EXTENSIONS

HashiCorp Vault secrets management via REST API (KV v1 and v2)

Query and manage AWS Security Hub findings from a delegated administrator

Azure infrastructure management via az CLI — 31 model types covering compute, networking, data, security, RBAC, Azure Policy, Defender for Cloud, Entra directory, monitoring, DNS, DevOps, and subscription-wide topology with Mermaid diagrams and cost estimation.

Install Tailscale on remote VMs over SSH and sync tailnet machine inventory from tailscale status JSON into per-machine resources.

Cloudflare security and configuration audit workflow.

Read-only local macOS security, sanity, and performance posture checks with a severity-rated report.

GitHub models for swamp. Currently provides @hivemq/github/token, which audits a single GitHub token.

Inventory and report on OIDC trust policies and workload-identity federation across GitHub, Google Cloud, and Cloudflare One.

Cloudflare One / Zero Trust Access discovery for swamp.

Query and inspect GuardDuty findings from a delegated administrator account,

Run Claude Code (and other workloads) inside a macOS apple/container sandbox.

Scans deno.lock and package-lock.json files for npm packages compromised

Workflow-scope report that audits S3 buckets against standard security

Detects and mitigates the Dirty Frag Linux local privilege escalation

Run Claude Code (and other workloads) inside a macOS apple/container sandbox.

GitHub repository security auditing with support for native features and third-party tool detection

Tailnet health reporting — find devices running outdated Tailscale clients and alert via Slack

Tailscale tailnet management — 10 model types covering devices, users, ACLs, DNS, auth keys, webhooks, settings, contacts, posture, and log config. 22 workflows for device inventory, user lifecycle, ACL audit, security audit, compliance, incident response, monitoring, and more. Fix: OAuth token cache now keys on credentials so different tailnets/OAuth clients no longer share tokens.