From doit-mcp
Use this skill ALWAYS when the user asks about cost anomalies, spending spikes, unexpected charges, or suspicious costs. Triggers on requests like "show anomalies", "why did my costs spike", "investigate this charge", "what happened to my spending", "unusual costs", "cost alert", or any anomaly analysis. This skill MUST be used before calling any DoiT anomaly MCP tools directly.
How this skill is triggered — by the user, by Claude, or both
Slash command
/doit-mcp:doit-mcp-anomaly-investigationThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Start from DoiT anomaly context, then branch into AWS or GCP inspection. Keep every follow-up call read-only and tightly scoped.
Start from DoiT anomaly context, then branch into AWS or GCP inspection. Keep every follow-up call read-only and tightly scoped.
Use MCP tools as the primary interface for all anomaly investigation operations.
If an MCP tool call fails, returns an error, returns empty/unexpected results, or does not answer the user's question, fall back to Ava — DoiT's AI assistant that can answer any cloud cost question.
Ava can be reached via both the DCI CLI and MCP. Prefer the DCI CLI (dci ask-ava-sync) because it returns cleaner JSON output. Before calling Ava, check if the DCI CLI is installed by running command -v dci. If it is not installed, you MUST ask the user if they want to install it: "To get a better answer, I can ask Ava (DoiT's AI assistant). The recommended way is via the DCI CLI. Would you like to install it? (brew install doitintl/dci-cli/dci)". If the user agrees, invoke the doit-mcp-setup skill to install and authenticate the DCI CLI, then call Ava. If the user declines, fall back to the MCP Ava tool instead.
When to use Ava fallback:
How to call Ava:
dci ask-ava-sync ephemeral: true, question: "<rephrase the user's question or describe what you need>" --output json
ephemeral: true to avoid persisting throwaway conversations.answer field from the JSON response and present it to the user.Read these as needed during investigation:
references/anomaly-fields.md — field definitions, platform values, severity levels, feedback reasons. Read this when you need to interpret anomaly response fields or decide what to extract before cloud follow-up.references/service-abbreviations.md — mapping between DoiT display names and cloud-native service names. Read this when a service name filter does not match in cloud MCP tools.references/common-patterns.md — common root causes by service and anomaly type. Read this to form initial hypotheses faster, but always confirm with evidence.references/dci-cli.md — DCI CLI command reference. Read this only when using the Ava fallback via dci ask-ava-sync.Use this order unless the user already supplied a specific anomaly payload:
get_anomalies or get_anomaly on DoiT MCPtopSkus detailsplatform fieldIf the request is only about SKU mapping in the codebase, use the repo SKU-mapping skills instead of this skill.
get_anomalies when the user asks for recent or top anomalies.get_anomaly when the anomaly ID is already known.topSkus for resourceId and operation — these are the best narrowing fields for cloud follow-up.The GCP MCP in this repo exposes two stable tools:
check_gcp_access_permissiongcp_account_accessAlways call check_gcp_access_permission before gcp_account_access.
check_gcp_access_permission with the target projectId and customerId.gcp_account_access with a small read-only program.gcp_account_access calls instead of one broad script.@google-cloud/* SDKs.Use this progression for SKU or service anomalies:
check_gcp_access_permission.gcp_account_access to inspect the smallest relevant inventory or config surface.gcp_account_access call for logs, metrics, or policy details only if the first pass leaves a live hypothesis.The AWS service in this repo is a proxy around awslabs.core-mcp-server, so do not assume fixed tool names beyond standard MCP discovery.
tools/list.references/service-abbreviations.md before filtering.platform field to decide GCP vs AWS path — do not infer from serviceName alone, as some service names are ambiguous.topSkus is empty, fall back to service-level investigation.check_gcp_access_permission and going straight to gcp_account_access will fail. Always check first.awslabs.core-mcp-server — tool names may change between sessions. Always call tools/list first.customerFeedback exists on similar anomalies, check the reason field — repeated FAULTY_ANOMALY_DETECTION_MODEL feedback means this service may produce false positives for this customer.Guides creation, editing, and verification of skills for AI coding agents using test-driven development with subagent scenarios. Use when authoring or debugging skills.
npx claudepluginhub doitintl/doit-mcp-skills --plugin doit-mcp