Add psd-infrastructure plugin: Aruba, FortiAnalyzer, Freshservice, DocBot - #80
Add psd-infrastructure plugin: Aruba, FortiAnalyzer, Freshservice, DocBot#80reeseherber wants to merge 1 commit into
Conversation
…ce, DocBot) Four MCP servers bundled via a clone-and-pull launcher plus companion skills. Server code auto-updates from internal psd401 repos on every launch; the plugin omits its version field so every marketplace commit ships to users with auto-update enabled. Marketplace 2.22.1 -> 2.23.0.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds the psd-infrastructure plugin, which bundles four MCP servers (Aruba, FortiAnalyzer, Freshservice, and DocBot) and their companion skills. The review feedback identifies several key improvements: removing the allowed-tools restriction in the skill frontmatter files to allow the custom MCP tools to run, adding a fallback to standard git clone in the launcher script if gh is unauthenticated, and optimizing bun install execution to reduce startup latency.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| allowed-tools: Read, Bash | ||
| version: 0.1.0 |
There was a problem hiding this comment.
Specifying allowed-tools: Read, Bash in the skill frontmatter restricts Claude to only using those two tools when this skill is active. This will completely block Claude from calling any of the custom aruba_* MCP tools defined by the plugin. Removing this restriction allows Claude to use all registered tools, including the MCP tools.
| allowed-tools: Read, Bash | |
| version: 0.1.0 | |
| version: 0.1.0 |
| allowed-tools: Read, Bash | ||
| version: 0.1.0 |
There was a problem hiding this comment.
Specifying allowed-tools: Read, Bash in the skill frontmatter restricts Claude to only using those two tools when this skill is active. This will completely block Claude from calling any of the custom docbot_* MCP tools defined by the plugin. Removing this restriction allows Claude to use all registered tools, including the MCP tools.
| allowed-tools: Read, Bash | |
| version: 0.1.0 | |
| version: 0.1.0 |
| allowed-tools: Read, Bash | ||
| version: 0.1.0 |
There was a problem hiding this comment.
Specifying allowed-tools: Read, Bash in the skill frontmatter restricts Claude to only using those two tools when this skill is active. This will completely block Claude from calling any of the custom faz_* or search_logs MCP tools defined by the plugin. Removing this restriction allows Claude to use all registered tools, including the MCP tools.
| allowed-tools: Read, Bash | |
| version: 0.1.0 | |
| version: 0.1.0 |
| allowed-tools: Read, Bash | ||
| version: 0.1.0 |
There was a problem hiding this comment.
Specifying allowed-tools: Read, Bash in the skill frontmatter restricts Claude to only using those two tools when this skill is active. This will completely block Claude from calling any of the custom freshservice_* MCP tools defined by the plugin. Removing this restriction allows Claude to use all registered tools, including the MCP tools.
| allowed-tools: Read, Bash | |
| version: 0.1.0 | |
| version: 0.1.0 |
| clone_repo() { | ||
| mkdir -p "$CACHE_ROOT" | ||
| if command -v gh >/dev/null 2>&1; then | ||
| gh repo clone "$REPO" "$DIR" -- --quiet >&2 | ||
| else | ||
| git clone --quiet "https://github.com/$REPO.git" "$DIR" >&2 | ||
| fi | ||
| } |
There was a problem hiding this comment.
If gh is installed but not authenticated (or authenticated to a different account/org), gh repo clone will fail and immediately exit the script due to set -e. Adding a fallback to standard git clone on failure, and cleaning up any partial directory, makes the cloning process much more robust.
| clone_repo() { | |
| mkdir -p "$CACHE_ROOT" | |
| if command -v gh >/dev/null 2>&1; then | |
| gh repo clone "$REPO" "$DIR" -- --quiet >&2 | |
| else | |
| git clone --quiet "https://github.com/$REPO.git" "$DIR" >&2 | |
| fi | |
| } | |
| clone_repo() { | |
| mkdir -p "$CACHE_ROOT" | |
| if command -v gh >/dev/null 2>&1; then | |
| gh repo clone "$REPO" "$DIR" -- --quiet >&2 || { | |
| log "gh repo clone failed, falling back to git clone" | |
| rm -rf "$DIR" | |
| git clone --quiet "https://github.com/$REPO.git" "$DIR" >&2 | |
| } | |
| else | |
| git clone --quiet "https://github.com/$REPO.git" "$DIR" >&2 | |
| fi | |
| } |
| ;; | ||
| fortianalyzer) | ||
| command -v bun >/dev/null 2>&1 || { log "bun is required (brew install oven-sh/bun/bun)"; exit 1; } | ||
| bun install --silent >&2 || true |
There was a problem hiding this comment.
Running bun install on every single launch of the MCP server adds unnecessary startup latency and network overhead. We can optimize this by only running bun install if node_modules does not exist or if package.json is newer than node_modules (indicating an update occurred). We only touch node_modules on success to ensure retries on failure.
| bun install --silent >&2 || true | |
| if [ ! -d "node_modules" ] || [ "package.json" -nt "node_modules" ]; then | |
| if bun install --silent >&2; then | |
| touch "node_modules" | |
| fi | |
| fi |
| ;; | ||
| freshservice) | ||
| command -v bun >/dev/null 2>&1 || { log "bun is required (brew install oven-sh/bun/bun)"; exit 1; } | ||
| bun install --silent >&2 || true |
There was a problem hiding this comment.
Running bun install on every single launch of the MCP server adds unnecessary startup latency and network overhead. We can optimize this by only running bun install if node_modules does not exist or if package.json is newer than node_modules (indicating an update occurred). We only touch node_modules on success to ensure retries on failure.
| bun install --silent >&2 || true | |
| if [ ! -d "node_modules" ] || [ "package.json" -nt "node_modules" ]; then | |
| if bun install --silent >&2; then | |
| touch "node_modules" | |
| fi | |
| fi |
| ;; | ||
| docbot) | ||
| command -v bun >/dev/null 2>&1 || { log "bun is required (brew install oven-sh/bun/bun)"; exit 1; } | ||
| bun install --silent >&2 || true |
There was a problem hiding this comment.
Running bun install on every single launch of the MCP server adds unnecessary startup latency and network overhead. We can optimize this by only running bun install if node_modules does not exist or if package.json is newer than node_modules (indicating an update occurred). We only touch node_modules on success to ensure retries on failure.
| bun install --silent >&2 || true | |
| if [ ! -d "node_modules" ] || [ "package.json" -nt "node_modules" ]; then | |
| if bun install --silent >&2; then | |
| touch "node_modules" | |
| fi | |
| fi |
|
Closing: we want infrastructure details out of the public marketplace. The plugin is moving to an internal-visibility marketplace repo (psd401/psd-claude-plugins-internal) instead — same content, org-members-only. |
1 participant
What
New
psd-infrastructureplugin — the infrastructure counterpart to psd-productivity, per Kris's suggestion to package the homebuilt MCP servers for team distribution.arubaaruba-wirelessfortianalyzerfortianalyzer-logsfreshservicefreshservice-ticketsdocbotdocbot-docsHow it stays current
scripts/run-server.shclones each server from its internal psd401 repo on first use andgit pull --ff-onlys on every launch. Pushing to a server repo ships to everyone's next session — no plugin release needed. Verified live: pushed a freshservice fix mid-build and the launcher picked it up on the next start.versionfield, so every commit to this repo counts as a new plugin version for auto-update (a set-but-unbumped version silently freezes updates per the plugin docs).Tested
All four servers probed end-to-end through the launcher (fresh clone → install →
tools/list): fortianalyzer 25 tools, freshservice 15, docbot 30, aruba 5. Skills were reviewed for leaks (public repo — placeholders only, verified clean) and tool-name accuracy (100% match against source).Notes
aruba_get_node_configexists only in Reese's uncommitted working copy and will appear when committed (the skill already documents it, including the output-size warning).zabbixandonesyncservers are excluded until their connection issues are fixed;mac-miniandpinchtabare personal tooling and stay out."autoUpdate": trueon the marketplace entry would remove the toggle step org-wide.