$curl -o .claude/agents/AGENTS.md https://raw.githubusercontent.com/Raishin/vanguard-frontier-agentic/HEAD/agents/AGENTS.md141 agents across 18 providers. This file is the index; load provider files on demand.
| 1 | # AGENTS.md — Navigation Compass |
| 2 | |
| 3 | 141 agents across 18 providers. This file is the index; load provider files on demand. |
| 4 | |
| 5 | ## File structure |
| 6 | |
| 7 | ``` |
| 8 | agents/<provider>/<agent-id>/AGENT.md ← harness-neutral role contract (load this) |
| 9 | agents/<provider>/<agent-id>/harnesses/ ← 7 adapters: codex, copilot, claude-code, |
| 10 | cursor, gemini, kiro-ide, kiro-cli |
| 11 | agents/<provider>/<agent-id>/metadata.json ← catalog mirror |
| 12 | catalog/agents.json ← machine-readable index of all 127 agents |
| 13 | ``` |
| 14 | |
| 15 | ## Agent tiers |
| 16 | |
| 17 | | Tier | sandbox_mode | When to load | |
| 18 | |---|---|---| |
| 19 | | **review** | `read-only` | Audit, analysis, recommendations — never writes to live systems | |
| 20 | | **router / maestro** | `read-only` | Classifies task → dispatches narrowest specialist(s); never auto-dispatches live-guards | |
| 21 | | **live-guard** | `workspace-write` | Approval-gated mutations; requires current-state capture + explicit sign-off before every write | |
| 22 | |
| 23 | Live-guard agents refuse to proceed without: target confirmation (cluster/account/region), current-state evidence (`kubectl get … -o yaml` / equivalent), and explicit platform-team or operator sign-off. Missing any one is a hard stop. |
| 24 | |
| 25 | --- |
| 26 | |
| 27 | ## 🟧 AWS — 43 agents → [`agents/aws/AGENTS.md`](aws/AGENTS.md) |
| 28 | |
| 29 | **Entry point:** load `agents/aws/aws-maestro-agent/AGENT.md` for any AWS task; it routes to the right specialist and back. |
| 30 | |
| 31 | | Category | Agents | Load when | |
| 32 | |---|---|---| |
| 33 | | **Router** | `aws-maestro-agent` | Any AWS task without a known specialist | |
| 34 | | **IAM / identity** | `aws-iam-least-privilege-review-agent`, `aws-kms-secrets-lifecycle-steward-agent`, `aws-s3-data-perimeter-governor-agent`, `aws-compliance-evidence-mapper-agent` | IAM policy, KMS key policy, S3 perimeter, compliance mapping | |
| 35 | | **Security posture** | `aws-security-posture-hardening-agent`, `aws-bedrock-agent-security-governor-agent` | Security Hub, GuardDuty, Bedrock agent trust | |
| 36 | | **Compute / EKS / ECS** | `aws-eks-platform-operator-agent`, `aws-ecs-fargate-platform-operator-agent`, `aws-ec2-compute-operations-steward-agent`, `aws-ecs-service-remediation-operator-agent` | EKS cluster ops, ECS/Fargate service review, EC2 operations | |
| 37 | | **Databases** | `aws-rds-aurora-performance-investigator-agent`, `aws-dynamodb-data-modeling-performance-review-agent` | RDS/Aurora query tuning, DynamoDB data model | |
| 38 | | **Serverless** | `aws-serverless-production-readiness-agent`, `aws-serverless-rollout-corrector-agent` | Lambda readiness, canary/alias rollout | |
| 39 | | **Networking / edge** | `aws-network-architect-agent`, `aws-api-edge-delivery-review-agent` | VPC/TGW/DirectConnect, API Gateway + CloudFront + WAF | |
| 40 | | **IaC** | `aws-iac-change-safety-review-agent`, `aws-iac-patch-executor-agent` | CDK/CFN/SAM/Terraform review, IaC file patching | |
| 41 | | **Cost / FinOps** | `aws-cost-optimization-governor-agent`, `aws-cost-anomaly-watch-coordinator-agent` | Cost Explorer, budget drift | |
| 42 | | **CI/CD / DevOps** | `aws-ci-cd-release-engineer-agent`, `aws-devops-agent-skill-designer-agent`, `aws-pipeline-fix-operator-agent`, `aws-deployment-hotfix-operator-agent` | CodePipeline, release gates, hotfix patching | |
| 43 | | **Architecture** | `aws-solution-architect-agent`, `aws-migration-cutover-architect-agent`, `aws-resilience-bcdr-review-agent`, `aws-event-driven-architecture-review-agent`, `aws-landing-zone-governor-agent`, `aws-network-architect-agent` | Solution design, migrations, BCDR, event-driven, Control Tower | |
| 44 | | **AI / Bedrock** | `aws-generative-ai-developer-agent`, `aws-agentcore-agent` | Bedrock app dev, AgentCore deployment | |
| 45 | | **Ops / observability** | `aws-observability-incident-responder-agent`, `aws-daily-operations-briefing-coordinator-agent`, `aws-ticket-triage-escalation-coordinator-agent`, `aws-change-impact-advisor-agent`, `aws-data-protection-backup-steward-agent`, `aws-limits-capacity-planner-agent`* | CloudWatch, incident triage, ops briefing | |
| 46 | | **Live-guard (5)** | `aws-live-deployment-guarded-operator-agent`, `aws-live-ecs-rollout-guard-agent`, `aws-live-iac-change-guard-agent`, `aws-live-pipeline-approval-operator-agent`, `aws-live-serverless-release-guard-agent` | Approval-gated live mutations; never auto-dispatched | |
| 47 | |
| 48 | > For operational rules, credential chain guidance, and MCP tool usage → [`agents/aws/AGENTS.md`](aws/AGENTS.md) |
| 49 | |
| 50 | --- |
| 51 | |
| 52 | ## 🟦 Azure — 32 agents → [`agents/azure/AGENTS.md`](azure/AGENTS.md) |
| 53 | |
| 54 | **Entry point:** load `agents/azure/azure-maestro-agent/AGENT.md` for any Azure task. |
| 55 | |
| 56 | | Category | Agents | Load when | |
| 57 | |---|---|---| |
| 58 | | **Router** | `azure-maestro-agent` | Any Azure task without a known specialist | |
| 59 | | **Identity / RBAC** | `azure-rbac-review-agent`, `azure-role-selector-agent`, `azure-entra-id-specialist-agent`, `azure-identity-governance-review-agent` | Role assignments, custom roles, Entra ID posture, identity governance | |
| 60 | | **AKS / containers** | `azure-aks-platform-operator-agent` | AKS cluster ops, node pool, networking | |
| 61 | | **App Service** |