Use before running any build, test, lint, or format command to establish a working toolchain or runtime. Follows the user's declared environment presets, probes what is already available, provisions only in ways that do not modify the host machine (an ephemeral nix/guix shell or a throwaway container), and otherwise asks the user instead of guessing or installing.
Use to review an existing Forseti deployment against best practice and surface what to harden. Runs the built-in config linter, then walks the operator-guide security checklist (2FA enforcement, rotated secrets, internal-listener exposure, forwarded-for trust, TLS headers, webhook key permissions, database choice, DCR hardening, audit retention), and produces a ranked, numbered punch-list the user can pick fixes from. Triggers: audit Forseti, review the Forseti setup, harden Forseti, security review of the config, best-practice check.
Use to change an existing Forseti deployment toward a specific goal: add a social login provider (GitHub, Google, Microsoft, GitLab, Apple), enable Linux/POSIX login (PAM/NSS/sshd via the device grant), register a downstream OAuth client, enable or switch the email provider, turn on Enterprise SAML SSO, or adjust branding and rate limits. Locates the live config, reads the relevant operator-guide section, makes the change in the right file, validates it, and tests the affected flow. Triggers: add a GitHub login to Forseti, configure Linux login, add an OAuth client, reconfigure Forseti.
Use to set up a new Forseti deployment (the web UI and OIDC front-end for the Ory Kratos + Hydra stack), with or without Docker. Brings up the Ory stack and Postgres, generates secure Kratos/Hydra/Forseti config with fresh secrets, wires the mandatory keys (audit webhook token, cookie secret, admin allowlist, service URLs), seeds an admin, and verifies the instance boots and the login flow works. Triggers: installing Forseti, first-time setup, standing up the Ory stack, getting Forseti running.
Use to review an existing Stackpit deployment against best practice and surface what to harden. Checks the live config against Stackpit's own startup validation rules and the operator-guide security checklist (no-auth posture, admin-token strength, secure cookies, master-key separation, OIDC audience/TTL binding, trusted proxies, admin-port exposure, filter mode, retention), and produces a ranked, numbered punch-list the user can pick fixes from. Triggers: audit Stackpit, review the Stackpit setup, harden Stackpit, security review of the config, best-practice check.
Use to change an existing Stackpit deployment toward a specific goal: enable OIDC/OAuth SSO (Ory Hydra, Keycloak, Authentik, Auth0), map organizations and roles from IdP claims, gate the MCP endpoint, enable or switch email, set up Slack/webhook alert integrations, tighten the event filter mode, migrate from SQLite to Postgres, or import from Sentry. Locates the live config, reads the relevant operator-guide section, makes the change in the right place, validates it, and tests the affected flow. Triggers: add SSO to Stackpit, configure OIDC login, map orgs from claims, add Slack alerts, switch Stackpit to Postgres, import from Sentry.
Use to set up a new Stackpit deployment (the self-hosted, single-binary drop-in for Sentry event ingestion), with or without Docker and on SQLite or Postgres. Runs the init template, sets the load-bearing config (bind addresses, external URLs, admin token, master key, filter mode), points SDKs at the ingest listener, and verifies the instance boots and accepts events. Triggers: installing Stackpit, first-time setup, standing up Stackpit, getting Stackpit running, self-hosting Sentry replacement.