Skip to Content
DojOps: AI-powered DevOps automation. Learn more →
ComponentsSpecialist Agents

Specialist Agents

DojOps includes 32 built-in specialist agents for keyword-based prompt routing, plus support for user-defined custom agents. Each agent has a domain-specific system prompt, keyword set, and optional tool dependencies.


How Routing Works

When you send a prompt to DojOps, the AgentRouter scores it against each agent’s keyword list:

  1. Keyword matching, Each agent has a set of domain-specific keywords. The router counts how many keywords appear in the prompt.
  2. Primary keyword boosting, Each agent also has a primaryKeywords subset (typically 3-5 keywords) that receive higher weight during scoring, ensuring strong domain signals are prioritized.
  3. Confidence scoring, The score is normalized based on keyword match density. Higher scores indicate stronger domain relevance.
  4. Threshold check, If the highest-scoring agent exceeds the confidence threshold, the prompt is routed to that specialist.
  5. Fallback, If no agent exceeds the threshold, the prompt goes to the general-purpose DevOpsAgent.

The selected agent’s system prompt is prepended to the LLM request, providing domain-specific instructions and constraints.


Agent List

#AgentDomainDescription
1ops-cortexorchestrationTask decomposition, cross-domain routing, dependency ordering, strategy, roadmap, migration planning
2terraform-specialistinfrastructureTerraform, HCL, modules, state management, workspaces, providers, cost optimization
3kubernetes-specialistcontainer-orchestrationDeployments, Helm, RBAC, autoscaling, service mesh, ingress, operators, CRDs
4cicd-specialistci-cdGitHub Actions, GitLab CI, Jenkins, build optimization, pipelines, artifacts, caching
5security-auditorsecurityVulnerability scanning, secret management, IAM, RBAC, CVEs, threat modeling, encryption
6observability-specialistobservabilityPrometheus, Grafana, Datadog, tracing, SLOs, SLIs, alerting, OpenTelemetry, logging
7docker-specialistcontainerizationMulti-stage builds, image optimization, registries, BuildKit, Compose, distroless images
8cloud-architectcloud-architectureAWS/GCP/Azure design, cost optimization, migration strategies, serverless, well-architected
9network-specialistnetworkingDNS, load balancers, VPN, CDN, service mesh, firewall rules, VPC, subnets, proxies
10database-specialistdata-storagePostgreSQL, MySQL, Redis, DynamoDB, MongoDB, replication, backup, migration, schema design
11gitops-specialistgitopsArgoCD, Flux, drift detection, sealed secrets, progressive delivery, reconciliation
12compliance-auditorcomplianceSOC2, HIPAA, PCI-DSS, GDPR, policy-as-code (OPA/Rego), Kyverno, CIS benchmarks
13ci-debuggerci-debuggingLog analysis, root cause diagnosis, flaky test detection, error classification
14appsec-specialistapplication-securityOWASP Top 10, SAST/DAST, code review, pentest methodology, Snyk, Trivy, Gitleaks
15shell-specialistshell-scriptingBash/POSIX, ShellCheck, error handling, cron, automation, sed, awk, pipefail
16python-specialistpython-scriptingType hints, pytest, Poetry, async, Flask, Django, FastAPI, mypy, ruff
17devsecops-reviewerdevsecops-reviewDevSecOps review pipeline: tool validation, Context7 docs, structured LLM analysis of DevOps configs
18sre-specialistsite-reliabilitySLOs, SLIs, error budgets, incident management, capacity planning, toil reduction
19cost-optimizercost-optimizationCloud cost analysis, FinOps, right-sizing, reserved instances, spot strategies, budget alerts
20incident-responseincident-managementIncident triage, severity classification, RCA, communication plans, escalation paths
21remediation-specialistremediationCVE fixes, dependency updates, config hardening, security patching, compliance gap closure
22performance-engineerperformanceLoad testing (k6, Locust, Gatling), profiling, bottleneck identification, caching strategies
23api-security-specialistapi-securityOAuth 2.0, JWT, OWASP API Top 10, API gateway, rate limiting, CORS, mTLS
24container-securitycontainer-securityImage scanning (Trivy, Grype), runtime security (Falco), pod security standards, SBOM
25secret-managementsecretsHashiCorp Vault, AWS/GCP/Azure secret managers, rotation, KMS, SOPS, external secrets
26log-analyzerlog-analysisELK, Loki, Fluentd, structured logging, log parsing, anomaly detection, correlation
27migration-specialistmigrationCloud migration, database migration, blue-green cutover, data pipelines, rollback planning
28chaos-engineerchaos-engineeringLitmus, Chaos Mesh, Gremlin, game days, failure injection, resilience testing, blast radius
29platform-engineerplatform-engineeringInternal developer platforms, Backstage, Crossplane, golden paths, self-service infrastructure
30change-impact-analystchange-analysisBlast radius estimation, dependency tracing, change risk scoring, rollback planning
31runbook-generatorrunbook-generationOperational runbooks, decision trees, escalation paths, PagerDuty/OpsGenie integration
32policy-engine-specialistpolicy-as-codeOPA/Rego, Kyverno, Gatekeeper, admission control, compliance-as-code, conftest

Keywords Reference

Each agent is matched by the following keyword sets:

AgentKeywords
ops-cortexplan, decompose, break down, steps, orchestrate, coordinate, multi-step, project, strategy, roadmap, migration plan, goal, end-to-end, full stack
terraform-specialistterraform, infrastructure, iac, hcl, provision, resource, module, state, backend, workspace, tf, provider, data source, output, variable
kubernetes-specialistkubernetes, k8s, pod, deployment, service, helm, ingress, namespace, kubectl, statefulset, daemonset, hpa, kustomize, operator, crd
cicd-specialistci, cd, pipeline, github actions, build, deploy, release, continuous, jenkins, gitlab ci, artifact, workflow, cache, matrix, runner
security-auditorsecurity, audit, vulnerability, secret, scan, firewall, iam, rbac, cve, threat, penetration, hardening, encryption, tls, certificate
observability-specialistmonitoring, logging, alerting, tracing, prometheus, grafana, datadog, observability, metrics, dashboard, slo, sli, opentelemetry, loki, elk
docker-specialistdocker, dockerfile, container, image, compose, registry, ecr, gcr, buildkit, multi-stage, distroless, alpine, buildx, layer
cloud-architectaws, gcp, azure, cloud, architect, serverless, lambda, s3, ec2, vpc, region, cost, well-architected, migration, landing zone, multi-cloud
network-specialistdns, load balancer, vpn, vpc, subnet, cdn, nginx, traefik, route53, peering, proxy, network, gateway, ssl, http
database-specialistdatabase, postgres, mysql, redis, dynamodb, mongodb, rds, cache, backup, replication, migration, schema, sql, nosql, elasticsearch
gitops-specialistgitops, argocd, flux, reconciliation, sync, promotion, drift, declarative, sealed secrets, sops, rollout, flagger, kustomization, image automation
compliance-auditorcompliance, soc2, hipaa, pci, gdpr, policy, governance, regulation, opa, rego, kyverno, sentinel, cis benchmark, audit trail
ci-debuggerdebug, error, failed, failure, log, broken, fix, timeout, flaky, crash, exit code, stack trace, oom, ci error
appsec-specialistappsec, owasp, xss, injection, csrf, ssrf, pentest, sast, dast, code review, secure coding, exploit, snyk, trivy, gitleaks
shell-specialistbash, shell, shellcheck, sh, zsh, posix, script, cron, sed, awk, grep, pipefail, trap, shebang, systemd, service, timer, unit, journalctl
python-specialistpython, pip, pytest, mypy, ruff, poetry, venv, asyncio, flask, django, fastapi, pep8, pylint, typer
devsecops-reviewerreview, devsecops, validate, audit, compliance, best practices, security review, config review, iac review, pipeline review
sre-specialistsre, reliability, slo, sli, error budget, postmortem, capacity, toil, on-call, pager
cost-optimizercost, expensive, budget, finops, right-size, reserved, spot, savings, spend, billing
incident-responseincident, outage, downtime, pagerduty, opsgenie, severity, rca, root cause
remediation-specialistremediate, patch, vulnerability, cve, upgrade, harden, mitigate
performance-engineerperformance, latency, throughput, load test, bottleneck, slow, profile, benchmark
api-security-specialistapi security, oauth, jwt, oidc, rate limit, cors, api gateway, api key, authorization, authentication
container-securitycontainer security, image scan, falco, seccomp, apparmor, rootless, trivy, grype, cosign, sbom
secret-managementvault, secret, credential, rotate, kms, seal, unseal, secrets manager, external secrets, sops
log-analyzerlog, logging, elk, loki, fluentd, logstash, kibana, parse, aggregate, structured log, syslog
migration-specialistmigrate, migration, lift and shift, replatform, rearchitect, cutover, blue-green migration, data migration
chaos-engineerchaos, chaos engineering, litmus, chaos mesh, gremlin, game day, fault injection, resilience, blast radius
platform-engineerplatform, idp, backstage, crossplane, golden path, developer experience, self-service, portal, scaffold
change-impact-analystimpact, blast radius, change risk, downstream, dependency, rollback plan, risk score, affected
runbook-generatorrunbook, procedure, playbook, standard operating, escalation, decision tree, operational guide
policy-engine-specialistopa, rego, kyverno, gatekeeper, admission, policy, guardrail, constraint, enforce, conftest

Tool Dependencies

Some agents declare external tool dependencies that enhance their capabilities:

AgentTool Dependency
terraform-specialisthcl2json
kubernetes-specialistyaml-lint
cicd-specialistyaml-lint
security-auditorsnyk
docker-specialistdockerfilelint
gitops-specialistyaml-lint
compliance-auditor@open-policy-agent/opa-wasm
appsec-specialistsnyk
shell-specialistshellcheck
python-specialistpyright
policy-engine-specialist@open-policy-agent/opa-wasm

Using Agents

CLI

# List all agents dojops agents list # Show agent details (partial names supported) dojops agents info terraform # matches terraform-specialist dojops agents info security # matches security-auditor dojops agents info cloud # matches cloud-architect dojops agents info terraform-specialist # exact name also works # Pin chat to an agent dojops chat --agent=terraform

API

# List all agents curl http://localhost:3000/api/agents

Automatic Routing

Agents are selected automatically based on prompt content. No manual routing is needed:

# Routes to terraform-specialist (matches: terraform, s3, iac) dojops "Create a Terraform config for S3" # Routes to kubernetes-specialist (matches: kubernetes, deployment, nginx) dojops "Write a Kubernetes deployment for nginx" # Routes to cicd-specialist (matches: github actions, pipeline, ci) dojops "Set up GitHub Actions CI pipeline" # Routes to ops-cortex (matches: plan, multi-step, end-to-end) dojops plan "Set up end-to-end CI/CD with Docker and Kubernetes"

Custom Agents

In addition to the 32 built-in agents, you can create your own custom agents. Custom agents participate in the same keyword-based routing as built-in agents and can even override built-in agents by name.

Agent Definition Format

Each custom agent is a directory with a structured README.md:

.dojops/agents/sre-specialist/README.md
# SRE Specialist ## Domain site-reliability ## Description SRE specialist for incident response, reliability engineering, and observability. ## System Prompt You are an SRE specialist. You specialize in: - Incident response and post-mortems - SLO/SLI design and error budgets - Chaos engineering and resilience testing - On-call runbooks and escalation procedures - Capacity planning and performance optimization When asked about infrastructure, focus on reliability patterns... ## Keywords sre, incident, reliability, error budget, slo, chaos, postmortem, runbook, on-call, resilience

Required sections: ## Domain, ## Description, ## System Prompt, ## Keywords (comma-separated).

Discovery Paths

Custom agents are discovered from two locations:

LocationPathScope
Project.dojops/agents/<name>/README.mdCurrent project only
Global~/.dojops/agents/<name>/README.mdShared across all projects

Project agents override global agents with the same name.

Creating Custom Agents

LLM-generated (recommended):

dojops agents create "an SRE specialist for incident response and reliability"

The LLM generates a complete agent definition (name, domain, description, system prompt, keywords) and writes the README.md to .dojops/agents/<name>/.

Manual creation:

dojops agents create --manual

Interactive prompts guide you through defining name, domain, description, system prompt, and keywords.

Global agents (shared across projects):

dojops agents create --global "a cost optimization specialist"

Managing Custom Agents

# List all agents (built-in + custom) dojops agents list # Show agent details (partial names supported, includes source path for custom agents) dojops agents info sre # matches sre-specialist # Remove a custom agent dojops agents remove sre-specialist

Routing with Custom Agents

Custom agents are routed exactly like built-in agents, by keyword matching. If a custom agent’s keywords match the prompt with higher confidence than any built-in agent, the custom agent handles the request:

# Routes to custom sre-specialist (matches: sre, error budget, slo) dojops "Design SLOs and error budgets for our payment service"

Agents in Plan Execution

Beyond prompt routing, agents also participate in plan execution. When dojops plan decomposes a goal into a task graph, the LLM assigns a specialist agent to each task based on domain relevance.

During execution, the assigned agent’s system prompt is injected as domain context into the skill’s LLM call. This means the LLM sees both:

  • Agent expertise, Domain-specific knowledge (e.g., Terraform state management, K8s security best practices)
  • Skill instructions, The skill’s generation format and rules (e.g., “output valid HCL”)
Goal: "Set up CI/CD with Docker and Kubernetes" Task 1: github-actions [cicd-specialist] -> CI/CD pipeline expertise Task 2: dockerfile [docker-specialist] -> Multi-stage build patterns Task 3: kubernetes [kubernetes-specialist] -> Deployment best practices

Agent assignment is optional, tasks where no specialist clearly matches proceed without additional domain context. Both built-in and custom agents participate in delegation.

See Task Planner for details on the decomposition and execution flow.


Built-in Agent Configuration

Built-in agents are defined in packages/core/src/agents/specialists.ts. Each agent specifies:

  • name, Unique identifier
  • domain, Category label
  • description, System prompt context
  • keywords, Array of matching keywords for routing
  • primaryKeywords, Subset of keywords with boosted weight for stronger routing signals
  • toolDependencies, Optional external tools

All agents include a NO_FOLLOWUP_INSTRUCTION suffix ensuring single-shot responses without conversational follow-ups.


Specialized Analyzers

In addition to the 32 routed agents, DojOps provides three specialized analyzers that are invoked directly (not via AgentRouter):

AnalyzerClassInputOutput SchemaCLI Command
CI DebuggerCIDebuggerCI log contentCIDiagnosisSchemadojops debug ci
Infra DiffInfraDiffAnalyzerDiff contentInfraDiffAnalysisSchemadojops analyze diff
DevOps CheckerDevOpsCheckercontext.json + filesCheckReportSchemadojops check

DevOps Checker

The DevOpsChecker (packages/core/src/agents/devops-checker.ts) analyzes DevOps files detected during dojops init for quality, security, and best practices. It produces:

  • Maturity score (0-100), Minimal (0-25), Basic (26-50), Good (51-75), Excellent (76-100)
  • Findings, Severity-ranked issues (critical, error, warning, info) categorized as security, quality, best-practice, performance, or reliability
  • Missing files, Important DevOps files the project should have but doesn’t
dojops check # Display formatted report dojops check --output json # Machine-readable JSON output