hysteresis resolve threshold, auto-resolve, no-data and execution-error state), notification noise (re-notification interval, status filters, route-bypass), monitor health and silence

• audit-jsm

  Read-only scored audit of Jira Service Management (JSM) Operations paging health across escalation and routing, on-call schedules, notification-policy noise controls (dedup, delay, suppress, auto-close, auto-restart), maintenance windows, heartbeat liveness, and unacknowledged-alert aging; writes fi

• audit-kubernetes

  Read-only scored audit of a Kubernetes cluster's security and operational posture — Pod Security Admission enforcement, RBAC over-permissioning, network-policy coverage, workload resource limits, and PodDisruptionBudget/replica resilience — that also reports a separate NON-SCORED live-runtime snapsh

• audit-lgtm

  Read-only scored audit of the LGTM (Loki, Tempo, Mimir) and VictoriaMetrics store stacks and their alert routing — logs, traces, the Mimir/VictoriaMetrics metrics stores (reachability, queryability, multi-tenancy, ingestion freshness, ruler health), per-service telemetry coverage, Alertmanager/vmale

• audit-newrelic

  Read-only scored audit of a New Relic account across alert delivery (condition to policy to workflow to destination), alert noise (tiering, evaluation sanity, muting hygiene, measured fire-history from NrAiIncident), entity coverage and span-derived topology, SLO and dashboard posture, and data heal

• audit-pagerduty

  Read-only scored audit of PagerDuty paging health across services, escalation policies, on-call schedules, alert grouping and noise controls, incident aging, and a vendor-analytics-backed actionability section (auto-resolved share, MTTA, sleep-hour interruptions); writes findings.json and report.md

• audit-prometheus

  Read-only scored audit of a Prometheus server and its rule-engine plane — scrape-target health and per-service `up` coverage, TSDB cardinality/churn, WAL and compaction integrity, remote-write backlog, config-reload state, and alerting/recording rule health (loaded, error-free, evaluating on time, b

• audit-sentry

  Read-only scored audit of your Sentry org: project privacy scrubbing, alert rule tiers and receiver liveness, integrations, releases and source maps, and cron/uptime monitors; writes findings.json and report.md, changes nothing. Use when the user mentions auditing or scoring Sentry, Sentry alert rul

• audit-signoz

  Read-only scored audit of a SigNoz observability deployment (OpenTelemetry-native metrics/traces/logs on ClickHouse): telemetry coverage for critical services, ingestion freshness, per-signal retention TTL, ClickHouse backend health, alert rules that evaluate and route to a live channel, dashboards,

• audit-splunk-oncall

  Read-only scored audit of Splunk On-Call (formerly VictorOps) routing, effective paging, suppression, future coverage, incident response and alert fatigue. Joins paging paths to separately observed alert sources; emits findings.json, inventory.json and reports without sending a page. Use when you sa

• audit-zenduty

  Read-only scored audit of Zenduty (Xurrent IMR) paging health across escalation and on-call, alert-rule and service-level noise controls (collation dedup, suppress rules, correlation, delay, maintenance windows), integration and routing hygiene, and a server-side-analytics-backed actionability secti

• business-context-resolver

  Auto-discover K8s labels, AWS tags, GitHub CODEOWNERS and generate computed_metadata.jsonl for metadata-driven audit filtering, escalation, and cost sensitivity. Read-only discovery only; no mutations to live services.

• business-context

  Capture your organization's SRE guardrails as a rich, version-controlled source-of-truth file (~/.scoutflo/business_context.md) that every audit and setup reads — SLAs and SLOs per service, per-environment access (which AWS profile / GCP project / cluster each environment uses) and per-environment S

• checkpoint

  Interactive inventory selection + batching for large estates. Before running audit-all, users select which services and regions to audit, saving the scope to topology.json for reuse. On large estates (1000+ resources), automatically batches queries to control token costs. Use when auditing multi-ser

• connect

  Guided credential setup; creates minimal-scope tokens per tier for Grafana, Sentry, PagerDuty, Datadog, ELK/Kibana, JSM Operations, Zenduty, Splunk On-Call (VictorOps), Groundcover, Prometheus, Loki, Tempo, Mimir, VictoriaMetrics (plus VictoriaLogs and VictoriaTraces via the loki/tempo blocks), Clic

• correlation-engine

  Harness skill (run it directly, or let audit-all run it for you): after any audit(s) (audit-all, sequential, or targeted 2-3), builds correlation.json that identifies shared-resource monitoring candidates and possible dependency chains, and advisory cross-tool coverage candidates; downstream consume

• cost-analysis

  Internal roll-up harness (v0.1.67+): inside /scoutflo:audit-all, aggregates the cost-optimization findings the individual audits already wrote (area cost-optimization — AWSOPT-*, DDOPT-*), annotates exact-target overlaps from current qualified evidence, and writes a combined cost roll-up. It ALWAYS

• doctor

  Preflight connection check; a bundled read-only script reads ~/.scoutflo/toolkit.yaml, makes bounded read-only probes for each configured integration, and emits a JSON-per-check matrix with fix hints and distinct exit codes. Use when the user mentions doctor, preflight, connection check, cannot reac

• map-repos

  Builds a read-only, human-confirmed map from your services to their GitHub repositories and writes repo-map.md plus a machine-readable repo-map.json keyed on each repo's immutable numeric id. Use when the user asks to map services to repos, find which repo backs a service, link code to services, or

• map-topology

  Builds a read-only service topology map from the best available source — Istio or plain Kubernetes when a cluster is configured, and otherwise cloud inventories (AWS ECS/EC2/Lambda/ALB, DigitalOcean), APM-derived service maps (New Relic entities + span-derived call edges, Sentry projects), or a guid

• migration-plan

  Read-only, evidence-cited migration PLAN between two configured observability providers — currently Datadog → SigNoz. Inventories every source object (monitors, SLOs, synthetics, dashboards, downtimes, log pipelines), joins the audits' findings + measured fire-history so dead weight is proposed for

• rca

  Answer "why is <resource/service> failing / at risk — give me the RCA" with a live, evidence-cited root cause. It uses your existing audit reports as REFERENCE (what's known, where to look), the service topology as the BLAST-RADIUS MAP (every attached resource/service, who calls whom, what monitors

• schedule-audits

  Sets up recurring audits by filling a GitHub Actions workflow, crontab entry, or Claude cloud schedule that runs audit-all headless with an optional Slack brief, writing the file only after approval. Use when the user asks to schedule audits, run audits weekly or nightly, automate recurring audits,

• setup-aws

  Guided hardening of AWS observability from audit-aws findings; fixes CloudWatch alarms, SNS routing, RDS backups, uptime alarms, and log retention and forwarding, announcing each change, waiting for confirmation, then verifying live. Use when the user asks to fix an AWS-NNN finding, wire AWS alert r

• setup-azure

  Guided hardening of Azure Monitor from audit-azure findings; creates and repairs action groups, metric alerts, scheduled-query (log) alerts, activity-log alerts, VM/VMSS alerts, AKS Container Insights and managed Prometheus, and diagnostic settings to Log Analytics, announcing each change, waiting f

• setup-clickstack

  Guided hardening of a ClickStack (ClickHouse + HyperDX + OpenTelemetry) stack from audit-clickstack findings. Sets deliberate per-table retention TTL on the otel_* telemetry tables, creates a HyperDX alert wired to a live receiver, creates a scoped read-only ClickHouse user for audits, and hardens C

• setup-digitalocean

  Guided hardening of DigitalOcean observability from audit-digitalocean findings; provisions alert destinations, uptime checks, App Platform alert rules and health checks, database alert policies, and log forwarding, announcing each change, waiting for confirmation, then verifying live. Use when the

• setup-gcp

  Guided hardening of Google Cloud Monitoring from audit-gcp findings; creates and repairs notification channels, uptime checks, alert policies, logs-based metrics, and dashboards, announcing each change, waiting for confirmation, then verifying live. Monitoring-plane writes only. Use when the user as

• setup-grafana

  Guided hardening of Grafana datasources, dashboards, contact points, notification policies, and alert rules from audit-grafana findings; announces each change, waits for confirmation, applies, then verifies live. Use when the user asks to fix a GRAF-NNN finding, wire or repair contact points, clean

• setup-kubernetes

  Guided hardening of a Kubernetes cluster from audit-kubernetes findings; labels namespaces for Pod Security Admission, tightens over-permissioned workload RBAC, adds default-deny NetworkPolicies, sets workload resource limits, and adds PodDisruptionBudgets — announcing each change, waiting for expli

• setup-lgtm

  Guided hardening of LGTM and VictoriaMetrics stacks from audit-lgtm and audit-alertmanager findings: alert routing, noisy rules, retention, HA, exposure, service labels, and monitoring-namespace NetworkPolicies and PDBs, each change announced, confirmed, then verified live. Use when the user asks to

• setup-newrelic

  Guided, confirm-then-verify remediation of the gaps audit-newrelic finds in a New Relic account — wiring workflows to uncaught policies, creating per-service alert conditions from golden metrics, fixing condition tiering/evaluation/loss-of-signal settings, retiring dead-weight conditions, scheduling

• setup-sentry

  Guided hardening of a Sentry org from audit-sentry findings (projects, environments, scrubbing, alert rules and routing, monitors); announces each change, waits for confirmation, then verifies live. Use when the user asks to fix a SNTRY-NNN finding, wire Sentry alerts to Slack or PagerDuty, clean up

• setup-splunk-oncall

  Configure Splunk On-Call (formerly VictorOps) teams, staffed rotations, escalation policies, routing keys, effective notifications, suppression and incident-quality improvements with exact change approval, fresh dependency checks and readback. Use when you say "set up Splunk On-Call", "fix VictorOps

• start

  Orientation for the Scoutflo AI Readiness: execution and data handling, first steps, the full skill catalog, credential tiers, and where audit reports land. Use when the user asks where to start, what the toolkit can do, which skills exist, how reports and scoring work, or whether any data leaves th

• topology-guided-setup

  Internal harness library (v0.1.66+): an available helper a setup skill can source to make topology-aware fix decisions from correlation.json + business-context — detect redundant monitoring (skip or dedup), find cascade risks (fix root causes first), apply business context (critical services require

Hooks (1)

• SessionStart

  sh "${CLAUDE_PLUGIN_ROOT}/hooks/scripts/config-nudge.sh"

Similar plugins