EXTENSIONS

Read-only client for MySQL and Aurora MySQL. Checks connectivity, runs

Repository hygiene checks for swamp repos — hardcoded absolute home paths in model/workflow sources (test fixtures and the Linuxbrew prefix exempted), pulled extensions whose source files are missing, generated .swamp artifacts not covered by .gitignore, and workflow wiring drift: scripts missing an exec bit/shebang, declared schedules with no live registration, and dead step dependencies that skip silently or dereference the outputs of a failed step. Writes a combined markdown report plus per-check structured resources.

Run AI coding agents (Claude, Codex) with structured output for CI

Observe Route53 hosted zones, record sets, and detect orphaned DNS records

Choose which model each kind of work uses, and fall back to the next model

SOPS + age vault for swamp: one encrypted file per secret.

Run AI coding agents headless from swamp workflows and record what each run

Upload local files into Google Drive (My Drive), under a named folder.

A tiny dedup ledger for swamp pipelines: remember which ids have already

Show and build Dojo plans with doj-plan-build, and order a plans checkout into dependency waves for building.

Keep the DNS learned from DHCP for the whole host, but send one zone (or sub-zone) to that zone's authoritative nameservers — or to a pinned list — so records you manage update at the zone's speed instead of the DHCP resolver's cache.

Finds and mitigates hosts exposed to Tailworm, the security assessment of

Inspect, create and convert X.509 material with the local `openssl` CLI.

Install, run and inspect a local mitmproxy (HTTP/HTTPS intercepting proxy)

Drive a 44x11 LED name badge (USB 0416:5020, WCH CH583 "LSLED" / Badge

Swamp vault backed by a running KeePassXC, reached through its Browser

One hourly HTML status page for a mixed Debian-family fleet: it audits pending

Run pixiecore as a managed container, auto-configured to serve netboot.xyz to any host that netboots on the LAN.

Finds and fixes Brotli decoders exposed to **CVE-2026-111497**

Finds and fixes Linux, macOS and Windows hosts and Linux containers that

Finds and patches PHP installs exposed to the critical PHP remote code

Set up an Ubuntu host to run KVM/QEMU virtual machines with libvirt, the way the kvm-training deck does it, with the check/apply pattern @adam/cfgmgmt uses: host (the QEMU, libvirt and virtinst packages, and the user added to libvirt and kvm), pool (directory storage pools), network (nat, bridge, macvtap or routed), vm (Ubuntu Server guests from the release's cloud image, checked against SHA256SUMS and configured by cloud-init, with their address from qemu-guest-agent, and snapshots) and uplink, which says which of those can work on the host and why: Wi-Fi can't be bridged, a host that is itself a VM needs its hypervisor's help, and Docker can block bridged traffic. Every type runs on the host itself, as a swamp worker step, or over SSH with cfgmgmt's nodeHost arguments; workflows for both are included.

Detects and mitigates the Dirty Frag Linux local privilege escalation

Install and run Deno commands. Manages Deno binary downloads with