EXTENSIONS

Datadog Security Signals — signal search, triage, and archiving

Datadog Security Rules — detection rule CRUD and management

Datadog Security Suppressions — suppression rule management

macOS Keychain vault using the security CLI. Emits OpenTelemetry spans for get, put, and list so vault reads are visible in traces, including reads during model and workflow runs where the host emits nothing. Span attributes carry the vault name, key name, and keychain service only — never secret values, argv, or error messages.

HashiCorp Vault secrets management via REST API (KV v1 and v2). Emits OpenTelemetry spans for get, put, and list, with one child span per request in the recursive list walk, so vault reads are visible in traces including reads during model and workflow runs where the host emits nothing. Span attributes carry the vault name, key name, and KV version only — never secret values, tokens, or error messages.

Agile threat modeling as an agent-guided concept model.

Snyk Issues — vulnerability issues across projects and groups

Snyk SAST — static application security testing results and management

Query and manage AWS Security Hub findings from a delegated administrator

Cross-account IAM observation model for role, user, and policy inventory.

Snyk Projects — project listing, attributes, relationships, and target management

Snyk Policies — security policy management and rule configuration

Read-only observability model for GuardDuty findings. Query and inspect

Cloudflare management - zones, DNS records, WAF/firewall rules, Workers, and cache/CDN

Snyk SBOM — software bill of materials testing and analysis

Snyk Container Images — container image scanning and vulnerability data

Cloudflare Rulesets — WAF custom rules, transform rules, managed rulesets

Snyk Cloud — cloud environments, scans, and resource posture management

Query Discourse forums via the public REST API. List categories, browse

Cloudflare security and configuration audit workflow.

DNS and network probing model that generates diverse diagnostic events.

Run govulncheck against a Go module and record which known vulnerabilities affect the code

Standalone TLS certificate expiry checker. Give it hostnames, get back days-until-expiry — no external service dependency.

Look up known GitHub Security Advisories (GHSA) for a package + ecosystem — the same {ecosystem, package} shape a Renovate merge request reports.