Skip to main content
The plugin gives your coding agent read-only production context while it reviews code, prepares a deployment, investigates an incident, or explains architecture. It combines Graph MCP with an Agent Skill that teaches the agent how to gather and interpret that evidence, plus Cypher recipes for the common analyses.
The package follows Agent Plugins 1.0.0 and connects to Graph MCP over MCP 2026-07-28. It contains no API token, project identifier, authorization header, or database name.
v0.3.0 (2026-09-08) changes the MCP endpoint and the tool set. The plugin now connects to https://api.anyshift.io/mcp/graph and exposes ten tools over the live event graph. Older installs keep working against the previous endpoint but do not receive the new tools. To update: Codex users re-add the marketplace at --ref v0.3.0 and run codex mcp login agent-plugin; Cursor users run git pull --ff-only in their checkout, which also updates the packaged MCP entry; Claude Code users on the earlier manual setup must switch to the native install below (or re-register the endpoint: claude mcp remove agent-plugin, then claude mcp add --transport http --scope user agent-plugin https://api.anyshift.io/mcp/graph and claude mcp login agent-plugin), because git pull only refreshes the skill and leaves the old MCP entry in place. In every case authorize once: the new endpoint is a new MCP entry.

Install

Choose your coding agent below. Compatible Agent Plugins clients install the package directly; clients such as Claude Code load the same Agent Skill and Graph MCP connection separately. During the first Graph MCP connection, sign in to Anyshift, select the project the agent may read, and approve access. The client stores the resulting credentials.
Update Codex CLI before installing:
codex mcp add only registers the server; codex mcp login starts the Graph MCP OAuth flow. Sign in, select the Anyshift project the agent may read, and start a new Codex task so the skill and MCP tools load together.
Codex currently requires the explicit codex mcp add command because installing a plugin-owned remote MCP entry does not start its OAuth flow automatically.
End-to-end production verification of v0.3.0 covers Claude Code (native plugin install and OAuth) and the endpoint itself. For other clients, confirm authentication, discovery of the ten tools, one authenticated read-only call, and uninstall behavior against the version your team deploys.

What the plugin gives your agent

Use the plugin to:
  • review a code or infrastructure change against current production dependencies;
  • identify direct dependencies and bounded blast radius before a deployment;
  • trace public-edge exposure paths, observed controls, and explicit evidence gaps;
  • correlate recent changes with topology during an incident;
  • explain how a repository fits into the current production architecture; and
  • produce focused post-deployment checks from observed graph evidence.
Graph MCP supplies read-only tools over the live event graph: schema discovery, resource lookup and details, relationship walks, resource and project-wide change events, correlated event chains, project switching, and read-only Cypher. The packaged skill teaches the agent to discover the project’s vocabulary first, read the completeness signals the tools return, separate observed evidence from inference and unknowns, and ships Cypher recipes for single points of failure, orphans, blast radius, public exposure, shortest paths, RBAC reach and Kubernetes hygiene gaps. This is not an autonomous SRE agent or an incident-response loop. For Annie’s full AI SRE investigation workflow, use Annie Remote MCP.

Try it

After installation, ask the agent to combine the code in your workspace with production evidence:
Other useful starting points:

More clients

Kiro supports Agent Skills and remote HTTP MCP servers with browser OAuth. Configure the two components separately.First, open Agent Steering & Skills in the Kiro panel, select Import a skill, choose GitHub, and paste:
Then run Kiro: Open user MCP config (JSON) from the Command Palette and merge this entry into ~/.kiro/settings/mcp.json:
Save the file. Kiro reconnects automatically and opens the Anyshift authorization page when Graph MCP requests OAuth. Verify the connection in the MCP servers panel, then invoke /agent-plugin or ask a production-impact question.See Kiro’s Agent Skills and MCP configuration guides.
This setup is for the xAI Grok Build coding agent, not the consumer Grok chat or bot.
Review the source and the capabilities Grok displays before using --trust. Start a new Grok session and complete browser OAuth on the first Graph MCP use. The skill is available as /agent-plugin. Run grok mcp doctor agent-plugin if the server does not connect.See the Grok Build guides for plugins and MCP servers.
Install the repository from inside a GitHub Copilot CLI session:
If the server is listed as needs-auth, start the browser flow:
If your Copilot version installs the skill but does not load the portable MCP entry, add the endpoint explicitly from your shell:
Start a new session after installation. Invoke /agent-plugin/agent-plugin, or ask Copilot to inspect production impact and let it select the skill automatically.See GitHub’s guides for Copilot plugins and MCP servers.
OpenClaw loads the skill and remote MCP connection separately. Clone the current package, then install its skill for all local agents:
Register and authorize Graph MCP:
Restart the relevant agent or Gateway if it was already running. Run openclaw skills list to confirm the skill loaded, then invoke /agent-plugin or ask the agent for production evidence.See OpenClaw’s Skills and MCP guides.
Hermes supports Agent Skills and OAuth-authenticated HTTP MCP servers, but loads the two components separately. Clone the current package into a stable location:
Merge these entries into ~/.hermes/config.yaml:
Complete OAuth and verify the connection from a fresh terminal:
Start hermes chat and invoke /agent-plugin, or ask a production-impact question and let Hermes load the skill automatically.See Hermes’ Skills and MCP guides.
Load the public repository root in a client that supports Agent Plugins and the streamable-http MCP transport:
The client should discover plugin.json, mcp.json, and the packaged skill. Treat the client as unverified until you have tested installation, OAuth, discovery of the expected tools, one authenticated call, and uninstall behavior with the exact version you deploy.

Verify the connection

A complete installation has all four of these signals:
  1. The agent-plugin skill is visible to the agent.
  2. agent-plugin is connected and authenticated.
  3. The client discovers the ten tools: describe_schema, find_resources, get_resource_details, get_related, get_resource_events, get_recent_events, get_correlated_events, query_graph, list_projects, and set_project.
  4. A read-only request returns project-scoped evidence with an evidence timestamp.
Use this focused verification prompt:

Manage access and updates

  • Update with your client’s plugin manager: Codex codex plugin marketplace add anyshift-io/agent-plugin --ref <version> then codex plugin add agent-plugin@anyshift; Claude Code /plugin update anyshift-graph@anyshift; VS Code from Chat: Open Customizations. For manual Git checkouts (Cursor, Kiro, OpenClaw, Hermes), run git pull --ff-only in the package directory, then restart the client.
  • A release that changes the MCP endpoint (such as v0.3.0) is a new MCP entry: authorize once after updating. Your previous authorization stays listed under Authorized Apps and can be revoked there.
  • The installed version is the version field of the package’s plugin.json; releases are listed at anyshift-io/agent-plugin.
  • Start a new agent session after installing or updating so the current skill and MCP tools are loaded.
  • Keep only one Graph MCP registration per client. Installing the package and configuring the same endpoint manually can create duplicate tools and separate OAuth state.
  • View or revoke authorized MCP connections from your Anyshift profile page under Authorized Apps.

Troubleshooting

Start authentication again from the MCP client and use the newly generated browser page. OAuth callback URLs are tied to the active client attempt; an old page can no longer complete a later connection.
Copy the fresh authorization URL shown by the client into a browser where you can sign in to Anyshift. This is common when the agent client runs over SSH or in a remote development environment. Keep the client process running until authorization completes.
Confirm that agent-plugin is enabled, complete OAuth, and start a new agent session. If the server still does not appear, use the client’s MCP diagnostics to inspect its connection state.
Remove the standalone MCP entry when the Agent Plugin already supplies Graph MCP. Keep the package installation if you want both the tools and the agent-plugin skill.
Use Cursor’s standalone Graph MCP entry as a fallback:
Complete browser OAuth and start a new Agent chat. This fallback provides the Graph tools but does not install the agent-plugin skill.
Ask the agent to call list_projects and then set_project with the intended project; the switch applies to the existing connection without re-authenticating. To change the project a connection was consented for, revoke it from Authorized Apps on your Anyshift profile and authenticate again.
The package source, releases, validation instructions, and compatibility evidence are available in anyshift-io/agent-plugin.