{ "registry_name": "CloudShipAI Station Registry", "description": "A collection of curated MCP and agent bundles for Station — turnkey, open-source security/finops/devops automations with human-readable guardrails and CI/CD gating.", "version": "1.0.0", "last_updated": "2025-08-19T12:00:00Z", "base_url": "https://github.com/cloudshipai/registry/raw/main", "site_url": "https://cloudshipai.github.io/registry", "bundles": [ { "id": "ci-guardrails-bundle", "name": "CI Pipeline Guardrails (Code + Pipelines)", "description": "Blocks risky code and CI configs before they run. Runs Semgrep on source, actionlint on GitHub Actions, hadolint on Dockerfiles, and optional Trivy, then annotates PRs or opens autofix PRs.", "version": "1.0.0", "author": "cloudshipai", "tags": ["ci", "sast", "lint", "security"], "download_url": "https://github.com/cloudshipai/registry/raw/main/bundles/ci-guardrails-bundle/ci-guardrails-bundle.tar.gz", "metadata_url": "https://github.com/cloudshipai/registry/raw/main/bundles/ci-guardrails-bundle/ci-guardrails-bundle.json", "source_url": "https://github.com/cloudshipai/registry/tree/main/bundles/ci-guardrails-bundle", "file_size": 3241, "created_at": "2025-08-19T12:00:00Z", "mcps": [ {"name": "semgrep", "description": "Multi-language static analysis", "tools": ["scan_repo", "scan_diff", "upload_sarif"]}, {"name": "actionlint", "description": "GitHub Actions workflow linter", "tools": ["lint_workflows"]}, {"name": "hadolint", "description": "Dockerfile linter", "tools": ["lint_dockerfiles"]}, {"name": "trivy", "description": "Optional container/IaC/secret scan", "tools": ["scan_image", "config_scan"]} ], "agents": [ {"name": "CI Gatekeeper", "description": "Runs SAST/lint on each PR; fails on high-risk findings; can open autofix PRs.", "capabilities": ["pr_annotation", "autofix", "sarif_reporting"]} ], "verified": true, "popular": true }, { "id": "dep-lic-sbom-bundle", "name": "Dependency & License Compliance (SBOM policy)", "description": "Proves licenses and blocks disallowed ones; catches known vulns via OSV/Grype. Builds SBOMs with Syft, checks licenses, enforces org policy with Conftest.", "version": "1.0.0", "author": "cloudshipai", "tags": ["sbom", "license", "vulnerability", "policy"], "download_url": "https://github.com/cloudshipai/registry/raw/main/bundles/dep-lic-sbom-bundle/dep-lic-sbom-bundle.tar.gz", "metadata_url": "https://github.com/cloudshipai/registry/raw/main/bundles/dep-lic-sbom-bundle/dep-lic-sbom-bundle.json", "source_url": "https://github.com/cloudshipai/registry/tree/main/bundles/dep-lic-sbom-bundle", "file_size": 4122, "created_at": "2025-08-19T12:00:00Z", "mcps": [ {"name": "syft", "description": "Generate CycloneDX/SPDX SBOMs", "tools": ["sbom"]}, {"name": "osv_scanner", "description": "Vulns via OSV database", "tools": ["scan"]}, {"name": "grype", "description": "SBOM/image vulnerability scan", "tools": ["scan"]}, {"name": "scancode", "description": "License detection for files", "tools": ["licenses"]}, {"name": "conftest", "description": "Rego policy engine for JSON/YAML", "tools": ["test"]} ], "agents": [ {"name": "SBOM Guard", "description": "Generates SBOMs, scans for vulns, enforces license/vuln thresholds on PRs.", "capabilities": ["sbom_build", "vuln_scan", "license_policy", "pr_blocking"]} ], "verified": true, "popular": true }, { "id": "iac-guardrails-bundle", "name": "IaC Guardrails on Plan (OPA + Checkov)", "description": "Stops risky infrastructure before apply using community policies (Checkov) and custom Rego (Conftest) on Terraform/OpenTofu plan JSON.", "version": "1.0.0", "author": "cloudshipai", "tags": ["iac", "terraform", "policy", "opa"], "download_url": "https://github.com/cloudshipai/registry/raw/main/bundles/iac-guardrails-bundle/iac-guardrails-bundle.tar.gz", "metadata_url": "https://github.com/cloudshipai/registry/raw/main/bundles/iac-guardrails-bundle/iac-guardrails-bundle.json", "source_url": "https://github.com/cloudshipai/registry/tree/main/bundles/iac-guardrails-bundle", "file_size": 3890, "created_at": "2025-08-19T12:00:00Z", "mcps": [ {"name": "checkov", "description": "750+ IaC policies across TF/CFN/K8s", "tools": ["scan"]}, {"name": "conftest", "description": "Org Rego against plan JSON", "tools": ["test"]}, {"name": "terraform", "description": "Plan/show JSON producer", "tools": ["plan_json", "show_json"]} ], "agents": [ {"name": "IaC Plan Gate", "description": "Runs Checkov + OPA on plan JSON; blocks PRs or patches module vars automatically.", "capabilities": ["policy_eval", "pr_blocking", "autofix_suggestions"]} ], "verified": true, "popular": true }, { "id": "iac-live-drift-bundle", "name": "Live ↔ IaC Drift Detection & Reconciliation", "description": "Finds drift between real cloud and code, flags policy violations, and opens PRs to reconcile or import missing resources.", "version": "1.0.0", "author": "cloudshipai", "tags": ["drift", "iac", "cloud", "reconciliation"], "download_url": "https://github.com/cloudshipai/registry/raw/main/bundles/iac-live-drift-bundle/iac-live-drift-bundle.tar.gz", "metadata_url": "https://github.com/cloudshipai/registry/raw/main/bundles/iac-live-drift-bundle/iac-live-drift-bundle.json", "source_url": "https://github.com/cloudshipai/registry/tree/main/bundles/iac-live-drift-bundle", "file_size": 3580, "created_at": "2025-08-19T12:00:00Z", "mcps": [ {"name": "cloudquery", "description": "Snapshot cloud/GitHub into Postgres", "tools": ["sync"]}, {"name": "terrascan", "description": "Policy scan of code and live", "tools": ["scan"]}, {"name": "terraformer", "description": "Import live resources to code", "tools": ["import_resources"]} ], "agents": [ {"name": "Drift Doctor", "description": "Nightly compares live vs. IaC, files PRs to add/remove resources with evidence tables.", "capabilities": ["inventory_diff", "policy_scan", "pr_creation"]} ], "verified": true, "popular": false }, { "id": "k8s-baseline-hardening-bundle", "name": "Kubernetes Baseline Hardening (CIS + Runtime + Policy)", "description": "Brings clusters to CIS baseline, monitors runtime threats, and enforces admission guardrails for images and resources.", "version": "1.0.0", "author": "cloudshipai", "tags": ["kubernetes", "cis", "runtime", "policy"], "download_url": "https://github.com/cloudshipai/registry/raw/main/bundles/k8s-baseline-hardening-bundle/k8s-baseline-hardening-bundle.tar.gz", "metadata_url": "https://github.com/cloudshipai/registry/raw/main/bundles/k8s-baseline-hardening-bundle/k8s-baseline-hardening-bundle.json", "source_url": "https://github.com/cloudshipai/registry/tree/main/bundles/k8s-baseline-hardening-bundle", "file_size": 5310, "created_at": "2025-08-19T12:00:00Z", "mcps": [ {"name": "kube_bench", "description": "CIS benchmark tests", "tools": ["run"]}, {"name": "kube_hunter", "description": "Find exposed K8s surfaces", "tools": ["probe"]}, {"name": "falco", "description": "Runtime rule events", "tools": ["watch", "export"]}, {"name": "kyverno", "description": "Admission policies", "tools": ["apply_policy", "test"]} ], "agents": [ {"name": "K8s Hardener", "description": "Runs CIS checks, probes exposures, deploys Falco rules & Kyverno policies, and opens PRs with fixes.", "capabilities": ["cis_scan", "runtime_monitor", "admission_enforce", "pr_fixes"]} ], "verified": true, "popular": true }, { "id": "cost-waste-cleanup-bundle", "name": "Cost & Waste Cleanup (Steampipe Thrifty → Custodian)", "description": "Finds idle/underused resources and, with approval, applies lifecycle/stop/tag actions to save money safely.", "version": "1.0.0", "author": "cloudshipai", "tags": ["cost", "finops", "cleanup"], "download_url": "https://github.com/cloudshipai/registry/raw/main/bundles/cost-waste-cleanup-bundle/cost-waste-cleanup-bundle.tar.gz", "metadata_url": "https://github.com/cloudshipai/registry/raw/main/bundles/cost-waste-cleanup-bundle/cost-waste-cleanup-bundle.json", "source_url": "https://github.com/cloudshipai/registry/tree/main/bundles/cost-waste-cleanup-bundle", "file_size": 2874, "created_at": "2025-08-19T12:00:00Z", "mcps": [ {"name": "steampipe", "description": "Run Thrifty benchmark packs", "tools": ["run_mod"]}, {"name": "cloudcustodian", "description": "Policy-driven remediation", "tools": ["apply_policy"]} ], "agents": [ {"name": "FinOps Cleaner", "description": "Finds waste, estimates savings, opens approval issues, and triggers Custodian to remediate.", "capabilities": ["benchmark", "savings_calc", "approval_flow", "remediate"]} ], "verified": false, "popular": true }, { "id": "aws-misconfig-sweep-bundle", "name": "AWS Misconfig Sweep → Auto-Remediate (Approvals)", "description": "Nightly detection of public S3, unencrypted EBS, weak IAM, etc. Creates tickets/PRs and, on approval, runs Custodian to quarantine/auto-tag/fix.", "version": "1.0.0", "author": "cloudshipai", "tags": ["aws", "security", "remediation"], "download_url": "https://github.com/cloudshipai/registry/raw/main/bundles/aws-misconfig-sweep-bundle/aws-misconfig-sweep-bundle.tar.gz", "metadata_url": "https://github.com/cloudshipai/registry/raw/main/bundles/aws-misconfig-sweep-bundle/aws-misconfig-sweep-bundle.json", "source_url": "https://github.com/cloudshipai/registry/tree/main/bundles/aws-misconfig-sweep-bundle", "file_size": 3012, "created_at": "2025-08-19T12:00:00Z", "mcps": [ {"name": "prowler", "description": "AWS security checks", "tools": ["scan"]}, {"name": "cloudcustodian", "description": "Apply enforcement policies", "tools": ["apply_policy"]}, {"name": "scoutsuite", "description": "Human-readable posture report (optional)", "tools": ["report"]} ], "agents": [ {"name": "AWS Fix-It Bot", "description": "Finds misconfigs, files issues, and applies vetted policies after human approval.", "capabilities": ["detect", "ticket", "remediate_with_approval"]} ], "verified": true, "popular": true }, { "id": "secrets-hygiene-bundle", "name": "Secrets Hygiene: Detect → Purge → Rotate", "description": "Stops secret sprawl by scanning repos/orgs, opening PRs to purge, and rotating/inactivating leaked IAM keys automatically or with approval.", "version": "1.0.0", "author": "cloudshipai", "tags": ["secrets", "github", "aws", "security"], "download_url": "https://github.com/cloudshipai/registry/raw/main/bundles/secrets-hygiene-bundle/secrets-hygiene-bundle.tar.gz", "metadata_url": "https://github.com/cloudshipai/registry/raw/main/bundles/secrets-hygiene-bundle/secrets-hygiene-bundle.json", "source_url": "https://github.com/cloudshipai/registry/tree/main/bundles/secrets-hygiene-bundle", "file_size": 2766, "created_at": "2025-08-19T12:00:00Z", "mcps": [ {"name": "gitleaks", "description": "Repo/org secret scanner", "tools": ["scan"]}, {"name": "trufflehog", "description": "Verified secret detection", "tools": ["scan_verified"]}, {"name": "aws", "description": "IAM key rotation & disable", "tools": ["iam_rotate_access_key", "iam_disable_access_key"]} ], "agents": [ {"name": "Secret Janitor", "description": "Finds secrets, purges from history, files PRs, and rotates access keys.", "capabilities": ["scan", "purge", "rotate", "evidence"]} ], "verified": true, "popular": true }, { "id": "tls-cert-rotation-bundle", "name": "TLS/Cert Posture & Rotation", "description": "Ends expiring/weak certs and enforces HTTPS. Scans domains for expiry, installs cert-manager with ACME or step-ca, and applies Kyverno TLS policies.", "version": "1.0.0", "author": "cloudshipai", "tags": ["kubernetes", "tls", "certs", "acme"], "download_url": "https://github.com/cloudshipai/registry/raw/main/bundles/tls-cert-rotation-bundle/tls-cert-rotation-bundle.tar.gz", "metadata_url": "https://github.com/cloudshipai/registry/raw/main/bundles/tls-cert-rotation-bundle/tls-cert-rotation-bundle.json", "source_url": "https://github.com/cloudshipai/registry/tree/main/bundles/tls-cert-rotation-bundle", "file_size": 3333, "created_at": "2025-08-19T12:00:00Z", "mcps": [ {"name": "cert_manager", "description": "Install/operate cert-manager", "tools": ["install", "apply_clusterissuer", "apply_certificate"]}, {"name": "step_ca", "description": "Smallstep private ACME", "tools": ["ensure_acme_provisioner"]}, {"name": "check_ssl_cert", "description": "Expiry/chain scan", "tools": ["scan"]}, {"name": "kyverno", "description": "Require Ingress TLS policies", "tools": ["apply_policy"]} ], "agents": [ {"name": "TLS Steward", "description": "Audits certificates, deploys issuers, auto-renews, and enforces HTTPS.", "capabilities": ["scan", "issuer_setup", "auto_renew", "admission_policy"]} ], "verified": true, "popular": true }, { "id": "dr-smoke-tests-bundle", "name": "Disaster-Recovery Smoke Tests", "description": "Continuously proves you can restore. Nightly backups, weekly restore rehearsal into staging, health asserts via KUTTL, optional chaos tests.", "version": "1.0.0", "author": "cloudshipai", "tags": ["backup", "dr", "kubernetes", "resilience"], "download_url": "https://github.com/cloudshipai/registry/raw/main/bundles/dr-smoke-tests-bundle/dr-smoke-tests-bundle.tar.gz", "metadata_url": "https://github.com/cloudshipai/registry/raw/main/bundles/dr-smoke-tests-bundle/dr-smoke-tests-bundle.json", "source_url": "https://github.com/cloudshipai/registry/tree/main/bundles/dr-smoke-tests-bundle", "file_size": 4199, "created_at": "2025-08-19T12:00:00Z", "mcps": [ {"name": "velero", "description": "Backup/restore/schedule", "tools": ["install", "schedule_create", "restore_create", "status"]}, {"name": "kuttl", "description": "Cluster assertions", "tools": ["run"]}, {"name": "litmus", "description": "Chaos experiments", "tools": ["run_experiment"]} ], "agents": [ {"name": "DR Rehearsal", "description": "Backs up nightly, restores weekly to a staging namespace, validates, and reports.", "capabilities": ["backup", "restore", "assert", "report"]} ], "verified": true, "popular": false }, { "id": "serverless-least-priv-bundle", "name": "Serverless (SAM/CFN) Least-Privilege & Security Gate", "description": "Prevents permissive Lambdas and risky configs. Scans with Checkov & cfn-nag, enforces org Rego, and autogenerates least-priv IAM via Policy Sentry.", "version": "1.0.0", "author": "cloudshipai", "tags": ["aws", "lambda", "cloudformation", "policy"], "download_url": "https://github.com/cloudshipai/registry/raw/main/bundles/serverless-least-priv-bundle/serverless-least-priv-bundle.tar.gz", "metadata_url": "https://github.com/cloudshipai/registry/raw/main/bundles/serverless-least-priv-bundle/serverless-least-priv-bundle.json", "source_url": "https://github.com/cloudshipai/registry/tree/main/bundles/serverless-least-priv-bundle", "file_size": 3520, "created_at": "2025-08-19T12:00:00Z", "mcps": [ {"name": "checkov", "description": "SAM/CFN static checks", "tools": ["scan"]}, {"name": "cfn_nag", "description": "Insecure CFN pattern linter", "tools": ["scan"]}, {"name": "conftest", "description": "Org Rego rules", "tools": ["test"]}, {"name": "policy_sentry", "description": "Least-priv IAM generator", "tools": ["write_policy", "lint_role"]} ], "agents": [ {"name": "Serverless Gate", "description": "Blocks insecure serverless changes and proposes least-priv IAM replacements.", "capabilities": ["scan", "policy_enforce", "iam_synthesize", "pr_autofix"]} ], "verified": true, "popular": true }, { "id": "github-org-security-bundle", "name": "Org & Repo Security Baseline (GitHub)", "description": "Locks down orgs/repos to sane defaults. Enforces branch protection, Dependabot, secret scanning; runs Scorecard and Allstar to monitor drift.", "version": "1.0.0", "author": "cloudshipai", "tags": ["github", "governance", "security", "policy"], "download_url": "https://github.com/cloudshipai/registry/raw/main/bundles/github-org-security-bundle/github-org-security-bundle.tar.gz", "metadata_url": "https://github.com/cloudshipai/registry/raw/main/bundles/github-org-security-bundle/github-org-security-bundle.json", "source_url": "https://github.com/cloudshipai/registry/tree/main/bundles/github-org-security-bundle", "file_size": 3105, "created_at": "2025-08-19T12:00:00Z", "mcps": [ {"name": "ossf_scorecard", "description": "Repo posture scoring", "tools": ["scan_repo", "scan_org"]}, {"name": "allstar", "description": "Org policy enforcement", "tools": ["ensure_installed", "push_org_config_repo", "list_violations"]}, {"name": "gitleaks", "description": "Secrets sweep", "tools": ["scan"]}, {"name": "trufflehog", "description": "Verified leaks", "tools": ["scan"]}, {"name": "github_admin", "description": "Apply repo settings", "tools": ["ensure_branch_protection", "enable_dependabot", "enable_secret_scanning"]} ], "agents": [ {"name": "Org Baseline Enforcer", "description": "Applies baseline protections, detects drift weekly, and files PRs/issues to fix gaps.", "capabilities": ["inventory", "settings_apply", "drift_watch", "issue_pr"]} ], "verified": true, "popular": true }, { "id": "golden-images-compliance-bundle", "name": "Golden AMI/Container Pipeline with Compliance", "description": "Keeps base images patched & compliant. Builds with Packer, audits AMIs (OpenSCAP/Lynis), scans containers (Trivy), signs with Cosign, and updates IaC via PR.", "version": "1.0.0", "author": "cloudshipai", "tags": ["ami", "container", "compliance", "supply-chain"], "download_url": "https://github.com/cloudshipai/registry/raw/main/bundles/golden-images-compliance-bundle/golden-images-compliance-bundle.tar.gz", "metadata_url": "https://github.com/cloudshipai/registry/raw/main/bundles/golden-images-compliance-bundle/golden-images-compliance-bundle.json", "source_url": "https://github.com/cloudshipai/registry/tree/main/bundles/golden-images-compliance-bundle", "file_size": 4680, "created_at": "2025-08-19T12:00:00Z", "mcps": [ {"name": "packer", "description": "Build AMIs/OCI images", "tools": ["build_ami", "build_oci", "validate"]}, {"name": "openscap", "description": "CIS/STIG evaluation", "tools": ["eval"]}, {"name": "lynis", "description": "OS hardening audit", "tools": ["audit"]}, {"name": "trivy", "description": "Image vuln scan", "tools": ["scan_image"]}, {"name": "cosign", "description": "Sign/verify artifacts", "tools": ["sign", "verify"]} ], "agents": [ {"name": "Golden Image Builder", "description": "Builds, audits, signs, and publishes blessed images; bumps downstream IaC automatically.", "capabilities": ["build", "scan", "sign", "pr_bump"]} ], "verified": true, "popular": false }, { "id": "k8s-multitenant-guardrails-bundle", "name": "Kubernetes Multi-Tenant Guardrails (Policy + Network)", "description": "Prevents noisy neighbors and cross-namespace access. Applies default-deny NetworkPolicies, requires requests/limits, verifies image provenance, and right-sizes with Goldilocks.", "version": "1.0.0", "author": "cloudshipai", "tags": ["kubernetes", "network", "policy", "tenancy"], "download_url": "https://github.com/cloudshipai/registry/raw/main/bundles/k8s-multitenant-guardrails-bundle/k8s-multitenant-guardrails-bundle.tar.gz", "metadata_url": "https://github.com/cloudshipai/registry/raw/main/bundles/k8s-multitenant-guardrails-bundle/k8s-multitenant-guardrails-bundle.json", "source_url": "https://github.com/cloudshipai/registry/tree/main/bundles/k8s-multitenant-guardrails-bundle", "file_size": 4562, "created_at": "2025-08-19T12:00:00Z", "mcps": [ {"name": "kyverno", "description": "PodSecurity/verifyImages/quotas", "tools": ["apply_policy", "test"]}, {"name": "network", "description": "Default-deny and allows (Cilium/Calico)", "tools": ["apply_default_deny", "apply_allowlist"]}, {"name": "goldilocks", "description": "VPA-based recommendations", "tools": ["install", "recommend"]} ], "agents": [ {"name": "Tenant Guard", "description": "Audits namespaces, applies default-deny, enforces admission policies, and opens PRs with right-sizing.", "capabilities": ["audit", "network_lockdown", "admission_enforce", "rightsizing_pr"]} ], "verified": true, "popular": true }, { "id": "os-patch-cis-fleet-bundle", "name": "OS Patch & CIS Compliance (Fleet)", "description": "Keeps nodes/VMs patched and compliant. Queries FleetDM/osquery for exposure, runs OpenSCAP for CIS, patches in windows, and verifies via live queries.", "version": "1.0.0", "author": "cloudshipai", "tags": ["endpoint", "patching", "cis", "fleetdm"], "download_url": "https://github.com/cloudshipai/registry/raw/main/bundles/os-patch-cis-fleet-bundle/os-patch-cis-fleet-bundle.tar.gz", "metadata_url": "https://github.com/cloudshipai/registry/raw/main/bundles/os-patch-cis-fleet-bundle/os-patch-cis-fleet-bundle.json", "source_url": "https://github.com/cloudshipai/registry/tree/main/bundles/os-patch-cis-fleet-bundle", "file_size": 4401, "created_at": "2025-08-19T12:00:00Z", "mcps": [ {"name": "fleet", "description": "Hosts/software/queries/installs", "tools": ["auth", "list_hosts", "run_live_query", "list_software", "install_package", "install_result"]}, {"name": "openscap", "description": "CIS evaluation/remediation", "tools": ["eval"]}, {"name": "conftest", "description": "CVE/CIS policy gates", "tools": ["test"]} ], "agents": [ {"name": "Fleet Compliance", "description": "Builds exposure table, schedules patches, runs CIS scans, and reports before/after deltas.", "capabilities": ["inventory", "policy_gate", "patch", "verify"]} ], "verified": false, "popular": false }, { "id": "dast-preprod-bundle", "name": "DAST for Services (Pre-Prod)", "description": "Catches web vulns before prod. Runs ZAP baseline or authenticated AF scans against staging, optional Nikto, and Trivy config on manifests; fails gate on high/crit.", "version": "1.0.0", "author": "cloudshipai", "tags": ["dast", "web", "appsec", "staging"], "download_url": "https://github.com/cloudshipai/registry/raw/main/bundles/dast-preprod-bundle/dast-preprod-bundle.tar.gz", "metadata_url": "https://github.com/cloudshipai/registry/raw/main/bundles/dast-preprod-bundle/dast-preprod-bundle.json", "source_url": "https://github.com/cloudshipai/registry/tree/main/bundles/dast-preprod-bundle", "file_size": 3955, "created_at": "2025-08-19T12:00:00Z", "mcps": [ {"name": "zap", "description": "Baseline & Automation Framework", "tools": ["baseline", "automation"]}, {"name": "nikto", "description": "Legacy/server misconfig scan", "tools": ["scan"]}, {"name": "trivy", "description": "Manifests/Helm misconfig", "tools": ["config_scan"]} ], "agents": [ {"name": "Staging DAST", "description": "Scans staging apps, annotates PRs with repro steps, and enforces risk thresholds.", "capabilities": ["dast", "auth_scan", "config_scan", "pr_gate"]} ], "verified": true, "popular": true }, { "id": "registry-hygiene-bundle", "name": "Container Registry Hygiene & Retention", "description": "Cuts image storage cost and attack surface. Lists old/untagged/unsigned images, estimates reclaimed size, requires approvals, and deletes safely; emits native retention policies.", "version": "1.0.0", "author": "cloudshipai", "tags": ["registry", "cosign", "cleanup", "retention"], "download_url": "https://github.com/cloudshipai/registry/raw/main/bundles/registry-hygiene-bundle/registry-hygiene-bundle.tar.gz", "metadata_url": "https://github.com/cloudshipai/registry/raw/main/bundles/registry-hygiene-bundle/registry-hygiene-bundle.json", "source_url": "https://github.com/cloudshipai/registry/tree/main/bundles/registry-hygiene-bundle", "file_size": 3721, "created_at": "2025-08-19T12:00:00Z", "mcps": [ {"name": "registry", "description": "regctl/crane drivers", "tools": ["list_repos", "list_tags", "inspect", "delete", "verify_delete_plan"]}, {"name": "cosign", "description": "Signature verification", "tools": ["verify"]}, {"name": "trivy", "description": "Prioritize vulnerable images", "tools": ["scan_image"]} ], "agents": [ {"name": "Registry Janitor", "description": "Produces per-repo cleanup plans, enforces approvals, and applies vendor retention.", "capabilities": ["inventory", "signature_check", "size_math", "delete", "retention_emit"]} ], "verified": true, "popular": true }, { "id": "openinfraquote-cost-gate-bundle", "name": "OpenInfraQuote: PR Cost Envelope & Budget Gate", "description": "Estimates min/max monthly cost from Terraform plan/state (with usage & region what-ifs) and blocks PRs that exceed team budgets.", "version": "1.0.0", "author": "cloudshipai", "tags": ["finops", "cost", "terraform", "policy"], "download_url": "https://github.com/cloudshipai/registry/raw/main/bundles/openinfraquote-cost-gate-bundle/openinfraquote-cost-gate-bundle.tar.gz", "metadata_url": "https://github.com/cloudshipai/registry/raw/main/bundles/openinfraquote-cost-gate-bundle/openinfraquote-cost-gate-bundle.json", "source_url": "https://github.com/cloudshipai/registry/tree/main/bundles/openinfraquote-cost-gate-bundle", "file_size": 3340, "created_at": "2025-08-19T12:00:00Z", "mcps": [ {"name": "openinfraquote", "description": "Local pricing from plan/state", "tools": ["download_pricesheet", "print_default_usage", "match", "price"]}, {"name": "conftest", "description": "Budget policy enforcement", "tools": ["test"]}, {"name": "terraform", "description": "Plan/state JSON producer", "tools": ["show_json"]} ], "agents": [ {"name": "Cost Gate", "description": "Comments cost envelopes on PRs, enforces budgets, and suggests cheaper variants.", "capabilities": ["pricing", "policy_gate", "pr_comment", "what_if"]} ], "verified": true, "popular": true }, { "id": "provenance-artifact-trust-bundle", "name": "Release Provenance & Artifact Trust", "description": "Only ships artifacts that are signed and proven. Verifies Cosign signatures, SLSA provenance, and in-toto attestations; optional cluster admission enforcement.", "version": "1.0.0", "author": "cloudshipai", "tags": ["supply-chain", "signing", "slsa", "attestations"], "download_url": "https://github.com/cloudshipai/registry/raw/main/bundles/provenance-artifact-trust-bundle/provenance-artifact-trust-bundle.tar.gz", "metadata_url": "https://github.com/cloudshipai/registry/raw/main/bundles/provenance-artifact-trust-bundle/provenance-artifact-trust-bundle.json", "source_url": "https://github.com/cloudshipai/registry/tree/main/bundles/provenance-artifact-trust-bundle", "file_size": 3602, "created_at": "2025-08-19T12:00:00Z", "mcps": [ {"name": "cosign", "description": "Verify signatures/attestations", "tools": ["verify"]}, {"name": "slsa_verifier", "description": "Verify SLSA provenance", "tools": ["verify"]}, {"name": "in_toto", "description": "Attestation verify", "tools": ["verify"]}, {"name": "sigstore_policy_controller", "description": "K8s admission enforcement", "tools": ["install", "apply_policy"]} ], "agents": [ {"name": "Provenance Gate", "description": "Blocks releases missing trusted signatures/provenance and enforces at deploy time.", "capabilities": ["verify", "admission_enforce", "pr_gate"]} ], "verified": false, "popular": true }, { "id": "terraform-preplan-lint-bundle", "name": "Terraform Pre-Plan Lint & Business Compliance", "description": "Catches bad resources and enforces business rules before planning. TFLint provider rules + terraform-compliance features + OPA for org specifics.", "version": "1.0.0", "author": "cloudshipai", "tags": ["terraform", "lint", "policy"], "download_url": "https://github.com/cloudshipai/registry/raw/main/bundles/terraform-preplan-lint-bundle/terraform-preplan-lint-bundle.tar.gz", "metadata_url": "https://github.com/cloudshipai/registry/raw/main/bundles/terraform-preplan-lint-bundle/terraform-preplan-lint-bundle.json", "source_url": "https://github.com/cloudshipai/registry/tree/main/bundles/terraform-preplan-lint-bundle", "file_size": 2988, "created_at": "2025-08-19T12:00:00Z", "mcps": [ {"name": "tflint", "description": "Terraform linter", "tools": ["run"]}, {"name": "terraform_compliance", "description": "BDD business rules on plan", "tools": ["test"]}, {"name": "conftest", "description": "Org policy extras", "tools": ["test"]} ], "agents": [ {"name": "Pre-Plan Guard", "description": "Lint + policy gate before plan/apply; gives precise, human-readable failures.", "capabilities": ["lint", "policy_gate", "annotate"]} ], "verified": true, "popular": false }, { "id": "sbom-lifecycle-dtrack-bundle", "name": "SBOM Lifecycle & Portfolio Risk (Dependency-Track)", "description": "Generates SBOMs, scans for vulns, and tracks portfolio policy in Dependency-Track with continuous risk visibility.", "version": "1.0.0", "author": "cloudshipai", "tags": ["sbom", "portfolio", "vulnerability"], "download_url": "https://github.com/cloudshipai/registry/raw/main/bundles/sbom-lifecycle-dtrack-bundle/sbom-lifecycle-dtrack-bundle.tar.gz", "metadata_url": "https://github.com/cloudshipai/registry/raw/main/bundles/sbom-lifecycle-dtrack-bundle/sbom-lifecycle-dtrack-bundle.json", "source_url": "https://github.com/cloudshipai/registry/tree/main/bundles/sbom-lifecycle-dtrack-bundle", "file_size": 3421, "created_at": "2025-08-19T12:00:00Z", "mcps": [ {"name": "syft", "description": "CycloneDX/SPDX SBOM", "tools": ["sbom"]}, {"name": "grype", "description": "Vuln from SBOM", "tools": ["scan"]}, {"name": "dependency_track", "description": "Upload & policy watch", "tools": ["upload", "project_status"]} ], "agents": [ {"name": "Portfolio SBOM", "description": "Publishes SBOMs to D-Track, gates merges on policy, and links to findings.", "capabilities": ["sbom", "vuln", "policy_gate"]} ], "verified": false, "popular": false }, { "id": "sops-encryption-enforce-bundle", "name": "Secrets-in-Git Encryption Enforcement (SOPS + age)", "description": "Allows secrets in Git only if encrypted. Verifies SOPS headers and permitted recipients; auto-encrypts and PRs fixes when needed.", "version": "1.0.0", "author": "cloudshipai", "tags": ["secrets", "encryption", "gitops"], "download_url": "https://github.com/cloudshipai/registry/raw/main/bundles/sops-encryption-enforce-bundle/sops-encryption-enforce-bundle.tar.gz", "metadata_url": "https://github.com/cloudshipai/registry/raw/main/bundles/sops-encryption-enforce-bundle/sops-encryption-enforce-bundle.json", "source_url": "https://github.com/cloudshipai/registry/tree/main/bundles/sops-encryption-enforce-bundle", "file_size": 2705, "created_at": "2025-08-19T12:00:00Z", "mcps": [ {"name": "sops", "description": "Encrypt/verify secrets", "tools": ["verify", "encrypt"]}, {"name": "age", "description": "Recipient/key management", "tools": ["keygen", "inspect"]}, {"name": "conftest", "description": "Policy on recipients/KMS", "tools": ["test"]} ], "agents": [ {"name": "Secret Cryptor", "description": "Blocks plaintext secrets and auto-converts to SOPS with approved recipients.", "capabilities": ["verify", "encrypt", "policy_enforce", "pr_autofix"]} ], "verified": true, "popular": true }, { "id": "cloud-identity-least-priv-bundle", "name": "Cloud Identity Graph & Least-Privilege Remediation", "description": "Builds a graph of cloud identities/paths, detects privilege escalation routes, and right-sizes IAM permissions safely with approvals.", "version": "1.0.0", "author": "cloudshipai", "tags": ["iam", "graph", "least-privilege", "aws"], "download_url": "https://github.com/cloudshipai/registry/raw/main/bundles/cloud-identity-least-priv-bundle/cloud-identity-least-priv-bundle.tar.gz", "metadata_url": "https://github.com/cloudshipai/registry/raw/main/bundles/cloud-identity-least-priv-bundle/cloud-identity-least-priv-bundle.json", "source_url": "https://github.com/cloudshipai/registry/tree/main/bundles/cloud-identity-least-priv-bundle", "file_size": 3816, "created_at": "2025-08-19T12:00:00Z", "mcps": [ {"name": "cartography", "description": "Ingest cloud/identity → Neo4j", "tools": ["sync"]}, {"name": "pmapper", "description": "IAM privesc analysis", "tools": ["analyze"]}, {"name": "repokid", "description": "Remove unused permissions", "tools": ["repokey"]} ], "agents": [ {"name": "Least-Priv Engineer", "description": "Finds toxic privilege paths and opens PRs to right-size roles with change windows.", "capabilities": ["graph", "analysis", "rightsizing", "approval_flow"]} ], "verified": false, "popular": false } ], "categories": { "ci-cd": ["ci-guardrails-bundle", "terraform-preplan-lint-bundle", "dast-preprod-bundle"], "sbom-and-licenses": ["dep-lic-sbom-bundle", "sbom-lifecycle-dtrack-bundle", "provenance-artifact-trust-bundle"], "iac-and-cloud-policy": ["iac-guardrails-bundle", "iac-live-drift-bundle", "serverless-least-priv-bundle", "aws-misconfig-sweep-bundle"], "kubernetes-security": ["k8s-baseline-hardening-bundle", "k8s-multitenant-guardrails-bundle", "tls-cert-rotation-bundle", "dr-smoke-tests-bundle"], "finops": ["openinfraquote-cost-gate-bundle", "cost-waste-cleanup-bundle"], "registries-and-artifacts": ["registry-hygiene-bundle", "golden-images-compliance-bundle", "provenance-artifact-trust-bundle"], "secrets-and-governance": ["secrets-hygiene-bundle", "sops-encryption-enforce-bundle", "github-org-security-bundle"], "endpoint-and-os": ["os-patch-cis-fleet-bundle"], "identity-and-iam": ["cloud-identity-least-priv-bundle"] }, "featured_bundles": [ "openinfraquote-cost-gate-bundle", "k8s-multitenant-guardrails-bundle", "github-org-security-bundle", "ci-guardrails-bundle", "registry-hygiene-bundle" ] }