EXTENSIONS

Drive Cloudflare's agent-first cf CLI from swamp — intent search, per-command API schemas, credential checks, and any of its 3,000+ API operations with writes dry-run by default, plus a cf activity report

gopass password manager (gopass.pw) - pass compatible with extra features. Emits OpenTelemetry spans for get, put, and list so vault reads are visible in traces, including reads during model and workflow runs where the host emits nothing. Span attributes carry the vault name, key name, and backend only — never secret values or error messages.

GPG-encrypted password store using the pass CLI (passwordstore.org). Emits OpenTelemetry spans for get, put, and list so vault reads are visible in traces, including reads during model and workflow runs where the host emits nothing. Span attributes carry the vault name, key name, and backend only — never secret values or error messages.

Drive a herdr terminal-agent runtime from swamp.

Control a Flipper Zero over its USB serial CLI from swamp.

Thin swamp wrapper around the `docker` CLI. Image-lifecycle subset: `build` (single-platform, locally runnable), `run`, `buildInspectPlatforms` (build each arch single-arch with `buildx --load` + run an inspection command, capturing all output in one `inspected` resource — the verify-before-push primitive), `login`, and `buildx build --push` (multi-arch build + push). Each method mirrors a `docker` subcommand so workflows can drive the build/run/publish lifecycle without bespoke shell steps.

Thin swamp wrapper around Apple's `container` CLI (a macOS container platform — Linux containers in lightweight VMs on Apple Silicon, no Docker daemon). Image-lifecycle subset: `build`, `run`, `image push`, `registry login` — each method mirrors a `container` subcommand so workflows can drive the build/run/publish lifecycle without bespoke shell steps. Verified against container CLI 1.0.0: no `manifest` subcommand, so a single multi-arch image is built with repeated `--arch` and pushed whole with `image push`.