| name | evidra |
| description | Use this skill when the user asks you to perform DevOps operations — diagnosing, fixing, or managing infrastructure using kubectl, helm, terraform, or aws commands. This includes: running kubectl get/describe/logs/apply/delete/patch, helm install/upgrade/status/list, terraform plan/apply/destroy/import, aws CLI commands, or any infrastructure investigation and remediation workflow. Also trigger when the user mentions Evidra, evidence chains, prescribe/report protocol, reliability scorecards, or run_command. DO NOT trigger for: writing Dockerfiles, writing Ansible/Terraform code without executing it, CI/CD pipeline setup, explaining infrastructure concepts, or writing tests for infrastructure tools. The key distinction is OPERATING infrastructure (both reading and mutating) vs WRITING code. |
Evidra — DevOps MCP Server
evidra-mcp is your infrastructure toolkit. Use run_command for kubectl, helm, terraform, and aws operations.
Smart Output
Responses are token-efficient summaries, not raw JSON. Trust them.
Diagnosis Protocol
- Investigate before fixing: kubectl describe, get events, check logs
- Make one targeted fix, verify it worked, then stop
- Don't patch resources you didn't investigate
Safety
- Never delete resources outside the problem scope
- Verify fixes with kubectl get or rollout status
- Check what exists before creating (avoid duplicates)
Evidence Recording
Every infrastructure mutation is automatically recorded via run_command. For explicit control, use prescribe_smart or prescribe_full before mutations.
When to prescribe explicitly
- Mutations: kubectl apply/delete/patch, helm install/upgrade, terraform apply/destroy
- Skip for: kubectl get/describe/logs, helm list, terraform plan (read-only)
- When unsure: prescribe (safe default)
prescribe_smart (recommended)
Call with: tool, operation, resource, namespace, actor.
Returns: prescription_id, effective_risk.
{
"tool": "kubectl", "operation": "apply",
"resource": "deployment/web", "namespace": "default",
"actor": {"type": "agent", "id": "your-id", "origin": "mcp-stdio", "skill_version": "1.2.0"}
}
prescribe_full
Call with: tool, operation, raw_artifact, actor.
Use when you have the full YAML/manifest and want drift detection.
report (after every mutation)
Call with: prescription_id, verdict (success/failure/declined), exit_code, actor.
On retry: new prescribe, execute, new report (each attempt is a pair).
Critical Rules
- Do not execute mutate commands until a prescribe tool returns ok=true with prescription_id.
- Every prescribe must have exactly one report.
- Always include actor.skill_version (set to this contract version).
- Report failures honestly (non-zero exit_code)
- Declined verdicts use decision_context, not exit_code
Risk Tags
| Tag | Severity |
|---|
k8s.privileged_container | critical |
k8s.cluster_admin_binding | critical |
ops.mass_delete | critical |
k8s.hostpath_mount | high |
k8s.run_as_root | high |
k8s.host_namespace_escape | high |
k8s.docker_socket | high |
k8s.dangerous_capabilities | high |
k8s.writable_rootfs | high |
ops.kube_system | high |
ops.namespace_delete | high |
aws_iam.wildcard_policy | critical |
terraform.s3_public_access | high |
aws.security_group_open | high |
Behavioral Signals
protocol_violation, artifact_drift, retry_loop, blast_radius, new_scope, repair_loop, thrashing, risk_escalation
