mittwald

name	mittwald
description	Read and inspect mittwald mStudio projects, apps, runtimes, databases, domains, mail, backups, files, containers, and access users through SecretRef-backed API requests.
user-invocable	true
requires	{"bins":["node"]}
credentials	[{"id":"mittwald-api-token","kind":"bearer","required":true,"secret_ref":{"source":"store","id":"MITTWALD_API_TOKEN"},"scope":"https://api.mittwald.de Authorization bearer","how_to_obtain":"Create an API token in mittwald mStudio under the user profile API token\nsettings. Set `MITTWALD_API_TOKEN` through browser admin at\n`/admin/secrets`; if browser admin is unavailable,\nuse `/secret set MITTWALD_API_TOKEN \"<token>\"` in browser `/chat` or TUI;\nlocal console fallback:\n`hybridclaw secret set MITTWALD_API_TOKEN \"<token>\"`.\n"}]
metadata	{"hybridclaw":{"category":"infrastructure","short_description":"mittwald mStudio read operations and guarded production planning.","tags":["mittwald","mstudio","hosting","infrastructure","production"],"related_roadmap":["R21.104"],"issue":1068,"stakes_tiers":{"green":"[Truncated]","amber":"[Truncated]","red":"[Truncated]"},"escalation":{"writes":"confirm-each","route":"f14"},"cost_measurement":{"system":"UsageTotals","sub_limit_key":"mittwald"}}}

mittwald

Use this skill for mittwald mStudio / Kundencenter production-platform work: project inventory, app/runtime inspection, deployment readiness, databases, domains/DNS/SSL/ingress, mail resources, backups, files, containers, SSH/SFTP users, and marketplace/license readouts.

Default Workflow

1. Read first. Use mittwald.cjs to generate allowlisted http_request payloads and pass only the emitted httpRequest value to the built-in http_request tool.
2. Treat MITTWALD_API_TOKEN as a SecretRef only. The helper sets bearerSecretName: "MITTWALD_API_TOKEN" so the gateway injects Authorization: Bearer ... server-side. Never ask the user to paste the token, inspect it, or write raw Authorization headers.
3. For prompt/user testing, stop after plan or helper http-request payload generation. Do not call http_request unless live mittwald data is needed for the user's request.
4. For live calls, stop after the first 401 or 403. Report a credential or API role setup problem and ask the operator to verify MITTWALD_API_TOKEN in this order: browser admin at the active /admin/secrets route, /secret set MITTWALD_API_TOKEN "<mittwald-api-token>" in browser /chat or TUI, then local console fallback hybridclaw secret set MITTWALD_API_TOKEN "<mittwald-api-token>".
5. For 429 responses, report rate-limit guidance from Retry-After, X-RateLimit-Reset, X-RateLimit-Remaining, and X-RateLimit-Limit when present. Do not start retry loops.
6. For guarded writes, require exact F8/F14 operator approval for the named target and pass --operator-grant only after that approval. The helper includes the target resource id in approval.requiredGrant.
7. Account for eventual consistency after writes: mutating responses may return an etag event id. Run the emitted event-follow-up command with --event-id <etag> so the read uses if-event-reached before reporting completion.
8. Do not use curl as the normal execution path when http_request is available.

The helper is read-first. Guarded write operations exist only for allowlisted mittwald API shapes and require exact F8/F14 approval: service actions, database creation, app installation creation, cronjob creation, domain project/nameserver/deletion changes, backup restore, delivery box creation, license-key validation, and extension ordering. App installation runtime actions are intentionally not exposed because the current mittwald OpenAPI marks that endpoint deprecated and non-functional. Do not create API tokens or use unlisted marketplace mutations.