From sre-extension
Discovers and maps GCP infrastructure compute, networking, storage, and service dependencies for incident response and architecture auditing.
How this skill is triggered — by the user, by Claude, or both
Slash command
/sre-extension:gcp-architecture-discoveryThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
This skill provides a **discovery** approach for GCP infrastructure. It discovers what's needed for the current investigation and caches results for future use.
This skill provides a discovery approach for GCP infrastructure. It discovers what's needed for the current investigation and caches results for future use.
The Architecture Graph is Your Mental Model.
The discover.json and generated PNG represent how you see the system right now. Do not hesitate to update, rewrite, or expand the graph whenever you discover something new. For example: If you realize a Load Balancer connects to a different backend than previously drawn, overwrite it immediately.
Discovery Strategy (Adaptive Blast Radius) Exhaustive scans of an entire massive project waste time, but lazily scanning just one node causes you to miss critical infrastructure changes (e.g. altered firewalls, deleted databases, changed IAM policies).
🚨 CRITICAL RULE: NEVER stop after discovering just the single affected resource. You MUST forcefully map its entire surrounding ecosystem. Relying on old cache assumptions causes you to miss deleted, unmapped, or altered infrastructure.
🚨 CRITICAL RULE: MANDATORY OUTPUT GENERATION Setting up or updating the discovery folder structure is NOT OPTIONAL. Every time this skill is triggered, you MUST ALWAYS create or update the corresponding target folder,
.json,.mdand generate the.pngvisualization accurately. Never leave the data exclusively in the chat context.
The folder structure MUST be strictly organized as follows:
{AGENT_WORKSPACE_ROOT}/discover/{gcp-project|azure-subscription}/{PROJECT_ID_OR_SUBSCRIPTION_NAME}/
Inside each project/subscription directory, maintain these explicit files:
discover.json (Structured Data Cache):
"mermaid" key for rendering.wiki.<category>.md (Topological Documentation by Resource Type):
wiki.gce.md for VMs, wiki.vnet.md for networks, wiki.cloudrun.md for Cloud Run, wiki.sql.md for databases).wiki.overview.md, MUST contain the main topology image link () and the high-level project description.## (H2) header inside its respective category file.### (H3) or #### (H4) headers under the respective resource.Step 1: Check Cache First
# Agent checks documentation for architecture
# Files: ./discover/{gcp-project|azure-subscription}/{PROJECT_ID_OR_NAME}/discover.json and ./discover/{gcp-project|azure-subscription}/{PROJECT_ID_OR_NAME}/wiki.*.md
Step 2: Discovery Sweep (Blast Radius)
list or describe core resources connected to the incident. Do not rely on old cache assumptions—if a resource is throwing errors, verify its existence, its properties, and its relations.Step 3: Discover Dependencies & Network Layers
discover.json file.Step 4: 🛑 MANDATORY TOOL EXECUTION - Update Cache
You MUST always perform this step. Never skip saving your discoveries to disk. Do not hesitate to update the cache—this is your active mental model. Overwrite outdated assumptions immediately.
CRITICAL: You must physically execute the replace_string_in_file or create_file tools to update these files BEFORE responding to the user.
./discover/{gcp-project|azure-subscription}/{PROJECT_ID_OR_NAME}/discover.json. Create the file/directory if it does not exist.discover.json../discover/{gcp-project|azure-subscription}/{PROJECT_ID_OR_NAME}/wiki.<category>.md files based on resource type (e.g., wiki.vnet.md, wiki.gce.md). Create the files if they do not exist. Ensure there are NO raw mermaid blocks inside any wiki file."mermaid" key of ./discover/{gcp-project|azure-subscription}/{PROJECT_ID_OR_NAME}/discover.json.subgraph structures that represent their actual Network boundaries (Virtual Networks, VPCs, Subnets), Security Perimeters (VPC Service Controls, IAM domains), and Firewall rules (ingress/egress policies). No compute resource should "hang flat" without its network/security context.python skills/gcp-architecture-discovery/scripts/render_architecture_png.py ./discover/{gcp-project|azure-subscription}/{PROJECT_ID_OR_NAME}/discover.json to generate a PNG graphic of the architecture.Step 5: Document in Session
wiki.<category>.md files to reflect the latest known good state if discrepancies were found.This skill respects SAFE_MODE="enabled" and will only use read-only commands. All discovery operations are non-mutating and safe to run during incidents.
gcloud locally, as it perfectly fits the agent's JSON capabilities. If MCP is missing or lacking specific access, fall back to standard gcloud commands.describe over list during incidents**: Target specific resources by name to save time, rather than performing bulk operations.discover.json. Don't overwrite the entire cache unless performing a baseline regeneration.discover.json cache is recent, rely on it to make architectural decisions quickly during an outage. Only refresh specific resource nodes when you suspect they've undergone recent changes (e.g. recent deployments).npx claudepluginhub gemini-cli-extensions/sre --plugin sre-extensionOrchestrates SRE incident response on Google Cloud Platform. Starts outage investigation, maps architecture via gcp-architecture-discovery, and coordinates GKE/Cloud Run mitigation.
Design and review GCP network architecture: VPC topology, Shared VPC, Cloud Interconnect/VPN, Cloud NAT, DNS, Cloud Armor, Traffic Director.
Provides GCP architecture expertise for organization/project structure, VPC networking, data/analytics, Kubernetes/serverless, AI/ML platforms, security, and cost optimization. Use when designing or evaluating GCP systems.