From reflex
Trace Azure resource dependencies and generate topology diagrams
How this command is triggered — by the user, by Claude, or both
Slash command
/reflex:azure-discover <resource-name> [--subscription NAME] [--output FILE] [--store]This command is limited to the following tools:
The summary Claude sees in its command listing — used to decide when to auto-load this command
# Azure Resource Dependency Tracer Trace all dependencies of a specific Azure resource — networking, security, identity, monitoring — and generate a topology diagram with metadata tables. **SAFETY: This command is READ-ONLY. NEVER call `az` commands that create, modify, or delete resources. NEVER call `az account set` or other commands that mutate local CLI state. Only use `show`, `list`, `get`, and `query` operations. Pass `--subscription` as a flag to scope queries instead of switching context. The `Write` tool is only for writing the output markdown report.** ## Syntax ## Arguments...
Trace all dependencies of a specific Azure resource — networking, security, identity, monitoring — and generate a topology diagram with metadata tables.
SAFETY: This command is READ-ONLY. NEVER call az commands that create, modify, or delete resources. NEVER call az account set or other commands that mutate local CLI state. Only use show, list, get, and query operations. Pass --subscription as a flag to scope queries instead of switching context. The Write tool is only for writing the output markdown report.
/reflex:azure-discover <resource-name> [--subscription NAME] [--output FILE] [--store]
| Argument | Required | Default | Description |
|---|---|---|---|
<resource-name> | Yes | — | Name of the Azure resource to trace |
--subscription | No | (current default) | Subscription name or ID to narrow search |
--output | No | <resource-name>-topology.md | Output file name for the report |
--store | No | false | Store the report in Qdrant for RAG queries |
| Variable | Default | Description |
|---|---|---|
REFLEX_AZURE_DISCOVER_OUTPUT_DIR | $HOME/Desktop | Directory where topology reports are written |
Parse the user's input to extract:
<resource-name> (required — if missing, ask the user)--subscription — narrows search scope--output — custom output file name (default: <resource-name>-topology.md)--store — whether to store in Qdrant after generatingResolve the output directory by running:
echo "${REFLEX_AZURE_DISCOVER_OUTPUT_DIR:-$HOME/Desktop}"
Use the result as the output directory. Combine it with the --output file name to get the full output path.
Run az account show to confirm Azure CLI is authenticated.
az login first.--subscription was provided, pass --subscription "<name>" to all subsequent az commands. Do NOT run az account set — it mutates global CLI state.Use Azure Resource Graph to find the resource by name:
az graph query -q "resources | where name =~ '<resource-name>'" --first 10 -o json
Handle results:
id, name, type, resourceGroup, location, subscriptionId.AskUserQuestion to let the user pick which resource. Show name, type, resource group, and subscription for each.IMPORTANT: Use the exact query templates from the azure-resource-discovery skill. Do NOT improvise Resource Graph KQL syntax — it frequently produces InvalidQuery errors. When you need filtering beyond the templates, use az resource list with JMESPath --query instead.
Based on the target resource's type, select the appropriate tracer from the azure-resource-discovery skill:
| Resource Type | Tracer |
|---|---|
Microsoft.App/containerApps | Container App Tracer |
Microsoft.Compute/virtualMachines | Virtual Machine Tracer |
Microsoft.ContainerService/managedClusters | AKS Cluster Tracer |
Microsoft.Web/sites (not functionapp) | App Service Tracer |
Microsoft.Web/sites (kind contains functionapp) | Function App Tracer |
| Any other type | Generic Tracer |
Execute the tracer's az CLI commands from the skill. Each tracer returns a set of discovered dependencies with metadata.
For each discovered dependency, collect:
runs in, secured by, pulls from)Use the Networking Detail Collectors from the skill to gather VNet, subnet, NSG rules, and private endpoint information.
Construct a graph with:
Group nodes by category: Networking, Security, Data, Monitoring, Identity, Compute/Containers.
Choose diagram format based on node count:
dot -Tsvg
dot is not installed, fall back to Mermaid regardless of node countUse the diagram templates from the azure-resource-discovery skill. The target resource should be visually emphasized (bold border, distinct fill color).
Assemble the report using the Markdown Report Template from the azure-resource-discovery skill. Sections:
Write the report to the output directory resolved in Step 1, combined with the output file name.
If --store was specified, store a summary in Qdrant (not the full report — structured documents with tables and diagrams fragment poorly in vector search). The full report stays on disk; the Qdrant entry is a retrieval pointer.
Build a concise summary (3-5 sentences) covering: what resource was traced, key dependencies found, networking topology highlights, and any notable security findings.
Tool: qdrant-store
Information: "Azure topology trace for <resource-name> (<type-shorthand>) in <resource-group>, <location>. <summary of key dependencies — e.g., 'Runs in prod-vnet/app-subnet, secured by app-nsg, pulls images from prodregistry ACR, authenticates via user-assigned managed identity, secrets from prod-keyvault.'> <dependency-count> dependencies traced. Full report: <output-file-path>"
Metadata:
source: "azure_discovery"
content_type: "infrastructure_summary"
harvested_at: "<current ISO 8601 timestamp>"
subscription_name: "<subscription name>"
subscription_id: "<subscription ID>"
resource_name: "<target resource name>"
resource_type: "<target resource type>"
resource_group: "<target resource group>"
dependency_count: <total count>
regions: "<comma-separated regions>"
report_path: "<full output file path>"
category: "devops"
subcategory: "azure"
type: "topology_report"
confidence: "high"
Summarize what was done:
--store was used)# Trace a container app's dependencies
/reflex:azure-discover my-container-app
# Trace with specific subscription
/reflex:azure-discover my-aks-cluster --subscription "Production"
# Custom output file name (written to $REFLEX_AZURE_DISCOVER_OUTPUT_DIR or ~/Desktop)
/reflex:azure-discover my-webapp --output webapp-deps.md
# Trace and store in Qdrant
/reflex:azure-discover my-vm --store
# Full options
/reflex:azure-discover my-func-app --subscription "Dev" --output func-topology.md --store
npx claudepluginhub mindmorass/reflex --plugin reflex/extract-infrastructureExtracts Azure infrastructure from a resource group using Azure CLI and generates Docker Compose stack with service emulators for local development.
/cost-optimizationGenerates a cost optimization report for Azure environments using Advisor recommendations, orphaned resources detection, rightsizing analysis, and commitment discounts.
/enrichEnriches Drawio diagrams with details from code analysis, API docs, and web research. Generates diagrams from source code or analyzes gaps in existing ones.
/deploy-azureDeploys Azure infrastructure for TVS Holdings using Bicep templates: Key Vault (kv-tvs-holdings), Functions (func-tvs-ingest), Static Web Apps (stapp-broker-*), App Insights. Supports --resource kv|func|stapp|insights|all.
/estimate-costEstimates Azure costs for architectures, deployment plans, or resource requirements via live Azure Retail Prices API. Outputs detailed estimate in chat.
/diagramGenerates infrastructure and architecture diagrams using D2 from codebase analysis, producing detailed/simplified MD docs, D2 sources, and light/dark SVGs in ./diagrams/.