# Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation This site has an agentic ask interface you may use to query the documentation dynamically by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.agents.opsera.ai/index.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. --- # Start Building with Opsera AI Agents Intelligent DevSecOps automation for your development workflow, powered by natural language. > **Security reviews that take weeks. Architecture docs that are always out of date. Compliance audits that freeze entire teams. Opsera Agents fix that — from inside the IDE you already use, with plain English commands.** ### What a real agent run looks like Before you install anything — here's exactly what happens when you run your first Opsera Agent.

## How it works **Three steps. That's it.** No new dashboards. No context switching. No API keys to manage. {% stepper %} {% step %} ### You type a prompt Plain English in Claude Code, Cursor, or VS Code {% endstep %} {% step %} ### Agent analyzes your repo MCP connects to your stack across 150+ tools {% endstep %} {% step %} ### You get results Actionable insights, reports, and fixes — right in your IDE {% endstep %} {% endstepper %} ## Built for your role ### What you can do with it Not a feature list — real scenarios for the person reading this. **🛡️Security Engineer:** Catch CVEs before they reach productionRun SAST, dependency audits, and secrets detection on any repo in under 30 seconds. **⚙️Platform Engineer:** Generate pipelines and manifests on demandDescribe what you need. Get a working GitHub Actions pipeline or K8s manifest instantly. **🏗️Engineering Manager:** Architecture docs without chasing your teamAuto-generate system diagrams and codebase docs that stay current with every commit.
### Does my code leave my environment? {% hint style="danger" %} No. Your source code stays local. Opsera Agents operate via the Model Context Protocol (MCP), a local connection between your IDE and the agent. Your source code is analyzed in your environment and never uploaded to Opsera servers. Only structured metadata and results are returned to the portal. You stay in control. {% endhint %} ### Opsera AI Agents Opsera AI Agents bring intelligent automation directly into your development workflow. Using natural language commands in Claude Desktop, Cursor, or VS Code, you can analyze system architectures, scan for security vulnerabilities, audit compliance, and document your codebase, all without leaving your terminal. Built on the Model Context Protocol (MCP), Opsera Agents connect seamlessly to your DevOps ecosystem, orchestrating actions across 150+ integrated tools to deliver comprehensive insights in minutes, not hours. ## **Start Building with Opsera Agents** {% columns %} {% column %} Full setup guide for Claude Code, Cursor, and VS Code {% file src="/files/RWDVWjCuxaUaZdJKa6mU" %} {% endcolumn %} {% column %}

{% endcolumn %} {% endcolumns %} ### Jump right in

		Cover image
Quickstart	Run your first Opsera Agent in minutes.	Screenshot 2026-03-06 at 6.23.15 PM.png	Prerequisites
Setup Your Environment	Install dependencies and configure Claude, Cursor, or VS Code to run Opsera Agents.	Screenshot 2026-03-06 at 6.23.51 PM.png	Choose your development environment
Create Your Agent Portal Account	Sign up to manage agents, monitor activity, and explore platform capabilities.	Screenshot 2026-03-06 at 6.24.13 PM.png	https://docs.agents.opsera.ai/opsera-agent-portal

Cover image

Quickstart

Run your first Opsera Agent in minutes.

Screenshot 2026-03-06 at 6.23.15 PM.png

Prerequisites

Setup Your Environment

Install dependencies and configure Claude, Cursor, or VS Code to run Opsera Agents.

Screenshot 2026-03-06 at 6.23.51 PM.png

Choose your development environment

Create Your Agent Portal Account

Screenshot 2026-03-06 at 6.24.13 PM.png

https://docs.agents.opsera.ai/opsera-agent-portal

# What are Opsera Agents Opsera Agents are AI-powered automation tools that help teams analyze, secure, and document their software systems. They integrate directly into developer environments such as **Claude Desktop, Cursor, and VS Code**, enabling engineers to run complex analysis using natural language prompts. Opsera Agents help teams understand system architecture, identify security risks, protect sensitive data, and maintain compliance across the software development lifecycle. **Agents work with you, not against you** — adapting to your specific needs rather than forcing your workflow into predefined boxes. ## What is an Opsera Agent? An Opsera Agent is a **self-contained, AI-driven microservice** that: 1. **Receives context** about your application and environment 2. **Analyzes requirements** based on detected patterns and configurations 3. **Generates solutions** through templates, machine learning, and best practices 4. **Orchestrates tools** to execute the planned steps 5. **Validates outcomes** and provides intelligent feedback 6. **Adapts behavior** based on results and learned patterns ``` Agent = Context Analysis + Intelligent Decision-Making + Tool Orchestration + Validation ``` ## Core Principles | Principle | Definition | Benefit | | ----------------- | ------------------------------------------------------- | ----------------------------------------- | | **Intelligence** | Agents understand intent and context, not just commands | Fewer manual steps, smarter defaults | | **Autonomy** | Agents operate independently within guardrails | Reduced human toil, faster feedback loops | | **Composability** | Agents combine to solve complex problems | Flexible solutions for unique situations | | **Transparency** | Every action is logged, auditable, and explainable | Full compliance and audit trail | | **Reliability** | Agents include error handling and self-healing | Predictable, reproducible deployments | ## Recommended path for new users Follow these steps to start using **Opsera Agents** with Claude, Cursor, or VS Code. {% stepper %} {% step %} ### **Install Opsera Agents** Add Opsera Agents to your development environment using the MCP integration. Opsera Agents work with supported developer tools including **Claude Code, Cursor IDE, and VS Code**. Follow the installation guide for your editor to add the Opsera MCP server. {% endstep %} {% step %} ### **Connect your development environment** Once installed, Opsera Agents connect to your workspace or repository so they can analyze your codebase, infrastructure configuration, and dependencies. After setup, your editor will recognize the available Opsera agents and their capabilities. {% endstep %} {% step %} ### **Run your first agent** Use natural language prompts directly in your editor or chat interface to run analyses. Examples: * Run a security scan for this repository * Analyze the architecture of this codebase * Check this project for compliance issues * Identify vulnerabilities in the current service Opsera Agents will analyze your project and return results directly in your development environment. {% endstep %} {% step %} ### **Review insights and take action** Opsera Agents generate actionable insights, including: * security vulnerabilities and remediation guidance * architecture analysis and system diagrams * database and SQL security findings * compliance gap analysis and audit reports You can use these results to improve system security, maintain documentation, and automate DevSecOps workflows. {% endstep %} {% endstepper %} ### Develop with Opsera Agents Opsera provides tools that allow teams to integrate AI-powered analysis directly into their development workflows. * **Editor Integrations**\ Use Opsera Agents directly within development environments such as Claude Desktop, Cursor, and VS Code. * **CI/CD Integrations**\ Run automated analysis and security checks within CI/CD pipelines. * **Reports and Documentation**\ Generate architecture diagrams, security reports, and compliance documentation automatically. # How It Works > Think of Opsera Agents like a senior DevOps engineer who never sleeps, one who knows your entire codebase, understands your compliance requirements, and can run a full security review, generate a deployment pipeline, or map your architecture the moment you ask. From inside the IDE you already use. ## A developer pushes code. Here's what Opsera does. Follow a single moment from your prompt to a result in plain English. {% stepper %} {% step %} ### You type a natural language promptInside Claude Code, Cursor, or VS Code No new tool to learn. You describe what you need in plain English. * "Run a security scan on this repository" * "Analyze the architecture of my payment service" * "Check compliance for SOC2 and show gaps {% endstep %} {% step %} ### Agent Gateway The agent receives your request and understands contextVia the Model Context Protocol (MCP), the agent connects to your workspace. It reads your codebase, infrastructure config, and dependencies understanding the full picture before doing anything. * Reads your repo structure, file types, and languages * Detects your infrastructure (k8s, Terraform, Docker) * Loads your org's compliance policies and rules {% endstep %} {% step %} ### It decides the best approach Opsera's intelligent decision engine figures out which agents to run, in what order, and with what tools. You don't configure this — it infers it from your codebase. * Selects the right agent for the task (Security, Architecture, Compliance, SQL) * Determines which of your 150+ connected tools to use * Builds an execution plan and checks for risks before starting {% endstep %} {% step %} #### Agents run across your entire stack in parallel Multiple specialist agents execute simultaneously — scanning, analyzing, generating — while enforcing your policies automatically. No bottlenecks. No manual steps. * SAST scan, dependency audit, and secrets detection run in parallel * Compliance checks happen automatically at every step * Self-heals on minor issues without interrupting you {% endstep %} {% step %} #### You get actionable results — right in your IDE Results come back directly in your editor with specific findings, severity levels, file locations, and remediation steps. A full report is also saved to your Opsera portal. * Exact file paths and line numbers for every finding * Remediation steps generated for each issue * Full audit trail stored automatically for compliance {% endstep %} {% endstepper %} ### Before and after Opsera Agents

### Core Architecture #### System Architecture Diagram ``` ┌─────────────────────────────────────────────────────────────────┐ │ TRIGGER EVENTS LAYER │ │ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │ │ │ Git Events │ │ Schedules │ │ Webhooks │ │ │ │ (push, PR) │ │ (cron, etc) │ │ (external) │ │ │ └──────────────┘ └──────────────┘ └──────────────┘ │ └────────────────────────┬─────────────────────────────────────────┘ │ ┌────────────────────────▼─────────────────────────────────────────┐ │ AGENT GATEWAY (Event Router) │ │ • Event normalization and routing │ │ • Authentication and authorization │ │ • Rate limiting and queue management │ └────────────────────────┬─────────────────────────────────────────┘ │ ┌────────────────────────▼─────────────────────────────────────────┐ │ CONTEXT COLLECTION & ANALYSIS LAYER │ │ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │ │ │ Code Analysis│ │ Config Parse │ │ Dependency │ │ │ │ (AST, lang) │ │ (YAML, JSON) │ │ Detection │ │ │ └──────────────┘ └──────────────┘ └──────────────┘ │ │ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │ │ │ Env Scan │ │ Policy Check │ │ Historical │ │ │ │ (infra, k8s)│ │ (rules, iam) │ │ Analysis │ │ │ └──────────────┘ └──────────────┘ └──────────────┘ │ └────────────────────────┬─────────────────────────────────────────┘ │ ┌────────────────────────▼─────────────────────────────────────────┐ │ INTELLIGENT DECISION ENGINE │ │ ┌────────────────────────────────────────────────────────────┐ │ │ │ • ML Model: Predict optimal deployment strategy │ │ │ │ • Rules Engine: Apply organizational policies │ │ │ │ • Template Matching: Select best practices │ │ │ │ • Risk Assessment: Evaluate deployment risks │ │ │ │ • Dependency Resolution: Build execution order │ │ │ └────────────────────────────────────────────────────────────┘ │ └────────────────────────┬─────────────────────────────────────────┘ │ ┌────────────────────────▼─────────────────────────────────────────┐ │ AGENT SELECTOR & ORCHESTRATOR │ │ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │ │ │ CI/CD Agent │ │ Security Ag. │ │ Compliance │ │ │ │ │ │ │ │ Agent │ │ │ └──────────────┘ └──────────────┘ └──────────────┘ │ │ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │ │ │ Databricks │ │ Kubernetes │ │ Deployment │ │ │ │ Agent │ │ Agent │ │ Agent │ │ │ └──────────────┘ └──────────────┘ └──────────────┘ │ └────────────────────────┬─────────────────────────────────────────┘ │ ┌────────────────────────▼─────────────────────────────────────────┐ │ AGENT EXECUTION LAYER │ │ ┌─────────────────────────────────────────────────────────────┐│ │ │ Agent 1: Run Pre-checks & Validation ││ │ │ ├─ Code quality scan (SonarQube) ││ │ │ ├─ Dependency check (security) ││ │ │ ├─ Policy compliance (IaC validation) ││ │ │ └─ Environmental sanity checks ││ │ └─────────────────────────────────────────────────────────────┘│ │ │ │ ┌─────────────────────────────────────────────────────────────┐│ │ │ Agent 2: Generate Artifacts ││ │ │ ├─ Compose Dockerfile with security ││ │ │ ├─ Create k8s manifests (Helm/Kustomize) ││ │ │ ├─ Generate IaC (Terraform) ││ │ │ └─ Build CI pipeline configuration ││ │ └─────────────────────────────────────────────────────────────┘│ │ │ │ ┌─────────────────────────────────────────────────────────────┐│ │ │ Agent 3: Execute Build & Test ││ │ │ ├─ Compile/Build application ││ │ │ ├─ Run unit & integration tests (parallel) ││ │ │ ├─ Security scanning (SAST/Container) ││ │ │ └─ Performance benchmarking (optional) ││ │ └─────────────────────────────────────────────────────────────┘│ │ │ │ ┌─────────────────────────────────────────────────────────────┐│ │ │ Agent 4: Deploy to Environment ││ │ │ ├─ Provision infrastructure (if needed) ││ │ │ ├─ Deploy application (blue-green/canary) ││ │ │ ├─ Execute smoke tests ││ │ │ └─ Configure monitoring & logging ││ │ └─────────────────────────────────────────────────────────────┘│ │ │ │ ┌─────────────────────────────────────────────────────────────┐│ │ │ Agent 5: Validation & Compliance ││ │ │ ├─ Health check verification ││ │ │ ├─ Compliance auditing (POL, SOC2, etc) ││ │ │ ├─ Security assessment (DAST) ││ │ │ └─ Final gate approval (if required) ││ │ └─────────────────────────────────────────────────────────────┘│ │ │ │ ┌─────────────────────────────────────────────────────────────┐│ │ │ Agent 6: Reporting & Feedback ││ │ │ ├─ Generate deployment report ││ │ │ ├─ Collect metrics (DORA, performance) ││ │ │ ├─ Create notification payload ││ │ │ └─ Update dashboard / SLA tracking ││ │ └─────────────────────────────────────────────────────────────┘│ └────────────────────────┬─────────────────────────────────────────┘ │ ┌────────────────────────▼─────────────────────────────────────────┐ │ INTEGRATION & OUTPUT LAYER │ │ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │ │ │ GitHub/GitLab│ │ Slack/Teams │ │ Datadog/New │ │ │ │ Status API │ │ Notifications│ │ Relic │ │ │ └──────────────┘ └──────────────┘ └──────────────┘ │ │ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │ │ │ AWS/Azure │ │ Jira/Linear │ │ Compliance │ │ │ │ Deployments │ │ Issue Updates│ │ Dashboard │ │ │ └──────────────┘ └──────────────┘ └──────────────┘ │ └─────────────────────────────────────────────────────────────────┘ ▼ ┌─────────────────────────────────────────────────────────────────┐ │ STATE & TELEMETRY PERSISTENCE │ │ • Deployment history & artifacts │ │ • Execution logs & audit trails │ │ • Metrics & performance data │ │ • Compliance & security findings │ │ • ML model training data │ └─────────────────────────────────────────────────────────────────┘ ``` ### The Agent Lifecycle #### Detailed State Machine ``` ┌──────────────────┐ │ INITIALIZATION │ │ • Validate input│ │ • Auth check │ │ • Setup logging │ └────────┬─────────┘ │ ▼ ┌──────────────────┐ ┌─────────────────┐ │ ANALYZING │ │ (Error: Invalid │ │ • Parse code │─────>│ config found) │ │ • Scan infra │ └─────────────────┘ │ • Extract cfg │ │ └────────┬─────────┘ │ │ │ ▼ │ ┌──────────────────┐ │ │ PLANNING │ │ │ • Build strat │─────┐ │ │ • Dependency │ │ │ │ ordering │ │ │ └────────┬─────────┘ │ │ │ │ │ ▼ │ │ ┌──────────────────┐ │ │ │ GENERATING │ │ │ │ • Create Docker │ │ │ │ • IaC configs │ │ │ │ • Deploy manifests │ │ └────────┬─────────┘ │ │ │ │ │ ▼ │ │ ┌──────────────────┐ │ │ │ VALIDATING │ │ │ │ • Syntax check │─────┤ │ │ • Security scan │ │ │ │ • Policy compl. │ │ │ └────────┬─────────┘ │ │ │ │ │ ▼ │ │ ┌──────────────────┐ │ │ │ EXECUTING │ │ │ │ • Build app │ │ │ │ • Run tests │ │ │ │ • Push artifacts│ │ │ └────────┬─────────┘ │ │ │ │ │ ▼ │ │ ┌──────────────────┐ │ │ │ DEPLOYING │ │ │ │ • Infra provision │ │ │ • App deployment │ │ │ │ • Config setup │ │ │ └────────┬─────────┘ │ │ │ │ │ ▼ │ │ ┌──────────────────┐ │ │ │ CONFIRMING │◄────┘ │ │ • Health checks │ (Retry if │ │ • Run smoke tests failed) │ │ • Verify config │ │ └────────┬─────────┘ │ │ │ ▼ │ ┌──────────────────┐ │ │ COMPLETED │ │ │ • Generate rep. │ │ │ • Send notif. │ │ │ • Store telemetry │ └────────┬─────────┘ │ │ │ ▼ │ SUCCESS │ (Store │ logs & │ metrics) │ │ ▼ ┌──────────────────┐ │ FAILED │ │ • Log errors │ │ • Notify team │ │ • Suggest fixes │ │ • Offer rollback│ └──────────────────┘ ``` ### Real-World Industry Examples #### Example 1: Fintech Startup (Payment Processing) ``` COMPANY: Example company (startup processing $10M/month) REQUIREMENTS ├─ Process payments 24/7 with 99.99% uptime ├─ Sub-100ms latency for transactions ├─ Regulatory compliance (PCI-DSS, SOC2) ├─ Process code changes multiple times daily ├─ Scale from 10 to 1000 transactions/second OPSERA DEPLOYMENT │ ├─ ARCHITECTURE │ ├─ Node.js API (payment processing) │ ├─ Python backend (fraud detection ML) │ ├─ PostgreSQL (transaction ledger) │ ├─ Redis (cache & rate limiting) │ └─ Stripe integration (payment gateway) │ ├─ AGENT USAGE │ │ │ ├─ CI/CD Agent │ │ ├─ Run 500+ unit tests in parallel │ │ ├─ SAST scan for payment vulnerabilities │ │ ├─ Integration test against Stripe sandbox │ │ ├─ Performance test (1000 req/sec load test) │ │ └─ PCI-DSS compliance scan │ │ │ ├─ Security Agent │ │ ├─ Scan for hardcoded API keys │ │ ├─ Check for SQL injection vulnerability │ │ ├─ Verify encryption of sensitive data │ │ ├─ Penetration test in staging │ │ └─ Audit compliance checker │ │ │ ├─ Kubernetes Agent │ │ ├─ Deploy to AWS EKS (multi-AZ) │ │ ├─ Blue-green deployment │ │ ├─ Auto-scaling to handle traffic spikes │ │ ├─ Persistent volumes for ledger │ │ └─ Network policies for isolation │ │ │ └─ Monitoring Agent │ ├─ Datadog integration │ ├─ Transaction success rate monitoring │ ├─ Latency percentile tracking (p99.99) │ ├─ PagerDuty integration for incidents │ └─ Automated rollback on error rate > 0.5% │ └─ RESULTS ├─ Deployment frequency: 5x per day ├─ Lead time: 8 minutes (code → production) ├─ Change failure rate: < 2% ├─ MTTR: 5 minutes ├─ Uptime: 99.99% (maintained) ├─ Latency: p99 = 45ms (improved from 250ms) ├─ Auto-remediation: 80% of issues self-heal └─ Compliance: 100% automated audit trail ``` #### Example 2: Healthcare Company (HIPAA-Regulated) ``` COMPANY: HealthTech Sample company (10,000 patient records) REQUIREMENTS ├─ HIPAA compliance (encryption, audit logs) ├─ Data residency restrictions (US-only) ├─ 30-day audit trail (immutable) ├─ Controlled access with role-based secrets ├─ Strict change control process OPSERA DEPLOYMENT │ ├─ COMPLIANCE AGENTS │ │ │ ├─ Compliance Agent │ │ ├─ Pre-deployment: Verify all HIPAA controls │ │ ├─ Check: Data encrypted at rest (TLS 1.3) │ │ ├─ Check: Audit logging enabled │ │ ├─ Check: Access controls validated │ │ ├─ Check: Data location (US-only) │ │ └─ Block: Any policy violation │ │ │ ├─ Audit Agent │ │ ├─ Record every code change │ │ ├─ Log all deployments (who/what/when) │ │ ├─ Track all database access │ │ ├─ Immutable audit log (in S3 with MFA delete) │ │ └─ Generate compliance reports monthly │ │ │ └─ Security Agent │ ├─ Scan for PHI (personally identifiable health info) │ ├─ Verify encryption for all patient data │ ├─ Check access controls on sensitive fields │ ├─ Monitor for unauthorized access attempts │ └─ Alert on any potential breaches │ ├─ DEPLOYMENT PROCESS (ENHANCED) │ │ │ ├─ Standard CI/CD │ │ └─ SAST, SCA, tests pass │ │ │ ├─ Compliance approval gate │ │ ├─ Compliance officer reviews changes │ │ ├─ Verifies no PHI exposure │ │ ├─ Approves deployment (digitally signed) │ │ └─ Max 4-hour approval window │ │ │ ├─ Staged deployment │ │ ├─ Dev (isolated, test data only) │ │ ├─ Staging (copy of prod with fake data) │ │ ├─ Production (careful monitoring) │ │ └─ Each stage requires approval │ │ │ └─ Post-deployment audit │ ├─ Verify deployment succeeded │ ├─ Run HIPAA control audit │ ├─ Generate deployment report │ ├─ Store digitally signed approval record │ └─ Immutable archive in S3 + Glacier │ └─ RESULTS ├─ Deployment frequency: 2x per week (controlled) ├─ Compliance score: 100% (all controls passing) ├─ Audit readiness: Always 100% ready ├─ Mean audit time: 2 hours (vs. 2 weeks before) ├─ Change failures caught: 100% pre-deployment ├─ Security incidents: 0 in past year ├─ Audit findings: 0 critical, 0 high └─ Customer trust: Improved (transparent compliance) ``` ## Agent Command Cheat Sheet ```bash # Deploy to cloud opsera deploy --app myapp --target aws:prod # Multi-cloud deployment opsera deploy --multi-cloud --targets aws:prod,azure:dr # Validate compliance opsera validate compliance --org healthcare --framework hipaa # View deployment history opsera history --limit 10 # Rollback deployment opsera rollback --deployment-id abc123 # Trigger security scan opsera security-scan --app myapp --type full # View metrics opsera metrics dora --period 90 # List available agents opsera agents list ``` # Opsera Agent Portal ## Platform Overview The Opsera DevOps Agents Platform is a centralized, AI-powered command center that allows you to discover, configure, and manage DevOps, Salesforce, DataOps, and Enterprise agents from a single interface. {% hint style="info" %} **Note:** * Google Sign-In is required to access the platform, and new accounts may need approval before the dashboard becomes available. * Billing information reflects current plan, active agents, and estimated costs; plan upgrades or downgrades can be managed directly from the Billing section. * Coupons and discounts can be applied during billing and take effect immediately if valid. {% endhint %} ### Access Platform To get access to the Platform: 1. Go to [Opsera Agent Portal](https://agent.opsera.ai/) 2. Click the Sign in button on the top-right corner. 3. Click Continue with Google button and authenticate your google account. Wait for the account approval. 4. Once approved, access the dashboard and start using the platform.

This screen helps users **get started quickly with Opsera AI Agents**, especially by configuring their local development environment to connect via MCP (Model Context Protocol). {% hint style="info" %} **Navigation & Organization Controls** Provides role-based access and organizational governance. **Organization Section** Includes: * Org Analytics * Members * Groups * Org Credentials * Access Control * Billing **Personal Section** Includes: * Documentation * Dashboard * Agents * Credentials * Custom Instructions * Usage * Settings {% endhint %} ### Key Sections **Quick Start** A two-step onboarding flow designed to reduce setup friction: 1. **Configure Your IDE** * Guides users to connect Opsera agents to their IDE (Claude Code, Cursor, or VS Code). * Learn here to get started with [Claude Code connection](https://docs.opsera.io/opsera-ai-agents/getting-started/terminal-setup-guide-for-claude) * Learn here to get started with [Cursor connection](https://docs.opsera.io/opsera-ai-agents/getting-started/terminal-setup-guide-for-cursor) * Learn here to get started with [VS Code connection](https://docs.opsera.io/opsera-ai-agents/getting-started/terminal-setup-guide-for-vs-code) 2. **Start Using Agents** * Once configured, users can invoke agents from their IDE using natural language commands. **MCP Configuration** This section provides two ways to configure MCP: **Option 1: Recommended CLI Command** * Best for most users * Applies globally (all projects for the user) Example: ```bash claude mcp add --scope user --transport http opsera https://agent.opsera.ai/mcp ``` **What this does** * Registers Opsera as an MCP server * Enables secure HTTP-based communication between the IDE and Opsera agents **Option 2: JSON Configuration (Manual)** * For advanced users or restricted environments * Allows manual editing of MCP config files Key fields explained: * `mcpsServers`: List of MCP providers * `type`: Transport mechanism (HTTP) * `url`: Opsera MCP endpoint **Available Agents** View the agents so users can immediately explore value. Each agent card: * Shows category (DevOps, Salesforce, Developer) * Briefly explains the use case * Links to detailed agent views **Available Agents List** Quick navigation shortcuts: * **All Agents** – Browse the full catalog * **Usage & Analytics** – Monitor adoption and performance * **Settings** – Account-level configuration ### Dashboard Screen

The Dashboard is the central command center for monitoring agents, usage, and allocations across your organization. **Summary Cards** * **Available Agents:** Total agents accessible under your plan * **Total MCP Calls:** Total tool invocations across agents * **Unique Agents Used:** Number of distinct agents actively used **Your Allocated Agents** Shows agents grouped by functional domains, helping users understand coverage.

Each card: * Displays number of agents * Acts as a drill-down entry point **Quick Actions** Designed for common next steps: * **Setup Guide** – IDE and MCP onboarding * **Upgrade Plan** – Unlock additional agents or capabilities ### Credential Store Screen Provides a secure vault for managing credentials used by Opsera agents when integrating with external systems.

**Credential Table** Each credential entry includes: * **Name** – Friendly identifier * **Category** – SKU or functional grouping (e.g., Databricks, Security) * **URL** – Target system endpoint * **Username / Password** – Encrypted at rest * **Tools** – Agents authorized to use the credential * **Status** – Active / Inactive **Add Credential** The **Add Credential** action allows users to store secrets securely and associate credentials with specific tools. To add a new credential: 1. Click the **+ Add Credential** button. 2. Choose the tupe ### Custom Instructions Screen Allows users to control and personalize how AI agents behave during execution. Instructions are injected into the AI context: * Before agent execution * Before tool calls * With defined priority rules

**Instruction Scope Options** **By SKU** * Applies instructions when tools from a specific license or product SKU are used * Example: Security agents follow stricter compliance rules **By Tool** * Instructions apply only to a specific agent or tool * Useful for fine-grained behavioral control ### Usage (My Usage) Screen Gives individual users full visibility into how they are using Opsera agents.


Section	Description	Why It Matters
Summary Metrics	Total number of tool invocations across all agents	Measures overall platform usage and adoption
	Percentage of successful tool executions	Indicates execution reliability and system health
	Number of tools currently in use	Shows breadth of agent adoption
	Count of unique prompts executed	Helps understand usage diversity
Usage by Agent (Bar Chart)	Visualizes how often each agent is used	Identifies heavily used vs underused agents
	Side-by-side usage comparison across agents	Highlights optimization or enablement opportunities
Distribution by Category	Usage related to architecture and design analysis	Tracks strategic planning and design automation
	Usage of security-focused agents	Measures security automation adoption
	Usage of database and SQL security tools	Identifies database risk management activity
	Usage of compliance and audit agents	Supports governance and compliance tracking
Detailed Tool Table	Number of times each tool was executed	Shows tool demand and frequency
	Execution success percentage per tool	Helps diagnose reliability issues
	Average time taken per execution	Identifies performance bottlenecks
	Most recent execution timestamp	Highlights stale or unused tools
Operational Insights	Uses execution data to detect issues	Improves tool reliability and tuning
	Correlates usage with business value	Supports leadership reporting
	Identifies candidates for deeper automation	Guides future optimization efforts

### Org Analytics

The Org Analytics tab provides organization administrators with a centralized view of AI agent adoption, usage patterns, and operational impact across teams, users, and tool categories. {% hint style="info" %} **Note:** This page is designed to answer key questions such as: * Who is using Opsera agents? * Which agents deliver the most value? * How adoption varies across teams and SKUs * Where optimization or expansion opportunities exist {% endhint %} **Organization Summary Metrics** * **Total MCP Calls**: Represents the total number of MCP tool executions across the organization. Includes all users, agents, and teams. * **Active Users**: Number of unique users who have invoked at least one agent. * **Active Agents**: Count of unique agents used across the organization * **Success Rate**: Percentage of successful tool executions #### Usage Trends **Usage Over Time** A time-series view showing: * MCP calls per day, week, or month * Option to filter by user, team, SKU, or agent **Use cases** * Track adoption after rollout * Measure impact of training or enablement sessions * Spot usage spikes or drops #### Usage by Team / Group Displays usage aggregated by: * Organizational groups * Departments or squads #### Usage by User Shows individual user activity: * MCP calls per user * Agents used * Last activity date #### Usage by Agent Breaks down: * How often each agent is invoked * Success rates per agent * Average execution time #### Usage by SKU / Category Groups usage by product SKU or functional area such as: * CI/CD * Security & Compliance * Data Platforms * Salesforce * Enterprise tools #### Filters & Controls **Time Range Selector** * Filter analytics by custom or predefined ranges * Last 7 days * Last 30 days * Custom date range **Export Analytics** Admins can export analytics data for: * CSV * Excel * Internal reporting * Executive summaries ### Organization Members

The Organization Members page allows organization administrators to manage users, roles, subscriptions, SKUs, and activity across the Opsera platform. This page acts as the central identity and entitlement management hub for your organization. #### Summary Metrics * **Total Members**: Total number of users added to the organization * **Platform Admins**: Users with full platform-level administrative privileges * **Org Admins**: Users with organization-level administrative access * **Active**: Number of users currently active and enabled **Member Search & Filters** * Search by name or email to quickly locate users * Role filter to view users by role (Admin, Member, etc.) #### Members Table Each row represents a single user with the following details: * Member: User identity (name/email) * Role: Defines permissions: * **Platform Admin** – Full platform control * **Org Admin** – Organization-level management * **Member** – Standard usage access * Status * **Active** – User can access the platform * **Inactive** – User access is disabled * **Subscription**: Indicates the subscription tier (e.g., Enterprise) * **SKUs**: Lists product SKUs assigned to the user. These SKUs determine which agents and tools the user can access. * **Tool Calls**: Displays tool usage relative to quota. Shows the Number of tools used and the Prompt usage * **Joined**: Date the user joined the organization #### Member Actions (⋮ Menu)

Available per user: * **View Details** – Detailed activity and access overview * **Edit SKUs** – Modify assigned SKUs * **Send Email** – Contact the user directly * **Deactivate** – Disable user access ### Groups

The Groups page allows administrators to organize users into teams and assign SKUs at a group level. * A **Group** represents a team, department, or function * SKUs assigned to a group are inherited by its members * Users can belong to multiple groups #### Groups List Each group card displays: * Group Name * Members Count * SKUs (SKUs granted via the group) #### Group Actions Icons on each group card allow admins to: * **Manage Members** – Add or remove users * **Edit Group** – Update name, description, or SKUs * **Delete Group** – Remove the group (does not delete users) **Create New Group** The Create New Group dialog allows admins to create a group and define default SKU access for its members. To create a new group: 1. Click + New Group. 2. Fill in the following fields: 1. Group Name 2. Description (Optional) 3. SKUs: Select one or more SKUs to assign to all group members 4. Set as Default Group for New Users: Check this box to automatically assigns new users to this group ### Organization Credentials

The Organization Credentials page manages shared credentials that are available to all users in the organization. These credentials are commonly used by AI agents when integrating with external DevOps tools. **Key Characteristics** * Shared across the organization * Securely encrypted at rest * Centrally managed by admins * Reduces duplicate credential creation **Credential List** When credentials exist, this page displays: * Credential name * Category (SKU) * Associated tools * Status If no credentials exist, users are prompted to add one. **Add Credential** Use the Add Credential button to store a new shared credential. Admins can securely create and store credentials for DevOps tools used by Opsera agents: 1. Enter a name. 2. Under Category (SKU), determine which tools can use the credential * Examples: * Security * CI/CD * Databricks 3. URL: Endpoint of the external service * Example: `https://sonarqube.example.com` 4. Username: Username or API key name (if applicable) 5. Password / Token: Password or API token 6. Select which tools can access this credential. Filtered based on selected SKU ### Organization Custom Instructions

The Organization Custom Instructions page allows admins to define default AI behavior for all users in the organization. These instructions ensure consistency, governance, and compliance across AI agent usage. **How Instructions Work** * Injected into the AI context during tool execution * Apply organization-wide * Can be overridden by individual user instructions **Instruction Scope** * By SKU: Applies when tools from a specific SKU are used * Example: CI/CD tools must follow deployment approval rules * By Tool: Applies to specific agents or tools * Example: Security scans must produce audit-friendly output **SKU-Specific Instructions** Each entry is tied to a SKU (e.g., CI/CD Container Deployer). Contains custom guidance text. Can be edited or deleted Audit Information Shows last updated timestamp. Displays the admin who made the change ### Access Control

The Access Control section allows organization administrators to define security policies, control agent availability, and audit security-related events across the Opsera platform. This area is critical for: * Enterprise security compliance * Controlled AI adoption * Audit readiness Only Org Admins and Platform Admins can manage these settings. #### Access Control Tabs **Security Policies** Security Policies define organization-wide authentication and session rules that apply to all users. These policies help enforce enterprise security standards and reduce risk. Available Policies: **Require SSO for All Users (Global)** * Forces all users to authenticate using Single Sign-On * Prevents password-based logins **Recommended for** * Enterprise deployments * SOC2, ISO, and internal compliance requirements **MFA for Admin Actions (Global)** * Requires multi-factor authentication for sensitive administrative operations **IP Whitelist (Global)** * Restricts platform access to approved IP address ranges * Blocks login attempts from unauthorized networks **Session Timeout (Global)** * Automatically logs users out after a defined period of inactivity * Reduces risk from unattended sessions #### Agent Access

The Agent Access tab controls which AI agents are available to users in the organization. **Enabling or Disabling Agents** * Toggle **ON** to allow usage across the organization * Toggle **OFF** to fully block access #### Audit Log

The Audit Log provides a chronological record of security-related events across the organization. This supports compliance audits, security investigations and Internal governance reviews. Examples include: * SSO login events * Failed login attempts * Policy changes * API key creation * Agent access changes ### Billing

The Billing page allows administrators to manage subscription plans, monitor costs, apply discounts, and review detailed usage-based charges. **Billing Summary** * Current Plan: Displays the active subscription (e.g., Enterprise) * Active Agents: Number of agents currently enabled and contributing to cost * Current Spend: Accumulated spend for the current billing period * Payment Method: Indicates whether a payment method is on file #### Discounts & Coupons

**Applying a Coupon** * Enter a valid coupon code * Click **Apply** * Discount is reflected immediately in billing totals **Secure Payment Processing** * All payments processed using 256-bit SSL encryption * Supports major credit cards (Visa, Mastercard, AmEx, Discover) **Agent Cost Breakdown** * Provides transparent, per-agent cost visibility based on usage. * Breakdown details for each agent: * Monthly call count * Base subscription cost * Usage-based charges * Total cost contribution * Total This Month: Aggregated cost across all agents. It matches the **Current Spend** summa **Settings**

The Settings section allows users to manage personal account information, notifications, and security preferences: * Profile Information * Account Details **Notifications** Choose how you receive updates: * **Email Notifications:** Platform updates and alerts via email * **Push Notifications:** Browser-based notifications * **Slack Integration:** Sends alerts to configured Slack channels **Alert Types** * **Usage Alerts:** Triggered when approaching usage or quota limits * **Security Alerts:** Login issues, policy changes, suspicious activity **Password Management** * Update password using: * Current password * New password * Confirmation **Two-Factor Authentication (2FA)** * Adds an additional security layer * Recommended for all users * Required for admins if enforced by policy **Active Sessions** Displays: * Current active session * Device, browser, and location * Session status # Prerequisites Before you start using Opsera AI Agents, ensure you have the following requirements in place. This page covers everything you need to successfully set up and run agents in your development environment ### Quick Checklist * [ ] Opsera account at agent.opsera.ai (sign in with Google) * [ ] One of the supported terminals installed (Claude Desktop, Cursor, or VS Code) * [ ] Network access to agent.opsera.ai * [ ] Repository access credentials (GitHub, GitLab, etc.) if needed * [ ] Appropriate permissions for your role ### Platform Requirements #### Opsera Platform Access **Required:** * Active Opsera account (sign up at [agent.opsera.ai](https://agent.opsera.ai)) * Internet connection for agent communication * Access to Opsera Agent portal **To verify your access:** 1. Visit [agent.opsera.ai](https://agent.opsera.ai) 2. Sign in with your Google account 3. Confirm you can see the Getting Started page and agent list **Don't have access?** Sign up at [agent.opsera.ai](https://agent.opsera.ai) using your corporate Google account, or contact for assistance. #### Authentication Opsera Agents use **automatic authentication** through the MCP (Model Context Protocol) configuration. No API keys required! **How it works:** * You sign into the Opsera portal with your Google account * Your terminal connects to Opsera's MCP server using a simple configuration * Authentication is handled automatically when you use agents 💡 **No secrets to manage** - Authentication happens through your browser session, making setup simple and secure. ### Terminal & IDE Requirements Choose **one** of the following terminals to run Opsera Agents. Each has different setup requirements: #### Option 1: Claude Desktop (Recommended for First-Time Users) **System Requirements:** * **macOS:** macOS 11 (Big Sur) or later * **Windows:** Windows 10 (64-bit) or later * **Linux:** Ubuntu 20.04+ or equivalent **Additional Requirements:** * Node.js 18+ (for MCP server) * npm or npx package manager * 2GB free disk space **Installation:** * Download from: [claude.ai/download](https://claude.ai/download) * Claude account required (free or Pro) #### Option 2: Cursor IDE **System Requirements:** * **macOS:** macOS 11 or later * **Windows:** Windows 10 (64-bit) or later * **Linux:** Ubuntu 20.04+ or equivalent **Additional Requirements:** * Node.js 18+ * 4GB free disk space * Active Cursor subscription (free or Pro) **Installation:** * Download from: [cursor.sh](https://cursor.sh/) #### Option 3: VS Code **System Requirements:** * **macOS:** macOS 10.15 or later * **Windows:** Windows 10 (64-bit) or later * **Linux:** Ubuntu 20.04+ or equivalent **Additional Requirements:** * Visual Studio Code 1.80+ * Node.js 18+ * Opsera Agents extension (available in VS Code Marketplace) **Installation:** * VS Code: [code.visualstudio.com](https://code.visualstudio.com/) * Extension: Search "Opsera Agents" in VS Code Extensions ### Optional: Pre-Installation Testing Before full setup, verify your environment meets all requirements: #### 1. Test Node.js & npm ```bash node --version # Should show v18.0.0 or higher npm --version # Should show v9.0.0 or higher ``` #### 2. Test Git Provider Access ```bash # Test GitHub access (if using GitHub) curl -H "Authorization: token YOUR_GITHUB_TOKEN" https://api.github.com/user # Test GitLab access (if using GitLab) curl -H "PRIVATE-TOKEN: YOUR_GITLAB_TOKEN" https://gitlab.com/api/v4/user ``` **All tests passed?** You're ready to proceed with [Terminal Setup](/terminal-setup/choose-your-environment)! ### Troubleshooting Prerequisites #### Common Issues **"I don't have access to the Agents section in Opsera Portal"** * Your account may not have Agent features enabled * Contact your Opsera administrator or support team **"Node.js is not installed or version is too old"** * Download and install from [nodejs.org](https://nodejs.org/) * Or use [nvm](https://github.com/nvm-sh/nvm) for version management **"Network connection to Opsera fails"** * Check firewall/proxy settings * Verify with IT that Opsera domains are whitelisted * Try from a different network (e.g., mobile hotspot) to isolate issue **"Git provider authentication fails"** * Verify your token has correct scopes/permissions * Check token hasn't expired * Ensure token is correctly entered in Opsera Portal **"I'm getting SSL certificate errors"** * Your corporate network may use SSL inspection * Contact IT to add Opsera certificates to trusted list * Or disable strict SSL (not recommended for production) *** ### Next Steps Once you've confirmed all prerequisites are met: 1. **Choose your terminal:** [Claude Desktop](/terminal-setup/claude-desktop) | [Cursor](/terminal-setup/cursor-ide) | [VS Code](/terminal-setup/vs-code) 2. **Follow the setup guide** for your chosen terminal 3. **Run your first agent** with [our Quick Start Guide](/) *** ### Need Help? **Still having issues with prerequisites?** * 📚 Check our [FAQ](https://claude.ai/chat/4ebb4297-734f-4bb7-a76f-dbf4ccd66dac#) * 💬 Join our [Discord Community](https://claude.ai/chat/4ebb4297-734f-4bb7-a76f-dbf4ccd66dac#) * 📧 Email support: **Enterprise customers:** Contact your dedicated Customer Success Manager for personalized setup assistance. # Choose your development environment Opsera Agents work in Claude Desktop, Cursor IDE, and VS Code. Pick the environment that fits your workflow,se tup takes 5 minutes in any of them. All three options give you the same capabilities: natural language commands to run security scans, analyze architecture, audit compliance, and more. ## Which terminal should I use? | Claude Desktop | Cursor IDE | VS Code | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | |

Best for: Quick analysis, ad-hoc security scans, one-off tasks

You'll use it for:

Running security scans before committing code
Quick architecture analysis
Exploring what agents can do
Tasks that don't require deep IDE integration

Setup time: 1 command (fastest)

Best for: Active development, continuous security checks, integrated workflows

You'll use it for:

Security scanning while writing code
Architecture analysis during code reviews
Real-time compliance checking
Keeping agents in your development context

Setup time: 3 steps (\~5 minutes)

Best for: Teams already using VS Code, GitHub Copilot users, enterprise environments

You'll use it for:

Integration with GitHub Copilot Chat
Team-wide agent deployment (via workspace config)
Corporate standardization
Existing VS Code workflows

Setup time: 3 steps (\~5 minutes)

| | [Get started with Claude Desktop →](/terminal-setup/claude-desktop) | [Get started with Cursor →](/terminal-setup/cursor-ide) | [Get started with VS Code →](/terminal-setup/vs-code) | # Claude Desktop ### What you'll accomplish By the end of this guide, you'll have Opsera Agents running in Claude Code and ready to automate your DevSecOps workflows with natural language commands. **You'll be able to:** * Run security scans with a single command * Generate CI/CD pipelines by describing what you need * Analyze architecture and generate diagrams * Audit compliance across your codebase **Time to complete:** \~5 minutes *** ### Before you begin Make sure you have: * ✅ **Claude Code CLI** installed * ✅ **Terminal access** (macOS, Linux, or WSL) * ✅ **Node.js 18+** installed (`node --version`) That's it. No API keys, no complex configuration—just add one line and you're ready. *** ### Setup (choose your method) #### Option 1: Install Opsera Agent from Claude Marketplace (Private Marketplace) Install the Opsera DevSecOps plugin in Claude Code using `/install opsera-devsecops` (or manually via the plugin marketplace), then restart and authenticate via browser login. Once installed, simply describe your task. [Learn the installation procedure here.](/marketplace/marketplace/claude-code-plugin) #### Option 2: One-line install (recommended) Run this command in your terminal: ```bash claude mcp add --scope user --transport http opsera https://agent.opsera.ai/mcp ``` Then restart Claude Code. Done. **What this does:** Adds Opsera Agents to your Claude Code MCP configuration globally, so it works across all your projects. #### Option 3: Manual configuration If you prefer manual setup or need to customize: 1. **Open your MCP config file:** * macOS/Linux: `~/.config/claude/mcp_settings.json` * Or use: `claude mcp edit` 2. **Add this configuration:** ```json { "mcpServers": { "opsera": { "type": "http", "url": "https://agent.opsera.ai/mcp" } } } ``` 3. **Save and restart Claude Code** *** ### Verify it's working Open Claude Code and type: ``` "List available Opsera agents" ``` You should see the 4 core agents: * Architecture Analyze Agent * Security Scan Agent * SQL Security Agent * Compliance Audit Agent If you see these, you're all set! 🎉 *** ### Try your first agent Once connected, just describe what you want in natural language: **Run a security scan:** ``` "Run a security scan on my repository at ~/projects/my-app and show me critical vulnerabilities" ``` **Analyze architecture:** ``` "Analyze the architecture of my payment service and generate a system diagram" ``` **Check compliance:** ``` "Run a SOC2 compliance audit and show me what needs to be fixed" ``` *** ### Troubleshooting **"MCP server not found" error?** * Restart Claude Code after adding the configuration * Verify the config file was saved correctly * Check Node.js is installed: `node --version` **Agents not responding?** * Make sure you're connected to the internet * Try: `claude mcp list` to see installed servers * Restart Claude Code # Cursor IDE ### What you'll build Get Opsera Agents running directly in Cursor IDE to automate DevSecOps workflows while you code. **You'll be able to:** * Run security scans from the Cursor chat * Generate CI/CD pipelines without leaving your editor * Analyze architecture while reviewing code * Audit compliance in real-time ⏱️ **Time:** 5 minutes *** ### What you need * **Cursor IDE** - [Download](https://cursor.sh) * **Terminal** - macOS, Linux, or WSL * **Node.js 18+** - Check with `node --version` *** ## Setup (choose your method) ### Option 1: Install via Marketplace (Private Marketplace) Install the **Opsera DevSecOps Agent** in Cursor via **Settings → Marketplace → Add Plugin**, then start using it through chat prompts. It scans your codebase for security, compliance, SQL, and architecture issues, providing severity breakdowns, file-level findings, and actionable fixes. [Learn more on the installation procedure here.](/marketplace/marketplace/cursor-plugin) ### Option 2: Manual Configuration #### Step 1: Open MCP config Locate your Cursor MCP configuration file: **macOS/Linux:** bash ```bash ~/.cursor/mcp.json ``` **Windows:** bash ```bash %USERPROFILE%\.cursor\mcp.json ``` **Project-specific (optional):** bash ```bash .cursor/mcp.json ``` *** #### Step 2: Add Opsera configuration Open the file and add: json ```json { "mcpServers": { "opsera": { "type": "streamable-http", "url": "https://agent.opsera.ai/mcp" } } } ``` Save the file. *** #### Step 3: Enable in Cursor 1. Open Cursor **Settings** (⌘/Ctrl + ,) 2. Navigate to **Cursor Settings** → **Tools and MCP** 3. **Enable** the Opsera MCP server 4. **Restart** Cursor *** ### Verify Open Cursor and check: 1. **Settings** → **Cursor Settings** → **Tools and MCP** 2. Look for **Opsera MCP** with a **green indicator** If you see green, you're ready! 🎉

### Try it Open Cursor's chat (⌘/Ctrl + L) and try: **Run a security scan:** ``` "Scan this repository for security vulnerabilities and show critical issues" ``` **Analyze architecture:** ``` "Analyze the architecture of this codebase and generate a diagram" ``` **Generate Kubernetes manifests:** ``` "Create Kubernetes deployment manifests for this microservice" ``` ### Troubleshooting **MCP server not showing?** * Check the config file saved correctly * Restart Cursor completely * Verify Node.js: `node --version` **Green indicator not appearing?** * Go to Settings → Cursor Settings → Tools and MCP * Toggle MCP enable/disable * Restart Cursor **Agents not responding in chat?** * Ensure internet connection * Check MCP server is enabled (green indicator) * Try closing and reopening the chat panel # VS Code ## Terminal Setup Guide for VS Code ### What you'll build Get Opsera Agents integrated with GitHub Copilot in VS Code to automate DevSecOps workflows directly in your editor. **You'll be able to:** * Run security scans while reviewing code * Generate CI/CD pipelines from Copilot Chat * Create Salesforce packages automatically * Analyze architecture without switching contexts ⏱️ **Time:** 5 minutes *** ### What you need * **VS Code 1.102+** - [Download](https://code.visualstudio.com) * **GitHub Copilot extension** - [Get it](https://marketplace.visualstudio.com/items?itemName=GitHub.copilot) * **Node.js 18+** - Check with `node --version` *** ### Installation Choose your setup method: #### Option 1: Workspace-specific (recommended for teams) Sets up Opsera for the current project only. **Step 1:** Create config file in your project: bash ```bash .vscode/mcp.json ``` **Step 2:** Add this configuration: json ```json { "servers": { "opsera": { "type": "http", "url": "https://agent.opsera.ai/mcp" } } } ``` **Step 3:** Save and reload VS Code (⌘/Ctrl + Shift + P → "Reload Window") *** #### Option 2: Global (all projects) Sets up Opsera for all your VS Code projects. **Step 1:** Open Command Palette (⌘/Ctrl + Shift + P) **Step 2:** Select **"MCP: Open User Configuration"** **Step 3:** Add this configuration: json ```json { "servers": { "opsera": { "type": "http", "url": "https://agent.opsera.ai/mcp" } } } ``` **Step 4:** Save and reload VS Code *** ### Verify Open **GitHub Copilot Chat** and type: ``` "View my Tools" ``` You should see **Opsera DevOps Agent** listed with available tools. If you see it, you're ready! 🎉

### Try it Open Copilot Chat (⌘/Ctrl + Shift + I) and try: **Run a security scan:** ``` "Run a security scan for this project" ``` **Create Salesforce package:** ``` "Generate a Salesforce package.xml for the ./src directory" ``` **Analyze architecture:** ``` "Analyze the architecture of this codebase" ``` **Note:** Copilot may ask for permission before running tools—click **"Allow"** to proceed. ### Troubleshooting **"Agent" option not showing in Copilot Chat?** * Update VS Code to latest version (1.102+) * Update GitHub Copilot extension * Enable in settings: `"chat.agent.enabled": true` * Restart VS Code **Tools listed but not running?** * Open `mcp.json` file * Look for **CodeLens** text above the JSON (says "Start" or "Restart") * Click it to activate the connection * If still not working, reload VS Code **Permission errors when running tools?** * Copilot will prompt for permission before running MCP tools * Click **"Allow"** to proceed * Check "Always allow" if you want to skip future prompts **MCP server not connecting?** * Verify `mcp.json` saved correctly * Check JSON syntax (no trailing commas) * Ensure internet connection * Restart VS Code completely **Tools not appearing in "View my Tools"?** * Wait 10-15 seconds after reload for MCP to initialize * Check Output panel: View → Output → MCP * Look for connection errors * Try restarting VS Code ### Tips 💡 **For team projects:** Use workspace configuration (`.vscode/mcp.json`) and commit it to your repo so the whole team gets Opsera Agents automatically. 💡 **Permission prompts:** You can configure Copilot to always allow specific tools in Settings → Extensions → GitHub Copilot. 💡 **Check connection status:** Open Command Palette → "MCP: Show Status" to see if Opsera is connected. # Security Scan Agent Secure every commit. Proactively detect SAST vulnerabilities, CVEs, and exposed secrets before they reach production ### What it does The Security Scan Agent runs comprehensive security audits on your codebase—scanning for secrets, vulnerable dependencies, code vulnerabilities, and container issues—all in one command. Think of it as your automated security engineer that checks everything before you commit. **You'll get:** * Exposed API keys and credentials detected * Vulnerable dependencies with exact fix commands * OWASP Top 10 vulnerabilities flagged * Container and infrastructure security issues * Actionable remediation steps ⏱️ **Scan time:** 2-5 minutes depending on project size ## Sample Prompts {% hint style="success" %} **Examples** #### **pre‑merge‑secret‑sweep** **Prompt:** "Scan only for exposed secrets in the feature branch before merging.” #### **release‑v1.0‑vuln‑audit** **Prompt**: “Perform a high‑severity vulnerability audit of the codebase ahead of v1.0 release.” #### **nightly‑iac‑check** **Prompt:** “Run an infrastructure‑as‑code compliance check on `infra/` every night.” #### **ci‑sast‑python** **Prompt:** “Static analysis of all Python files with medium severity in the CI pipeline.” #### **monthly‑full‑security** **Prompt:** “Execute a comprehensive full‑repo security scan as part of monthly governance.” {% endhint %} ### Why use it **Instead of:** * Running 4 separate security tools manually * Spending hours reviewing scan results * Googling how to fix vulnerabilities **You get:** * One command that runs everything * Exact fix commands (e.g., `npm install package@version`) * Auto-installation of missing security tools * Clear risk scores and prioritized fixes **Impact:** * 70-85% reduction in exploitable vulnerabilities * 12-20 hours saved per week per team * Catch issues before they reach production ### What it scans The agent performs 4 types of security scans: #### 1. Secrets Detection **Tool:** Gitleaks\ **Finds:** Hardcoded API keys, tokens, passwords, credentials\ **Example:** AWS keys, GitHub tokens, database passwords in config files #### 2. Dependency Scanning **Tool:** Built-in audits (npm, pip, etc.)\ **Finds:** Known CVEs in third-party packages\ **Example:** Vulnerable versions of Express, Django, React #### 3. Source Code Analysis (SAST) **Tool:** Semgrep\ **Finds:** OWASP Top 10 vulnerabilities in your code\ **Example:** SQL injection, XSS, insecure authentication #### 4. Container & Infrastructure **Tool:** Trivy, policy validators\ **Finds:** Container vulnerabilities, IaC misconfigurations\ **Example:** Outdated base images, insecure Terraform configs *** ### How to use it #### Basic scan Run a full security audit on your current directory: bash ```bash /opsera-devops-agent:security-scan ``` or in natural language: ``` "Run a security scan on this project" ``` *** #### Specific scans **Secrets only:** ``` "Run a secrets-only scan" ``` **High severity only:** ``` "Run a full scan but only show critical and high severity issues" ``` **Specific directory:** ``` "Scan the ./src directory for security vulnerabilities" ``` *** ### What you'll see #### During the scan ```bash 🔍 Security Scan Agent Starting... Phase 1/6: Pre-flight checks... ✓ Project validated ✓ Security tools detected Phase 2/6: Secrets detection... ✗ Found 2 exposed credentials - AWS_ACCESS_KEY in config.js:12 - GITHUB_TOKEN in .env:5 Phase 3/6: Dependency scanning... ! Found 3 vulnerable packages - express@4.17.1 (CVE-2024-1234) - lodash@4.17.19 (CVE-2024-5678) Phase 4/6: SAST analysis... ✗ Found 1 SQL injection vulnerability - src/api/users.js:42 Phase 5/6: Container scanning... ✓ No container vulnerabilities found Phase 6/6: Generating report... ✓ Report saved: security-scan-report.html ``` *** #### Report summary ``` Security Scan Results ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Risk Score: 68/100 (High Risk) Findings by Severity: 🔴 Critical: 2 🟠 High: 3 🟡 Medium: 5 🟢 Low: 8 Scan Coverage: 100% ✓ Secrets Detection ✓ Dependency Scanning ✓ SAST Analysis ✓ Container Scanning Top Priority Fixes: 1. Revoke exposed AWS credentials (config.js:12) 2. Update express to 4.18.2: npm install express@4.18.2 3. Fix SQL injection in src/api/users.js:42 ``` *** ### Quality gates Use these benchmarks to measure your security posture: | Metric | Target | Purpose | | --------------------- | ---------- | ----------------------------------------- | | **Critical Findings** | 0 | Block deployment if critical issues exist | | **Risk Score** | < 20/100 | Maintain low overall risk | | **Scan Coverage** | 100% | All 4 scan types completed | | **Time to Fix** | < 24 hours | Critical issues resolved quickly | **Recommended thresholds:** * **Pass:** 0 critical, risk score < 20 * **Warning:** 0 critical, risk score 20-50 * **Fail:** Any critical findings or risk score > 50 *** ### After the scan #### 1. Fix critical issues immediately **Exposed secrets:** ```bash # Revoke the token immediately # Rotate credentials in your cloud provider # Remove from code and add to .gitignore ``` **Critical vulnerabilities:** ```bash # Use the exact commands from the report: npm install express@4.18.2 npm install lodash@4.17.21 ``` *** #### 2. Review the detailed report Open the generated report: ```bash security-scan-report.html ``` This includes: * Line-by-line code references * CVE details and severity scores * Step-by-step remediation instructions * Before/after code examples *** #### 3. Install missing tools (if needed) If the scan shows incomplete coverage: ```bash # macOS brew install gitleaks semgrep trivy # Linux # Follow instructions in the scan output ``` *** #### 4. Re-scan to verify After fixing issues, run the scan again: ```bash /opsera-devops-agent:security-scan ``` Your risk score should improve and findings should decrease. *** ### Common issues **"Tool not found" errors?** * Install missing tools: `brew install gitleaks semgrep` * Or let the agent try to install them automatically **Scan taking too long?** * Run specific scans: "Run a secrets-only scan" * Exclude directories: "Scan but skip node\_modules" **Too many false positives?** * Focus on critical/high: "Show only critical and high severity" * Configure suppressions in the report **Report not generating?** * Check disk space * Verify write permissions in current directory * Look for errors in scan output ### Examples **Quick security check before commit:** ``` "Run a quick security scan and show me any critical issues" ``` **Full audit for production release:** ``` "Run a comprehensive security scan with all checks enabled" ``` **Focus on dependencies:** ``` "Scan my dependencies for known CVEs and show me how to fix them" ``` **Check for exposed secrets:** ``` "Scan for exposed API keys and credentials in this repository" ``` # Compliance Audit Agent Audit-ready, always. Automate continuous governance for SOC2, HIPAA, PCI-DSS, ISO27001, and SOX ### What it does The Compliance Audit Agent runs automated compliance assessments against SOC2, HIPAA, PCI-DSS, ISO 27001, and GDPR—generating audit-ready reports with specific remediation steps. Think of it as your automated compliance officer that checks your security posture against regulatory frameworks. **You'll get:** * Overall compliance score across all frameworks * Detailed findings for every failing control * Prioritized remediation roadmap (6-week plan) * Audit-ready documentation checklist * Exportable HTML reports for stakeholders ⏱️ **Audit time:** 5-10 minutes depending on scope ## Sample Prompts {% hint style="success" %} **Examples** #### **annual‑hipaa‑review** **Prompt:** “Perform our yearly HIPAA compliance audit across both infrastructure and applications.” #### **pre‑product‑launch‑soc2** **Prompt:** “Run a full SOC 2 assessment before we ship the new SaaS offering.” #### **quick‑pci‑check** **Prompt:** “Just check the payment‑processing components for PCI‑DSS gaps.” #### **infra‑iso27001** **Prompt:** “Audit only the cloud/network infrastructure against ISO 27001 controls.” #### **mfa‑gap‑analysis** **Prompt:** “Assess known gaps around multi‑factor authentication for all user‑facing services.” {% endhint %} ### Why use it **Instead of:** * Spending months preparing for compliance audits * Hiring expensive external consultants for initial assessment * Manually collecting evidence across systems * Guessing which controls to fix first **You get:** * Automated gap analysis in minutes * Clear compliance scores per framework * Prioritized remediation timeline * Evidence collection without exposing sensitive data * Continuous compliance monitoring **Impact:** * Audit preparation from months → weeks * 78% average compliance score achievable in 90 days * Zero overlooked controls (automated checks) *** ### Supported frameworks The agent assesses against these regulatory standards: | Framework | Focus | Common For | | ------------- | -------------------------------------------------------- | ------------------------------- | | **SOC2** | Trust Service Criteria (Security, Availability, Privacy) | SaaS companies, cloud providers | | **HIPAA** | Healthcare data protection | Healthcare, health tech | | **PCI-DSS** | Payment card data security | E-commerce, payment processors | | **ISO 27001** | Information security management | Enterprise, global compliance | | **GDPR** | Data privacy and protection | EU operations, user data | You can audit one framework or run "All of the above" for comprehensive coverage. *** ### How to use it #### Basic audit Run a comprehensive compliance audit: ```bash /mcp.opsera.compliance-audit ``` or in natural language: ``` "Run a SOC2 compliance audit" ``` *** #### Specific frameworks **SOC2 only:** ``` "Run a SOC2 compliance audit" ``` **HIPAA assessment:** ``` "Prepare for HIPAA assessment" ``` **Multiple frameworks:** ``` "Run compliance audit for SOC2 and ISO 27001" ``` **Gap analysis:** ``` "Perform a compliance gap analysis for all frameworks" ``` *** #### Scope options During setup, you'll choose your assessment scope: **1. Infrastructure Only** * Servers, cloud resources, network * Access controls, encryption * Best for: DevOps/SRE teams **2. Application Only** * Code, APIs, databases * Application-level security * Best for: Development teams **3. Full Assessment** * Infrastructure + Application + Policies * Complete compliance posture * Best for: Formal audits, certifications *** ### What you'll see #### During the audit ```bash 🔍 Compliance Audit Agent Starting... Phase 1/6: Setup ✓ Frameworks: SOC2, HIPAA, ISO 27001 ✓ Scope: Full Assessment Phase 2/6: Scope definition ✓ Infrastructure scan enabled ✓ Application scan enabled ✓ Policy review enabled Phase 3/6: Evidence collection (silent) ✓ Analyzing access controls... ✓ Checking encryption at rest... ✓ Reviewing audit logs... ✓ Validating vulnerability management... Phase 4/6: Control assessment ✓ SOC2: 78% (82/105 controls) ✓ HIPAA: 65% (45/69 controls) ✓ ISO 27001: 71% (66/93 controls) Phase 5/6: Detailed findings Found 38 non-compliant controls 🔴 High severity: 8 🟠 Medium severity: 15 🟡 Low severity: 15 Phase 6/6: Generating roadmap ✓ Created 6-week remediation plan ✓ Report saved: compliance-audit-report.html ``` *** ### What you get #### 1. Compliance Dashboard ``` Compliance Audit Results ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Overall Score: 78% (189/243 controls passing) Control Status: ✅ Passing: 189 ⚠️ Partial: 32 ❌ Failing: 22 Framework Breakdown: SOC2: 78% (82/105 controls) HIPAA: 65% (45/69 controls) PCI-DSS: 81% (29/36 controls) ISO 27001: 71% (66/93 controls) GDPR: 73% (44/60 controls) SOC2 Trust Service Criteria: Security: 85% Availability: 92% Processing Integrity: 78% Confidentiality: 68% Privacy: 75% ``` *** #### 2. Detailed Findings For every failing control, you get: **Example:** ``` Control: CC6.1 - Logical Access Controls Status: ❌ FAILING Severity: HIGH Evidence Summary: - 3 users without MFA enabled - 5 inactive accounts still active (>90 days) - 2 service accounts with human-level permissions Remediation Steps: 1. Enable MFA for all users: [User1, User2, User3] 2. Disable inactive accounts in IAM console 3. Create dedicated service accounts with minimal permissions 4. Review access logs for unauthorized attempts Estimated Effort: 2-3 days ``` *** #### 3. Remediation Roadmap **6-Week Prioritized Plan:** ``` WEEKS 1-2 (Critical & High Priority) ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ □ Enable MFA for all users (CC6.1) [2 days] □ Encrypt data at rest (CC6.6) [3 days] □ Implement audit logging (CC7.2) [2 days] □ Remove inactive accounts (CC6.1) [1 day] WEEKS 3-4 (Medium Priority) ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ □ Configure log retention (CC7.3) [1 day] □ Update incident response plan (CC7.4) [3 days] □ Implement vulnerability scanning (CC7.1) [2 days] WEEKS 5-6 (Low Priority & Documentation) ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ □ Document change management process [2 days] □ Create network diagrams [1 day] □ Update security policies [2 days] ``` *** #### 4. Audit Readiness Checklist **Required Documentation Status:** ``` Policies & Plans: ✅ Information Security Policy [Current] ✅ Business Continuity Plan [Current] ❌ Incident Response Plan [Missing] ⚠️ Data Classification Policy [Expired - 2023] Technical Documentation: ✅ Network Diagrams [Current] ❌ Data Flow Diagrams [Missing] ✅ System Inventory [Current] Evidence & Testing: ✅ Penetration Test Results [2024-02-15] ⚠️ Vulnerability Scan Results [Outdated - 2024-01] ✅ Access Control Logs [Current] ✅ Training Records [Current] ``` *** #### 5. HTML Report A professional, shareable report is generated: ```bash compliance-audit-2024-03-06.html ``` **Includes:** * Executive summary with compliance scores * Detailed findings per framework * Visual pass/fail indicators (color-coded) * Complete remediation roadmap * Ready to share with auditors or stakeholders *** ### Quality benchmarks Use these targets to measure compliance readiness: | Metric | Target | Purpose | | ---------------------- | -------- | --------------------- | | **Overall Score** | > 80% | Audit-ready threshold | | **Critical Findings** | 0 | No high-risk gaps | | **Framework Coverage** | 100% | All controls assessed | | **Documentation** | Complete | All policies current | **Compliance levels:** * ✅ **Audit Ready:** > 80%, 0 critical findings * ⚠️ **Needs Work:** 60-80%, < 5 critical findings * ❌ **Not Ready:** < 60% or > 5 critical findings *** ### After the audit #### 1. Address critical findings immediately **Priority order:** 1. **HIGH severity** - MFA, encryption, access controls 2. **MEDIUM severity** - Logging, monitoring, policies 3. **LOW severity** - Documentation, training records *** #### 2. Follow the 6-week roadmap Use the prioritized timeline: * Weeks 1-2: Critical security fixes * Weeks 3-4: Medium priority items * Weeks 5-6: Documentation and policies Track progress with checkboxes in the roadmap. *** #### 3. Update missing documentation Review the audit readiness checklist: * Create missing policies * Update expired documents * Gather required evidence (logs, test results) * Schedule training sessions *** #### 4. Re-audit to verify improvements After completing fixes: ```bash /mcp.opsera.compliance-audit ``` Your compliance score should improve significantly. *** ### Security & privacy The agent follows strict security guardrails: **✅ The agent WILL:** * Show compliance status and scores * Provide control IDs and remediation steps * Summarize evidence (e.g., "3 users without MFA") * Generate audit-ready reports **❌ The agent WILL NOT:** * Expose raw config files or logs * Show internal file paths * Reveal evidence collection commands * Display sensitive credentials or keys All evidence collection happens silently—only sanitized summaries are shown. *** ### Common issues **Audit taking too long?** * Choose specific framework instead of "All" * Select "Infrastructure Only" or "Application Only" * Larger environments may take 10-15 minutes **Low compliance score?** * This is normal for first audit * Focus on critical findings first * Use the 6-week roadmap to improve systematically **Missing evidence errors?** * Ensure proper access to infrastructure * Check cloud provider permissions * Verify logging is enabled **Documentation marked as missing?** * Create required policies from templates * Update expired documents * Add to version control for tracking *** ### Examples **Quick SOC2 check:** ``` "Run a SOC2 compliance audit and show me critical gaps" ``` **Full assessment for certification:** ``` "Run a comprehensive compliance audit for all frameworks with full scope" ``` **Focus on specific framework:** ``` "What do we need to fix for HIPAA compliance?" ``` **Gap analysis:** ``` "Perform a compliance gap analysis and prioritize fixes" ``` **Re-audit after fixes:** ``` "Run another compliance audit to verify our improvements" ``` # Architecture Analyze Agent Map your entire system automatically! Generate multi-repo diagrams and visualize data flow to master complex architecture ### What it does The Architecture Analyze Agent automatically discovers, maps, and documents your entire software architecture—generating visual diagrams, API documentation, cost optimization recommendations, and operational runbooks. Think of it as your automated principal architect that reverse-engineers your system and creates production-ready documentation. **You'll get:** * System architecture diagrams (15+ formats: Mermaid, PlantUML, D2, Draw\.io) * Complete API documentation with endpoints and data flows * Cost optimization analysis with savings projections * Disaster recovery blueprints with RPO/RTO targets * Production-ready code examples and operational runbooks ⏱️ **Analysis time:** 5-15 minutes depending on codebase size ## Sample Prompts {% hint style="success" %} **Examples** #### **pre‑deploy‑review** **Prompt:** “Analyze our service mesh and identify any single‑points‑of‑failure before deploying the new microservice.” #### **auth‑route‑audit** **Prompt:** “Verify all authentication routes and dataflows to ensure no unsecured endpoints exist.” #### **high‑latency‑diagnosis** **Prompt:** “Inspect the architecture for components contributing to the 200 ms latency spikes in the checkout flow.” #### **scaling‑risk‑assessment** **Prompt:** “Evaluate our current setup for risks when scaling from 100 to 10 000 concurrent users.” #### **third‑party‑dependency‑map** **Prompt**: “Generate a diagram showing external APIs and their expected request volumes for security review.”
{% endhint %} ### Why use it **Instead of:** * Spending 30-40 hours manually documenting architecture * Reverse-engineering systems from outdated diagrams * Guessing at cost optimization opportunities * Creating DR plans from scratch **You get:** * Automated discovery of your entire tech stack * Multi-format diagrams ready to edit * $335K+ average annual cloud savings identified * Production-ready monitoring and error handling code * Week-by-week implementation roadmap **Impact:** * 30-40 hours saved per project on documentation * 40-60% cloud cost reduction (average) * 15-minute RPO / 4-hour RTO for disaster recovery *** ### What it analyzes The agent performs deep analysis across multiple layers: #### 1. Technology Stack Discovery **Scans:** Languages, frameworks, cloud services\ **Finds:** Python versions, React/Node.js, Databricks, AWS/Azure/GCP\ **Example:** Detects "Python 3.11, FastAPI, Databricks Unity Catalog, Delta Lake" #### 2. Component Mapping **Analyzes:** Directory structures, config files\ **Finds:** Microservices, APIs, databases, storage layers\ **Example:** Maps package.json, Dockerfile, terraform files to system boundaries #### 3. Data Flow Analysis **Reads:** Source code, API calls, data pipelines\ **Finds:** Medallion architecture (Bronze/Silver/Gold), API endpoints, auth flows\ **Example:** Traces data from ingestion → transformation → consumption #### 4. Security Architecture **Maps:** Defense-in-depth layers, access controls\ **Finds:** Network isolation, authentication, encryption, RBAC\ **Example:** Documents 8-layer security framework with Private Link setup #### 5. Cost Optimization **Analyzes:** Compute resources, storage, network\ **Finds:** Auto-termination gaps, spot instance opportunities, rightsizing needs\ **Example:** Identifies $335K+ annual savings in unused compute #### 6. Disaster Recovery **Plans:** Multi-region failover, backup strategies\ **Finds:** Recovery point objectives (RPO), recovery time objectives (RTO)\ **Example:** Creates active-passive setup with 15-min RPO / 4-hour RTO *** ### How to use it #### Basic analysis Analyze your current directory: bash ```bash opsera-devops-agent:architecture-analyze ``` or in natural language: ``` "Analyze the architecture of this project" ``` *** #### Specific analyses **Full system with all diagram formats:** ``` "Analyze the entire system and generate diagrams in all formats" ``` **Focus on cost optimization:** ``` "Analyze this architecture and show me cost optimization opportunities" ``` **CI/CD architecture:** ``` "Generate a CI/CD architecture with pipeline recommendations" ``` **Security architecture only:** ``` "Map the security architecture with defense-in-depth layers" ``` **Specific directory:** ``` "Analyze only the ./src directory with API documentation" ``` *** ### What you'll see #### During analysis bash ```bash 🏗️ Architecture Analyze Agent Starting... Phase 1/6: Environment discovery... ✓ Detected: Python 3.11, FastAPI, React 18 ✓ Cloud services: Databricks, AWS S3, RDS ✓ Infrastructure: Terraform, Docker, Kubernetes Phase 2/6: Component mapping... ✓ Found 8 microservices ✓ Identified 24 API endpoints ✓ Mapped 3 data layers (Bronze/Silver/Gold) Phase 3/6: Logic extraction... ✓ Traced data flows across pipelines ✓ Documented authentication sequences ✓ Mapped API dependencies Phase 4/6: Multi-layer diagramming... ✓ Generated system overview ✓ Created data flow diagrams ✓ Rendered security architecture ✓ Produced 15 diagrams in 4 formats Phase 5/6: Strategic analysis... ✓ Identified $420K in potential savings ✓ Created week-by-week implementation plan ✓ Analyzed DR requirements (RPO/RTO) Phase 6/6: Artifact delivery... ✓ Generated 5 comprehensive reports ✓ Created operational runbooks ✓ Produced production-ready code examples 📁 Reports saved to: /Users/opsera/architecture-docs/ ``` *** ### Reports generated You'll get 5 comprehensive documentation files: #### 1. Architecture Documentation **File:** `architecture-documentation.md` **Contains:** * **Technology Stack Analysis:** Complete breakdown of backend, data layers, infrastructure * **API Specification:** All discovered endpoints with request/response formats * **Visual Blueprints:** 15+ diagrams including: * System overview * Data flow (Medallion architecture) * Component diagrams * Sequence diagrams * ER diagrams * **Multi-Format Export:** Mermaid, PlantUML, D2, Draw\.io XML **Example output:** markdown ````markdown ## System Overview Diagram ```mermaid graph TB API[FastAPI Gateway] DB[(PostgreSQL)] Cache[(Redis)] Queue[RabbitMQ] API --> DB API --> Cache API --> Queue ``` ## Technology Stack - **Backend:** Python 3.11 (FastAPI, Celery) - **Frontend:** React 18 (TypeScript, Tailwind) - **Data:** Databricks (Delta Lake, Unity Catalog) - **Infrastructure:** AWS (EKS, RDS, S3) ## API Endpoints - POST /api/v1/users - Create user - GET /api/v1/users/{id} - Get user details - POST /api/v1/pipelines/run - Execute data pipeline ```` *** #### 2. CI/CD Architecture **File:** `cicd-pipeline-architecture.md` **Contains:** * **Pipeline Orchestration:** Complete GitHub Actions workflows (600+ lines) * **Environment Strategy:** Dev → Staging → Prod promotion path * **Quality Gates:** Automated testing, security scanning, manual approvals * **Deployment Patterns:** Blue-green, canary, rolling updates **Example output:** yaml ```yaml # GitHub Actions Pipeline name: Deploy to Production on: push: branches: [main] jobs: test: runs-on: ubuntu-latest steps: - name: Run pytest - name: Security scan (TruffleHog, Bandit) - name: Code quality (SonarQube) deploy: needs: test steps: - name: Deploy to EKS - name: Run smoke tests - name: Health check ``` *** #### 3. Cost Optimization Analysis **File:** `cost-optimization-analysis.md` **Contains:** * **Current Spend Analysis:** Breakdown by service, region, resource type * **Optimization Opportunities:** Auto-termination, spot instances, rightsizing * **ROI Projections:** 3-year savings forecast * **Implementation Roadmap:** Week-by-week plan **Example output:** ``` Cost Optimization Opportunities ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Current Annual Spend: $840,000 Projected Annual Savings: $504,000 (60%) Payback Period: 3 months Quick Wins (Week 1-2): □ Enable auto-termination on Databricks clusters [$120K/year] □ Switch to spot instances for non-prod workloads [$80K/year] □ Rightsize RDS instances (t3.large → t3.medium) [$24K/year] Medium-term (Week 3-6): □ Implement data lifecycle policies (S3 → Glacier) [$60K/year] □ Optimize SQL warehouse size and concurrency [$100K/year] □ Enable compute autoscaling [$120K/year] 3-Year ROI Projection: Year 1: $504K savings - $15K implementation = $489K net Year 2: $504K savings Year 3: $504K savings Total 3-Year Savings: $1,497,000 ``` *** #### 4. Disaster Recovery Blueprint **File:** `disaster-recovery-architecture.md` **Contains:** * **Resiliency Targets:** RPO (15 minutes), RTO (4 hours) * **Failover Procedures:** Active-passive multi-region setup * **Automated Scripts:** Failover automation code * **Testing Procedures:** DR drill runbooks **Example output:** ```` Disaster Recovery Plan ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Targets: RPO (Recovery Point Objective): 15 minutes RTO (Recovery Time Objective): 4 hours Architecture: Primary Region: us-east-1 (Active) DR Region: us-west-2 (Passive) Replication: Cross-region automated backups Failover Steps: 1. Detect primary region failure (CloudWatch alarms) 2. Promote DR database replica to primary 3. Update Route 53 DNS to DR region 4. Validate application health checks 5. Notify stakeholders Automated Failover Script: ```bash #!/bin/bash # Failover to DR region aws rds promote-read-replica --db-instance dr-database aws route53 change-resource-record-sets --change-batch file://failover.json # Verify health curl https://api.example.com/health ``` DR Testing Schedule: - Monthly: Backup restore tests - Quarterly: Full failover drills - Annual: Complete DR simulation ```` *** #### 5. Production-Ready Code & Operations **Files:** `production_ready_code_examples.py`, `operational-guide.md` **Contains:** * **Hardened Code:** Circuit breakers, exponential backoff, structured logging * **Operational Runbooks:** Common tasks (scaling, troubleshooting, monitoring) * **Security Hardening:** Network isolation, RBAC, encryption **Example output:** python ```python # production_ready_code_examples.py import time import logging from functools import wraps # Circuit breaker pattern class CircuitBreaker: def __init__(self, failure_threshold=5, timeout=60): self.failure_count = 0 self.failure_threshold = failure_threshold self.timeout = timeout self.last_failure_time = None def call(self, func): if self.failure_count >= self.failure_threshold: if time.time() - self.last_failure_time < self.timeout: raise Exception("Circuit breaker is OPEN") else: self.failure_count = 0 # Reset after timeout try: result = func() self.failure_count = 0 # Reset on success return result except Exception as e: self.failure_count += 1 self.last_failure_time = time.time() raise # Exponential backoff with retry def retry_with_backoff(max_retries=3, base_delay=1): def decorator(func): @wraps(func) def wrapper(*args, **kwargs): for attempt in range(max_retries): try: return func(*args, **kwargs) except Exception as e: if attempt == max_retries - 1: raise delay = base_delay * (2 ** attempt) logging.warning(f"Retry {attempt + 1}/{max_retries} after {delay}s") time.sleep(delay) return wrapper return decorator # Structured JSON logging import json from datetime import datetime class StructuredLogger: def log(self, level, message, **kwargs): log_entry = { "timestamp": datetime.utcnow().isoformat(), "level": level, "message": message, **kwargs } print(json.dumps(log_entry)) logger = StructuredLogger() logger.log("INFO", "Pipeline started", pipeline_id="abc123", user="admin") ``` *** ### After analysis #### 1. Review the architecture documentation Open `architecture-documentation.md` to see: * Complete system overview * All discovered APIs and endpoints * Visual diagrams in multiple formats * Technology stack breakdown *** #### 2. Implement cost optimizations Follow the quick wins in `cost-optimization-analysis.md`: * Enable auto-termination on compute clusters * Switch non-prod workloads to spot instances * Rightsize over-provisioned resources * Implement data lifecycle policies **Typical savings:** $300K-$500K annually *** #### 3. Deploy CI/CD improvements Use the workflows in `cicd-pipeline-architecture.md`: * Copy GitHub Actions workflows to `.github/workflows/` * Set up quality gates (testing, security scanning) * Configure environment promotion (Dev → Staging → Prod) * Enable automated deployments *** #### 4. Harden production systems Use `production_ready_code_examples.py`: * Add circuit breakers to external API calls * Implement exponential backoff with retry logic * Switch to structured JSON logging * Add comprehensive error handling *** #### 5. Prepare disaster recovery Follow the DR blueprint in `disaster-recovery-architecture.md`: * Set up multi-region replication * Configure automated failover scripts * Schedule quarterly DR drills * Document runbooks for emergencies *** ### Quality benchmarks Use these standards to measure architectural quality: | Metric | Target | Purpose | | -------------------------- | ------------------------ | ---------------------------- | | **Documentation Coverage** | 100% | All components documented | | **Diagram Accuracy** | Current | Reflects actual system state | | **Cost Efficiency** | Auto-termination enabled | No wasted compute | | **DR Preparedness** | RPO 15min / RTO 4hr | Business continuity | | **Security Layers** | 8-layer defense-in-depth | Comprehensive protection | **Architecture maturity levels:** * ✅ **Production Ready:** All targets met, DR tested, costs optimized * ⚠️ **Needs Hardening:** Documentation complete, DR planned, some cost waste * ❌ **Early Stage:** Incomplete docs, no DR plan, high cost waste *** ### Common issues **Analysis taking too long?** * Start with specific directory: "Analyze only the ./api directory" * Skip certain analyses: "Analyze architecture but skip cost optimization" * Larger codebases may take 15-20 minutes **Diagrams not rendering?** * Copy Mermaid/PlantUML code to specialized viewers * Use Draw\.io XML files for visual editing * Check diagram syntax in generated markdown **Missing components in diagrams?** * Ensure all config files are present (package.json, Dockerfile, etc.) * Check that services are running or have recent activity * Verify cloud provider credentials for service discovery **Cost analysis shows no savings?** * Your infrastructure may already be optimized * Run analysis on production environment for accurate data * Check for auto-termination and spot instance usage **Reports not generated?** * Check write permissions in output directory * Verify sufficient disk space * Look for errors in analysis output *** ### Examples **Quick architecture overview:** ``` "Analyze this project and show me the system architecture" ``` **Full analysis with all diagrams:** ``` "Generate a complete architecture analysis with all diagram formats and cost optimization" ``` **API documentation:** ``` "Analyze this codebase and document all API endpoints" ``` **Cost optimization focus:** ``` "Analyze my cloud architecture and identify cost savings opportunities" ``` **Security architecture:** ``` "Map the security architecture with defense-in-depth layers" ``` **DR planning:** ``` "Generate a disaster recovery plan with RPO and RTO targets" ``` # SQL Security Scan Optimize every query. Eliminate SQL injection risks, enforce schema best practices, and safeguard PII/PHI data with real-time analysis before deployment. ### What it does The SQL Security Agent scans your SQL code and Databricks environments for security vulnerabilities—detecting SQL injection, hardcoded credentials, PII exposure, and missing encryption—then automatically generates secure code fixes. Think of it as your automated database security expert that finds vulnerabilities and writes the fixes for you. **You'll get:** * SQL injection vulnerabilities detected and fixed * Hardcoded credentials replaced with secrets management * PII data (SSN, emails, phone numbers) automatically masked * Insecure joins and queries refactored * Auto-generated masking functions for production use ⏱️ **Scan time:** 2-5 minutes depending on SQL file size ## Sample Prompts {% hint style="success" %} Examples #### **pre‑deployment‑ddl‑check** **Prompt:** “Validate all new DDL statements in `migrations/` for dangerous operations before pushing to prod.” #### **monthly‑audit‑queries** **Prompt:** “Scan stored procedures and views for SQL injection patterns as part of the monthly security review.” #### **api‑endpoint‑review** **Prompt:** “Inspect the SQL used by the payments API for unparameterized queries.” #### **schema‑change‑risk** **Prompt:** “Check proposed schema changes in the feature branch for permission‑escalation risks.” #### **vendor‑sql‑analysis** **Prompt:** “Analyze third‑party SQL scripts for hard‑coded credentials and unsafe constructs.”
{% endhint %} ### Why use it **Instead of:** * Manually reviewing SQL code for security issues * Writing PII masking functions from scratch * Guessing at privilege escalation risks * Spending hours on security audits **You get:** * Automated vulnerability detection with fixes * AI-generated secure code (Claude Sonnet 4) * 98-99% accurate PII detection and masking * One-command scan-and-fix workflow * Compliance-ready security reports **Impact:** * Zero SQL injection vulnerabilities * Automated PII protection (GDPR/HIPAA compliant) * Secure credentials management via Databricks secrets * Manual security reviews → automated 7-step process *** ### What it scans The agent detects and fixes these vulnerability types: | Vulnerability | Severity | Standard | Auto-Fix | | -------------------------- | ----------- | -------- | --------- | | **SQL Injection** | 🔴 Critical | CWE-89 | ✅ Yes | | **Hardcoded Credentials** | 🔴 Critical | CWE-798 | ✅ Yes | | **PII Exposure** | 🟠 High | CWE-359 | ✅ Yes | | **Missing Encryption** | 🟠 High | CWE-311 | ✅ Yes | | **Insecure Joins** | 🟡 Medium | CWE-1286 | ✅ Yes | | **Over-Privileged Access** | 🟠 High | CWE-269 | ⚠️ Manual | *** ### How to use it #### Basic scan and fix Scan and automatically fix vulnerabilities in a SQL file: ```bash sql-security scan-and-fix --file queries.sql ``` or in natural language: ``` "Scan my SQL file for security vulnerabilities and fix them" ``` *** #### Specific scans **Detect PII in a table:** ```bash sql-security detect-pii --table customer_data ``` ``` "Scan the customer_data table for PII and show me what needs masking" ``` **Compliance check:** ```bash sql-security compliance --standard SOC2 ``` ``` "Run a SOC2 compliance check on my Databricks workspace" ``` **Privilege analysis:** ```bash sql-security analyze-privileges --user john.doe ``` ``` "Check if john.doe has excessive database privileges" ``` *** ### What you'll see #### The 7-step scan-and-fix process ```bash 🔍 SQL Security Agent Starting... Step 1/7: Vulnerability scan... ✗ Found SQL injection in line 42 ✗ Found hardcoded password in line 15 ✗ Found PII exposure (SSN) in line 67 Step 2/7: AI fix generation... ✓ Generated secure parameterized query ✓ Generated Databricks secret reference ✓ Generated masking function for SSN Step 3/7: Safety verification... ✓ Verified query logic preserved ✓ Verified no syntax errors ✓ Verified performance unchanged Step 4/7: Diff presentation... Vulnerable Code (Line 42): query = "SELECT * FROM users WHERE id = '" + user_id + "'" Secure Code (Auto-fixed): query = "SELECT * FROM users WHERE id = :user_id" params = {"user_id": user_id} Rationale: Prevents SQL injection by using parameterized queries Step 5/7: User approval... ? Apply this fix? (y/n) Step 6/7: Applying fixes... ✓ Fixed SQL injection (3 instances) ✓ Replaced hardcoded credentials (1 instance) ✓ Added PII masking (2 instances) ✓ Generated: queries_fixed.sql Step 7/7: Re-scan verification... ✓ No vulnerabilities found ✓ All security checks passed 📁 Fixed file saved: queries_fixed.sql 📊 Report saved: sql-security-report.html ``` *** ### What you get #### 1. SQL Security Report **File:** `sql-security-report.html` ``` SQL Security Scan Results ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Overall Risk: HIGH (before fixes) Files Scanned: 5 Issues Found: 12 Vulnerability Breakdown: 🔴 Critical: 4 - SQL Injection: 3 - Hardcoded Credentials: 1 🟠 High: 5 - PII Exposure: 3 - Missing Encryption: 2 🟡 Medium: 3 - Insecure Joins: 3 Compliance Status: SOC2: ⚠️ 67% (missing encryption at rest) GDPR: ❌ 45% (PII not masked) HIPAA: ❌ 40% (no access logs) Impact Analysis: - 3 SQL injection vectors closed - 850K sensitive records now masked - Credentials moved to secrets vault ``` *** #### 2. Fixed SQL Files **File:** `queries_fixed.sql` **Before (Vulnerable):** ```sql -- SQL Injection vulnerability SELECT * FROM customers WHERE email = '" + user_input + "' -- Hardcoded credentials spark.sql(""" CREATE TABLE users USING org.apache.spark.sql.jdbc OPTIONS ( url 'jdbc:mysql://prod.db:3306', user 'admin', password 'P@ssw0rd123' -- CRITICAL: Hardcoded! ) """) -- PII exposure SELECT customer_name, ssn, -- Exposed! email, -- Exposed! credit_card -- Exposed! FROM customers ``` **After (Secure):** ```sql -- Fixed: Parameterized query SELECT * FROM customers WHERE email = :email_param -- Fixed: Using Databricks secrets spark.sql(f""" CREATE TABLE users USING org.apache.spark.sql.jdbc OPTIONS ( url '{dbutils.secrets.get(scope='prod', key='db-url')}', user '{dbutils.secrets.get(scope='prod', key='db-user')}', password '{dbutils.secrets.get(scope='prod', key='db-password')}' ) """) -- Fixed: PII masked with functions SELECT customer_name, mask_ssn(ssn) as ssn, -- Masked: ***-**-1234 mask_email(email) as email, -- Masked: j***@example.com mask_credit_card(credit_card) -- Masked: ****-****-****-1234 FROM customers ``` *** #### 3. Auto-Generated Masking Functions **File:** `pii_masking_functions.sql` ```sql -- Email masking function CREATE OR REPLACE FUNCTION mask_email(email STRING) RETURNS STRING RETURN CASE WHEN current_user() LIKE '%@company.com' AND current_database() != 'production' THEN email -- Show full email in non-prod for internal users ELSE CONCAT( SUBSTRING(email, 1, 1), '***@', SPLIT(email, '@')[1] ) -- Mask: j***@example.com END; -- SSN masking function CREATE OR REPLACE FUNCTION mask_ssn(ssn STRING) RETURNS STRING RETURN CASE WHEN current_user() IN (SELECT user FROM authorized_users) THEN ssn -- Full SSN for authorized users only ELSE CONCAT('***-**-', SUBSTRING(ssn, -4)) -- Mask: ***-**-1234 END; -- Credit card masking function CREATE OR REPLACE FUNCTION mask_credit_card(card STRING) RETURNS STRING RETURN CONCAT('****-****-****-', SUBSTRING(card, -4)); -- Phone number masking function CREATE OR REPLACE FUNCTION mask_phone(phone STRING) RETURNS STRING RETURN CONCAT('(***) ***-', SUBSTRING(phone, -4)); -- Apply masking to existing table ALTER TABLE customers ADD COLUMN email_masked STRING GENERATED ALWAYS AS (mask_email(email)); ALTER TABLE customers ADD COLUMN ssn_masked STRING GENERATED ALWAYS AS (mask_ssn(ssn)); ``` **Usage:** ```sql -- Use masked columns in queries SELECT customer_name, email_masked as email, -- Automatically masked ssn_masked as ssn -- Automatically masked FROM customers; ``` *** #### 4. Before/After Comparison **Vulnerable Code:** ```sql -- Insecure joins (missing ON clause) SELECT * FROM orders, customers WHERE customers.id = orders.customer_id ``` **Secure Code:** ```sql -- Secure explicit JOIN SELECT o.*, c.name, c.email_masked as email FROM orders o INNER JOIN customers c ON o.customer_id = c.id WHERE c.is_active = true; ``` *** ### After the scan #### 1. Review and apply fixes The agent shows you each fix with rationale: * Review the before/after code * Understand why the change improves security * Approve or reject each fix * Apply all approved fixes at once *** #### 2. Deploy masking functions Use the auto-generated functions in production: ```sql -- Deploy to production spark.sql(""" CREATE DATABASE IF NOT EXISTS security_functions; """) -- Upload pii_masking_functions.sql %run /security_functions/pii_masking_functions.sql -- Verify functions work SELECT mask_ssn('123-45-6789'); -- Returns: ***-**-6789 ``` *** #### 3. Migrate credentials to secrets Replace hardcoded credentials with Databricks secrets: ```bash # Create secret scope databricks secrets create-scope --scope prod # Add secrets databricks secrets put --scope prod --key db-password databricks secrets put --scope prod --key api-key # Update code to use secrets # (Agent provides the updated code) ``` *** #### 4. Update privilege grants For over-privileged accounts flagged: ```sql -- Review current privileges sql-security analyze-privileges --user john.doe -- Output shows: -- john.doe has ADMIN on production.* (EXCESSIVE) -- Recommended: SELECT on production.customers only -- Apply least privilege REVOKE ALL PRIVILEGES ON production.* FROM john.doe; GRANT SELECT ON production.customers TO john.doe; ``` *** #### 5. Re-scan to verify After applying fixes, verify everything is secure: ```bash sql-security scan-and-fix --file queries_fixed.sql ``` Expected result: ✅ No vulnerabilities found *** ### Quality benchmarks Use these standards to measure SQL security: | Metric | Target | Purpose | | ------------------------- | --------------- | ------------------------- | | **SQL Injection** | 0 instances | Prevent data breaches | | **Hardcoded Credentials** | 0 instances | Secure secrets management | | **PII Masking Coverage** | 100% | Comply with GDPR/HIPAA | | **Encryption at Rest** | Enabled | Protect sensitive data | | **Privilege Escalation** | No admin grants | Least privilege principle | **Security levels:** * ✅ **Secure:** 0 critical, 100% PII masked, secrets managed * ⚠️ **Needs Work:** 0 critical, partial PII masking * ❌ **Vulnerable:** Any critical findings, no PII masking *** ### Common issues **"No vulnerabilities found" but I know there are issues?** * Check file path is correct * Verify SQL syntax is valid * Try specific scans: `detect-pii`, `compliance` **Auto-fixes breaking query logic?** * Review the "Safety Verification" step output * Test fixed queries in non-prod first * Reject specific fixes and apply manually **Masking functions not working?** * Check function syntax: `SELECT mask_email('test@example.com')` * Verify user permissions to create functions * Ensure functions are in correct database **PII detection missing fields?** * Increase confidence threshold: `--confidence 90` * Add custom patterns: `--pattern-file custom_pii.yaml` * Review detection summary for false negatives **Secrets management errors?** * Verify Databricks secrets scope exists * Check secret key names match code references * Test secret access: `dbutils.secrets.get(scope, key)` *** ### Examples **Quick SQL security scan:** ``` "Scan my queries.sql file for security vulnerabilities" ``` **Full scan with auto-fix:** ``` "Scan and automatically fix all security issues in my SQL code" ``` **Find PII exposure:** ``` "Detect all PII in my customer_data table and generate masking functions" ``` **Compliance check:** ``` "Run a GDPR compliance check on my Databricks workspace" ``` **Privilege analysis:** ``` "Show me all users with admin access to the production database" ``` **Secure credentials:** ``` "Find all hardcoded credentials in my SQL files and replace them with secrets" ``` # How it Works Vibe-Shift is Opsera's autonomous DevOps agent that takes your AI-generated code and deploys it to production on AWS EKS — no CI/CD knowledge, no Dockerfile, no YAML required. From *Vibe Code*\ to Production — --------------- The Problem Vibe coding gets you to a working app in minutes. But working isn't production. Vibe-generated code ships without real auth, no Dockerfile, no container config, no CI/CD, no health checks, no audit trail. What Vibe-Shift does VIBEshift is Opsera's autonomous DevOps agent. It takes your vibe-coded app directly from GitHub, detects your stack, generates a Dockerfile, provisions AWS EKS infrastructure, and deploys your app to production — no CI/CD knowledge, no YAML, no Terraform required.

The result A production-grade application running on AWS EKS, with production-ready OAuth, health verification, and a full audit trail. ## 6 Autonomous Steps. **No human required.**

Vibe-Shift runs a full production pipeline against your repo — automatically, in sequence, with self-healing built in at every stage.


Step 01 Stack Auto-Detection Reads your repo and identifies Node.js, Python, React, or Next.js — no configuration file needed. Vibe-Shift figures out what you built so you don't have to tell it.
Step 02 OAuth Migration Detects existing OAuth flows and upgrades them to Express + Passport.js for production-grade security — automatically, with no manual code changes required from you.
Step 03 Dockerfile Generation Creates a production-optimised Dockerfile from your detected stack. This is the only file committed to your repo — clean and minimal. Nothing else touched.
Step 04 Self-Healing Deployments Monitors rollout health in real time and automatically retries failed steps — up to 5 times before alerting you. Most issues resolve without you ever knowing they happened.
Step 05 Health Verification Validates that pods are running and service endpoints are responding before marking the deployment complete. Your app is confirmed live — not just deployed.

Step 01

Stack

Auto-Detection

Reads your repo and identifies Node.js, Python, React, or Next.js — no configuration file needed. Vibe-Shift figures out what you built so you don't have to tell it.

Step 02

OAuth

Migration

Detects existing OAuth flows and upgrades them to Express + Passport.js for production-grade security — automatically, with no manual code changes required from you.

Step 03

Dockerfile

Generation

Creates a production-optimised Dockerfile from your detected stack. This is the only file committed to your repo — clean and minimal. Nothing else touched.

Step 04

Self-Healing Deployments

Monitors rollout health in real time and automatically retries failed steps — up to 5 times before alerting you. Most issues resolve without you ever knowing they happened.

Step 05

Health

Verification

Validates that pods are running and service endpoints are responding before marking the deployment complete. Your app is confirmed live — not just deployed.

## **GitOps, Built In.** Auto-deploy is on by default. The moment you push to main, Vibe-Shift triggers the full 6-step pipeline — no commands, no manual steps. Your git push is your deployment trigger. ## **Deploy From Your IDE.** Vibe-Shift integrates natively with Claude Code, Cursor or VS Code via MCP. Type one command in your chat window and the agent handles the rest — end to end, autonomously. That's it. Vibe-Shift does the rest. {% stepper %} {% step %} ### **One command deploy** The full pipeline runs from a single chat message in your IDE. {% endstep %} {% step %} ### **Deterministic execution** Server-orchestrated, reproducible results, every time. {% endstep %} {% step %} ### **MCP-native** Code connects via HTTPS + OAuth Bearer token. SKU-filtered tool access per plan. {% endstep %} {% step %} ### **Full observability** Every tool call, auth event, and deployment step is logged. Complete audit trail, always. {% endstep %} {% endstepper %} ### What Vibe Platforms Ship vs What Vibe-Shift Adds | | Vibe Platform | Vibe-Shift | | ------------------------------------- | ------------- | ------------------------ | | Working code | ✅ | ✅ | | Production auth (OAuth / Passport.js) | ❌ | ✅ | | Dockerfile | ❌ | ✅ Auto-generated | | CI/CD pipeline | ❌ | ✅ GitOps, zero config | | Cloud infrastructure | ❌ | ✅ AWS EKS, fully managed | | Health verification | ❌ | ✅ Pod + endpoint checks | | Failure recovery | ❌ | ✅ 5× auto-retry | | Audit trail | ❌ | ✅ Full PostgreSQL log | {% hint style="info" %} * **Supported stacks:** Node.js, Python, React, Next.js * **Supported git providers:** GitHub, GitLab, Bitbucket **Supported clouds:** AWS EKS (Azure and GCP available via pipeline environment config) **Powered by:** Claude AI (Sonnet + Opus), MCP Protocol {% endhint %} ### Enterprise-grade infra. **Fully managed. No customer VPC.** Vibe-Shift provisions and manages all of the following on your behalf — you get production infrastructure without managing any of it. # Onboarding Guide {% hint style="info" icon="user-gear" %} **Permission Requirement** Platform Admin role {% endhint %} ## Prerequisites Before creating your first Vibe-Shift pipeline, confirm the following: * An Opsera account. * A GitHub, GitLab, or Bitbucket repository containing your vibe-coded app * A GitHub Personal Access Token with the following scopes: * `repo` — full repository access * `admin:repo_hook` — webhook registration for auto-deploy > **Note on token scopes:** Your GitHub PAT must include both `repo` and `admin:repo_hook`. Without `admin:repo_hook`, the GitOps webhook cannot be registered and pushes to `main` will not trigger the pipeline automatically. ## Create Your First Vibe-Shift Pipeline

Follow these steps to go from a Git repo to a deployed production app. {% stepper %} {% step %} ### **Step 1 — Sign in to Opsera Agents Portal** Navigate to **agent.opsera.ai** and sign in with your credentials. Confirm you see the Platform Admin badge in the top-left navigation. {% endstep %} {% step %} ### **Step 2 — Open the Vibe-Shift dashboard** Click **Vibe-Shift** from the left navigation. {% endstep %} {% step %} ### **Step 3 — Create a new pipeline** Click `+ New Vibe-Shift Pipeline` in the top right. Enter a pipeline name (e.g. Task Management App). Choose your authentication method: * **Personal Access Token** (recommended) — paste your GitHub PAT * **GitHub App** — use if your org enforces GitHub App auth Required scopes: `repo`, `admin:repo_hook`. Click **Next**. Search your repositories from the dropdown, or paste the repo URL directly. Then set: * **Branch** — default is `main` * **App Name** — becomes the deployed container/app identifier * **Environment** — select `dev` or `prod` Auto-deploy is enabled by default. A GitHub webhook is registered automatically — every push to `main` triggers the full pipeline without any manual action. Expand **Advanced Options** for additional configuration if needed. Click **Create**. {% endstep %} {% step %} ### **Pipeline runs automatically** On creation, the pipeline kicks off immediately. Six autonomous steps run in sequence (see below). Monitor progress in real time on the pipeline detail view. On success, the pipeline shows a green Success badge and Healthy deployment status. {% endstep %} {% step %} ### One Command Deploy If using Claude Code, Cursor or VS Code, you can use it to deloy your app in the IDE chat. Vibe-Shift handles the rest autonomously via MCP Protocol. {% endstep %} {% step %} ### View the Vibe-Shift Dashboard Once your pipeline is created, it kicks off automatically. Here is how to read the interface: * The Execution View (Pipeline Flow) * The Insights View (Analytics) [Read more here](/vibe-shift/vibe-shift-dashboard) {% endstep %} {% endstepper %} # Vibe-Shift Dashboard Your central hub for managing and monitoring deployments

When you open Vibe-Shift from the left sidebar, you land on the main pipeline dashboard. There are two primary views available: * **Pipeline Dashboard** — live status of all your pipelines across all organisations * **Insights View** — high-level analytics and trends, accessed via the View Insights button ## The Pipeline Dashboard {% stepper %} {% step %} ### **Top Stats — At a Glance** The four cards at the top of the dashboard give you an instant snapshot of your deployment fleet:

Card	What it shows
VS Pipelines	Total number of VIBEshift pipelines configured
Deployed	Pipelines with a live running app
Healthy	Pipelines passing health checks
Active Runs	Pipelines currently in progress

{% endstep %} {% step %} ### **The Pipeline List** Below the stats cards is your full pipeline list. Each row shows: * **Pipeline name** — with branch (`main`) and GitOps/auto-deploy indicators * **Owner** — name and email of the pipeline creator * **Organisation** — which org the pipeline belongs to * **Repository** — the connected GitHub/GitLab/Bitbucket repo * **Environment** — `DEV` or `PROD` badge * **Deployment** — live health status (Healthy / Unknown) * **Last Run** — status badge (Success / Cancelled / No runs) and time elapsed > **Note:** A Cancelled status on an older run does not affect the current deployment health. The pipeline still shows Healthy if the most recent successful run deployed correctly. > {% endstep %} {% step %} ### **Filtering and Navigation** Use the controls above the pipeline list to narrow your view: * **Search** — search pipelines by name * **All Status** — filter by Success, Failed, Running, or Cancelled * **All Envs** — filter to show only DEV or PROD pipelines * **All Organizations** — scope the list to a specific org * **Refresh** — force-refresh all pipeline statuses * **+ New Vibe-Shift Pipeline** — create a new pipeline (top right) {% endstep %} {% endstepper %} ## The Insights Dashboard Click **View Insights** from the main dashboard to open the analytics view, scoped across all organisations. {% stepper %} {% step %} ### **Top Metrics** Four summary cards give you the organisation-wide health picture: | Metric | | ---------------- | | **Pipelines** | | **Total Runs** | | **Success Rate** | | **Deployed** | | {% endstep %} | {% step %} ### **Pipelines by Environment** A donut chart showing how your pipelines are distributed across environments: * **dev** — 6 pipelines * **prod** — 1 pipeline Use this to understand whether your team is primarily working in dev or moving workloads into production. {% endstep %} {% step %} ### **Run Activity (Last 30 Days)** A line graph tracking success vs failed runs {% endstep %} {% step %} ### **Organizations Tab** A per-organisation breakdown of pipeline health. Currently showing 2 organisations: {% endstep %} {% step %} ### **Users Tab** Switch to the **Users** tab to see activity broken down per developer — pipelines owned, total runs, success and failure counts, average run duration, and last run timestamp. {% endstep %} {% step %} ### **Activity Tab** Switch to the **Activity** tab for a run-by-run environment breakdown, showing which environments are being exercised and at what frequency. {% endstep %} {% endstepper %} # How it works **Code to Cloud** is Opsera's AI deployment agent. You point it at your GitHub repository from your IDE, answer a few questions, and it deploys your app to wherever you want it — your AWS account, your EKS cluster, your ECR registry. No CI/CD setup, no YAML writing, no DevOps expertise needed. ## **The Problem** You have a working app in a GitHub repo. Deploying it means: * Writing a Dockerfile * Setting up a container registry * Provisioning or configuring a Kubernetes cluster * Writing Helm charts and deployment manifests * Building a CI/CD pipeline with build, scan, push, and deploy stages * Wiring up secrets, ingress, TLS, and DNS That's days of work before a single user sees your app. Code to Cloud compresses it to a single conversation. ## **Prerequisites** Before starting, confirm the following: * An Opsera Enterprise account with Code to Cloud access * An IDE with MCP support — VS Code with the Claude extension, or Cursor * AWS CLI installed locally with at least one named profile configured * `kubectl` installed and accessible in your PATH * A GitHub repository containing your application code * AWS credentials with sufficient permissions for EKS, ECR, and IAM read access ## **What Code to Cloud Does** The agent connects to your IDE via MCP. You give it your repo path. It inspects your code, asks you a handful of questions about where you want to deploy, then creates and runs a fully configured pipeline — all within your existing AWS infrastructure. **You stay in control.** The agent deploys to your AWS account, your EKS cluster, your ECR registry. It doesn't spin up new infrastructure you don't own. It works with what you already have. **Nothing is assumed. Nothing is hard-coded.** Every deployment target is confirmed by you before the pipeline is created. Your app is deployed at a URL auto-assigned from your cluster's wildcard domain. ## **How the Agent Works — Step by Step** **1. Repository Analysis** The agent reads your repo — tech stack, package files, Dockerfile (if present), existing manifests. It tells you exactly what it found and what it will auto-generate if missing. **2. You Answer a Guided Set of Questions** The conversation is shaped by what the agent found in your code. Core questions cover: * App name * Target environment (dev / test / uat / prod / custom) * Cloud provider * AWS profile — the agent lists all profiles found on your machine; you select one * EKS cluster and ECR repository — discovered automatically from your selected profile * Deployment asset handling — how to manage your Dockerfile and K8s manifests. If the agent finds existing K8s manifests, it asks how you want to use them. If nothing exists, it offers to generate a full Helm chart. Options vary based on what's in your repo * Security scanning — optionally enable SonarQube code quality scanning and Grype container vulnerability scanning The questions are specific to your application — not a one-size-fits-all wizard. **3. Deployment Plan Review** Before doing anything, the agent shows you a full summary table covering: pipeline name, app name, environment, cloud, cluster, registry, namespace, ingress pattern, deployment URL, branch, workflow stages, and secrets needed. You confirm with `yes` or provide corrections before the agent proceeds. **4. Pipeline Created** On confirmation, the agent creates the pipeline in Opsera with all variables pre-filled, generates the deployment script, and tells you exactly which secrets to configure in the portal. The number and type of secrets required depends on your pipeline configuration. **5. You Configure Secrets** Open the portal link provided by the agent and enter the credential secrets that cannot be auto-detected from your environment. Common secrets include your GitHub Personal Access Token, AWS credentials, container registry credentials, and any scan tokens for enabled scanning tools. All other pipeline variables are already pre-filled. **6. You Trigger the Pipeline** Return to the IDE and type `deploy` to trigger the first run. Subsequent runs can also be triggered directly from the Opsera portal using the **Run Pipeline** button, or automatically via webhook on git push. The pipeline runs end to end and your app goes live. **The Pipeline Chain** The pipeline stages depend on what was configured for your specific pipeline. The core stages are: ``` clone → build → push → deploy ``` If security scanning tools were configured, additional stages are added at the appropriate points: ``` clone → scan → build → containerscan → push → deploy ``` Scanning stages are not automatically added to every pipeline. Whether `scan` or `containerscan` appear depends on how your pipeline was configured when it was created. Each pipeline's stage chain reflects its own setup. ## **After Deployment** Once your pipeline runs successfully, you can manage everything from the Opsera portal under **Code-to-Cloud → Pipelines**: * View run history and per-stage logs * Access the live deployment URL from any successful run record * Re-trigger runs using the Run Pipeline button * Set up a webhook to auto-trigger on every git push to your branch * Update pipeline variables or secrets without recreating the pipeline * View the Deployment Plan, Blueprint, and Activity tabs for the full configuration and audit trail Every run is logged with who triggered it, when it ran, which stages executed, and what the outcome was. ## **Use Cases** Use Case 1 — Frontend Web App, Dev Environment ***Scenario**:* A developer has a Vite + React + TypeScript app in GitHub. They want to deploy it to their team's AWS dev cluster to share a preview URL with designers. ***What they do**:* Open IDE, trigger agent with repo path, confirm app name, select environment dev, pick their AWS dev profile, use existing ECR repo. ***What the agent does**:* Detects the Vite + React stack, finds the Dockerfile, discovers the EKS cluster, identifies the wildcard domain, creates the pipeline with all variables pre-filled. *Pipeline chain for this run:* `clone → build → push → deploy` (no scanning configured for this pipeline) ***Result**:* App live at a shareable URL in under 10 minutes. Designer review link ready immediately. Use Case 2 — Backend API, Production Deployment ***Scenario**:* A team is ready to promote their Node.js REST API to production. Their production pipeline was configured with SonarQube and Grype, with strict quality and security thresholds. ***What they do**:* Trigger agent, select environment prod, pick the production AWS profile. ***What the agent does**:* Discovers the production EKS cluster and ECR registry, creates the pipeline. Because this pipeline was configured with scanning, the full chain is built in. *Pipeline chain for this run:* `clone → scan → build → containerscan → push → deploy` ***Result**:* Every deployment to prod automatically runs through the quality and security stages configured for that pipeline. Full audit trail visible in the Opsera portal. Use Case 3 — New App, No Dockerfile, No Manifests ***Scenario:*** A developer has just finished building a Python Flask API. The repo has only application code — no Dockerfile, no K8s YAML, no CI/CD config at all. ***What they do:*** Trigger agent with the repo path. Agent detects Python + Flask, reports no Dockerfile found, offers to auto-generate everything. ***What the agent does:*** Generates a multi-stage Python Dockerfile, creates a full Helm chart, creates a new ECR repository, builds the complete pipeline. *Pipeline chain for this run:* `clone → build → push → deploy` ***Result**:* A repo with zero DevOps files becomes a fully deployed, URL-accessible application — without the developer writing a single line of YAML. Use Case 4 — Multiple Environments, Same App ***Scenario:*** An engineering team wants dev, uat, and prod pipelines for the same application — each pointing to a different AWS account and EKS cluster. ***What they do:*** Run the Code to Cloud agent three times — once per environment. Each time, select the appropriate AWS profile, which maps to the correct account and cluster. ***What the agent does:*** Creates three fully independent pipelines, each with its own namespace, ECR configuration, deployment URL, and stage chain. Each pipeline reflects the configuration choices made for that environment. ***Result**:* Full environment isolation. Each pipeline is independently configured, independently triggered, and independently visible in the Opsera portal under the same organization. # Onboarding Guide **GETTING STARTED — Code to Cloud** > **Permission Requirement:** Platform Admin role required. Bring your application from source code to a live cloud deployment. This guide walks you through connecting your repository, configuring your cloud target, and running your first automated pipeline. ## **Before You Begin** * **Personal Access Token for your source control provider** — Needs repo-level read access and, if applicable, org-level read access. * **Cloud provider credentials configured** * **IDE with MCP support** — VS Code with the Claude extension, or Cursor. ## **Pipeline Setup — Step by Step** **Step 1 — Connect the MCP Server** In your IDE, open the MCP configuration panel and connect the Opsera MCP server. Once connected, the agent will appear as an active Dev MCP connection and you are ready to proceed. **Step 2 — Trigger the Agent with Your Project Path** Open a new agent chat in your IDE. Invoke the Code to Cloud MCP tool and provide the path to your project. The agent will begin analysing your repository immediately. The MCP tool to invoke depends on your deployment type: * `code-to-cloud-web` — for standard web application deployments * `code-to-cloud-enterprise` — for enterprise-grade deployments Example: ``` /user-opsera/code-to-cloud-web ``` The agent immediately begins reading your repository — detecting your tech stack, port, branch, existing Dockerfiles, Kubernetes manifests, and Helm charts. It reports exactly what it found and what it will auto-generate if anything is missing. **Step 3 — Answer the Guided Setup Questions** The agent walks you through a structured conversation shaped by what it found in your code. The questions are specific to your repository — not the same for every app. Questions typically cover: * **App name** — The agent suggests one from your repo name; confirm or provide your own. * **Target environment** — dev, test, uat, prod, or custom. * **Cloud provider** — AWS (EKS + ECR) or Azure. * **AWS profile** — The agent lists all profiles found on your machine; you select which one to use. Region and account are auto-detected from the selected profile. * **EKS cluster and ECR repository** — Discovered automatically from your selected profile. You choose which cluster to deploy to and whether to use an existing ECR repo or create a new one. * **Deployment asset handling** — How to manage your Dockerfile and deployment manifests. If the agent finds existing Kubernetes manifests, it asks how you want to use them. If nothing exists, it offers to generate a full Helm chart. Options are tailored to what's in your repo. * **Security scanning (optional)** — Enable SonarQube code quality scanning and/or Grype container vulnerability scanning if needed for your pipeline. > You are not asked to provide cluster names, registry URLs, namespaces, ingress settings, or region codes — the agent resolves all of these automatically from your answers. **Step 4 — Review and Confirm the Deployment Plan** Once you have answered all questions, the agent presents a full deployment plan summary before creating anything. This covers pipeline name, app name, environment, cloud, cluster, registry, namespace, ingress pattern, deployment URL, branch, workflow stages, and which secrets will need to be configured. Review the plan and type `yes` to confirm. The agent then: * Creates the pipeline in the Opsera backend * Pre-fills all 35+ pipeline variables automatically * Generates the deployment script * Returns a **Configure Secrets in Portal** link **Step 5 — Configure Secrets in the Portal** Navigate to the portal link provided by the agent. Enter the credential secrets that cannot be auto-detected from your environment. Common secrets include: * `GIT_PAT` — GitHub Personal Access Token * `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` — AWS credentials * `SONAR_TOKEN` — SonarQube authentication token (only if SonarQube was enabled) All other pipeline variables are already pre-filled. Only credentials require manual entry. **Step 6 — Deploy** Return to the IDE agent chat and type: ``` deploy ``` The pipeline runs end to end — clone, build, push, deploy — and your app goes live. The deployment URL is shown on completion. Subsequent runs can also be triggered from the Opsera portal using the **Run Pipeline** button, or automatically on every git push by configuring a webhook from the pipeline's **Webhook** tab. **Step 7 — Monitor and Manage** Open the Opsera portal and navigate to **Code-to-Cloud → Pipelines** to find your pipeline. After your first run you can: * View run history and per-stage logs from the **Runs** tab * Access your live deployment URL directly from any successful run record * Trigger manual runs or re-runs using the **Run Pipeline** button * Set up automatic triggering on git push from the **Webhook** tab * Review the full pipeline configuration from the **Blueprint** tab * Update any pipeline variable or secret without recreating the pipeline from the **Variables** tab * View a chronological audit log of all pipeline events from the **Activity** tab # Code to Cloud Dashboard **Code to Cloud Dashboard** When you open Code to Cloud from the left sidebar in the Opsera portal, you land on the main pipeline dashboard. The dashboard has three tabs: * **Pipelines** — live status of all your C2C pipelines across all organizations * **Activity** — a chronological log of all pipeline events across your organization * **Templates** — pre-built pipeline templates ## **The Pipeline Dashboard** **1. Top Stats — At a Glance** The four cards at the top of the dashboard give you an instant snapshot of your deployment fleet: | Card | What it Shows | | ----------------- | ------------------------------------------------------------------------ | | **C2C Pipelines** | Total number of Code to Cloud pipelines configured, with total run count | | **Deployed** | Pipelines with a live running application, with success rate percentage | | **Active Runs** | Pipelines currently executing, with count of runs in a waiting state | | **Failed** | Pipelines that need attention — runs that did not complete successfully | **2. The Pipeline List** Below the stats, the pipeline list shows every C2C pipeline you have access to, with the total pipeline count displayed next to the **C2C Pipelines** label. Each row shows: | Column | Description | | ---------------- | -------------------------------------------------------------------------------------------------------------- | | **Pipeline** | Pipeline name and branch. A coloured left border indicates last run status — red for failed, green for success | | **Owner** | The user who created the pipeline and their email | | **Organization** | The Opsera organization the pipeline belongs to | | **Repository** | The linked source control repository | | **Environment** | The target environment shown as a badge — DEV, TEST, UAT, or PROD | | **Last Run** | Status of the most recent run (Failed / Success), run count, a visual run history bar, and time since last run | | **Actions** | **Run** button to trigger the pipeline manually, and a delete option | **3. Filtering and Navigation** Use the filter bar to narrow the pipeline list by: * **Search** — Type a pipeline name to find it instantly * **All Status** — Filter by run status: All Status / Running / Success / Failed * **All Envs** — Filter by environment: All Envs / dev / test / uat / prod * **All Orgs** — Filter by organization * **Refresh** — Manually refresh the list to pick up the latest run status ## **Individual Pipeline View** Clicking into any pipeline opens the pipeline detail page. At the top, the pipeline header shows the pipeline name, environment badge, branch, and the **Run Pipeline** button. **Pipeline Stats** Four cards show pipeline-level metrics: | Card | What it Shows | | ---------------- | ------------------------------------------------------ | | **Total Runs** | Number of runs executed, with passed and failed counts | | **Success Rate** | Percentage of runs that completed successfully | | **Avg Duration** | Average time per pipeline run | | **Last Run** | Time since the most recent run | **Stage Visualisation** The pipeline canvas shows the full stage chain for your pipeline — for example `Clone → Code Scan → Docker Build → Image Scan → Push → Deploy`. Each stage card shows its name and last run status. A red border and failed indicator appears on stages that did not complete successfully. **Pipeline Tabs** | Tab | What it Shows | | ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | | **Runs** | Full run history. Each run shows its number, status, stage-level indicators, timestamp, and any error message. Expand a run to see per-stage detail | | **Deployment Plan** | Environment configuration, ingress host, namespace, trigger settings, and stack configuration | | **Webhook** | Configure automatic pipeline triggering on git push | | **Variables** | All pipeline variables — pre-filled and secrets — with edit access | | **Blueprint** | The generated pipeline script. A blue dot indicates the script is present | | **Activity** | Timestamped log of all events for this specific pipeline | | **Logs** | Raw execution logs for the most recent run | **Run History** Each entry in the Runs tab shows the run number, overall status, individual stage indicators, timestamp, and — if the run failed — the specific error message # Billing and Pricing {% hint style="info" %} Billing for Opsera Agents is **coming soon**. We are currently building a flexible, usage-based pricing model. Until billing launches, new users receive **full access to all features with a 30-day free trial — no credit card required.** {% endhint %} ### Free Trial During your trial, you get unrestricted access to the entire Opsera Agents platform. Your trial includes: * **All AI Agents**\ Access architecture analysis, security scanning, SQL security, compliance auditing, and more. * **Unlimited MCP Calls**\ No usage limits while exploring the platform. * **Full Security Suite**\ Includes SAST scanning, CVE detection, and secret discovery. * **Compliance Auditing**\ Evaluate systems against major frameworks such as **SOC2, HIPAA, PCI-DSS, and ISO 27001**. ### Trial Milestones As you use Opsera Agents, you unlock milestone badges during your trial. | Milestone | Achievement | | ---------- | -------------- | | **Day 1** | Explorer Badge | | **Day 5** | Rising Star | | **Day 10** | 10-Day Streak | | **Day 20** | DevOps Pro | | **Day 30** | Champion Badge | These milestones highlight your progress as you explore the platform and run agents across your projects. ### Upcoming Pricing Flexible pricing plans will be introduced soon, including: * **Individual developer plans** * **Team and enterprise tiers** * **Usage-based billing** Your trial will continue until billing officially launches. # Marketplace ## Install Opsera where you already work. The Opsera DevSecOps Agent is available across the tools and platforms your team uses every day. Pick your environment, install in minutes, and bring AI-powered security directly into your workflow. ## Choose your environment Choose your platform below to get started.

		Cover image
Claude Code Plugin (Private Marketplace) Install DevSecOps agents directly into Claude Code. Invoke agents with slash commands or plain English from your terminal	Claude Code Plugin	Screenshot 2026-03-17 at 4.27.57 PM.png
Cursor Plugin Install Opsera DevSecOps Agent in Cursor. Scan code, enforce compliance, and analyze risks with simple commands.	Cursor Plugin	Screenshot 2026-03-17 at 4.28.00 PM.png

# Claude Code Plugin The Opsera DevSecOps plugin brings four AI security and compliance agents directly into Claude Code. Currently available in the **private marketplace only.** ## Installation There are two ways to install. The Marketplace method is the fastest and handles future updates automatically. #### Method A — Claude Code Marketplace Recommended Install directly from inside Claude Code with a single command: ``` /install opsera-devsecops ``` {% hint style="info" %} If this command works, skip directly to the [Authentication step](https://www.claudeusercontent.com/?domain=claude.ai\&errorReportingMode=parent\&formattedSpreadsheets=true#section-auth). You don't need Method B. {% endhint %} #### Method B — Install from GitHub Manual Use this if your Claude Code version doesn't support `/install`, or to pin a specific versionOpen Claude Code ***

## Step 1: Open Claude Code Launch Claude Code in your terminal: ``` claude ``` Then open the plugin manager: ``` /plugin ``` ## Step 2: Add the Plugin Repository Navigate to **Marketplace → Add Marketplace**. {% hint style="info" %} If `claude` isn't found, visit [code.claude.com/docs](https://code.claude.com/docs) to install Claude Code and add it to your PATH.2🐙Add the Plugin Repository {% endhint %} When prompted for the marketplace source, enter: ``` opsera-agents/opsera-devsecops ``` **Press Enter to confirm. You'll see: `+ Adding marketplace to configuration…`** ## Step 3: Install the Plugins Select the **Opsera DevSecOps** plugin from the catalog and confirm. This installs all 4 agents in one step: ``` Architecture Analyze # Risk-focused architecture analysis Security Scan # SAST, secrets, CVEs, containers Compliance Audit # SOC2, HIPAA, PCI-DSS, ISO 27001 SQL Security # Injection detection + AI auto-fix ``` ## Step 4: Restart Claude Code Fully exit and reopen Claude Code for the plugin to load: ``` exit ``` ## Step 5: Verify Installation Run `/plugin` and go to **Installed Plugins**. You should see an **Opsera MCP** entry that requires authentication. Move your cursor to it and press Enter to begin the authentication flow. ## Step 6: Authenticate in Browser A browser window opens automatically for secure OAuth login. Sign in with your Opsera account at [agent.opsera.ai](https://agent.opsera.ai/) — or a free trial account is created automatically if you don't have one. Once authenticated in the browser, return to your terminal. You're ready to go. ## Using the Agents Just describe what you need. Claude routes the request to the right agent automatically: | What you say | Agent | What you get | | ---------------------------------------------------- | ---------------- | ---------------------------------------------------------- | | "Scan this repo for security vulnerabilities" | Security Scan | SAST report + CVE list + secret detection results | | "Are we SOC2 compliant?" | Compliance Audit | Gap analysis against SOC 2 controls with evidence map | | "Check my SQL files for injection risks" | SQL Security | Flagged queries with safe alternatives and auto-fix | | "What are the architectural risks in this codebase?" | Architecture | Risk-annotated architecture diagram + failure modes | | "Do we have any secrets committed to this repo?" | Security Scan | Per-file secret detection report with severity ratings | | "Generate a HIPAA compliance report" | Compliance Audit | HIPAA control checklist with pass/fail + remediation steps | | "Show PII exposure in our query layer" | SQL Security | PII/PHI field inventory with exposure risk ratings | # Cursor Plugin Installation Guide for Opsera DevSecOps Agent in Cursor The Opsera DevSecOps Agent for Cursor brings enterprise-grade security, compliance, and architecture analysis directly into your development workflow. By integrating seamlessly with Cursor, it enables developers to identify vulnerabilities, enforce compliance standards, and uncover architectural risks, without leaving their coding environment. ## ⚡ **Quick Start**

## **Steps to Install Opsera DevSecOps Agent Plugin** ## **Install the Plugin** 1. Go to 2. Click the **Add to Cursor** button**.** 3. Click **Add Plugin.** 4. From the pop-up screen, click **View in Editor.** 5. Under the cursor settings, the **Opsera DevSecops Agent** will be installed.

## **Run Your First Scan** Open **Try in Chat** and enter a command to start interacting with the Opsera agent. ## **Sample Prompts** ``` Run a security scan on this repository ``` ``` Identify the top 10 critical and high vulnerabilities ``` ``` Analyze the architecture and highlight key risks ``` ``` What are the biggest design issues in this codebase? ``` ``` Run a compliance audit for SOC2 ``` ``` Check this project against ISO27001 standards ``` ``` Run a pre-commit scan on my staged changes ``` ``` Scan db/ for SQL vulnerabilities and suggest fixes ``` ``` Find unsafe queries and convert them to parameterized queries ``` ## Sample Output After successfully installing and running the Opsera DevSecOps Agent, you can expect a clear, actionable view of your codebase’s security, compliance posture, and architectural health. **What You Will See** Each execution (e.g., `security-scan`, `architecture-analyze`) produces: * **Severity Summary** * Breakdown of Critical, High, Medium, and Low issues * **Detailed Findings** * File-level insights with exact locations (file path + line number) * Clear description of each issue * **Actionable Recommendations** * Step-by-step remediation guidance * Secure coding alternatives and best practices * **Contextual Insights** * Why the issue matters * Potential impact on security or compliance ## Supported **Core Capabilities**

Capability	What It Does
security-scan	Full vulnerability scan (SAST, secrets, containers, IaC)
architecture-analyze	Identifies design risks and system weaknesses
compliance-audit	Validates SOC2, HIPAA, PCI-DSS, ISO27001
sql-security	Finds SQL vulnerabilities + suggests fixes
pre-commit-scan	Automatic security scan before git commits — blocks commits if staged changes contain critical or high severity issues

## Plugin Components The Opsera DevSecOps Agent is composed of several integrated components that work together inside Cursor. {% hint style="info" %} **Note:**
* **Hooks:** The plugin registers a `beforeShellExecution` hook. This allows the agent to intercept and inspect shell commands before they run, enabling real-time security enforcement as part of your development workflow. * **Rules:** A `devsecops-standards` rule is included and active across all code changes. It enforces security-first coding practices, compliance awareness, and telemetry reporting automatically — no manual invocation required. * **MCP Integration:** The plugin includes an `opsera` MCP (Model Context Protocol) server, enabling deeper integration with Cursor's agent infrastructure for tool use and context sharing..- * **Subagent:** A `devsecops` subagent is registered by the plugin. It handles all DevSecOps tasks — risk assessment, vulnerability detection, compliance gap analysis, and SQL security scanning — and can be invoked directly in Cursor Chat {% endhint %} ## **Commands** The following are the Commands available directly in Cursor:

Command	Description
`architecture-analyze`	Perform a risk-focused architecture analysis on the current codebase
`compliance-audit`	Run an evidence-based compliance audit on the current codebase
`security-scan`	Run a comprehensive security scan on the current codebase
`sql-security`	Scan SQL files or database tables for security vulnerabilities

# Changelog Updates and improvements to Opsera AI Agents and related capabilities. {% updates format="full" %} {% update date="2026-03-10" %} ## Claude Code Marketplace The Opsera DevSecOps Agent is distributed through the **Private Marketplace** Install the entire plugin bundle: Architecture Analyze, Security Scan, Compliance Audit, and SQL Security, directly from inside Claude Code.

New

* **Claude Code Private Marketplace distribution**: The plugin is registered in the Claude Code Marketplace at `opsera-agents/opsera-devsecops`. Install via `/install opsera-devsecops` or by adding the GitHub marketplace source. No manual MCP config files required. * **One-command install bundles all four agents**: A single install step now provisions Architecture Analyze, Security Scan, Compliance Audit, and SQL Security simultaneously. Previously required separate configuration per agent. * **Secure OAuth authentication via browser:** Authentication now uses OAuth 2.0 with a browser-based login flow. Tokens are stored in the OS system keychain (Keychain Access on macOS, Secret Service on Linux) and refresh automatically — no manual token management. * **Slash command interface for all agent**s: All four agents are now accessible via dedicated slash commands: `/architecture-analyze`, `/security-scan`, `/compliance-audit`, `/sql-security`. Invocable alongside natural-language prompts. * **Automatic updates via Marketplace**: Plugin updates now propagate automatically through the Marketplace distribution channel. * **Free trial included with all four agents:** New users are provisioned a free Opsera trial account during the OAuth flow at `agent.opsera.ai`.

{% endupdate %} {% update date="2026-03-09" %} ## Introducing Opsera AI Agents Opsera AI Agents are available to bring AI-powered DevSecOps intelligence directly into your favorite development environments, including Claude Code, VS Code, and Cursor. The agents act as specialized automation partners that analyze, secure, and document your software systems using simple natural language commands. #### Core Agent Capailities This release introduces four specialized agents: * **Architecture Analyze Agent:** Automatically detects your tech stack and extracts API endpoints to generate live diagrams in formats like Mermaid and PlantUML. * **Security Scan Agent**: Performs comprehensive vulnerability detection (SAST, secrets, dependencies) with AI-powered auto-remediation to fix anti-patterns. * **SQL Security Agent:** Identifies SQL injection, PII exposure, and over-privileged access in platforms like Databricks and Snowflake with intelligent data masking. * **Compliance Audit Agen**t: Evaluates systems against frameworks like SOC2, HIPAA, and ISO 27001, generating audit-ready gap analysis reports.\ \ To get started, visit the [Opsera Agent Portal](https://www.google.com/search?q=https://agent.opsera.ai) Read the documentation

{% endupdate %} {% endupdates %} # Developer Platform Welcome to your team’s developer platform

Agent Library

Security, compliance, workflows, and more. Working 24/7. Right in your IDE

			Cover image
Security Scan Agent	Detect vulnerabilities, secrets, and CVEs before they reach production	https://template.gitbook.com/space-product-docs	claude-security-agent.gif
Compliance Audit Agent	Automated compliance assessments for SOC2, HIPAA, PCI-DSS, ISO 27001	https://template.gitbook.com/space-product-docs	claude-compliance-audit.gif
SQL Scan Agent	Find SQL injection risks, PII exposure, and database vulnerabilities	https://template.gitbook.com/space-api-reference	claude-sql-security.gif
Architecture Analyze Agent	Map your entire system automatically. Generate diagrams and documentation.		claude-arch-analyze.gif

{% columns %} {% column %}

{% endcolumn %} {% column %} ### Learn more about the Opsera Agents Read guides, watch tutorials, and learn how to integrate AI agents into your CI/CD pipelines and developer workflows. Blogs {% endcolumn %} {% endcolumns %}

Join a community of developers

Join our Discord community to learn, share ideas, and connect with other developers.

			Cover image
	Discord community	Join Discord	ChatGPT Image Mar 6, 2026, 03_24_37 PM.png

# Help Center ## What can we help you find? {% columns %} {% column %}

{% endcolumn %} {% column %}

Browse the topics below or ask the **AI assistant**

about setup, integrations, and using Opsera Agents. {% endcolumn %} {% endcolumns %} ## Query Log

What model does the execution use?

The model depends on your local LLM client, but this is tested and works best with Claude Sonnet & Opus.

Will Opsera read my code?

No, the code never leaves your local environment. The local LLM performs the code scans, and only metadata like file names, directory structure, language, and frameworks are sent to Opsera for agent orchestration.

How does the MCP integration work?

Opsera agents communicate through the Model Context Protocol (MCP). You configure your IDE (Claude Code, Cursor, or VS Code) with the Opsera MCP server URL, and the agents become available as tools within your existing workflow.

Is my data secure?

Absolutely. Code analysis happens locally through your LLM client. Only anonymized metadata and agent results flow through our servers. All communication is encrypted with TLS, and we follow SOC2 compliance practices.

Can I use multiple agents at once?

Yes! You can invoke different agents sequentially within the same conversation. For example, run Architecture Analyze first, then follow up with Security Scan — all in the same IDE session.

What IDEs are supported?

How do I get started?

What happens after the free trial?

## Manage Your Account

				Cover image
	Plans and billing	Get help with your billing	https://docs.agents.opsera.ai/reference/billing-and-pricing	Screenshot 2026-03-06 at 6.02.42 PM.png
	Product updates	See what’s new	https://docs.agents.opsera.ai/changelog	Screenshot 2026-03-06 at 6.03.35 PM.png

:bolt:

:leaf:

:globe-pointer:

Stack

Auto-Detection

OAuth

Migration

Dockerfile

Generation

Self-Healing Deployments

Health

Verification

Agent Library

Join a community of developers

:discord:

:money-bill-wave:

:bullhorn: