EXTENSIONS

Datadog Events — event search and submission

macOS Keychain vault using the security CLI. Emits OpenTelemetry spans for get, put, and list so vault reads are visible in traces, including reads during model and workflow runs where the host emits nothing. Span attributes carry the vault name, key name, and keychain service only — never secret values, argv, or error messages.

Datadog Monitors — monitor definitions, muting, status, and downtime management

Datadog Metrics — metric queries, submissions, tag configurations, and metadata

Datadog SLOs — service level objective definitions, status, and history

gopass password manager (gopass.pw) - pass compatible with extra features. Emits OpenTelemetry spans for get, put, and list so vault reads are visible in traces, including reads during model and workflow runs where the host emits nothing. Span attributes carry the vault name, key name, and backend only — never secret values or error messages.

HashiCorp Vault secrets management via REST API (KV v1 and v2). Emits OpenTelemetry spans for get, put, and list, with one child span per request in the recursive list walk, so vault reads are visible in traces including reads during model and workflow runs where the host emits nothing. Span attributes carry the vault name, key name, and KV version only — never secret values, tokens, or error messages.

Datadog Logs — log search, aggregation, and analytics

GPG-encrypted password store using the pass CLI (passwordstore.org). Emits OpenTelemetry spans for get, put, and list so vault reads are visible in traces, including reads during model and workflow runs where the host emits nothing. Span attributes carry the vault name, key name, and backend only — never secret values or error messages.

Query and analyze CloudWatch Alarms for operational visibility and incident response.

Stores swamp runtime data in GitLab using the Terraform state HTTP API. Provides distributed locking via GitLab's native state locking mechanism and bidirectional sync between local cache and GitLab. Emits OpenTelemetry spans for GitLab API calls, lock acquisition/release, and push/pull sync so datastore activity is visible in traces when a TracerProvider is configured.

Unified drift detection surface that composes observations from existing

CloudWatch alarm investigation and triage model.

Stores swamp runtime data in AWS DynamoDB with conditional-write distributed locking (fencing tokens + TTL-as-defense-in-depth) and chunked blob storage for items exceeding DynamoDB's 400KB size limit. Emits OpenTelemetry spans for DynamoDB operations, lock acquisition/release, and push/pull sync so datastore activity is visible in traces when a TracerProvider is configured.

Query and analyze CloudWatch Logs for operational visibility and incident investigation.

Query and analyze CloudWatch Metrics for operational visibility and performance monitoring.

Stores swamp runtime data in Valkey/Redis with sorted-set path indexing for O(log n + k) prefix lookups and SET NX distributed locking. Compatible with local Valkey, AWS ElastiCache Serverless, and AWS MemoryDB. Implements two-phase sync to minimize time under the global lock. Emits OpenTelemetry spans for Valkey commands, lock acquisition/release, and push/pull sync so datastore activity is visible in traces when a TracerProvider is configured.

Query and analyze X-Ray distributed traces for incident investigation and performance analysis.

Stores swamp runtime data in Azure Blob Storage using native blob-lease distributed locking (the lease ID doubles as the fencing-token nonce) and ETag-conditional writes on a shard-first path index for optimistic concurrency. Emits OpenTelemetry spans for blob operations, lock acquisition/release, and push/pull sync so datastore activity is visible in traces when a TracerProvider is configured. Supports Shared Key (account key or connection string) and Azure AD service-principal authentication. No Azure SDK dependency — talks to the Blob REST API directly via fetch.

Observe Route53 hosted zones, record sets, and detect orphaned DNS records

Observe AWS Config compliance evaluations as typed queryable data.

Stores swamp runtime data in PostgreSQL with row-based distributed locking. Compatible with AWS RDS, Aurora, and Aurora Serverless v2. Uses fencing tokens for split-brain safety across failover events. Emits OpenTelemetry spans for SQL operations, lock acquisition/release, and push/pull sync so datastore activity is visible in traces when a TracerProvider is configured.

Cloudflare Logpush — log jobs, destinations, field configurations

Query local system diagnostics via shell commands for operational visibility.