Last9 AI Toolkit

AI agents are good at writing queries and bad at knowing which query to write. This toolkit teaches coding agents — Claude Code, Codex, Grok Build, Cursor, and anything that speaks Agent Skills — how to instrument and investigate production systems with Last9: which tool to reach for, in what order, and which dead ends to skip.

Each skill encodes a workflow the way the product intends it — the skills hand off to one another when work crosses domains.

Skills

MCP gives your agent access. Skills give it judgment.

Skill	What it teaches
go-agent-install	Instrument a Go service with Last9 go-agent: detect the stack, wire chi + database/sql tracing, promote opt-in body capture, and verify spans land — without double-instrumenting
last9-logs	Log investigation: scope to a service first, attribute filters over body search, aggregate before drilling into raw lines
last9-traces	Trace investigation: a five-question interview that lands on the right tool call, plus a tracejson syntax reference card
last9-api	Call the Last9 REST API from scripts and CI without MCP: a stdlib Python helper handles refresh-token exchange and the X-LAST9-API-TOKEN header; references cover logs, traces, change events, and Alertmanager migration
last9-cloudwatch	CloudWatch investigation across Billing, RDS/Aurora, ElastiCache, MSK, DynamoDB, EC2, SQS, DMS, KMS, and S3; focused family references share discovery, statistic, and evidence rules

Installation

npx skills add last9/ai-toolkit

Install a single skill, or target a specific agent:

npx skills add last9/ai-toolkit --skill last9-logs
npx skills add last9/ai-toolkit -a claude-code

Claude Code and Codex install through their marketplaces, which resolve skills directly from this repository's canonical skills/ tree. Grok Build installs straight from the plugin subdirectory:

grok plugin install --trust "last9/ai-toolkit#plugins/last9"

OpenCode users get MCP registration plus skills from a single plugin:

{
  "$schema": "https://opencode.ai/config.json",
  "plugin": [["opencode-last9", { "org": "<org-slug>" }]]
}

Then run opencode mcp auth last9 once to authenticate. See plugins/opencode-last9/ for details.

Orca has no plugin format of its own — it orchestrates Claude Code and Codex workers, and those workers read skills from their usual directories. Install for the agents Orca drives:

npx skills add last9/ai-toolkit -g --agent claude-code --agent codex --agent universal

--agent universal writes to ~/.config/agents/skills/, which Orca also reads. Note that orca skills install resolves only Orca's own bundled skills, so it cannot install this repository.

Connecting to Last9

Last9 MCP is hosted, so there is no local server to run. Point your agent's MCP config at your organization's endpoint. For Codex:

[mcp_servers.last9]
url = "https://app.last9.io/api/v4/organizations/<org-slug>/mcp"

For Claude Code, add the same endpoint through its MCP configuration flow. Then run /mcp to authenticate. Keep local MCP config files (.codex/config.toml, .claude/settings.local.json) out of version control.

Contributing

The top-level skills/ directory is the single source of truth: marketplace manifests reference it directly and the OpenCode plugin assembles it into its tarball at pack time, so adding a skill is a single commit under skills/<name>/. CI validates distribution correctness (naming, declared paths, tarball completeness). See CONTRIBUTING.md for the workflow, and SECURITY.md for reporting vulnerabilities.

License

Last9 AI Toolkit is released under the MIT License.