TL;DR: Install the plugin, connect it to your Anyshift project, then ask Codex, Cursor, VS Code, or GitHub Copilot to review a change. Claude Code works too through a short manual setup. The package is open source, and every Graph MCP tool is read-only.
A Terraform change can look safe in the repository and still break a service in production. The code shows what you intend to change. It does not show everything connected to that resource right now.
Today we're releasing Anyshift Production Intelligence, an open-source plugin that gives coding agents that missing production context.
The package combines an Agent Skill with Anyshift's read-only Graph MCP tools: the skill defines how to investigate a change, while Graph MCP returns the identities, relationships, exposure paths, and recent changes the agent needs to review it.
What the plugin gives your agent
Anyshift's Production Graph connects code, Infrastructure as Code, cloud resources, Kubernetes, deployments, observability, and teams. It tracks resource identity, ownership, dependencies, provenance, exposure, and changes. Events update the graph as production changes; reconciliation checks those observations against their sources.
The Agent Skill turns that graph into a repeatable workflow:
- Resolve the resource. Distinguish between resources that share a name and keep the selected identity across later queries.
- Follow its dependencies. Inspect direct relationships, bounded transitive blast radius, and operational impact.
- Trace public exposure. Show the observed path and controls without hiding gaps in the available data.
- Check recent changes. Put a time-bounded change feed next to the topology instead of blaming the closest event.
It also tells the agent when to stop, what remains unknown, and when to use a constrained graph query instead of a dedicated tool. Your coding agent still owns the surrounding task. For a full AI SRE investigation, use Annie Remote MCP.
Three prompts to try
Review a change before it ships
Review my current Terraform changes. Resolve the affected production resources, then report their direct dependencies, public exposure, bounded blast radius, recent related changes, post-deployment checks, and explicit unknowns.
Check whether a service is exposed
Is
checkout-apireachable from the public edge? Show the observed path and controls, and preserve any evidence gaps.
Triage from a symptom
checkout-workerstarted restarting. What changed around it in the last two hours, and what could be affected downstream?
The coding agent keeps using the code, diffs, logs, and incident context already in its workspace. It calls Anyshift when it needs a fact from production.
What the plugin finds before a deploy
We tried it against our own production graph before deploying graph-api-production:
Before deploying
graph-api-production, what should I check?
That name matched three resources: the declared service, the ECS service actually running in production, and its log group. The agent picked the ECS service and followed its current relationships.
It found two upstream and two downstream relationships, plus 23 signal events from the previous 24 hours. One of those events was a deployment from task definition revision 61 to 62.
That left us with a short review list: the ECS service, revision 62, its running task, and four direct relationships. The graph showed no transitive blast radius beyond those resources. We could base the post-deployment checks on what the service actually used instead of guessing from resource names.
The limits matter. Anyshift reports what its connected sources have observed and when they observed it. A nearby change is not automatically the cause of a problem, and an empty result does not prove that nothing exists.
One package for Codex, Cursor, VS Code, and GitHub Copilot
The package follows the Agent Plugins 1.0.0 working-draft format. The Agent Skill contains the workflow, and mcp.json connects compatible clients to Anyshift's hosted Graph MCP endpoint.
Each client loads those components differently. We've verified Codex end to end against the current tool surface and Cursor against the preceding surface. VS Code and GitHub Copilot support the portable package format directly. The installation guide covers the setup and current verification status for each client.
Using Claude Code? Claude Code does not support the Agent Plugins package format yet, but you can still use Anyshift by installing the Agent Skill and Graph MCP connection separately. The setup is a short clone, skill symlink, and claude mcp add command.
Graph MCP uses stateless Streamable HTTP from MCP 2026-07-28. Each request carries its own context and can reach any healthy instance without a sticky server-side session. The endpoint also accepts initialization-based clients through MCP 2025-11-25.
You need an Anyshift project with production graph data. On the first connection, you authorize which project the agent may read. The open-source package contains no credentials or project identifiers. Every Graph MCP tool is read-only.
Install the plugin
Install Anyshift Production Intelligence and run the change-review prompt from your coding agent. If Anyshift resolves a different runtime resource than the one you expected, stop and check the mismatch before deploying.
Need to connect your production graph first? Talk to us.
