Vanguard Frontier Agentic

This is the edge of agentic intelligence — an enterprise-grade ecosystem for running AI agents at scale in environments where a wrong move is a board-level incident. It collects reusable skills, agents, rules, MCP references, and supporting assets for AWS, Azure, OCI, GCP, Alibaba Cloud, Huawei Cloud, Kubernetes, and Terraform — plus cross-functional Legal, HR, Marketing, Salesforce, .NET, Java, Kotlin, PHP, FinOps, Accounting, Finance, Oracle NetSuite ERP, SAP S/4HANA + BTP ERP, Microsoft 365 / Dynamics 365, and Azure-ecosystem Databricks and Snowflake data-platform agentic ecosystems.

This is not just cloud infrastructure tooling. It is agentic coordination: maestro routing, escalation-aware protocol, structured handoff between specialists, and refusal-by-default safety on every irreversible action. Cloud is one domain it operates in. Coordination, governance, and escalation are the product.

📊 Catalog at a glance

• 🧠 Skills = step-by-step workflows an AI assistant can follow.
• 🤖 Agents = reusable expert roles for review, architecture, and operations.
• 📏 Rules = durable instructions for a specific AI harness.
• 🔌 MCP references = trusted notes for connecting tools to real systems.
• 🗂️ Catalogs = machine-readable indexes so tools can discover everything.

Works with: Claude Code  ·  Codex  ·  GitHub Copilot  ·  Cursor  ·  Gemini CLI  ·  Kiro  ·  and any other coding agent.

📦 Available on npm: @raishin/vanguard-frontier-agentic is published on the public npm registry.

⚠️ ALPHA FINOPS BUNDLE: As of v1.8.0, this package includes 4 new experimental FinOps agents and 7 skills for cloud cost optimization, AI economics modeling, Kubernetes rightsizing, and FOCUS-spec normalization. All are marked lifecycle: experimental. See the board readiness memo for known limitations, risk mitigation, and 30-day diligence closure requirements. Use at your own risk in pre-production environments. Production deployment requires signed design-partner SOWs, Big 4 accounting validation, and SOC 2 Type II observation (≥150 days).

🛰️ Why Vanguard Frontier?

"Vanguard frontier" is not branding — it is an operating posture. This ecosystem is built for the front line of agentic deployment, where AI agents touch real production systems, real regulated data, and real legal exposure.

• 🏛️ Built for Fortune 50 / high-stakes environments. Every agent assumes the blast radius is enterprise-scale: regulated data, audited controls, and decisions that survive legal discovery. Refusal-by-default beats a fast path to a board-level incident.
• ⚖️ The Legal + HR ecosystem is proof of cross-functional agentic coordination. 28 specialist agents (Legal maestro + 12 specialists, HR maestro + 14 specialists) and 3 cross-functional protocol skills demonstrate that agents can hand off, escalate, and coordinate across organizational boundaries — not just answer in isolation.
• 🧾 Audit-ready, privacy-preserving, escalation-aware by design. Every review and live-guard agent emits a structured verdict (verdict, evidence_level, blockers, safe_next_actions, open_questions) that maps directly to SOC 2, PCI DSS, NIS2, NIST CSF, and ISO 27001 — no post-processing.
• 🛡️ Battle-tested against real compliance, governance, and risk workflows. These patterns are exercised against live IAM mutations, KMS destruction, litigation holds, RIF planning, and privacy reviews — the workflows where a generic agent gets an organization sued.

The bar: an auditor, a regulator, or opposing counsel should be able to read the agent's output and trace exactly who decided what, on what evidence, and who approved the risk.

🧱 What's Inside — the three-layer agentic architecture

Vanguard Frontier is not a flat bag of prompts. It is a deliberate three-layer system, and every domain — cloud providers, Kubernetes, marketing, Legal, HR — follows the same shape.

How it flows: a request enters at the maestro, which routes to a specialist. When a matter crosses a boundary — an HR investigation that needs privileged Legal review, or a Legal hold that triggers an HR data freeze — the cross-functional protocol carries a structured case capsule between agents, preserving privilege, minimizing data, and recording the escalation path.

This is what "agentic coordination" means here: routing, protocol, and escalation are first-class, not improvised.

🚀 Get Started

Pick the install path for your coding agent. Each dropdown is crystal-clear, step-by-step, and one-click plug-and-play where the harness supports it; the npm/export path works for everything else.

At a glance — which path is yours:

Expand the matching dropdown below for the full step-by-step.

/plugin marketplace add Raishin/vanguard-frontier-agentic
/plugin install vanguard-frontier-agentic@vanguard-frontier-agentic

Or wire it into ~/.claude/settings.json (or your project's .claude/settings.json) for team-wide trust:

{
  "extraKnownMarketplaces": {
    "vanguard-frontier-agentic": {
      "source": { "source": "github", "repo": "Raishin/vanguard-frontier-agentic" }
    }
  },
  "enabledPlugins": {
    "vanguard-frontier-agentic@vanguard-frontier-agentic": true
  }
}

Pin to a tag for reproducible installs: pick any released tag for stable versions, or use @latest for the current release.

• Bundled: all 631 cloud, security, compliance, Kubernetes, Terraform agents (incl. provider maestros and live-guard agents)
• Spec: .claude-plugin/marketplace.json + .claude-plugin/plugin.json (canonical Claude Code plugin layout)
• Not bundled: skills, rules, MCP references — use the npm path for those
• Docs: code.claude.com/docs/en/plugin-marketplaces

# Add the marketplace, then install
copilot plugin marketplace add Raishin/vanguard-frontier-agentic
/plugin install vanguard-frontier-agentic

Or in .github/copilot/settings.json for repo-wide trust:

{
  "extraKnownMarketplaces": [
    "https://raw.githubusercontent.com/Raishin/vanguard-frontier-agentic/master/.github/plugin/marketplace.json"
  ]
}

• Marketplace manifest: .github/plugin/marketplace.json declares this repo as a single-plugin marketplace
• Source path: ./ (the repo root is the plugin root)
• Bundled: 631 Copilot agent adapters under agents/<provider>/<agent>/harnesses/copilot.agent.md
• Docs: github.com/github/copilot-cli (/plugin marketplace add)

# Clone the repo, then register it as a plugin directory in Cursor:
git clone https://github.com/Raishin/vanguard-frontier-agentic

In Cursor: Settings → Plugins → Add Plugin Directory → pick the cloned repo path. Or via the Cursor Extension API:

vscode.cursor.plugins.registerPath("/absolute/path/to/vanguard-frontier-agentic");

• Plugin manifest: .cursor-plugin/plugin.json enumerates all 631 Cursor agent adapters explicitly via the agents field
• Bundled: all agents from agents/<provider>/<agent>/harnesses/cursor.agent.md
• Rules: existing rules/ directory at repo root is auto-discovered by Cursor
• Docs: cursor.com/docs/plugins · cursor.com/docs/reference/plugins

Kiro Powers UI is per-Power directory add — there is no single-command marketplace flow. This repo ships 42 Powers under powers/, one per provider, so Kiro users can add only what they need.

# 1. Clone this repo
git clone https://github.com/Raishin/vanguard-frontier-agentic
cd vanguard-frontier-agentic

# 2. In Kiro:
#    Open the Powers panel → "Add Custom Power" → "Local Directory"
#    Paste the absolute path to the Power(s) you need, one at a time:
#       /absolute/path/to/vanguard-frontier-agentic/powers/vanguard-aws
#       /absolute/path/to/vanguard-frontier-agentic/powers/vanguard-kubernetes
#       /absolute/path/to/vanguard-frontier-agentic/powers/vanguard-terraform

• Powers available: vanguard-accounting, vanguard-alibaba, vanguard-argocd, vanguard-aws, vanguard-azure, vanguard-backstage, vanguard-cert-manager, vanguard-cilium, vanguard-contabo, vanguard-databricks, vanguard-dotnet, vanguard-falco, vanguard-finance, vanguard-fluxcd, vanguard-frontend, vanguard-gcp, vanguard-generic, vanguard-hetzner, vanguard-hr, vanguard-huawei, vanguard-ionos, vanguard-istio, vanguard-java, vanguard-kotlin, vanguard-kubernetes, vanguard-kyverno, vanguard-legal, vanguard-marketing, vanguard-microsoft, vanguard-multi-cloud, vanguard-netsuite, vanguard-nvidia, vanguard-oci, vanguard-opentelemetry, vanguard-ovhcloud, vanguard-php, vanguard-prometheus, vanguard-salesforce, vanguard-sap, vanguard-scaleway, vanguard-sigstore, vanguard-snowflake, vanguard-terraform
• Each Power ships: routing pattern (maestro entry), live-mutation discipline, provider invariants (account-ID/region, MLPS 2.0, EU sovereignty, etc.)
• Frontmatter: strict-5 fields (name, displayName, description, keywords, author) per Kiro spec
• For Kiro agent adapter files (.kiro/agents/*.md, .kiro/agents/*.json): use the npm-export path below
• Docs: github.com/kirodotdev/powers

Antigravity reads skills from .agent/skills/<name>/SKILL.md (workspace) or ~/.gemini/antigravity/skills/<name>/ (global). There is no first-party marketplace install command — use the npm export to write skills + adapters into the right paths:

# Install the package
npm install @raishin/vanguard-frontier-agentic@latest

# Export agents + companion skills for Gemini Antigravity
npx vfa-export-agents --platform gemini --all --repo .

Or for a single provider:

npx vfa-export-agents --platform gemini --provider aws --repo .

• Workspace skills install to: .agent/skills/<name>/SKILL.md
• Global rules: ~/.gemini/GEMINI.md
• MCP servers: configure via Antigravity's MCP Store UI → mcp_config.json
• Docs: antigravity.google · github.com/google-gemini/gemini-cli

# Add the marketplace, then enable the bundled plugin
codex plugin marketplace add Raishin/vanguard-frontier-agentic
/plugin install vanguard-frontier-agentic@vanguard-frontier-agentic

codex plugin marketplace add writes the marketplace into your ~/.codex/config.toml. The resulting block looks like this (the screenshot pattern):

[marketplaces.vanguard-frontier-agentic]
last_updated = "2026-05-11T06:46:00Z"
last_revision = "<sha>"
source_type = "git"
source = "https://github.com/Raishin/vanguard-frontier-agentic.git"

[plugins."vanguard-frontier-agentic@vanguard-frontier-agentic"]
enabled = true

• Marketplace registry: .agents/plugins/marketplace.json at repo root (canonical Codex location per codex-rs plugin-json-spec)
• Bundled plugins:
  • vanguard-frontier-agentic — the main plugin, manifest at plugins/vanguard-frontier-agentic/.codex-plugin/plugin.json
  • cross-platform-agent-template — scaffold for new cross-platform agents
• For agent adapter files (.codex/agents/*.toml): after enabling the plugin, run npx vfa-export-agents --platform codex --all --repo . to write the 631 agent adapters into your repo
• Other commands: codex plugin marketplace upgrade vanguard-frontier-agentic, codex plugin marketplace remove vanguard-frontier-agentic
• Docs: github.com/openai/codex · Codex plugin spec

Prerequisite: Node.js 18+

# 1️⃣ Install the package
npm install @raishin/vanguard-frontier-agentic@latest

# 2️⃣ Export agents for your role into your repo (claude-code shown — swap platform)
npx vfa-export-agents --platform claude-code --role cloud-security-engineer --repo .

# 3️⃣ Open your coding agent and reference the exported agent
#    "Use kubernetes-rbac-review-agent to audit this RBAC change."

Supports --platform: claude-code, codex, copilot, cursor, gemini, kiro, kiro-ide, kiro-cli. Supports --role, --agents, --all, --provider filters. See the Install Reference for the full argument matrix.

Install paths

There are now eight supported install paths — Claude Code plugin marketplace, GitHub Copilot CLI marketplace, Cursor plugin, Codex plugin marketplace, Kiro Powers, Gemini Antigravity skills, npm package + vfa-export-agents CLI, and the third-party skills CLI — each with different versioning, trust, and scope characteristics. See docs/integrations/skills-cli.md for the full trust matrix, verified flag syntax, pinning guidance, and pre-install inspection steps.

npm install @raishin/vanguard-frontier-agentic@latest

🖥️ Terminal UI (vfa-tui)

⚠️ Alpha — the TUI is functional but under active development.

An enterprise-grade terminal interface for interactive catalog browsing, validation gate execution, and export command building — built in Rust for speed and security by construction. Distributed as the vfa-tui crate.

Install (recommended — from crates.io):

cargo install vfa-tui

Or download a prebuilt binary (Linux / macOS / Windows, x86-64 + arm64) — each release attaches the binaries alongside their SBOM and checksums.sha256 — from the latest vfa-tui release.

Build from source (alternative):

cd tools/vfa-tui && cargo build --release

Run (from the repo root — auto-detects workspace):

vfa-tui                                      # installed via cargo or prebuilt binary
./tools/vfa-tui/target/release/vfa-tui       # from a source build

Key features:

• 🗂️ Catalog browsing with fuzzy search across all agents, skills, and providers
• ✅ Validation gate execution with real-time progress and structured output
• 📦 Export command builder with platform/role/provider selection
• 🔐 Security by construction — no shell injection, no credential handling, no network access

Full documentation

🧠 Skills

654 skills across AWS, Azure, OCI, GCP, Alibaba Cloud, Huawei Cloud, Kubernetes, CNCF ecosystem, Terraform, marketing governance, and more.

🛡️ Live Guard skills — stop before you break prod

Live-guard skills enforce approval gates and rollback posture for irreversible operations:

🟧 AWS (5):

• aws-live-deployment-guarded-operator — approval-gated generic live deployment actions with account/region confirmation
• aws-live-iac-change-guard — CloudFormation/SAM/CDK/Terraform change set + drift + rollback posture enforcement
• aws-live-pipeline-approval-operator — CodePipeline approval gating with exact stage and approver scope
• aws-live-serverless-release-guard — Lambda alias/canary/linear rollout with alarm + rollback required
• aws-live-ecs-rollout-guard — ECS/Fargate deployment circuit breaker, health check evidence, rollback path

🟩 GCP (6):

• gcp-live-gke-rollout-guard — GKE deployment and node pool mutations, control-plane version gating
• gcp-live-iam-policy-change-guard — IAM binding mutations, org policy changes, SA key creation — org-wide blast radius
• gcp-live-kms-key-destruction-guard — Cloud KMS key version destruction — CMEK data permanently unrecoverable
• gcp-live-cost-budget-action-guard — budget thresholds, CUD commitments, quota increases — financial authority gate
• gcp-live-bigquery-dataset-deletion-guard — dataset deletion, table truncation, authorized view changes — irreversible data loss
• gcp-live-cloud-run-traffic-migration-guard — Cloud Run revision traffic shifts, min-instances changes — production traffic blast radius

🟠 Alibaba Cloud (6):

• alibaba-live-ack-rollout-guard — ACK deployment mutations, node pool scaling, cluster version upgrades
• alibaba-live-ram-policy-change-guard — RAM policy/role mutations — account-wide blast radius, privilege escalation risk
• alibaba-live-kms-key-mutation-guard — KMS key deletion/disable — encrypted data permanently inaccessible
• alibaba-live-cost-budget-action-guard — budget threshold changes, Savings Plan purchases, RI commitments — financial authority gate
• alibaba-live-oss-bucket-policy-guard — OSS bucket ACL/policy changes — public exposure or China data-residency violation
• alibaba-live-rds-polardb-mutation-guard — RDS/PolarDB instance deletion, spec downgrade, backup policy removal — data loss risk

🔴 Huawei Cloud (6):

• huawei-live-cce-rollout-guard — CCE deployment mutations, node pool upgrades, cluster version changes
• huawei-live-iam-policy-change-guard — IAM policy/SCP mutations — account-wide blast radius, privilege escalation
• huawei-live-kms-key-destruction-guard — DEW/KMS key deletion — CSMS secrets and DBSS-encrypted data permanently lost
• huawei-live-cost-budget-action-guard — budget threshold changes, RI purchases, CUD commitments — financial authority gate
• huawei-live-obs-bucket-policy-guard — OBS bucket ACL/policy changes — public exposure or data residency violation
• huawei-live-gaussdb-mutation-guard — GaussDB/RDS instance deletion, spec downgrade, backup policy changes — data loss

🟦 Azure (7):

• azure-live-aks-rollout-guard — PDB audit, rollout pause/undo, post-rollout health
• azure-live-arm-deployment-stack-guard — what-if evidence, denySettings, PIM-gated delete
• azure-live-app-service-slot-swap-guard — sticky-setting audit, traffic shifting, swap-back path
• azure-live-keyvault-rotation-purge-guard — rotation policy, soft-delete/purge-protection, PIM gate
• azure-live-pim-jit-activation-guard — eligible assignment audit, MFA gate, JIT revocation
• azure-live-cost-budget-action-guard — budget mutation, GPU SKU policy, quota read-only
• azure-live-entra-role-assignment-guard — permanent role assignment scope/principal audit, PIM-preference enforcement, Guest principal blocking

🟥 OCI (7):

• oci-live-autonomous-db-lifecycle-guard — ADB scale/stop/clone/terminate with tag enforcement
• oci-live-oke-rollout-guard — DevOps pipeline approval, PDB audit, rollout pause/undo
• oci-live-resource-manager-stack-guard — plan-before-apply, drift detection, job-lock enforcement
• oci-live-vault-key-destruction-guard — rotation vs. destruction separation, 7–30 day deletion window
• oci-live-iam-policy-compartment-guard — MFA break-glass, dual-approval for tenancy-root changes
• oci-live-cost-budget-runaway-guard — 3-tier budget management, GPU shape gate, ONS alert routing
• oci-live-network-security-rule-guard — Security List/NSG rule capture, 0.0.0.0/0 detection, DB-subnet criticality, Path Analyzer gate

☸️ Kubernetes (5):

• kubernetes-live-rbac-mutation-guard — escalate/bind/impersonate verb detection, wildcard blocking, pre-mutation state capture, rollback via YAML backup
• kubernetes-live-admission-policy-guard — Kyverno/VAP mutation blast-radius, failureAction enforcement, PolicyException scope validation
• kubernetes-live-mesh-policy-guard — Istio AuthorizationPolicy/PeerAuthentication traffic impact, PERMISSIVE→STRICT migration gating
• kubernetes-live-network-policy-guard — CiliumNetworkPolicy/NetworkPolicy connectivity impact, metadata service egress blocking
• kubernetes-live-argocd-sync-guard — AppProject blast-radius, sync impersonation identity review, sync-window change gating

Sample skills

• 🔐 skills/aws/aws-iam-least-privilege-review — Review AWS IAM policies and reduce unnecessary access.
• 🟦 skills/azure/azure-rbac-review — Review Azure RBAC assignments, scopes, and custom roles.
• 🟥 skills/oci/oci-autonomous-database-architect — Design and review Oracle Autonomous Database across OCI and multicloud options.
• 🟩 skills/gcp/gcp-gke-platform-operator — GKE Standard/Autopilot design with Day-0/Day-1 decisions, Workload Identity, and AI inference quickstart.
• 🟠 skills/alibaba/alibaba-china-compliance — MLPS 2.0, DSL, PIPL, and ICP filing compliance review for workloads in Alibaba Cloud China regions.
• 🔴 skills/huawei/huawei-secmaster-security-operations — Huawei SecMaster SIEM/SOAR, HSS, CFW, WAF posture hardening and incident triage.
• 💰 skills/finops/finops-cloud-price-advisor — Fetch live prices from AWS, Azure, and OCI public pricing APIs; estimate costs for live environments or prototypes.
• 📣 skills/marketing/marketing-pixel-data-leakage-review — Review advertising pixels and event tracking for PII/PHI leakage to ad networks.

Rule of thumb: if the asset teaches how to do a repeatable task, it is a skill.

🤖 Agents

631 agents matching the skill catalog — agents ship harness adapters and a hardened permission model.