Set up
Runs on your computer. Pick your agent and operating system.
This project does not publish an install method we can turn into a config. Follow the README instead.
README
synced Oct 22, 2026Opsphere — DevOps & SRE Intelligence for Cursor
Query logs, diagnose incidents, check deploys, and manage your infrastructure — without leaving the IDE.
What is Opsphere?
Opsphere is a DevOps and SRE intelligence plugin for Cursor. It connects your monitoring, deployment, and issue-tracking stack to the AI agent through a secure remote MCP gateway (mcp-cursor.opsphere.io). The plugin bundle ships rules, skills, agents, and mcp.json; tool execution and credential storage run on the gateway. Ask in natural language:
- "Search Datadog logs for payment errors in the last hour"
- "What's failing in Sentry right now?"
- "What was the last deployment in production?" —
deployment_statusacross your configured platforms - "What's wrong with my Bedrock agent?" — diagnose agent + action-group Lambdas (paid
awsmodule) - "Check DNS for mysite.com across all resolvers"
- "Diagnose the failed Bitbucket pipeline"
Everything runs through a secure remote MCP server — by design. Credentials are not stored in the plugin bundle or your workspace. OAuth2 + PKCE via Cursor Connect.
Architecture diagram and domain list: docs/REMOTE-MCP-ARCHITECTURE.md.
Connect another client
Use /opsphere-connect-another-client to reuse the same Opsphere account in Cursor, Codex, Claude Code, Warp, OpenCode, Antigravity, GitHub Copilot CLI or another compatible MCP host. Each client completes OAuth independently and receives its own revocable session; never copy token files between applications.
Warp local, OpenCode, Antigravity and GitHub Copilot CLI MCP are available across all Opsphere plans without per-user invitations. Optional packages: opsphere-warp/, opsphere-opencode/ (node install.mjs then opencode mcp auth opsphere), opsphere-antigravity/ (agy plugin install), opsphere-copilot/ (copilot plugin install). Opsphere OAuth is not supported in Warp/Oz cloud environments or Copilot cloud agent. Cursor, Codex and Claude Code continue to use their existing plugin manifests. Antigravity uses stable CIMD; OpenCode and Copilot CLI use DCR. Verified GitHub install commands: docs/MULTICLIENT-SUPPORT.md. See docs/INSTALL.md for OpenCode, Antigravity and Copilot steps.
VS Code with GitHub Copilot
Install opsphere-vscode from the GitHub-backed Opsphere agent marketplace, without cloning. See opsphere-vscode/ for installation, OAuth, local testing and removal. This package is separate from Copilot CLI.
Client integrations
Opsphere works with several AI clients. All of them use the same remote MCP gateway and the same Opsphere account; each client completes OAuth on its own. Every client has its own README with install steps, OAuth notes, uninstall and a screenshots section.
| Client | What you get | Installs from | Details |
|---|---|---|---|
| Codex / ChatGPT | Codex plugin: shared skills plus the gateway MCP config, for Codex CLI and ChatGPT desktop | Repo root | opsphere-codex/ |
| Claude Code | Claude Code plugin: skills, subagents, slash commands and MCP config, namespaced /opsphere: | Repo root | opsphere-claude/ |
| Antigravity | Agent plugin for agy: skills, agents, rules and mcp_config.json, with stable CIMD OAuth | opsphere-antigravity/ | opsphere-antigravity/ |
| GitHub Copilot CLI | Agent Plugins package: skills plus Copilot agents, commands and rules, with DCR OAuth | opsphere-copilot/ | opsphere-copilot/ |
| Warp (local) | Skills, AGENTS.md rules, agent catalog and profile checklist merged into a project by an installer | opsphere-warp/ | opsphere-warp/ |
| OpenCode | Skills, agents, commands and AGENTS.md rules merged into a project, plus opencode.json MCP config | opsphere-opencode/ | opsphere-opencode/ |
Cursor is covered by the rest of this README. opsphere-codex/ and opsphere-claude/ are documentation-only folders, because those two plugins live at the repo root.
Install from the public repo
Source: https://github.com/opsphere-io/opsphere-plugin. Claude Code and Codex use the repo root; Antigravity, Copilot CLI, Warp and OpenCode use their nested directory.
Claude Code (repo root)
claude plugin marketplace add opsphere-io/opsphere-plugin
claude plugin install opsphere@opsphere
Codex / ChatGPT (repo root)
npx @openai/codex plugin marketplace add opsphere-io/opsphere-plugin --ref main
npx @openai/codex mcp login opsphere
Antigravity (nested: opsphere-antigravity/)
agy plugin install https://github.com/opsphere-io/opsphere-plugin/tree/main/opsphere-antigravity
agy plugin validate ~/.gemini/config/plugins/opsphere
Keep the /tree/main/opsphere-antigravity path. Installing the bare repo URL installs the Cursor/Claude bundle instead.
GitHub Copilot CLI (nested: opsphere-copilot/)
copilot plugin install opsphere-io/opsphere-plugin:opsphere-copilot
Warp and OpenCode (nested: opsphere-warp/, opsphere-opencode/). Neither has a github: install command, so fetch only the folder you need and run its installer against your project (Node.js 20+):
git clone --depth 1 --filter=blob:none --sparse https://github.com/opsphere-io/opsphere-plugin.git
cd opsphere-plugin
git sparse-checkout set opsphere-opencode # or: opsphere-warp
node opsphere-opencode/install.mjs install /absolute/path/to/your-project
opencode mcp auth opsphere # OpenCode only, from your project
For Warp, enable the project MCP in Warp and complete browser OAuth. Then start a new session in the client and sign in with the same email as your other Opsphere clients. Full flows, uninstall steps and troubleshooting are in each client README above and in docs/MULTICLIENT-SUPPORT.md.
Screenshots and prompts for each client
Every client README already shows the shared sign-in screenshots (oauth-login.png and oauth-signup.png, reused from the Cursor set), because the browser sign-in page is the same for all clients. Do not capture those again per client. Each README also has a template for the client-specific shots. To fill it in, capture the shots below and save them as PNG in assets/screenshots/ with the client slug as a prefix, for example assets/screenshots/warp-install.png. Use the slugs codex, claude, antigravity, copilot, warp and opencode. Then uncomment the template in that client's README and remove the "coming soon" line. Antigravity, Claude Code, Copilot and OpenCode are already done: their antigravity-*.png, claude-*.png, copilot-*.png and opencode-*.png sets are in place and shown in opsphere-antigravity/, opsphere-claude/, opsphere-copilot/ and opsphere-opencode/. Use them as the model for the others: each walks through sign-in and the first call step by step, with a caption per shot. The number of shots depends on the client's setup flow.
Capture rules
- Use a fresh session, a throwaway project and a Community (free) account. Install the client as an end user would, from the public repo.
- Crop to the terminal or app window. Use one theme (dark) and a similar width across clients so the pages look consistent.
- Redact before saving: your email, workspace and tenant names, authorization codes, and any browser URL containing
code=orstate=. Never show a token file orconfig.tomlcontents. - Run only the read-only prompts below. Do not capture any configure flow that asks for credentials.
Shots (file names match the templates)
| File | What to capture |
|---|---|
<client>-install.png | The install command and its successful output |
<client>-connected.png | The client showing Opsphere connected (see the table below) |
<client>-first-call.png | The response to the first prompt below |
<client>-endpoint-health.png | The response to the endpoint-health prompt. This is the equivalent of Cursor's dns-diagnosis.png |
<client>-integration-status.png (optional) | The response to the integration-status prompt. Not in the template; add a row to it if you capture this one |
Antigravity used a longer sequence of self-explanatory names (antigravity-mcp-noauth, -callback, -success, -mcp-connected, -check-dns-one, -check-dns-two). Extra steps like these are fine; keep the <client>- prefix and describe each shot in its caption.
Where to capture and what to run
| Client | Install (<client>-install.png) | Connected (<client>-connected.png) | Prompts to run |
|---|---|---|---|
| Codex / ChatGPT | npx @openai/codex plugin marketplace add opsphere-io/opsphere-plugin --ref main, then Install in Plugins | Plugins → Opsphere, or /mcp | Call ops_my_usage · @endpoint-health check https://example.com · Which integrations do I have set up? |
| Claude Code | claude plugin marketplace add … then claude plugin install opsphere@opsphere | /mcp showing opsphere Connected | /opsphere:opsphere-welcome · @opsphere:endpoint-health check https://example.com · /opsphere:integration-status |
| Antigravity | agy plugin install <tree URL> and agy plugin validate ~/.gemini/config/plugins/opsphere (mcpServers : 1 processed) | MCP section of a new agy session, with Opsphere listed once | Prompts below, worded as "Use opsphere-onboarding…" |
| GitHub Copilot CLI | copilot plugin install opsphere-io/opsphere-plugin:opsphere-copilot, then copilot plugin list | /mcp and /skills list | Prompts below, worded as "Use opsphere-onboarding…" |
| Warp | node opsphere-warp/install.mjs install <project> | Warp MCP settings with Opsphere enabled and running | Prompts below, worded as "Use opsphere-onboarding…" |
| OpenCode | node opsphere-opencode/install.mjs install <project> | /mcps, or opencode mcp list after opencode mcp auth opsphere | /opsphere-welcome · prompts below |
Prompts for Antigravity, Copilot, Warp and OpenCode (the same read-only set from each package's examples/local.md, also usable in the clients above):
| Shot | Prompt |
|---|---|
first-call.png | Use opsphere-onboarding to show my plan and active workspace. Do not change anything. |
endpoint-health.png | Use endpoint-health to check https://example.com. Read-only; do not change infrastructure. |
integration-status.png | Which integrations do I have set up? |
When done, git status should show only new files under assets/screenshots/<client>/ and the edited client README. Run npm test before opening a PR.
Quick Start
- Install Opsphere from the Cursor Marketplace.
- Welcome: type
/opsphere-welcomein chat (or/opsphere-setupfor full onboarding) — see example prompts and next steps. - Connect: click Connect next to Opsphere in Cursor Settings → MCP. A browser window opens — sign up (free, no card needed) or log in. Cursor stores the token automatically.
- Connect your tools: say "Configure my Datadog" — the agent walks you through setup and sends credentials only via
ops_configure_integrationon the gateway (never stored in this repo or in Cursor's plugin files). - Start asking: say "Check DNS for mysite.com" or "What was the last deployment?" — you're live.
Network tools (
dns_lookup,http_check,cert_status) work immediately after step 3 — no integration setup needed.
Slash commands (type in chat)
| Command | When to use |
|---|---|
/opsphere-welcome | Just installed — quick tips and example prompts |
/opsphere-setup | First-run OAuth + first integration (step by step) |
/opsphere-reconnect | Plugin red, 401 or invalid_grant — recover Cursor/Codex OAuth safely |
@reconnect | Codex-native session-expiry recovery with silent post-auth verification |
/integration-status | See which providers are connected |
/link-account | Link/unlink an external workspace (Community → upgrade CTA; Personal Workspace is automatic). Org invites with the same email may link automatically on Developer+. |
/open-work-context | Switch to an external linked workspace (paid). Not needed for Community Personal Workspace |
Type /opsphere-welcome after install for example prompts including subagents (/outage-triage, /endpoint-health, /ci-investigator, /postmortem-writer, /qa-test-investigator, /qa-release-readiness).
No shell scripts run automatically when you open a workspace — you invoke commands and subagents yourself.
Developers / reviewers: to test from source before marketplace install, see docs/INSTALL.md (~/.cursor/plugins/local/opsphere).
How It Works
Remote MCP: Cursor calls one endpoint — https://mcp-cursor.opsphere.io/mcp. See docs/REMOTE-MCP-ARCHITECTURE.md for the full flow and domain list.
Cursor Automations use a separately authorized workload resource so their execution budget cannot be activated by prompt text or shared with interactive sessions. See docs/CURSOR-AUTOMATIONS.md.
You (Cursor chat)
│
▼
Opsphere plugin (rules, skills, MCP config) ← MIT bundle; guides the agent
│ OAuth2 Bearer token (Cursor-managed)
▼
mcp-cursor.opsphere.io/mcp ← ALL tool execution happens here
│
├── Datadog / Vercel / GitHub / AWS / … (server-side only)
└── DNS / HTTP / TLS built-ins
MCP resources (gateway)
After Connect, the gateway exposes 11 read-only MCP resources (policies, catalog, playbooks; plus Hub-only opsphere://hub/* when on Connection Hub). They complement tools — you do not need a resource per integration.
| Resource | Purpose |
|---|---|
opsphere://rules/operational | Tool catalog + your tenant scope (injected into server instructions) |
opsphere://tools/catalog | Enabled modules + prompt list (JSON) |
opsphere://playbooks/index | Guided workflows — outage, pipeline, SonarQube, Cloudflare audit, Bedrock agents (investigate-bedrock-agent), … |
opsphere://tenant/account-context | Full cloud-catalog context per account (infra names, regions, capabilities) |
opsphere://hub/active-context | Hub only — active context_id and linked connection for this MCP session |
opsphere://hub/connections | Hub only — linked organization workspaces (same as ops_accounts_list) |
opsphere://policies/* | Change approval, secrets handling, incident response |
opsphere://taxonomy/severity | SEV1–4 severity taxonomy |
opsphere://inventory/critical-assets | Brands, accounts, regions, apps inventory |
The plugin rule onboarding-guide.mdc tells the agent when to fetch these vs calling tools directly. Details: docs/TOOLS.md#mcp-resources.
Subagents
Opsphere ships specialized subagents in agents/. Invoke them in chat with /agent-name (e.g. /endpoint-health) or ask the main agent to use them. They run on the same remote MCP gateway; output is a structured report back to your thread.
Subagents use advertised tools and respect the active workspace's plan, configuration and execution permissions — no hardcoded tenant or org. Visibility is not authorization. With stable discovery enabled, switching workspace does not require reconnecting; use ops_my_usage and ops_list_integrations to check actual availability. When details are missing (hostname, repo, incident timeline), agents ask before running tool calls.
| Subagent | Invoke | Plans | Read-only | What it does |
|---|---|---|---|---|
| outage-triage | /outage-triage | All | Yes | Multi-step incident triage: alerts, edge (DNS/HTTP/TLS), deploys, logs, K8s/ArgoCD when available. Structured verdict + evidence. |
| endpoint-health | /endpoint-health | All | Yes | Single host/URL check: DNS → HTTP → TLS (+ optional TCP, DNSSEC, Cloudflare, Pingdom on paid catalogs). |
| ci-investigator | /ci-investigator | When CI diagnose tools are entitled and advertised | Yes | Failed CI: GitHub Actions + Bitbucket diagnose, PR/deploy correlation. Missing tools produce plan/configuration guidance. |
| postmortem-writer | /postmortem-writer | All | No* | Post-mortem / RCA draft; optional memory_store (scope=incident) after you approve. Asks for timeline, impact, action items. |
| qa-test-investigator | /qa-test-investigator | All | Yes | Designs focused tests, investigates suspected defects, and returns traceable evidence plus a ticket-ready bug report. |
| qa-release-readiness | /qa-release-readiness | All | Yes | Assesses one release against matching CI, test, deployment, endpoint, and observability evidence. |
* Writes only to operational memory when you confirm — no infra mutations (no deploys, cache purge, workflow dispatch).
When to use which
| You want… | Use |
|---|---|
| Site down, many services, or full incident flow | /outage-triage or macro_outage_triage (Team+) |
| One URL: up? DNS? cert expiry? | /endpoint-health or macro_endpoint_health (Team+) |
| Pipeline or GitHub Actions failed (paid) | /ci-investigator |
| Post-mortem or save lessons learned after resolution | /postmortem-writer |
| Test a feature or determine whether a behavior is a bug | /qa-test-investigator |
| Decide whether a specific release is ready to promote | /qa-release-readiness |
One quick http_check or log search | Main chat — no subagent |
Plan details and subagent rows: docs/PLANS.md. CI blocked on Community: docs/TROUBLESHOOTING.md.
Rules, skills & commands
The plugin bundle is markdown and JSON only — agent guidance, skills, and MCP configuration. Tool implementations live on the gateway.
| Layer | Path | Role |
|---|---|---|
| Always-on rule | rules/onboarding-guide.mdc | Tool catalog, integration triggers, subagent delegation, macro workflows, Community error codes (TRIAL_EXPIRED, RATE_LIMIT_EXCEEDED, READ_ONLY_PLAN, SINGLE_ENVIRONMENT_ONLY), memory hygiene, AWS (IAM keys, not SSO), credential rules |
| Skills | skills/configure-integration/ | Step-by-step provider setup → ops_configure_integration |
skills/set-work-context/ | Tenant work context (ops_set_work_context) | |
skills/link-account/ | Connection Hub — link/unlink external workspaces; org invites may auto-link on same email (Developer+) | |
skills/open-work-context/ | Switch to an external linked workspace (paid); not needed for Community Personal Workspace | |
skills/run-macro-workflows/ | Team+ composite macro_* tools (outage, endpoint, env health) | |
| Commands | commands/ | /opsphere-welcome, /opsphere-setup, /opsphere-reconnect, /opsphere-connect-another-client, /integration-status |
| Subagents | agents/ | Focused investigation and post-mortem flows (table above) |
The onboarding rule tells the main agent when to delegate vs handle inline, to call ops_my_usage before premium subagents when plan is unknown, and not to paste secrets outside the configure flow.
Claude Code does not load
rules/*.mdcas always-on context — see Claude Code above for theopsphere-onboardingskill substitute and/opsphere:/@opsphere:namespacing.
Supported Integrations
| Provider | What you can do | Credentials needed |
|---|---|---|
| Datadog | Search logs · count errors by service · check synthetics | API Key + App Key |
| Vercel | Latest deploys · project status · env vars | API Token |
| Railway | Projects · services · deployments · logs · metrics · env names · incident diagnosis | API token (account, workspace, or project) |
| GitHub | Repo discovery · summary · Actions runs · PRs | Personal Access Token; optional default org |
| Bitbucket | Pipeline list · pipeline diagnosis · PR search | App Password |
| Cloudflare | Zone/DNS status · firewall events · cache purge history · cache analytics · URL cache probe | API Token |
| Jira | Issue search · issue detail · comments | API Token |
| Sentry | Issues list · issue search · project stats | Auth Token |
| SonarQube | Quality gate · measures · issues · hotspots (paid) | Token + host URL |
| Algolia | Index inventory · search · record lookup · API logs (paid); global status/incidents built-in | App ID + restricted API key |
| AWS | Identity check · read-only CLI · Bedrock Agent / Lambda diagnose (paid aws module) | Access Key + Secret Key |
| Network (built-in) | DNS lookup · HTTP check · TLS cert · TCP · Algolia platform status | Nothing — always works |
AWS with the plugin
The Community setup uses IAM Access Key + Secret Access Key. Paid workspaces can instead use admin-configured AWS SSO when the workspace Cloud Catalog contains the profile and the required module is enabled. Local aws sso login on your laptop never supplies the remote gateway. The aws module owns device login, STS, and AWS query tools; the separate aws-sessions module owns session preflight/status/revoke/logout. Enabling one does not enable the other.
On paid plans with the aws module enabled, Opsphere can diagnose Amazon Bedrock Agents (not Agent Core): aws_bedrock_agent_diagnose for agent status, aliases, action groups, IAM, knowledge bases, and findings → aws_lambda_agent_diagnose for each backing Lambda → optional CloudWatch logs. Guided MCP prompt: investigate-bedrock-agent (listed in opsphere://playbooks/index). Details: docs/TOOLS.md.
Tool availability is dynamic. The gateway combines plan entitlements, tenant module settings, integration configuration, runtime, and security policy. Check the current
tools/list; paid does not mean a fixed full catalog.
Example Prompts
| You say | What happens |
|---|---|
"Configure my Datadog" | Guided setup: asks for API Key + App Key, configures and tests in one flow |
"Check DNS for example.com" | Runs dns_lookup across Google, Cloudflare, and system resolvers |
"Is api.mycompany.com up?" | Structured check: /endpoint-health (DNS + HTTP + TLS); or inline tools for a single probe |
"Is the site down?" / widespread outage | /outage-triage or macro_outage_triage (Team+) — multi-step incident report |
"How is PRE doing?" / env health | macro_env_health (Team+) when in tools/list |
"Write a post-mortem for today's outage" | /postmortem-writer — draft + optional incident memory |
"Show my latest Vercel deploys" | Vercel-only: last deployments with status, branch, timestamp |
"What's the status of my Railway project?" | railway_project_status or railway_health_summary (when Railway module enabled) |
"Diagnose my Railway production outage" | railway_incident_diagnosis → railway_logs |
"Configure my Railway" | Guided setup: account, workspace, or project API token |
"What was the last deployment?" / "¿Último despliegue?" | deployment_status(scope=auto) — Vercel, CI, GitOps, S3+CloudFront, ECS from catalog |
"Search Datadog logs for payment errors in the last hour" | Queries Datadog Logs v2 with your filter |
"What's failing in Sentry right now?" | Lists unresolved issues by severity |
"Diagnose the failed Bitbucket pipeline" | Community: bb_pipeline_diagnose inline; paid: delegate /ci-investigator for full report |
"Why did GitHub Actions fail on main?" | Paid: /ci-investigator; Community: ghe_actions_latest or upgrade at pricing |
"Find Jira issues assigned to me" | Searches Jira with JQL and returns summaries |
"What GitHub Actions ran on main today?" | Lists latest workflow runs with status |
"Why did SonarQube fail on main?" | sq_last_scan_summary or sq_quality_gate_status → sq_issues_search (when SonarQube module enabled) |
"Find this SonarCloud project" (paste URL) | sq_projects_search(q=<URL>) → sq_last_scan_summary |
"Summarize acme/backend on GitHub" | ghe_repo_summary(repo=acme/backend) — github.com needs only GHE_TOKEN |
"What repositories can I access?" | ghe_org_repos using the active workspace default org; repo-specific calls prefer owner/name |
"Is Algolia having an outage?" | alg_status + alg_incidents (built-in — no setup) |
"Why is this SKU missing from search?" | alg_object_get → alg_search (when Algolia module enabled) |
"Configure my Algolia" | Guided setup: App ID + restricted Search API key (not Admin) |
"Show my usage" | Displays plan, trial status, and daily tool calls |
"Which integrations do I have set up?" | Lists configured vs. pending providers |
"I accepted my company invite — is my workspace linked?" | ops_accounts_list — same email + Developer+ Hub often links automatically at accept; otherwise /link-account |
"Configure my AWS" | Guided IAM key setup (Access Key + Secret Key — not SSO) |
"List my S3 buckets" | Read-only aws_cli_query using configured keys (no SSO step) |
"What's wrong with Bedrock agent AGENT12345?" | aws_bedrock_agent_diagnose → aws_lambda_agent_diagnose per action-group Lambda; prompt investigate-bedrock-agent (paid aws module) |
"Do we have memory about this outage?" | memory_search (when the memory module is enabled for your tenant) |
"Save this investigation for next time" | memory_store — short distilled summary, not raw logs |
Operational memory: recall and save session notes when your tenant has the
memorymodule enabled. See docs/TOOLS.md.
Screenshots
Getting started
Type /opsp in the chat to access Opsphere commands. | /opsphere-setup guides you through authentication step by step. |
| Sign in with your existing account — browser-based OAuth2. | New user? Create a free account in seconds — no credit card required. |
| Cursor captures the OAuth callback automatically. | Connected — Community, Personal Workspace Active. |
Tools in action
dns_lookup resolves a domain across Google, Cloudflare, and system resolvers simultaneously. | /integration-status shows which providers are active and what tools they unlock. |
Community Plan (free trial)
Opsphere includes a 30-day Community trial with no credit card required:
- Personal Workspace automatic after Sign up free / login — operational immediately
- Organization workspaces: if your company invited you and you accept with the same email as your Connection Hub on a Developer (or higher) plan, that workspace is usually linked automatically — check with
ops_accounts_list. Use/link-accountwhen emails differ or you need to link manually. - Community operational catalog (gateway is source of truth; client UIs may display a different count)
- 100 tool calls per day (resets at midnight UTC)
- Core integrations (Datadog, Vercel, GitHub, Bitbucket, Cloudflare, Sentry, Jira, AWS, … when allowed by plan)
- Network diagnostics (
dns_lookup,http_check,cert_status) — no setup required - Subagents (all plans):
/outage-triage,/endpoint-health,/postmortem-writer,/qa-test-investigator,/qa-release-readiness;/ci-investigatoris paid only ops_my_usage— plan, trial, Personal Workspace, Work Context (separate), usage, integrations, upgrade link
After your trial, upgrade at opsphere.io/pricing for expanded catalog, unlimited daily calls, write access, external workspaces, and premium providers (Kubernetes, ArgoCD, Azure, Akamai, Pingdom, …).
Full comparison: docs/PLANS.md.
Security & Trust
Opsphere is a remote MCP SaaS: this repo is the open-source Cursor plugin bundle (MIT); tool execution and credential storage run on mcp-cursor.opsphere.io.
| Topic | Summary |
|---|---|
| Authentication | OAuth 2.0 + PKCE via Cursor Connect — no secrets in the plugin bundle |
| Credentials | Sent only via ops_configure_integration; encrypted at rest on gateway; never in plugin repo or Cursor plugin files |
| Transport | HTTPS only; credential values not logged; ops_list_integrations shows masked previews only |
| Your code | Not sent to Opsphere unless you paste it in chat |
| Revocation | Revoke the intended OAuth session through support. Disconnecting MCP or removing an integration does not revoke that client session. See multiclient recovery. |
| Bundle hygiene | Markdown + JSON only — no secrets, no install hooks, no exfiltration code in the plugin package |
Automated verification (public repo): every push/PR runs scripts/ci-validate.sh (manifest + hygiene checks) and Gitleaks (full-history secret scan) via .github/workflows/ci.yml. Run locally: npm test.
Cursor security review: "Security agent confirmed no secrets, no install hooks, no exfiltration in bundle."
Full details: SECURITY.md (encryption, retention, isolation, vulnerability reporting). Marketplace copy-paste: docs/SECURITY-AND-TRUST.md.
Legal: Privacy Policy · Terms of Service · docs/PRIVACY.md
Troubleshooting
- Open Cursor Settings → MCP and look for the Opsphere entry. If there is no Connect button, try reloading the window (
Cmd+Shift+P → Reload Window). - Check gateway reachability:
curl https://mcp-cursor.opsphere.io/health - If the gateway is down, check status.opsphere.io.
- Your access token has expired (tokens last 24 hours).
- In Cursor Settings → MCP, click Connect to open a new browser sign-in window and renew automatically.
- Your 30-day free trial has ended.
- Upgrade at opsphere.io/pricing to continue.
- Re-logging in will not fix this — it is a subscription state, not an auth issue.
- You have reached your daily limit of 100 tool calls.
- The limit resets at midnight UTC.
- Say "Show my usage" to check remaining calls via
ops_my_usage. - Upgrade at opsphere.io/pricing for unlimited calls.
- The integration for that provider is not yet configured, or it may require an upgrade / be unavailable on your plan.
- Run
/integration-status(orops_list_integrations) and only say "Configure my [Provider]" for providers listed under available to connect. - If the provider shows requires upgrade or beta, do not treat it as a missing-credentials-only problem.
See docs/TROUBLESHOOTING.md for the full guide.
Codex / ChatGPT
Opsphere is also packaged as a Codex plugin (same remote gateway as Cursor). Version 1.0.19 lives in .codex-plugin/plugin.json — independent from the Cursor marketplace version in .cursor-plugin/plugin.json.
Quick start (Codex CLI)
git clone https://github.com/opsphere-io/opsphere-plugin.git
cd opsphere-plugin
./scripts/codex-install.sh # optional: ChatGPT desktop local marketplace
./scripts/codex-mcp-config.sh # ~/.codex/config.toml (User-Agent + client_id)
npx @openai/codex mcp login opsphere
Verify: ask Codex to call ops_my_usage or use @configure-integration.
Skills (@ in Codex chat)
| Skill | Use when |
|---|---|
@incident-investigation | Outages, downtime, widespread 5xx |
@endpoint-health | Single URL up/down, DNS, TLS expiry |
@ci-investigation | Failed GitHub Actions / Bitbucket / GitLab pipelines |
@postmortem-writer | RCA / post-mortem after an incident |
@configure-integration | Connect Datadog, Vercel, AWS, etc. |
@set-work-context | Account work context (Team plans) |
@configure-deployment-catalog | Deployment sources (Community vs Team) |
@run-macro-workflows | Team/Enterprise macro workflows |
@noibu-analytics | Noibu store health (Store Pulse text), KPIs, domains, issues (preset: checkout, broker aliases, console links) — OAuth in Admin (module noibu); see skills/noibu-analytics/references/opsphere-broker-aliases.md |
Cursor agents (/outage-triage, etc.) map to the first four skills above; keep agents/ and ported skills in sync when editing.
Full install paths (desktop marketplace, troubleshooting): docs/INSTALL.md · docs/TROUBLESHOOTING.md · Codex client README: opsphere-codex/
Claude Code
Opsphere is also packaged as a Claude Code plugin (same remote gateway as Cursor and Codex). Version 1.0.13 lives in .claude-plugin/plugin.json — independent from the Cursor and Codex manifest versions. MCP configuration is a dedicated .claude.mcp.json (Claude requires "type": "http" and a camelCase oauth.clientId; it is not compatible with Codex's .mcp.json).
Quick start (Claude Code CLI)
From the marketplace (.claude-plugin/marketplace.json):
claude plugin marketplace add opsphere-io/opsphere-plugin
claude plugin install opsphere@opsphere
From source (local testing without installing):
git clone https://github.com/opsphere-io/opsphere-plugin.git
cd opsphere-plugin
claude --plugin-dir .
Inside Claude Code:
/reload-plugins # after pulling changes
/mcp # opsphere → Connected (or Needs authentication → login)
claude mcp login opsphere # re-auth from the shell if needed
/opsphere:opsphere-welcome
Skills and subagents (/opsphere: and @opsphere: in Claude Code)
The manifest name: opsphere namespaces every skill and subagent:
| Concept | Cursor | Codex | Claude Code |
|---|---|---|---|
| Skill invoke | /opsphere-welcome | @opsphere-welcome | /opsphere:opsphere-welcome |
| Agent invoke | /outage-triage | @incident-investigation | @opsphere:outage-triage |
| Connect MCP | Settings → Extensions | codex mcp login | /mcp or claude mcp login opsphere |
| Reload after edits | Reload Window | new Codex task | /reload-plugins |
The plugin includes 16 skills/ and 6 agents/; the portable Warp, OpenCode, Antigravity and Copilot packages include the 10 operational skills that apply there. Claude Code has no always-on rule mechanism (unlike Cursor's rules/onboarding-guide.mdc); the closest substitute is skills/opsphere-onboarding/SKILL.md, invoked with /opsphere:opsphere-onboarding.
Claude Code client README: opsphere-claude/.
Data & privacy
| Topic | Detail |
|---|---|
| Sent to Opsphere | OAuth tokens (via Cursor), tool parameters, integration credentials only via ops_configure_integration, usage metadata |
| Not stored locally | Integration secrets never persist in this repo, the plugin bundle, or workspace plugin files |
| Not sent | Your workspace source code (unless you paste it in chat) |
| Stored server-side | Integration credentials encrypted per tenant on Opsphere; audit events for configure/remove (no secret values in logs) |
| Full policy | docs/PRIVACY.md · opsphere.io/privacy |
Uninstall & revoke access
- Remove plugin: Cursor Marketplace → uninstall, or remove the plugin from your team marketplace.
- Disconnect MCP: Cursor Settings → MCP → disable/remove Opsphere.
- Revoke integrations: say "Remove my Datadog integration" or use
ops_remove_integration. - Account deletion: email contact@opsphere.io.
Removing the plugin does not automatically delete your Opsphere account or server-side credentials.
Links
- Website: opsphere.io
- Pricing: opsphere.io/pricing
- Status: status.opsphere.io
- Support: contact@opsphere.io
- Architecture (remote MCP): docs/REMOTE-MCP-ARCHITECTURE.md
- Codex publish (Fase 5): docs/PRE-PUBLISH-AUDIT.md · docs/CODEX-TEST-CASES.md
- Plans & subagents: docs/PLANS.md
- Tool reference: docs/TOOLS.md
- Security & Trust: SECURITY.md · docs/SECURITY-AND-TRUST.md
- Privacy: docs/PRIVACY.md · opsphere.io/privacy
- Security policy (vulnerabilities): SECURITY.md
- Terms: opsphere.io/terms
License
MIT — see LICENSE.
Opsphere is an independent product; not affiliated with or endorsed by Cursor/Anysphere.