@cubis/foundry 0.3.10

package/Ai Agent Workflow/powers/semgrep/steering/rulesets.md

@@ -0,0 +1,162 @@
+# Semgrep Rulesets Reference
+
+## Complete Ruleset Catalog
+
+### Security-Focused Rulesets
+
+| Ruleset | Description | Use Case |
+|---------|-------------|----------|
+| `p/security-audit` | Comprehensive vulnerability detection, higher false positives | Manual audits, security reviews |
+| `p/secrets` | Hardcoded credentials, API keys, tokens | Always include |
+| `p/owasp-top-ten` | OWASP Top 10 web application vulnerabilities | Web app security |
+| `p/cwe-top-25` | CWE Top 25 most dangerous software weaknesses | General security |
+| `p/sql-injection` | SQL injection patterns and tainted data flows | Database security |
+| `p/insecure-transport` | Ensures code uses encrypted channels | Network security |
+| `p/gitleaks` | Hard-coded credentials detection (gitleaks port) | Secrets scanning |
+| `p/findsecbugs` | FindSecBugs rule pack for Java | Java security |
+| `p/phpcs-security-audit` | PHP security audit rules | PHP security |
+
+### CI/CD Rulesets
+
+| Ruleset | Description | Use Case |
+|---------|-------------|----------|
+| `p/default` | Default ruleset, balanced coverage | First-time users |
+| `p/ci` | High-confidence security + logic bugs, low FP | CI pipelines |
+| `p/r2c-ci` | Low false positives, CI-safe | CI/CD blocking |
+| `p/r2c` | Community favorite, curated by Semgrep (618k+ downloads) | General scanning |
+| `p/auto` | Auto-selects rules based on detected languages/frameworks | Quick scans |
+| `p/comment` | Comment-related rules | Code review |
+
+### Third-Party Rulesets
+
+| Ruleset | Description | Maintainer |
+|---------|-------------|------------|
+| `p/gitlab` | GitLab-maintained security rules | GitLab |
+
+---
+
+## Ruleset Selection Algorithm
+
+Follow this algorithm to select rulesets based on detected languages and frameworks.
+
+### Step 1: Always Include Security Baseline
+
+```json
+{
+  "baseline": ["p/security-audit", "p/secrets"]
+}
+```
+
+- `p/security-audit` - Comprehensive vulnerability detection (always include)
+- `p/secrets` - Hardcoded credentials, API keys, tokens (always include)
+
+### Step 2: Add Language-Specific Rulesets
+
+For each detected language, add the primary ruleset. If a framework is detected, add its ruleset too.
+
+**GA Languages (production-ready):**
+
+| Detection | Primary Ruleset | Framework Rulesets | Pro Rule Count |
+|-----------|-----------------|-------------------|----------------|
+| `.py` | `p/python` | `p/django`, `p/flask`, `p/fastapi` | 710+ |
+| `.js`, `.jsx` | `p/javascript` | `p/react`, `p/nodejs`, `p/express`, `p/nextjs`, `p/angular` | 250+ (JS), 70+ (JSX) |
+| `.ts`, `.tsx` | `p/typescript` | `p/react`, `p/nodejs`, `p/express`, `p/nextjs`, `p/angular` | 230+ |
+| `.go` | `p/golang` | `p/go` (alias) | 80+ |
+| `.java` | `p/java` | `p/spring`, `p/findsecbugs` | 190+ |
+| `.kt` | `p/kotlin` | `p/spring` | 60+ |
+| `.rb` | `p/ruby` | `p/rails` | 40+ |
+| `.php` | `p/php` | `p/symfony`, `p/laravel`, `p/phpcs-security-audit` | 50+ |
+| `.c`, `.cpp`, `.h` | `p/c` | - | 150+ |
+| `.rs` | `p/rust` | - | 40+ |
+| `.cs` | `p/csharp` | - | 170+ |
+| `.scala` | `p/scala` | - | Community |
+| `.swift` | `p/swift` | - | 60+ |
+
+**Beta Languages (Pro recommended):**
+
+| Detection | Primary Ruleset | Notes |
+|-----------|-----------------|-------|
+| `.ex`, `.exs` | `p/elixir` | Requires Pro for best coverage |
+| `.cls`, `.trigger` | `p/apex` | Salesforce; requires Pro |
+
+**Experimental Languages:**
+
+| Detection | Primary Ruleset | Notes |
+|-----------|-----------------|-------|
+| `.sol` | No official ruleset | Use Decurity third-party rules |
+| `Dockerfile` | `p/dockerfile` | Limited rules |
+| `.yaml`, `.yml` | `p/yaml` | K8s, GitHub Actions, docker-compose patterns |
+| `.json` | `r/json.aws` | AWS IAM policies; use `r/json.*` for specific rules |
+| Bash scripts | - | Community support |
+| Cairo, Circom | - | Experimental, smart contracts |
+
+**Framework detection hints:**
+
+| Framework | Detection Signals | Ruleset |
+|-----------|------------------|---------|
+| Django | `settings.py`, `urls.py`, `django` in requirements | `p/django` |
+| Flask | `flask` in requirements, `@app.route` | `p/flask` |
+| FastAPI | `fastapi` in requirements, `@app.get/post` | `p/fastapi` |
+| React | `package.json` with react dependency, `.jsx`/`.tsx` files | `p/react` |
+| Next.js | `next.config.js`, `pages/` or `app/` directory | `p/nextjs` |
+| Angular | `angular.json`, `@angular/` dependencies | `p/angular` |
+| Express | `express` in package.json, `app.use()` patterns | `p/express` |
+| NestJS | `@nestjs/` dependencies, `@Controller` decorators | `p/nodejs` |
+| Spring | `pom.xml` with spring, `@SpringBootApplication` | `p/spring` |
+| Rails | `Gemfile` with rails, `config/routes.rb` | `p/rails` |
+| Laravel | `composer.json` with laravel, `artisan` | `p/laravel` |
+| Symfony | `composer.json` with symfony, `config/packages/` | `p/symfony` |
+
+### Step 3: Add Infrastructure Rulesets
+
+| Detection | Ruleset | Description |
+|-----------|---------|-------------|
+| `Dockerfile` | `p/dockerfile` | Container security, best practices |
+| `.tf`, `.hcl` | `p/terraform` | IaC misconfigurations, CIS benchmarks, AWS/Azure/GCP |
+| k8s manifests | `p/kubernetes` | K8s security, RBAC issues |
+| CloudFormation | `p/cloudformation` | AWS infrastructure security |
+| GitHub Actions | `p/github-actions` | CI/CD security, secrets exposure |
+| `.yaml`, `.yml` | `p/yaml` | Generic YAML patterns (K8s, docker-compose) |
+| AWS IAM JSON | `r/json.aws` | IAM policy misconfigurations (use `--config r/json.aws`) |
+
+### Step 4: Add Third-Party Rulesets
+
+These are **NOT optional**. Include automatically when language matches:
+
+| Languages | Source | Why Required |
+|-----------|--------|--------------|
+| Python, Go, Ruby, JS/TS, Terraform, HCL | [Trail of Bits](https://github.com/trailofbits/semgrep-rules) | Security audit patterns from real engagements (AGPLv3) |
+| C, C++ | [0xdea](https://github.com/0xdea/semgrep-rules) | Memory safety, low-level vulnerabilities |
+| Solidity, Cairo, Rust | [Decurity](https://github.com/Decurity/semgrep-smart-contracts) | Smart contract vulnerabilities, DeFi exploits |
+| Go | [dgryski](https://github.com/dgryski/semgrep-go) | Additional Go-specific patterns |
+| Android (Java/Kotlin) | [MindedSecurity](https://github.com/mindedsecurity/semgrep-rules-android-security) | OWASP MASTG-derived mobile security rules |
+| Java, Go, JS/TS, C#, Python, PHP | [elttam](https://github.com/elttam/semgrep-rules) | Security consulting patterns |
+| Dockerfile, PHP, Go, Java | [kondukto](https://github.com/kondukto-io/semgrep-rules) | Container and web app security |
+| PHP, Kotlin, Java | [dotta](https://github.com/federicodotta/semgrep-rules) | Pentest-derived web/mobile app rules |
+| Terraform, HCL | [HashiCorp](https://github.com/hashicorp-forge/semgrep-rules) | HashiCorp infrastructure patterns |
+| Swift, Java, Cobol | [akabe1](https://github.com/akabe1/akabe1-semgrep-rules) | iOS and legacy system patterns |
+| Java | [Atlassian Labs](https://github.com/atlassian-labs/atlassian-sast-ruleset) | Atlassian-maintained Java rules |
+| Python, JS/TS, Java, Ruby, Go, PHP | [Apiiro](https://github.com/apiiro/malicious-code-ruleset) | Malicious code detection, supply chain |
+
+### Step 5: Verify Rulesets
+
+Before finalizing, verify official rulesets load:
+
+```bash
+# Quick validation (exits 0 if valid)
+semgrep --config p/python --validate --metrics=off 2>&1 | head -3
+```
+
+Or browse the [Semgrep Registry](https://semgrep.dev/explore).
+
+### Output Format
+
+```json
+{
+  "baseline": ["p/security-audit", "p/secrets"],
+  "python": ["p/python", "p/django"],
+  "javascript": ["p/javascript", "p/react", "p/nodejs"],
+  "docker": ["p/dockerfile"],
+  "third_party": ["https://github.com/trailofbits/semgrep-rules"]
+}
+```

package/Ai Agent Workflow/powers/semgrep/steering/scanner-task-prompt.md

@@ -0,0 +1,102 @@
+# Scanner Subagent Task Prompt
+
+Use this prompt template when spawning scanner Tasks in Step 4. Use `subagent_type: Bash`.
+
+## Template
+
+```
+You are a Semgrep scanner for [LANGUAGE_CATEGORY].
+
+## Task
+Run Semgrep scans for [LANGUAGE] files and save results to [OUTPUT_DIR].
+
+## Pro Engine Status: [PRO_AVAILABLE: true/false]
+
+## APPROVED RULESETS (from user-confirmed plan)
+[LIST EXACT RULESETS USER APPROVED - DO NOT SUBSTITUTE]
+
+Example:
+- p/python
+- p/django
+- p/security-audit
+- p/secrets
+- https://github.com/trailofbits/semgrep-rules
+
+## Commands to Run (in parallel)
+
+### Generate commands for EACH approved ruleset:
+```bash
+semgrep [--pro if available] --metrics=off --config [RULESET] --json -o [OUTPUT_DIR]/[lang]-[ruleset].json --sarif-output=[OUTPUT_DIR]/[lang]-[ruleset].sarif [TARGET] &
+```
+
+Wait for all to complete:
+```bash
+wait
+```
+
+## Critical Rules
+- Use ONLY the rulesets listed above - do not add or remove any
+- Always use --metrics=off (prevents sending telemetry to Semgrep servers)
+- Use --pro when Pro is available (enables cross-file taint tracking)
+- Run all rulesets in parallel with & and wait
+- For GitHub URLs, clone the repo first if not cached locally
+
+## Output
+Report:
+- Number of findings per ruleset
+- Any scan errors
+- File paths of JSON results
+- [If Pro] Note any cross-file findings detected
+```
+
+## Variable Substitutions
+
+| Variable | Description | Example |
+|----------|-------------|---------|
+| `[LANGUAGE_CATEGORY]` | Language group being scanned | Python, JavaScript, Docker |
+| `[LANGUAGE]` | Specific language | Python, TypeScript, Go |
+| `[OUTPUT_DIR]` | Results directory with run number | semgrep-results-001 |
+| `[PRO_AVAILABLE]` | Whether Pro engine is available | true, false |
+| `[RULESET]` | Semgrep ruleset identifier | p/python, https://github.com/... |
+| `[TARGET]` | Directory to scan | . (current dir) |
+
+## Example: Python Scanner Task
+
+```
+You are a Semgrep scanner for Python.
+
+## Task
+Run Semgrep scans for Python files and save results to semgrep-results-001.
+
+## Pro Engine Status: true
+
+## APPROVED RULESETS (from user-confirmed plan)
+- p/python
+- p/django
+- p/security-audit
+- p/secrets
+- https://github.com/trailofbits/semgrep-rules
+
+## Commands to Run (in parallel)
+```bash
+semgrep --pro --metrics=off --config p/python --json -o semgrep-results-001/python-python.json --sarif-output=semgrep-results-001/python-python.sarif . &
+semgrep --pro --metrics=off --config p/django --json -o semgrep-results-001/python-django.json --sarif-output=semgrep-results-001/python-django.sarif . &
+semgrep --pro --metrics=off --config p/security-audit --json -o semgrep-results-001/python-security-audit.json --sarif-output=semgrep-results-001/python-security-audit.sarif . &
+semgrep --pro --metrics=off --config p/secrets --json -o semgrep-results-001/python-secrets.json --sarif-output=semgrep-results-001/python-secrets.sarif . &
+semgrep --pro --metrics=off --config https://github.com/trailofbits/semgrep-rules --json -o semgrep-results-001/python-trailofbits.json --sarif-output=semgrep-results-001/python-trailofbits.sarif . &
+wait
+```
+
+## Critical Rules
+- Use ONLY the rulesets listed above - do not add or remove any
+- Always use --metrics=off
+- Use --pro when Pro is available
+- Run all rulesets in parallel with & and wait
+
+## Output
+Report:
+- Number of findings per ruleset
+- Any scan errors
+- File paths of JSON results
+- Note any cross-file findings detected
+```

package/Ai Agent Workflow/powers/semgrep/steering/triage-task-prompt.md

@@ -0,0 +1,122 @@
+# Triage Subagent Task Prompt
+
+Use this prompt template when spawning triage Tasks in Step 5. Use `subagent_type: general-purpose`.
+
+## Template
+
+```
+You are a security finding triager for [LANGUAGE_CATEGORY].
+
+## Input Files
+[LIST OF JSON FILES TO TRIAGE]
+
+## Output Directory
+[OUTPUT_DIR]
+
+## Task
+For each finding:
+1. Read the JSON finding
+2. Read source code context (5 lines before/after)
+3. Classify as TRUE_POSITIVE or FALSE_POSITIVE
+
+## False Positive Criteria
+- Test files (should add to .semgrepignore)
+- Sanitized inputs (context shows validation)
+- Dead code paths
+- Example/documentation code
+- Already has nosemgrep comment
+
+## Output Format
+Create: [OUTPUT_DIR]/[lang]-triage.json
+
+```json
+{
+  "file": "[lang]-[ruleset].json",
+  "total": 45,
+  "true_positives": [
+    {"rule": "...", "file": "...", "line": N, "reason": "..."}
+  ],
+  "false_positives": [
+    {"rule": "...", "file": "...", "line": N, "reason": "..."}
+  ]
+}
+```
+
+## Report
+Return summary:
+- Total findings: N
+- True positives: N
+- False positives: N (with breakdown by reason)
+```
+
+## Variable Substitutions
+
+| Variable | Description | Example |
+|----------|-------------|---------|
+| `[LANGUAGE_CATEGORY]` | Language group being triaged | Python, JavaScript, Docker |
+| `[OUTPUT_DIR]` | Results directory with run number | semgrep-results-001 |
+
+## Example: Python Triage Task
+
+```
+You are a security finding triager for Python.
+
+## Input Files
+- semgrep-results-001/python-python.json
+- semgrep-results-001/python-django.json
+- semgrep-results-001/python-security-audit.json
+- semgrep-results-001/python-secrets.json
+- semgrep-results-001/python-trailofbits.json
+
+## Output Directory
+semgrep-results-001
+
+## Task
+For each finding:
+1. Read the JSON finding
+2. Read source code context (5 lines before/after)
+3. Classify as TRUE_POSITIVE or FALSE_POSITIVE
+
+## False Positive Criteria
+- Test files (should add to .semgrepignore)
+- Sanitized inputs (context shows validation)
+- Dead code paths
+- Example/documentation code
+- Already has nosemgrep comment
+
+## Output Format
+Create: semgrep-results-001/python-triage.json
+
+```json
+{
+  "file": "python-django.json",
+  "total": 45,
+  "true_positives": [
+    {"rule": "python.django.security.injection.sql-injection", "file": "views.py", "line": 42, "reason": "User input directly in raw SQL query"}
+  ],
+  "false_positives": [
+    {"rule": "python.django.security.injection.sql-injection", "file": "tests/test_views.py", "line": 15, "reason": "Test file with mock data"}
+  ]
+}
+```
+
+## Report
+Return summary:
+- Total findings: 45
+- True positives: 12
+- False positives: 33 (18 test files, 10 sanitized inputs, 5 dead code)
+```
+
+## Triage Decision Tree
+
+```
+Finding
+├── Is it in a test file? → FALSE_POSITIVE (add to .semgrepignore)
+├── Is it in example/docs? → FALSE_POSITIVE
+├── Does it have nosemgrep comment? → FALSE_POSITIVE (already acknowledged)
+├── Is the input sanitized/validated upstream?
+│   └── Check 10-20 lines before for validation → FALSE_POSITIVE if validated
+├── Is the code path reachable?
+│   └── Check if function is called/exported → FALSE_POSITIVE if dead code
+└── None of the above → TRUE_POSITIVE
+```

package/Ai Agent Workflow/powers/sentry-automation/SKILL.md

@@ -0,0 +1,232 @@
+---
+name: sentry-automation
+description: "Automate Sentry tasks via Rube MCP (Composio): manage issues/events, configure alerts, track releases, monitor projects and teams. Always search tools first for current schemas."
+requires:
+  mcp: [rube]
+---
+
+# Sentry Automation via Rube MCP
+
+Automate Sentry error tracking and monitoring operations through Composio's Sentry toolkit via Rube MCP.
+
+## Prerequisites
+
+- Rube MCP must be connected (RUBE_SEARCH_TOOLS available)
+- Active Sentry connection via `RUBE_MANAGE_CONNECTIONS` with toolkit `sentry`
+- Always call `RUBE_SEARCH_TOOLS` first to get current tool schemas
+
+## Setup
+
+**Get Rube MCP**: Add `https://rube.app/mcp` as an MCP server in your client configuration. No API keys needed — just add the endpoint and it works.
+
+
+1. Verify Rube MCP is available by confirming `RUBE_SEARCH_TOOLS` responds
+2. Call `RUBE_MANAGE_CONNECTIONS` with toolkit `sentry`
+3. If connection is not ACTIVE, follow the returned auth link to complete Sentry OAuth
+4. Confirm connection status shows ACTIVE before running any workflows
+
+## Core Workflows
+
+### 1. Investigate Issues
+
+**When to use**: User wants to find, inspect, or triage error issues
+
+**Tool sequence**:
+1. `SENTRY_LIST_AN_ORGANIZATIONS_ISSUES` - List issues across the organization [Required]
+2. `SENTRY_GET_ORGANIZATION_ISSUE_DETAILS` - Get detailed info on a specific issue [Optional]
+3. `SENTRY_LIST_AN_ISSUES_EVENTS` - View individual error events for an issue [Optional]
+4. `SENTRY_RETRIEVE_AN_ISSUE_EVENT` - Get full event details with stack trace [Optional]
+5. `SENTRY_RETRIEVE_ISSUE_TAG_DETAILS` - Inspect tag distribution for an issue [Optional]
+
+**Key parameters**:
+- `organization_id_or_slug`: Organization identifier
+- `issue_id`: Numeric issue ID
+- `query`: Search query (e.g., `is:unresolved`, `assigned:me`, `browser:Chrome`)
+- `sort`: Sort order (`date`, `new`, `freq`, `priority`)
+- `statsPeriod`: Time window for stats (`24h`, `14d`, etc.)
+
+**Pitfalls**:
+- `organization_id_or_slug` is the org slug (e.g., 'my-org'), not the display name
+- Issue IDs are numeric; do not confuse with event IDs which are UUIDs
+- Query syntax uses Sentry's search format: `is:unresolved`, `assigned:me`, `!has:release`
+- Events within an issue can have different stack traces; inspect individual events for details
+
+### 2. Manage Project Issues
+
+**When to use**: User wants to view issues scoped to a specific project
+
+**Tool sequence**:
+1. `SENTRY_RETRIEVE_ORGANIZATION_PROJECTS` - List projects to find project slug [Prerequisite]
+2. `SENTRY_RETRIEVE_PROJECT_ISSUES_LIST` - List issues for a specific project [Required]
+3. `SENTRY_RETRIEVE_ISSUE_EVENTS_BY_ID` - Get events for a specific issue [Optional]
+
+**Key parameters**:
+- `organization_id_or_slug`: Organization identifier
+- `project_id_or_slug`: Project identifier
+- `query`: Search filter string
+- `statsPeriod`: Stats time window
+
+**Pitfalls**:
+- Project slugs are different from project display names
+- Always resolve project names to slugs via RETRIEVE_ORGANIZATION_PROJECTS first
+- Project-scoped issue lists may have different pagination than org-scoped lists
+
+### 3. Configure Alert Rules
+
+**When to use**: User wants to create or manage alert rules for a project
+
+**Tool sequence**:
+1. `SENTRY_RETRIEVE_ORGANIZATION_PROJECTS` - Find project for the alert [Prerequisite]
+2. `SENTRY_RETRIEVE_PROJECT_RULES_BY_ORG_AND_PROJECT_ID` - List existing rules [Optional]
+3. `SENTRY_CREATE_PROJECT_RULE_FOR_ALERTS` - Create a new alert rule [Required]
+4. `SENTRY_CREATE_ORGANIZATION_ALERT_RULE` - Create org-level metric alert [Alternative]
+5. `SENTRY_UPDATE_ORGANIZATION_ALERT_RULES` - Update existing alert rules [Optional]
+6. `SENTRY_RETRIEVE_ALERT_RULE_DETAILS` - Inspect specific alert rule [Optional]
+7. `SENTRY_GET_PROJECT_RULE_DETAILS` - Get project-level rule details [Optional]
+
+**Key parameters**:
+- `name`: Alert rule name
+- `conditions`: Array of trigger conditions
+- `actions`: Array of actions to perform when triggered
+- `filters`: Array of event filters
+- `frequency`: How often to trigger (in minutes)
+- `actionMatch`: 'all', 'any', or 'none' for condition matching
+
+**Pitfalls**:
+- Project-level rules (CREATE_PROJECT_RULE) and org-level metric alerts (CREATE_ORGANIZATION_ALERT_RULE) are different
+- Conditions, actions, and filters use specific JSON schemas; check Sentry docs for valid types
+- `frequency` is in minutes; setting too low causes alert fatigue
+- `actionMatch` defaults may vary; explicitly set to avoid unexpected behavior
+
+### 4. Manage Releases
+
+**When to use**: User wants to create, track, or manage release versions
+
+**Tool sequence**:
+1. `SENTRY_LIST_ORGANIZATION_RELEASES` - List existing releases [Optional]
+2. `SENTRY_CREATE_RELEASE_FOR_ORGANIZATION` - Create a new release [Required]
+3. `SENTRY_UPDATE_RELEASE_DETAILS_FOR_ORGANIZATION` - Update release metadata [Optional]
+4. `SENTRY_CREATE_RELEASE_DEPLOY_FOR_ORG` - Record a deployment for a release [Optional]
+5. `SENTRY_UPLOAD_RELEASE_FILE_TO_ORGANIZATION` - Upload source maps or files [Optional]
+
+**Key parameters**:
+- `version`: Release version string (e.g., '1.0.0', commit SHA)
+- `projects`: Array of project slugs this release belongs to
+- `dateReleased`: Release timestamp (ISO 8601)
+- `environment`: Deployment environment name (e.g., 'production', 'staging')
+
+**Pitfalls**:
+- Release versions must be unique within an organization
+- Releases can span multiple projects; use the `projects` array
+- Deploying a release is separate from creating it; use CREATE_RELEASE_DEPLOY
+- Source map uploads require the release to exist first
+
+### 5. Monitor Organization and Teams
+
+**When to use**: User wants to view org structure, teams, or member lists
+
+**Tool sequence**:
+1. `SENTRY_GET_ORGANIZATION_DETAILS` or `SENTRY_GET_ORGANIZATION_BY_ID_OR_SLUG` - Get org info [Required]
+2. `SENTRY_LIST_TEAMS_IN_ORGANIZATION` - List all teams [Optional]
+3. `SENTRY_LIST_ORGANIZATION_MEMBERS` - List org members [Optional]
+4. `SENTRY_GET_PROJECT_LIST` - List all accessible projects [Optional]
+
+**Key parameters**:
+- `organization_id_or_slug`: Organization identifier
+- `cursor`: Pagination cursor for large result sets
+
+**Pitfalls**:
+- Organization slugs are URL-safe identifiers, not display names
+- Member lists may be paginated; follow cursor pagination
+- Team and member visibility depends on the authenticated user's permissions
+
+### 6. Manage Monitors (Cron Monitoring)
+
+**When to use**: User wants to update cron job monitoring configuration
+
+**Tool sequence**:
+1. `SENTRY_UPDATE_A_MONITOR` - Update monitor configuration [Required]
+
+**Key parameters**:
+- `organization_id_or_slug`: Organization identifier
+- `monitor_id_or_slug`: Monitor identifier
+- `name`: Monitor display name
+- `schedule`: Cron schedule expression or interval
+- `checkin_margin`: Grace period in minutes for late check-ins
+- `max_runtime`: Maximum expected runtime in minutes
+
+**Pitfalls**:
+- Monitor slugs are auto-generated from the name; use slug for API calls
+- Schedule changes take effect immediately
+- Missing check-ins trigger alerts after the margin period
+
+## Common Patterns
+
+### ID Resolution
+
+**Organization name -> Slug**:
+```
+1. Call SENTRY_GET_ORGANIZATION_DETAILS
+2. Extract slug field from response
+```
+
+**Project name -> Slug**:
+```
+1. Call SENTRY_RETRIEVE_ORGANIZATION_PROJECTS
+2. Find project by name, extract slug
+```
+
+### Pagination
+
+- Sentry uses cursor-based pagination with `Link` headers
+- Check response for cursor values
+- Pass cursor in next request until no more pages
+
+### Search Query Syntax
+
+- `is:unresolved` - Unresolved issues
+- `is:resolved` - Resolved issues
+- `assigned:me` - Assigned to current user
+- `assigned:team-slug` - Assigned to a team
+- `!has:release` - Issues without a release
+- `first-release:1.0.0` - Issues first seen in release
+- `times-seen:>100` - Seen more than 100 times
+- `browser:Chrome` - Filter by browser tag
+
+## Known Pitfalls
+
+**ID Formats**:
+- Organization: use slug (e.g., 'my-org'), not display name
+- Project: use slug (e.g., 'my-project'), not display name
+- Issue IDs: numeric integers
+- Event IDs: UUIDs (32-char hex strings)
+
+**Permissions**:
+- API token scopes must match the operations being performed
+- Organization-level operations require org-level permissions
+- Project-level operations require project access
+
+**Rate Limits**:
+- Sentry enforces per-organization rate limits
+- Implement backoff on 429 responses
+- Bulk operations should be staggered
+
+## Quick Reference
+
+| Task | Tool Slug | Key Params |
+|------|-----------|------------|
+| List org issues | SENTRY_LIST_AN_ORGANIZATIONS_ISSUES | organization_id_or_slug, query |
+| Get issue details | SENTRY_GET_ORGANIZATION_ISSUE_DETAILS | organization_id_or_slug, issue_id |
+| List issue events | SENTRY_LIST_AN_ISSUES_EVENTS | issue_id |
+| Get event details | SENTRY_RETRIEVE_AN_ISSUE_EVENT | organization_id_or_slug, event_id |
+| List project issues | SENTRY_RETRIEVE_PROJECT_ISSUES_LIST | organization_id_or_slug, project_id_or_slug |
+| List projects | SENTRY_RETRIEVE_ORGANIZATION_PROJECTS | organization_id_or_slug |
+| Get org details | SENTRY_GET_ORGANIZATION_DETAILS | organization_id_or_slug |
+| List teams | SENTRY_LIST_TEAMS_IN_ORGANIZATION | organization_id_or_slug |
+| List members | SENTRY_LIST_ORGANIZATION_MEMBERS | organization_id_or_slug |
+| Create alert rule | SENTRY_CREATE_PROJECT_RULE_FOR_ALERTS | organization_id_or_slug, project_id_or_slug |
+| Create metric alert | SENTRY_CREATE_ORGANIZATION_ALERT_RULE | organization_id_or_slug |
+| Create release | SENTRY_CREATE_RELEASE_FOR_ORGANIZATION | organization_id_or_slug, version |
+| Deploy release | SENTRY_CREATE_RELEASE_DEPLOY_FOR_ORG | organization_id_or_slug, version |
+| List releases | SENTRY_LIST_ORGANIZATION_RELEASES | organization_id_or_slug |
+| Update monitor | SENTRY_UPDATE_A_MONITOR | organization_id_or_slug, monitor_id_or_slug |

package/Ai Agent Workflow/powers/seo-fundamentals/POWER.md

@@ -0,0 +1,13 @@
+---
+name: seo-fundamentals
+description: SEO fundamentals, E-E-A-T, Core Web Vitals, and Google algorithm principles.
+---
+
+# seo-fundamentals
+
+This is a compatibility power wrapper for the `seo-fundamentals` skill.
+
+Primary source:
+- `Ai Agent Workflow/skills/seo-fundamentals/SKILL.md`
+
+Use this folder for power-specific extensions when needed.

package/Ai Agent Workflow/powers/seo-fundamentals/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: seo-fundamentals
+description: SEO fundamentals, E-E-A-T, Core Web Vitals, and Google algorithm principles.
+---
+
+# seo-fundamentals
+
+This power mirrors the base skill:
+- `Ai Agent Workflow/skills/seo-fundamentals/SKILL.md`
+
+When both exist, prefer the base skill as source of truth unless power-specific overrides are added here.

package/Ai Agent Workflow/powers/server-management/POWER.md

@@ -0,0 +1,13 @@
+---
+name: server-management
+description: Server management principles and decision-making. Process management, monitoring strategy, and scaling decisions. Teaches thinking, not commands.
+---
+
+# server-management
+
+This is a compatibility power wrapper for the `server-management` skill.
+
+Primary source:
+- `Ai Agent Workflow/skills/server-management/SKILL.md`
+
+Use this folder for power-specific extensions when needed.

package/Ai Agent Workflow/powers/server-management/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: server-management
+description: Server management principles and decision-making. Process management, monitoring strategy, and scaling decisions. Teaches thinking, not commands.
+---
+
+# server-management
+
+This power mirrors the base skill:
+- `Ai Agent Workflow/skills/server-management/SKILL.md`
+
+When both exist, prefer the base skill as source of truth unless power-specific overrides are added here.