blaktron/vultr-setup-wizard
interactivev0.3.0
Walks you through signing up for Vultr and building a secure, project-specific environment, making the changes itself when you provide an…
Declared capabilities
network: 1 hostsecrets: 1data: other
Capabilities are the author's declaration and the basis for policy and scanning. The registry cannot enforce them at run time. Your runtime should.
MCP servers & tools
agentry run serves exactly the tools this contract declares, through a per-run MCP gateway. An undeclared capability is a tool that does not exist at run time.
Tools the runner grants
| Manifest declaration | Tool(s) granted |
|---|---|
| (always) | write_report — reports → the run's output folder |
| (always) | list_inputs, read_input, search_inputs — operator-provided input files, read-only |
| (always) | scratch_list, scratch_read, scratch_write, scratch_search — the run's own scratch folder at /scratch, private to the run and deleted at its end; the runner's grant, not a line of the contract |
| (always) | export_pdf — a Markdown report as a PDF in reports/, laid out in your report design; the runner's grant, not a line of the contract |
| (always) | grep, glob — search file contents by regular expression and list files by path pattern (ripgrep), one area a call: the inputs, attached knowledge, /scratch; the runner's grant, not a line of the contract |
| network.egress | fetch — pinned to api.vultr.com |
MCP servers involved
- QuickAgent Tools — the runner's companion server, served through a per-run Docker MCP Gateway; its tool surface is exactly the table above.
- Operator-cataloged MCP servers may be attached for the declared dataAccess category (other); undeclared categories are never wired in.
Keys & identities
VULTR_API_KEY
The runner's guided setup collects these once into the QuickAgent's MCP profile, kept or removed per the operator's choice. Values are never published or shown.
In an embedded install
Installed into an existing coding agent (agentry install), the same contract maps to the host's built-in tools — enforcement there is the host's. Allowed tools: WebFetch(domain:api.vultr.com).
Install
agentry install blaktron/vultr-setup-wizard@0.3.0git clone https://secureagentry.net/blaktron/vultr-setup-wizard.gitgit clone ssh://git@git.secureagentry.net/blaktron/vultr-setup-wizard.gitclaude-skill is this agent's default target, so the flag is not needed.
agent.yaml
2.7 kBBack to files
schemaVersion: "2"
name: vultr-setup-wizard
namespace: blaktron
modes: [interactive]
version: 0.3.0
summary: Guides Vultr signup and project-specific infrastructure setup, makes approved API changes, and documents results.
license: MIT
tags: [vultr, cloud, infrastructure, security, setup]
entrypoints:
instruction: AGENT.md
intake:
- id: vultr_api_key
prompt: Optional Vultr API key for making approved changes; leave blank for portal instructions.
type: secret
guide:
overview: 'An interactive wizard for Vultr signup and project-specific infrastructure: private networking, restricted firewalls, SSH-key access, compute, managed databases and DNS. With a connected API key it makes explicitly approved changes; without one it gives portal instructions. It documents resources, costs, pending work and verification limits; guest configuration and credential handling remain your responsibility.'
prepare: ["Know your workload, users' locations, monthly budget and availability needs.", "Optionally connect a Vultr API key through the run's credential controls, not chat.", Have your SSH public key and administrative source IP ranges ready., Have your domain and access to its registrar if you want DNS configured., Have a payment method available for signup; enter it only on Vultr.]
task: e.g. Set up a two-tier web app with PostgreSQL for users in Frankfurt, domain example.com, within my stated monthly budget.
connect:
VULTR_API_KEY: 'Optional: enable API access in the Vultr Console under Account → API, or use a dedicated organization user under Manage Organization → Users → API Access. Connect the key through the run''s credential controls. Grant only the resource-management permissions needed for the agreed setup, plus read access for inventory and catalog checks. Restrict API access to actual runner outbound IP ranges when your operator provides them; your home IP may differ. Without a key, the wizard produces portal instructions and an unverified deployment plan instead of making changes. Never paste the key into chat.'
interactive:
opening: I'll help you plan and set up a Vultr environment, confirming costs and access changes before acting. What are you building, where are your users, and what monthly budget should we work within? A connected API key lets me make approved changes; otherwise I'll guide you through the Console.
runtime:
interfaces: [claude-skill, agents-md]
capabilities:
network:
egress: [api.vultr.com]
filesystem:
read: none
write: none
exec: none
secrets: [VULTR_API_KEY]
dataAccess: [other]
optionalSecrets: [VULTR_API_KEY]
publish:
include: [agent.yaml, AGENT.md, README.md, LICENSE]