jmagar

syslog-deploy-dropins

Deploy rsyslog forwarding drop-ins to configured fleet hosts over SSH. Use when configuring fleet forwarding, repairing missing rsyslog forwarding, or updating forwarding after server_url or syslog port changes.

syslog-dr

Run a comprehensive syslog-mcp health check covering environment, config quality, storage, ports, service status, HTTP health, MCP actions, listener reachability, Docker ingest, and fleet rsyslog forwarding. Use when the user asks for syslog doctor, deployment diagnostics, first-run preflight, health check, sanity check, or broad deployment verification.

syslog-frustration-assessment

Consume a syslog abuse_investigate JSON evidence bundle and produce a deep Markdown assessment covering signal authenticity, agent/user/external factors, good practices, recommended follow-ups, and evidence-backed Beads for critical/P1 issues only.

Data & Documents Listed

syslog-report

Generate a time-bounded markdown report from the syslog MCP server covering fleet activity, errors, stale hosts, correlations, and recommended actions.

syslog-troubleshoot

Troubleshoot syslog-mcp connection failures, missing logs, unhealthy containers, restart loops, or vague "logs aren't working" reports.

syslog

This skill should be used when the user asks to "search logs", "check errors", "tail logs", "show recent logs", "find log entries", "correlate events", "list hosts", "log stats", "syslog", "check homelab logs", or mentions system logs, syslog, log analysis, or log intelligence across homelab hosts.

syslog-logs

Tail or follow syslog-mcp service logs from Docker Compose. Use when the user asks for syslog-mcp service logs, startup logs, crash logs, plugin deployment logs, Docker logs, or follow mode. This is for the service's stdout/stderr, not client syslog entries.

DevOps & Infrastructure Listed

syslog-redeploy

Re-run the syslog-mcp plugin setup hook with the current userConfig and verify the Docker Compose deployment. Use when the user asks to redeploy syslog-mcp, apply plugin config changes immediately, rerun the setup hook, refresh the Docker deployment, or recover after an automated SessionStart/ConfigChange hook did not run.

syslog-version-check

Check whether the running syslog-mcp Docker container matches the local Compose image. Use when the user asks whether syslog-mcp is current, stale, deployed, updated, running the latest plugin image, or needs a restart/recreate after an upgrade. Supports an optional --pull mode for Docker image comparison.

axon-rag-synthesize

RAG synthesis prompt for axon ask — source-grounded, depth-adaptive, injection-hardened. Loaded at runtime by src/vector/ops/commands/ask/synthesis_prompt.rs.

axon

Use whenever the user wants to crawl, scrape, or extract a website; ingest a GitHub repo, Reddit, YouTube, or local AI sessions; embed content into Qdrant; run semantic search; ask grounded RAG questions; or manage axon's async job queues. Also use when the user mentions axon, the crawler, hybrid search, Qdrant, Tavily, or the MCP tool surface.

ask

Use when the user wants to ask a question and get an LLM-synthesized answer grounded in indexed documents, do RAG over previously crawled or embedded content, get cited answers from the knowledge base, or find information that was previously indexed. Triggers on "ask axon", "what does the documentation say about", "according to what I've indexed", "RAG query", "use axon to answer", or any question where the user wants grounded answers from indexed content rather than hallucination.

crawl

Use when the user wants to crawl an entire website, documentation site, or multiple pages from a domain; index a whole docs section; or follow links deeply across a site. Triggers on "crawl this site", "index the whole docs", "crawl all pages under", "spider this URL", "index the entire", "grab all pages from". Prefer over scrape when breadth matters — multiple pages across a site.

domains

Use when the user wants to see which domains have indexed content, get a summary grouped by domain, check how many pages from each site are stored, or audit coverage by website. Triggers on "list indexed domains", "which domains are in axon", "how many pages from each site", "domain breakdown", "show domains", "what sites are indexed". Similar to sources but grouped by domain — use domains for a high-level view, sources for individual URL details.

dr

Use when the user wants to check if axon services are healthy, diagnose connectivity problems, verify Qdrant/TEI/Chrome are reachable, troubleshoot why axon isn't working, or run a health check. Triggers on "axon doctor", "check axon health", "is axon working", "troubleshoot axon", "why is axon failing", "check services", "health check", "can axon connect to". Always run this first when something seems broken.

embed

Use when the user wants to embed a local file, directory, or URL into Qdrant; index local documents or code into the RAG; add files from disk to the knowledge base; or re-embed stale content. Triggers on "embed this file", "index this directory", "add to Qdrant", "embed local files", "embed this folder", "index my docs", "add this PDF", "embed into the knowledge base". Different from scrape/crawl (which fetches from web) — embed indexes content already on disk or from a URL directly.

Data & Documents Listed

extract

Use when the user wants to extract structured data from a web page using an LLM, parse specific fields from a URL (prices, names, dates, specs), get structured JSON from a page, or do LLM-powered data extraction. Triggers on "extract data from", "pull structured data from", "get the pricing table from", "parse the fields from", "extract JSON from this URL", "structured extraction". Different from scrape (raw markdown) — extract uses an LLM to interpret and structure the content.

ingest

Use when the user wants to index a GitHub repository, ingest a Reddit subreddit or thread, index a YouTube video or playlist, or import past Claude/Codex/Gemini session transcripts into axon. Triggers on "ingest this repo", "index this GitHub repo", "add this Reddit thread", "ingest subreddit", "index YouTube video", "import my sessions", "ingest GitHub", "index r/", "add this repo to axon". Also use when the user wants to make source code searchable via RAG.

map

Use when the user wants to discover all URLs on a site without fetching content, preview what pages exist before crawling, get a sitemap of a site, or explore the URL structure of a domain. Triggers on "map this site", "what pages exist at", "list all URLs on", "discover URLs", "show me the site structure", "find all pages before crawling". Fast and non-destructive — does not embed anything.

query

Use when the user wants to do a semantic vector search over indexed content, find relevant chunks matching a query, search the Qdrant knowledge base, or get raw search results without LLM synthesis. Triggers on "search axon", "query the knowledge base", "find chunks about", "vector search for", "semantic search", "what's indexed about", "find relevant passages". Different from `ask` (which synthesizes an answer) — query returns raw matching chunks with scores.

retrieve

Use when the user wants to fetch all stored chunks for a specific URL from Qdrant, get everything indexed from a particular page, or see what was stored for a specific source. Triggers on "retrieve from axon", "get the indexed content for this URL", "fetch stored chunks for", "what did axon store from", "show me what's indexed at". Different from query (keyword search) — retrieve fetches by exact URL.

scrape

Use when the user wants to scrape a single URL or a few URLs to markdown, fetch a page's content, extract text from a web page, or save a URL's content into Qdrant. Triggers on "scrape this URL", "fetch the content of", "get the text from this page", "save this page to axon", "read this webpage into the RAG", or when the user pastes a URL and wants its content extracted. Prefer this over crawl when only specific pages are needed rather than a whole site.

search

Use when the user wants to search the web via Tavily and index the results, find recent information on a topic and store it, or combine live web search with automatic crawling. Triggers on "search the web for", "find recent articles about", "search and index", "Tavily search", or when the user wants to pull fresh web content into axon. Different from `query` — this searches the live web, not already-indexed content.

sources

Use when the user wants to see all indexed URLs, list what pages are in the knowledge base, check which URLs have been scraped or crawled, audit what's in the vector store, or find out if a specific URL is indexed. Triggers on "list indexed sources", "what URLs are indexed", "show me the sources", "what's in axon", "which pages are stored", "list all indexed URLs", "what did I crawl". Different from domains (grouped by domain) — sources shows individual URLs.

stats

Use when the user wants to see Qdrant collection statistics, check how many points or vectors are indexed, see collection size, or get an overview of the vector store. Triggers on "axon stats", "how many vectors", "collection size", "how many points in Qdrant", "vector store stats", "how much is indexed", "collection stats". Different from sources (URL list) and status (job queue).

status

Use when the user wants to see the current job queue status, check what jobs are running or pending, monitor async jobs, or get an overview of the job queue. Triggers on "job status", "what's running in axon", "check the queue", "any jobs pending", "axon status", "what's in progress". Different from doctor (service health) — status shows job activity.