EXTENSIONS

Cisco Meraki Dashboard API v1 integration model for swamp.

Inventory a Backblaze B2 account — one read-only scan method emits a resource per bucket and per application key, plus a summary, via the B2 Native API v4.

Inventory and manage Backblaze B2 file versions via the Native API v4 — an aggregate scan that separates current bytes from the non-current versions a bucket with no hidden-version lifecycle rule pays for forever, plus sync, copy, and gated hide, delete and Object Lock updates.

Discover running AWS resources for cost estimation and inventory management.

Snyk Inventory — asset discovery for packages, containers, repos, and cloud resources

Snyk Assets — asset discovery and classification across the group

Inventories enrolled AI-tool configs in a swamp repo and reports drift between the enrollment manifest (.swamp.yaml tools:), the custom-tool definitions (.swamp-custom-tools.yaml), and on-disk state. Distinguishes a tool that is merely un-customised from one that is genuinely missing or orphaned.

Discover and summarize Kilo Code CLI configuration for a project — commands, agents, skills, instruction files, permissions, MCPs, config files, and Agent Manager state — without running Kilo or mutating project files. Optional secret redaction by default.

Swamp-managed Android device over ADB. One model type (@shrug/android/device) drives the local `adb` CLI (via Deno.Command, behind an injectable exec seam) to pull device state into typed, versioned snapshots and to manage apps through gated, auditable mutations. Reads (all non-root): device identity + capability ceiling + owners (syncDevice), full app inventory joined from `pm list` + `dumpsys package` (syncPackages), per-app usage + standby buckets (syncUsage), on-disk code sizes (syncStorage), user-facing runtime permissions with a privacy-category rollup (syncPermissions), estimated per-app power use in mAh (syncBattery), special-access appops holders (syncAppControls), and per-app notification posture (syncNotifications); a fan-out `sync` captures the whole surface in one model-lock run. Management (dry-run by default, confirm=true to apply, protected-app guard, every run audited to a mutation/reconcile log): disable/enable/uninstall/restore (single + fan-out), force-stop, clear-data, set an appop, and a declarative desired-state reconcile (applyDesired). syncLabels resolves human-readable app names in three layers (Play/F-Droid lookup by package id, an embedded-APK label parsed in-process without aapt, then a package-id fallback). Privacy-conscious: notification posture is derived from the POST_NOTIFICATIONS grant, never from notification content, and nothing leaves the device except the opt-in store-label lookups. Ships an app-classification report that flags unused junk, enriched by the Universal Debloater Alliance (UAD-NG) community list. Pure parsers over captured adb stdout make the whole surface unit-testable with no device.

Assess fixed-schema operational metadata with bounded counts, typed status flags and explicit fresh, stale, unknown, unavailable and error states, without probing backends or projecting arbitrary fields.

Observability and safe operational control for a TP-Link Omada controller. One fan-out sync reads every site, device, client, switch port, gateway WAN and SSID into addressable resources, and writes a drift record comparing configuration — not telemetry — against the previous sync, so an idle network reports nothing and a firmware bump, a re-addressed WAN, a disabled PoE port or a device that stopped answering each report themselves. Talks the supported Open API in client-credentials mode, with the controller's own web API as an optional fallback for reads the Open API does not expose. Writes are limited to reversible operational actions — reboot, PoE, client block, reconnect, LED, locate, firmware — each fanning out over a list in one controller session.

Read-only VM inventory for standalone VMware ESXi hosts, shaped for planning a migration off one and decommissioning it. Collects over SSH from vim-cmd, esxcli and the guests' own .vmx files — virtual hardware, storage with provisioned vs allocated bytes, in-guest identity (hostname, addressing, DNS, default route, mounted filesystems) via VMware Tools, live usage for rightsizing, and the complete vmx verbatim — plus a warnings list of what blocks a clean rebuild. One fan-out inventory method does the whole host in a single SSH round trip.

Consolidated inventory report across all @sntxrr/scaleway-* models — counts per service, per region/zone, per status, plus resource ids, names, and statuses, discovered from stored sync/list snapshots.

A versitygw S3 gateway for swamp, read over its admin API and its S3 API. Read-only.

Sidero Omni for swamp, through `omnictl`. Two model types, two roles.

Talos fleet discovery for swamp, via Sidero Omni.

Read-only inventory of an on-premises Active Directory domain over LDAP. Collects users, groups, and computers straight from a domain controller — no Windows host, no WinRM, no PowerShell — and decodes what AD returns raw: FILETIME timestamps, binary SIDs and GUIDs, userAccountControl and groupType bitmasks. Handles paged searches and member range retrieval, so domains over 1000 objects and groups over 1500 members are not silently truncated. Methods: inventory, list_users, list_groups, list_computers.

Backstage software catalog reader — query entities, read one entity with its

Hypervisor-layer VM inventory for TrueNAS SCALE, via the JSON-RPC WebSocket API.

A catalogue of hosts and groups with hierarchical global/group/host metadata, resolved per host for use in workflows.

Network scanning with nmap, stored as structured data for change tracking over time. Produces host and port resources keyed by IP and port number, so consecutive scans naturally version and diff via the swamp data model.

Fleet-wide VPC inventory across `profiles × regions`. A single read-only

Lists RDS DB clusters in the configured AWS region and emits two

Workflow-scope report that renders an operator VPC inventory from the `vpc`