Menu

Individual skill

mirrord-propagation-discovery

0upvotes

Scans a live Kubernetes environment with `mirrord dump` to find an identifier mirrord can filter traffic on: a header, a `baggage` or `tracestate` member, a tenant or user id, a trace id (W3C, B3, X-Ray, Google, Jaeger), a JWT claim, a cookie, a path segment, or a JSON body field that is present on every hop of a request chain, unique to one developer's traffic, and settable by that developer. Runs mirror-only dumps on each service, sends a tagged probe request at the edge or observes real traffic, scores the candidates, and produces the matching `http_filter` (regex, jq on headers, path, method, body, or combinations) plus a per-hop report of where each identifier is dropped. Installs the mirrord CLI through a package manager when it is missing. Use when the user asks what to filter on, whether the cluster already propagates a request id or trace context, how to isolate their own requests on a shared staging cluster, how to filter on a JWT or cookie with mirrord, or wants to inspect live traffic with mirrord dump. Changes no application code: propagation gaps go to the mirrord-header-propagation skill.

mirrord/mcp/corpus/skills/mirrord-propagation-discovery/SKILL.md

Read pinned source

Source commit 89bfc07c6a44e768cd0d060c79326fe585ae5601

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
Yes
Repository scan complete
No
Skill scan complete
No
Observed behavior
Network or broad shell
Last checked
Nov 9, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
5,409
Repository last updated
Nov 11, 2026
License
MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

# mirrord Propagation Discovery Skill

> mirrord routes a request to a developer's local process when the request matches an HTTP filter. On a shared cluster that filter has to pick out **one developer's requests at every service the request passes through**, so the value it matches on must already travel with the request across all hops. This skill finds that value in a live environment instead of assuming one: it dumps the traffic arriving at each service with `mirrord dump`, checks which identifiers survive from the edge to the last hop, and turns the best one into a `mirrord.json` filter. The sister skill `mirrord-header-propagation` changes code to make `baggage` propagate; this one changes nothing and tells you what already works.

## Security Boundaries

> **IMPORTANT:** Follow these rules for all operations in this skill.

- **Mirror only, never steal, during discovery.** `mirrord dump` copies traffic; the target keeps answering every request. Don't run a `steal` session or an unfiltered session against a shared target while scanning. The only cluster-side effect is the short-lived mirrord agent pod (or ephemeral container) each dump creates.
- **Staging and development clusters only.** Dumps print real request content. Don't point them at production.
- **Dump output is sensitive.** It contains bearer tokens, cookies, API keys and personal data. Keep logs in a temp directory outside the repository, delete them when done, quote header names and value shapes in reports (never full tokens), and never write a value captured from a dump into `mirrord.json`, a ticket, chat, or a commit.
- **Read-only on the cluster:** `kubectl get/describe`, `mirrord ls`, `mirrord dump`. No `kubectl apply/patch/delete`, no Helm, no config changes to ingress or mesh.
- **Probe requests are real requests.** A `POST` at the edge creates real records and real queue messages in that environment. Prefer a read-only endpoint that still fans out; when only a write exercises the flow, say so and use an obviously synthetic payload (a probe email, a test product).
- **Installing mirrord:** use a package manager (Homebrew, Chocolatey) or a pinned release binary from the official docs, and tell the user before you install. Never pipe a remote script into a shell.
Back to top