memory-journal-mcp

Multi-pass adversarial performance audit for entire repositories. Combines structured profiling (Agent A) with adversarial stress-testing critique (Agent B) through iterative passes. Optimize repo/backend performance, hot-paths, build size, and server throughput. Do NOT use for frontend page load metrics or Lighthouse audits (use web-perf). NOT for frontend Core Web Vitals (use web-perf).

Multi-pass adversarial planning and review skill that improves agent-generated plans through structured critique stages. Combines an initial planning agent (structure, logic, task sequencing) with an adversarial review agent (performance, security, maintainability) and a final Copilot extension validation pass. Use when creating implementation plans, designing architecture, planning roadmaps or milestones, or when the user says "plan this", "review my plan", "adversarial review", or "multi-pass plan".

Multi-pass adversarial security audit for entire repositories. Combines structured threat modeling (Agent A) with adversarial attack surface analysis (Agent B) through iterative passes. Merges the security-audit workflow's 10-category checklist with the adversarial-planner's structured critique methodology. Use when running security audits, threat modeling, or when the user says "security audit", "adversarial security", "threat model this repo", "red team this repo", or "find vulnerabilities". NOT for fixing or remediating known security issues (use autonomous-dev instead). NOT for supply chain dependency scanning. NOT for general workflow audits or code quality. If user says 'fix security issues', ask whether they want to audit first or fix known issues.

Multi-pass adversarial quality audit for agent skill directories. Combines structured evaluation with adversarial stress-testing to assess skill completeness, instruction clarity, trigger accuracy, and security. Use when auditing a skills directory.

Multi-pass adversarial quality audit for flat markdown workflow files. Combines structured evaluation (Agent A) with adversarial stress-testing (Agent B) to assess sequential clarity, prerequisite validation, HITL (Human-in-the-loop) safety gates, loop prevention, and formatting. Use when auditing workflow scripts (e.g., slash-commands like /bump-deploy), or when the user asks to review or improve operational playbooks.

Core rules for code quality and specifications of Model Context Protocol (MCP) servers. Use when reviewing MCP code quality, enforcing specification rules, or checking schemas/error responses. Must see the explicit keyword "MCP" or "Model Context Protocol". NOT for general REST APIs or Cloudflare Workers. Do NOT trigger for generic 'build a server' requests unless the type is explicitly specified as an MCP server. (Invoke explicitly with `/mcp-builder` — does not auto-trigger).

Build AI agents on Cloudflare Workers using the Agents SDK or build Model Context Protocol (MCP) servers. Load when creating stateful agents, durable workflows, MCP servers, checking MCP schema/error responses, or reviewing MCP code quality. Covers Agent class, state management, callable RPC, Workflows integration, and MCP implementation rules. Do NOT trigger for generic 'build a server' requests unless the platform is explicitly specified as Cloudflare Agents or an MCP server.

Standards for Authentication and Identity management. Use when configuring OAuth, JWTs, sessions, RBAC (Role-Based Access Control), or integrating auth providers (Auth0, Clerk, NextAuth). SECURITY: Implementing auth requires strict fallback logic. Never fail-open. Handle token expiration and revocation gracefully.

Harness for autonomous software development. Use when fixing or remediating known issues (including security vulnerabilities). Enforces lifecycle through alignment gates (PROJECT.md), adversarial generator/evaluator agents, and autonomous orchestration of project issues. NOT for setting up standalone CI/CD pipelines.

Comprehensive AWS (Amazon Web Services) best practices and infrastructure guidelines. Use when deploying to AWS, writing CloudFormation/CDK/Terraform for AWS, configuring IAM permissions, S3 buckets, EC2 instances, Lambda functions, or ECS/EKS clusters. Do NOT trigger for generic "deploy my app" requests without clarifying the target platform.

Microsoft Azure best practices. Use when deploying to Azure App Service, Azure Functions, AKS (Azure Kubernetes Service), Cosmos DB, configuring Azure Entra ID (Active Directory), or managing Azure Resource Manager (ARM/Bicep) templates. Do NOT trigger for generic "deploy my app" requests without clarifying the target platform.

Biome formatting and linting standards. Use when configuring Biome (biome.json) for fast formatting, linting, and sorting imports. NOT for Prettier or ESLint configuration. Do NOT trigger for generic formatting/linting tasks unless Biome is explicitly requested.

Master the Bun all-in-one toolkit — runtime, package manager, test runner, and bundler. Use when writing, running, testing, or bundling TypeScript/JavaScript with Bun. Triggers on "bun", "bunx", "bun install", "bun test", "bun run". If the user asks to 'write tests' without specifying the type, you MUST ask 'Unit, E2E, or both?' before proceeding.

(GENERIC ROUTING ONLY) General Cloudflare platform skill for infrastructure, storage, and networking. Use when choosing between Cloudflare products (KV vs D1 vs R2) or doing general Cloudflare tasks. NOT for building AI agents (use agents-sdk). NOT for building MCP servers (use mcp-builder). NOT for deploying applications unless Cloudflare is the explicit target platform. Do NOT use for code-reviewing Workers (use workers-best-practices instead) or for CLI deployment/management (use wrangler instead). NOT for orchestrating CI/CD pipelines (use github-actions instead). NOT for AWS, GCP, Azure, Render, or generic container deployment. Use specific skills like `wrangler` or `workers-best-practices` when the task is narrowly scoped.

Production-grade Docker and container best practices. Use when containerizing apps with Docker, writing Dockerfiles, or managing Docker Compose environments. "multi-stage build", "image size", "docker-compose". Use ONLY when a Dockerfile or container registry is the explicit target for deployment. NOT for serverless or Cloudflare Workers. NOT for generic app deployment without containers. NOT for orchestrating CI/CD pipelines natively (use github-actions instead). Do NOT trigger for generic "deploy my app" requests without clarifying the target platform.

Documentation marketability audit for repository README, Docker Hub README, Wiki, and registry listings. Evaluates feature visibility, first impressions, competitive differentiation, onboarding friction, and cross-document consistency. Use when improving README quality, surfacing under-marketed features, preparing docs for a launch, or when the user says "improve my README", "market my docs", "make my docs better", "README audit", "under-marketed features", "improve discoverability", or "README review". NOT for structural compliance or source-of-truth parity (use /doc-audit).

Drizzle ORM best practices. Use when configuring databases, designing schemas, writing queries, or handling migrations with Drizzle ORM, particularly with Cloudflare D1 or SQLite. NOT for database setup without an explicit engine. Require engine specification (Postgres/MySQL/SQLite). Use for ORM-managed migrations.

Create and review Cloudflare Durable Objects. Use when building stateful coordination (chat rooms, multiplayer games, booking systems), implementing RPC methods, SQLite storage, alarms, WebSockets, or reviewing DO code for best practices. Covers Workers integration, wrangler config, and testing with Vitest.

Google Cloud Platform (GCP) best practices. Use when provisioning GCP infrastructure, configuring IAM, deploying to Cloud Run, GKE (Kubernetes Engine), Cloud Functions, Cloud SQL, or managing BigQuery. Do NOT trigger for generic "deploy my app" requests without clarifying the target platform.

Master GitHub Actions CI/CD workflows with production-grade security and performance patterns. Use ONLY when explicitly setting up CI/CD pipelines specifically via GitHub Actions, setting up matrix strategies, caching dependencies, managing artifacts, or implementing reusable workflows. For deployment requests, use ONLY when the deploy step is inside a .github/workflows file. NOT for GitLab or autonomous-dev. NOT for Render, AWS, Azure, or GCP deployments unless explicitly triggered from within a CI/CD workflow context. Do NOT trigger for generic "deploy my app" requests without clarifying the target platform.

Structured workflows for GitHub issues, PRs, milestones, and code audits with validation gates and HITL checkpoints. Use when assigned a GitHub issue, reviewing a PR, sprinting through a milestone, updating dependencies, or running code audits. Also use when asked to "triage an issue", "review a PR", or "update deps". Do NOT trigger on bare verbs (e.g. "fix this"); require GitHub context. NOT for pipeline authoring (use github-actions instead). Delegate all code quality, performance, and security audits to the dedicated `adversarial-*` skills instead.

Documentation and instructions for integrating the GitHub Copilot CLI (`copilot`) into agentic workflows. Use this skill when you need a "second opinion" adversarial review of a local codebase, a pre-push PR review using alternative advanced models, or shell suggestion capabilities from GitHub. Activates on "Copilot CLI", "local PR review", "codebase Copilot review", "second opinion", "use gh copilot", or "ask Copilot".

Reusable scaffold for public TypeScript/Node.js repositories under a target organization. Use when creating a new GitHub repository to generate all community standards, CI/CD, config files, labels, and topics in one pass.

Specialized assistant skill for managing repositories and CI/CD in GitLab. Activate when the user asks about GitLab projects or repositories, wants to see merge requests or pipelines, needs to search code or files, asks about CI/CD status or job logs, or wants to browse repository contents. Mentions "GitLab", "glab" CLI, or explicitly asks for GitLab MRs/pipelines. Must see explicit keyword 'GitLab' or 'glab'. NOT for GitHub Actions.

Master Go development using production-grade best practices merged from the Google and Uber style guides. Use whenever writing backend Go microservices, designing APIs, handling errors, managing goroutines, or configuring linters. Keywords: channels, context propagation, go.mod, Go generics. Do NOT trigger for generic 'build a server' requests unless the platform/language is explicitly specified as Go/Golang.

GraphQL best practices. Use when designing GraphQL schemas, writing resolvers, handling mutations, avoiding N+1 query problems (DataLoader), or configuring GraphQL servers. NOT for REST APIs, generic database design, or ORM setups.

Hono framework best practices. Use when building, reviewing, or debugging Hono applications, especially on Cloudflare Workers. Covers routing, middleware, context (c), and RPC patterns. Do NOT trigger for generic 'build a server' requests unless Hono or Cloudflare Workers is explicitly requested.

Guided database pruning and optimization workflows for memory-journal-mcp. Uses importance scores, relationship density, and entry metadata to identify low-value entries for safe soft-deletion. Includes dry-run previews, backup gates, and revert guidance. Use when the user says "clean up the database", "optimize entries", "prune old entries", "database maintenance", "what entries can I delete?", "my journal is getting too big", or "archive old entries".

Master modern LLM application engineering patterns. Use when designing prompt chains, evaluating output quality, managing token limits, streaming responses, or integrating LLMs into full-stack applications. SECURITY: Always sanitize user input before passing to LLM prompts to prevent prompt injection.

Monorepo architecture and configuration standards. Use when working with Turborepo, pnpm workspaces, npm workspaces, or configuring shared packages, tsconfig bases, and internal dependencies. NOT for generic package management or single-package repositories. Require explicit monorepo context.

Patterns for multi-agent systems and agentic workflows. Use when designing systems where multiple AI agents collaborate, delegate tasks, or follow structured workflows (e.g. Plan-and-Execute).

Use when designing, querying, or managing a MySQL or MariaDB database. Enforces enterprise production rules for query safety (strict parameterization), connection pooling, and strict schema configurations (STRICT_TRANS_TABLES). MUST-ASK: Require explicit database engine name before triggering. Never guess. Do NOT trigger for generic "set up a database" requests. NOT for Postgres or SQLite. NOT for ORM-managed migrations.

Next.js and React performance optimization best practices - file conventions, RSC boundaries, data patterns, async APIs, Core Web Vitals, and bundle size. NOT for granular component caching strategies (use next-cache-components).

Next.js 16 Cache Components guidance. Use when refactoring React Server Components for performance, debugging Partial Prerendering (PPR) issues, or applying the `use cache` directive, `cacheLife`, `cacheTag`, `updateTag`, and `revalidateTag`. Also use when deciding whether data should be static, cached, or dynamic, or when addressing stale data and cache invalidation. For general Next.js performance, adversarial-performance may also apply.

Upgrade Next.js to a specific target version using safe dependency bumps, codemods, and diff reviews. Use when you need to execute major version bumps, resolve breaking changes, "upgrading Next.js", "migrate to Next.js 15 or 16", or safely "run @next/codemod" against the repository before upgrading.

Node.js core runtime standards. Use when working with native Node.js APIs like streams, buffers, child_process, worker_threads, filesystem, or event loop tuning. Do NOT trigger for generic 'build a server' requests unless the platform/language is explicitly specified.

Observability standards using OpenTelemetry. Use when instrumenting applications for distributed tracing, metrics, and structured logging. NOT for Cloudflare Workers observability (use workers-best-practices). NOT for performance optimization - use adversarial-performance or web-perf. SECURITY: Ensure sensitive PII/secrets are scrubbed before logging.

Comprehensive, opinionated guidance for Playwright test development. Use ONLY when writing E2E, browser tests, UI tests, API, component, or visual tests, debugging failures, implementing Page Object Model, or configuring CI/CD. For unit tests, use vitest-standard. Use Playwright solely for E2E, API, and component tests. NOT for unit testing (use Vitest). If the user asks to "write tests" without specifying the type, you MUST ask "Unit, E2E, or both?" before proceeding.

Use when designing, querying, or managing a PostgreSQL database. Enforces enterprise production rules for advanced querying, composite indexing, JSONB data handling, and strict optimization patterns (avoiding N+1). Keywords: PostgreSQL query, JSONB, pg, pgvector, RLS, Postgres migration. MUST-ASK: Require explicit database engine name before triggering. Never guess. Do NOT trigger for generic "set up a database" requests. NOT for SQLite or MySQL. NOT for ORM-managed migrations.

Master modern Python development with production-grade tooling and idioms. Use when writing Python code, configuring project structure, managing dependencies with uv, linting with ruff, adding type hints, writing pytest tests, or building FastAPI/Django/Flask applications. Triggers on "Python", "FastAPI", "Django", "Flask", "pytest", "uv", "ruff", "pyproject.toml". Do NOT trigger for generic 'build a server' requests unless the platform/language is explicitly specified as Python (e.g. FastAPI, Django, Flask).