blaktron/eks-assistant
interactivev0.1.0
Works with you on Amazon EKS: reviews configuration docs or your live account, then suggests or makes fixes and upgrades.
Declared capabilities
data: othermcp servers: 2
Capabilities are the author's declaration and the basis for policy and scanning. The registry cannot enforce them at run time. Your runtime should.
MCP servers & tools
agentry run serves exactly the tools this contract declares, through a per-run MCP gateway. An undeclared capability is a tool that does not exist at run time.
Tools the runner grants
| Manifest declaration | Tool(s) granted |
|---|---|
| (always) | write_report — reports → the run's output folder |
| (always) | list_inputs, read_input, search_inputs — operator-provided input files, read-only |
| (always) | scratch_list, scratch_read, scratch_write, scratch_search — the run's own scratch folder at /scratch, private to the run and deleted at its end; the runner's grant, not a line of the contract |
| (always) | export_pdf — a Markdown report as a PDF in reports/, laid out in your report design; the runner's grant, not a line of the contract |
| (always) | grep, glob — search file contents by regular expression and list files by path pattern (ripgrep), one area a call: the inputs, attached knowledge, /scratch; the runner's grant, not a line of the contract |
MCP servers involved
- QuickAgent Tools — the runner's companion server, served through a per-run Docker MCP Gateway; its tool surface is exactly the table above.
- pypi:awslabs-aws-api-mcp-server@1.5.6 — tools call_aws, suggest_aws_commands — env AWS_API_MCP_ALLOW_UNRESTRICTED_LOCAL_FILE_ACCESS=no-access, AWS_REGION=us-east-1no known advisories as of 2026-10-18 12:27 UTC
- pypi:awslabs-aws-documentation-mcp-server@1.2.2 — tools search_documentation, read_documentation, recommendno known advisories as of 2026-10-18 12:27 UTC
- Operator-cataloged MCP servers may be attached for the declared dataAccess category (other); undeclared categories are never wired in.
In an embedded install
Installed into an existing coding agent (agentry install), the same contract maps to the host's built-in tools — enforcement there is the host's. Allowed tools: none declared (host defaults apply).
Install
agentry install blaktron/eks-assistant@0.1.0git clone https://secureagentry.net/blaktron/eks-assistant.gitgit clone ssh://git@git.secureagentry.net/blaktron/eks-assistant.gitclaude-skill is this agent's default target, so the flag is not needed.
agent.yaml
3.3 kBBack to files
schemaVersion: "2"
name: eks-assistant
namespace: blaktron
modes: [interactive]
version: 0.1.0
summary: 'Works with you on Amazon EKS: reviews configuration docs or your live account, then suggests or makes fixes and upgrades.'
license: MIT
tags: [aws, eks, kubernetes, upgrades, infrastructure]
entrypoints:
instruction: AGENT.md
guide:
overview: A conversation with an EKS engineer. It can review configuration documentation you add (Terraform, CloudFormation, eksctl, runbooks), or connect to your AWS account with the keys you give and inspect, fix or upgrade your clusters. It asks before every change and writes a work record when done. It has no Kubernetes API access, so for pod-level steps it gives you commands to run.
prepare: [The cluster name and Region (this release reaches us-east-1 only)., 'An IAM access key for a least-privilege principal: read-only to review, plus the EKS update actions to fix or upgrade.', Any configuration files or documentation you want reviewed.]
files: Add Terraform, CloudFormation, eksctl or YAML files, exported settings, or runbooks as documents. Optional.
task: e.g. Review cluster prod-eks and plan an upgrade to the next Kubernetes version.
connect:
AWS_ACCESS_KEY_ID: "Optional. Without AWS keys the agent only reviews documentation and files you give it.\n\n1. In IAM, create a dedicated user or role for this work.\n2. Give it read-only access to review. For upgrades add only the EKS update actions you intend to allow (for example eks:UpdateClusterVersion, eks:UpdateNodegroupVersion, eks:UpdateAddon, eks:DescribeUpdate).\n3. Create an access key and paste the key ID here."
AWS_SECRET_ACCESS_KEY: Optional. The secret that goes with the access key ID. It is passed to the AWS server and the model never sees it.
AWS_SESSION_TOKEN: Optional. Only needed when you use temporary credentials from STS or SSO.
interactive:
opening: 'Which EKS cluster and Region are we working on, and what do you want: a review, a diagnosis, a fix or an upgrade? Tell me if I may make changes or should only read, and add any configuration files you want reviewed.'
capabilities:
network:
egress: none
filesystem:
read: none
write: none
exec: none
dataAccess: [other]
mcpServers:
- pypi: awslabs-aws-api-mcp-server
version: 1.5.6
tools: [call_aws, suggest_aws_commands]
secrets: [AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN]
egress: [servicereference.us-east-1.amazonaws.com, sts.us-east-1.amazonaws.com, sts.amazonaws.com, eks.us-east-1.amazonaws.com, ec2.us-east-1.amazonaws.com, iam.amazonaws.com, cloudformation.us-east-1.amazonaws.com, logs.us-east-1.amazonaws.com, autoscaling.us-east-1.amazonaws.com, elasticloadbalancing.us-east-1.amazonaws.com, kms.us-east-1.amazonaws.com, ssm.us-east-1.amazonaws.com]
env:
AWS_API_MCP_ALLOW_UNRESTRICTED_LOCAL_FILE_ACCESS: no-access
AWS_REGION: us-east-1
- pypi: awslabs-aws-documentation-mcp-server
version: 1.2.2
tools: [search_documentation, read_documentation, recommend]
egress: [docs.aws.amazon.com, proxy.search.docs.aws.amazon.com]
optionalSecrets: [AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN]
publish:
include: [agent.yaml, AGENT.md, README.md, LICENSE]