EXTENSIONS

Azure infrastructure management via az CLI — 43 model types covering compute, networking, data, security, RBAC, Azure Policy, Defender for Cloud, Entra directory, monitoring, DNS, DevOps, Azure AI Foundry (accounts, model deployments, projects, quota), AI Search, Cosmos DB, PostgreSQL Flexible Server, Static Web Apps, Service Bus, Event Grid, Recovery Services, Log Analytics, subscription-wide topology with Mermaid diagrams and cost estimation, actual-spend cost analysis and waste auditing via Cost Management/Resource Graph/Advisor, and the Azure AI Vision Face REST API for identity-aware room services.

Read, write, and delete secrets stored in Azure Key Vault. Supports secret

Azure Container Apps, Container Apps Jobs, managed environments, and Azure Container Registry lifecycle models. Wraps the `az` CLI to provide list/get/sync/create/update/delete plus revision management, scheduled/event/manual job execution, certificate upload, and ACR credential retrieval. Designed to compose with @dougschaefer/azure-* models.

Create, adopt, start, deallocate, stop, inspect and delete an Azure virtual machine through the Azure Resource Manager REST API with a service principal from a vault. One generic model type, keyed by subscription, resource group and VM name, with no credential on a command line.

Inspect and delete an Azure network security group and converge its security rules through the Azure Resource Manager REST API with a service principal from a vault. One generic model type, keyed by subscription, resource group and NSG name, with rule convergence that plans before it applies.

Full Azure DevOps API coverage: Git, pipelines, work items and more. Works with Azure DevOps Services, legacy visualstudio.com URLs and Server/on-prem.

Drive Azure DevOps from swamp workflows: run pull request reviews (draft PRs, reviewer votes, comment threads) and run YAML pipelines (queue with parameters, follow stages, stop at approvals).

Stores swamp runtime data in Azure Blob Storage using native blob-lease distributed locking (the lease ID doubles as the fencing-token nonce) and ETag-conditional writes on a shard-first path index for optimistic concurrency. Emits OpenTelemetry spans for blob operations, lock acquisition/release, and push/pull sync so datastore activity is visible in traces when a TracerProvider is configured. Supports Shared Key (account key or connection string) and Azure AD service-principal authentication. No Azure SDK dependency — talks to the Blob REST API directly via fetch. Credentials are read from a swamp vault with `vault.get` expressions in the datastore config, never written literally.

Manage Azure SSH public key resources (Microsoft.Compute/sshPublicKeys) via the az CLI. Supports list, get, and sync.

Azure OpenAI / AI Services token usage monitoring — multi-subscription

Azure App Service swamp extension — manages App Service Plans, Web Apps, and Function Apps. Wraps the `az` CLI to provide CRUD, power state, app settings, deployment slots, custom domains, SSL certificate lifecycle, and function inventory. Designed to compose with @dougschaefer/azure-* models.

One-shot bootstrap for @webframp/azure-blob-datastore. Creates an Azure

Vercel feature-flags infrastructure models

A generic, deterministic, evidence-gated feature-idea recommendation model. It is read-only and never approves, plans, executes, invokes tools, or creates side effects.

Records human-controlled, zero-authority post-release measurement plans.

Observe DevOps team effectiveness through cross-boundary collaboration.

Read-only Azure cost governance — actual spend, tag allocation, forecast, and budget inspection via the Cost Management API, plus FOCUS cost export consumption for Azure blob storage and AWS S3, with findings reports.

Unified cross-provider AI token usage monitoring — workflow, model, and

Fetch AI papers from arXiv and map them to cloud infrastructure decisions across AWS, Azure, and GCP. Produces structured per-provider implications with priority ratings, relevant cloud services, and decision categories.

Broad Microsoft Graph extension — nine model types over one shared app-only client: calendar (room/user calendarView, current/next meeting), places (room resources), users (Entra directory reads, manager, memberOf), groups, mail (Outlook messages), teams (chats/teams/channels/messages), presence, sharepoint (document-library navigation, search, and file download, working under either Sites.Read.All or Sites.Selected), and intune (enrolled devices, compliance policies, configuration profiles and settings catalog, remediation scripts, confirmation-gated device actions, and async report exports). Token caching, automatic paging, and a raw-bytes downloader; app credentials supplied from a vault. Supersedes the narrow ms-graph-calendar and absorbs azure-ad-user's lookup.

Microsoft Purview compliance-portal RBAC — role groups, their constituent management roles, membership, and the eDiscovery Administrator list, over Security & Compliance PowerShell. Exists because eDiscovery permission is invisible from Entra: Global Administrator maps to OrganizationManagement, which carries Case Management, Compliance Search, Hold and Search And Purge but not Export, Preview, Review, RMS Decrypt or Custodian, so a tenant admin can run a search yet be unable to export a single item. auditPrincipals separates canSearch from canExport and flags eDiscovery Administrators, who can open every case in the tenant. Carries its own credential surface because the compliance endpoint rejects Azure CLI tokens regardless of user.

AWS DATASYNC infrastructure models

GPU inference cost projection across cloud, rental, and capex scenarios.