EXTENSIONS

Google Cloud observability infrastructure models

Observe Route53 hosted zones, record sets, and detect orphaned DNS records

VictoriaMetrics query API for swamp — instant/range PromQL, scrape-target

VictoriaLogs query API — run LogsQL queries, field/stream stats, and hits

Per-workflow observability for a swamp repo's own scheduled work.

Install and configure a host-native metrics + logs agent on a remote

A distress-call beacon for AI agents.

Answer "what is actually reading this disk?" on a Linux host whose storage

Prometheus Alertmanager v2 API for swamp — list firing alerts, alert groups

A read-only container listing of a Docker host over SSH, narrow enough to hand to an unattended triage agent. It answers the first question an alert usually raises -- what is running on that host, and which container holds that port -- with name, image, state, status, published ports and creation time per container. It runs `docker ps` with an explicit, per-field `--format` template and rebuilds each row from those fields alone, so no environment variable and no label value ever leaves the host: `docker inspect` returns every container's environment, which is where compose files keep database passwords and API tokens, and `docker ps --format '{{json .}}'` includes the Labels field. The type has exactly one method and no free-form command or format argument, so a model instance exposes no write verb at all. Host key checking stays on by default.

Drive a Rollbar-compatible crash-reporting API (api.rollbar.com, or

Read a socialq deployment through its HTTP API with a Cloudflare Access

Zabbix Monitoring — integration for troubleshooting and observing monitored infrastructure via the Zabbix JSON-RPC 2.0 API. Retrieves hosts, problems, triggers, items, history, host groups, maintenance windows, events, network maps, template linkage, and dashboards (read and update).

Push metrics from a scheduled swamp method into a Prometheus Pushgateway. Scheduled jobs are exactly what Pushgateway exists for: a batch that runs, computes numbers, and exits long before any scrape could reach it. The `@sntxrr/prometheus/pushgateway` model's `push` method takes a flat `{name, value, labels}` series — the shape several models already emit alongside their verdicts — renders it as text exposition format, and writes it to a grouping key. Defaults to PUT so a series that disappears from the source disappears from the gateway, rather than lingering at its last value forever. Validates metric and label names and rejects non-finite values before sending, because Pushgateway answers 400 without naming the offending series and a single NaN discards the whole batch. Handles the base64 grouping-key escape for values containing a slash or empty values, which would otherwise corrupt or collapse a path segment. Emits an optional heartbeat counter, because pushed metrics go stale silently: the gateway serves the last value forever, so a job that stops running leaves every dashboard green while nothing is being checked.

Manage Honeycomb resources (environments, API keys, datasets) via the Honeycomb Management and Configuration APIs

GPG-encrypted password store using the pass CLI (passwordstore.org). Can return just the first line of a multiline entry (the password, by pass convention) or a named metadata field such as login. Emits OpenTelemetry spans for get, put, and list so vault reads are visible in traces, including reads during model and workflow runs where the host emits nothing. Span attributes carry the vault name, key and field names, and backend only — never secret values or error messages.

gopass password manager (gopass.pw) - pass compatible with extra features. Emits OpenTelemetry spans for get, put, and list so vault reads are visible in traces, including reads during model and workflow runs where the host emits nothing. Span attributes carry the vault name, key name, and backend only — never secret values or error messages.

Stores swamp runtime data in Valkey/Redis with sorted-set path indexing for O(log n + k) prefix lookups and SET NX distributed locking. Compatible with local Valkey, AWS ElastiCache Serverless, and AWS MemoryDB. Implements two-phase sync to minimize time under the global lock. Emits OpenTelemetry spans for Valkey commands, lock acquisition/release, and push/pull sync so datastore activity is visible in traces when a TracerProvider is configured.

Stores swamp runtime data in PostgreSQL with row-based distributed locking. Compatible with AWS RDS, Aurora, and Aurora Serverless v2. Uses fencing tokens for split-brain safety across failover events. Emits OpenTelemetry spans for SQL operations, lock acquisition/release, and push/pull sync so datastore activity is visible in traces when a TracerProvider is configured. The connection string, which embeds the password, is read from a swamp vault with a `vault.get` expression in the datastore config.

Stores swamp runtime data in GitLab using the Terraform state HTTP API. Provides distributed locking via GitLab's native state locking mechanism and bidirectional sync between local cache and GitLab. Emits OpenTelemetry spans for GitLab API calls, lock acquisition/release, and push/pull sync so datastore activity is visible in traces when a TracerProvider is configured. The access token is read from a swamp vault with a `vault.get` expression in the datastore config, never written literally.

Stores swamp runtime data in Azure Blob Storage using native blob-lease distributed locking (the lease ID doubles as the fencing-token nonce) and ETag-conditional writes on a shard-first path index for optimistic concurrency. Emits OpenTelemetry spans for blob operations, lock acquisition/release, and push/pull sync so datastore activity is visible in traces when a TracerProvider is configured. Supports Shared Key (account key or connection string) and Azure AD service-principal authentication. No Azure SDK dependency — talks to the Blob REST API directly via fetch. Credentials are read from a swamp vault with `vault.get` expressions in the datastore config, never written literally.

macOS Keychain vault using the security CLI. Emits OpenTelemetry spans for get, put, and list so vault reads are visible in traces, including reads during model and workflow runs where the host emits nothing. Span attributes carry the vault name, key name, and keychain service only — never secret values, argv, or error messages.

HashiCorp Vault secrets management via REST API (KV v1 and v2). Emits OpenTelemetry spans for get, put, and list, with one child span per request in the recursive list walk, so vault reads are visible in traces including reads during model and workflow runs where the host emits nothing. Span attributes carry the vault name, key name, and KV version only — never secret values, tokens, or error messages.

Stores swamp runtime data in AWS DynamoDB with conditional-write distributed locking (fencing tokens + TTL-as-defense-in-depth) and chunked blob storage for items exceeding DynamoDB's 400KB size limit. Emits OpenTelemetry spans for DynamoDB operations, lock acquisition/release, and push/pull sync so datastore activity is visible in traces when a TracerProvider is configured.