{
  "markdown": "# gemini-platform-engineer\n\n> **AI-powered Platform Engineering assistant for enterprises running on Google Cloud.**\n> Built on the [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) — connects Gemini CLI to your real GCP environment with security-first tooling for Cloud Run, GKE, CI/CD pipelines, and GitOps.\n\n[![CI](https://github.com/ashiq-ali/gemini-platform-engineer/actions/workflows/ci.yml/badge.svg)](https://github.com/ashiq-ali/gemini-platform-engineer/actions/workflows/ci.yml)\n[![Go 1.22+](https://img.shields.io/badge/Go-1.22+-00ADD8?logo=go)](https://go.dev/dl/)\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)\n[![MCP Compatible](https://img.shields.io/badge/MCP-Compatible-blueviolet)](https://modelcontextprotocol.io/)\n\n---\n\n## Architecture\n\n![Architecture](docs/architecture.svg)\n\n**Three-tier design:**\n\n| Tier | Technology | Purpose |\n|------|-----------|---------|\n| **Skills** | Markdown (SKILL.md) | Structured AI reasoning workflows — step-by-step playbooks the AI follows |\n| **MCP Server** | Go 1.22, distroless container | 7 tools exposed over JSON-RPC/stdio; executes real GCP operations |\n| **Knowledge Base** | Markdown (RAG context) | Production patterns pre-loaded into Gemini's context window |\n\n---\n\n## Features\n\n### 🚀 Security-First Deployment (`google-platform-deploy`)\n\nBefore a single byte hits GCP, the deploy skill gates on:\n\n1. **Secret scan** — 25+ patterns covering AWS, GCP, Azure, GitHub, Stripe, database credentials, RSA/EC/OpenSSH private keys. Blocks on `CRITICAL` or `HIGH` findings.\n2. **Application analysis** — auto-detects language (Go, Node.js, Python, Java, Rust), framework, port, and recommended deploy target.\n3. **Cost estimation** — shows Cloud Run, GKE, or GCS cost breakdown before committing.\n4. **Compliance check** — 12 CIS-benchmark checks across Dockerfile hygiene and K8s security context (baseline / restricted / PCI-DSS / HIPAA profiles).\n5. **Deploy** — Cloud Run (via `gcloud`) or GKE (generates a hardened manifest: non-root, read-only FS, HPA, PDB, network policy).\n\n### ⚙️ CI/CD Pipeline Generation (`google-platform-pipeline-design`)\n\nGenerates production-grade pipeline YAML with:\n\n- **Cloud Build** — 8-stage pipeline with gitleaks, language-specific tests, Semgrep SAST, docker build+push with cache, Container Analysis wait, staging deploy with tag routing, smoke test, production deploy.\n- **GitHub Actions** — multi-job workflow: secret-scan → test (with Codecov) → SAST → build (WIF + Buildx + metadata-action) → vuln-scan → deploy-staging → smoke-test → deploy-production (manual gate via GitHub Environments).\n- **GitLab CI** — equivalent stages with `when: manual` gate before production.\n\nAll pipelines enforce: SHA image tags (never `:latest`), Workload Identity Federation (no SA key files), Container Analysis blocking on CRITICAL/HIGH CVEs.\n\n### 🔁 GitOps Design (`google-platform-gitops`)\n\nGuides the App of Apps bootstrap with:\n\n- Config repo structure (bootstrap / platform / apps / clusters)\n- ArgoCD install + root Application\n- External Secrets Operator → GCP Secret Manager (zero secrets in Git)\n- Argo Rollouts canary strategy with automated analysis (error budget gates)\n- ArgoCD Image Updater wired to Artifact Registry\n- Multi-tenant RBAC (developer can sync staging; platform-engineer can sync production)\n\n### 🔒 Comprehensive Security Scan (`google-platform-security-scan`)\n\nFour-layer scan report:\n\n| Layer | Tool | What it catches |\n|-------|------|----------------|\n| Secrets | `scan_secrets` MCP tool | Hardcoded credentials (25+ patterns) |\n| SAST | Semgrep / `go vet` + `govulncheck` / `bandit` | SQL injection, path traversal, CVE-tracked deps |\n| Container | Container Analysis / Trivy | CRITICAL/HIGH CVEs in base images and packages |\n| Config | `check_compliance` MCP tool | K8s misconfigurations, CIS benchmark violations |\n\n---\n\n## Installation\n\n### Prerequisites\n\n| Tool | Minimum version | Install |\n|------|----------------|---------|\n| Gemini CLI | latest | [Install guide](https://github.com/google-gemini/gemini-cli#installation) |\n| Go | 1.22 | `brew install go` |\n| gcloud CLI | 470+ | [Install guide](https://cloud.google.com/sdk/docs/install) |\n| kubectl | 1.28+ | `brew install kubectl` |\n| Docker | 24+ | [Docker Desktop](https://www.docker.com/products/docker-desktop/) |\n\n### Option A — Install via npm (recommended)\n\n```bash\n# The npm shim downloads the correct binary for your platform\nnpm install -g gemini-platform-engineer-mcp\n\n# Add to your Gemini CLI extensions\ngemini extension add gemini-platform-engineer\n```\n\n### Option B — Build from source\n\n```bash\ngit clone https://github.com/ashiq-ali/gemini-platform-engineer.git\ncd gemini-platform-engineer\n\n# Build the MCP server binary\nmake build\n\n# Register the extension with Gemini CLI\ncp gemini-extension.json ~/.gemini/extensions/gemini-platform-engineer.json\n\n# Edit the extension to point to the local binary\n# Change: \"command\": \"npx\" → \"command\": \"/path/to/gemini-platform-engineer/mcp-server/bin/mcp-server\"\n```\n\n### Option C — Docker\n\n```bash\ndocker pull us-central1-docker.pkg.dev/ashiq-ali-oss/gemini-platform-engineer/mcp-server:latest\n\n# Run as MCP server (stdio mode)\ndocker run --rm -i \\\n  -v ~/.config/gcloud:/root/.config/gcloud:ro \\\n  us-central1-docker.pkg.dev/ashiq-ali-oss/gemini-platform-engineer/mcp-server:latest\n```\n\n---\n\n## Quickstart\n\n### 1. Authenticate to GCP\n\n```bash\ngcloud auth login\ngcloud auth application-default login\ngcloud config set project YOUR_PROJECT_ID\n```\n\n### 2. Deploy a service\n\nOpen Gemini CLI and type:\n\n```\ndeploy my Go API at ./cmd/api to Cloud Run in us-central1\n```\n\nGemini follows the deploy skill: scans for secrets → analyses the app → estimates cost → checks compliance → deploys. If any step fails, it stops and explains what to fix.\n\n### 3. Generate a CI/CD pipeline\n\n```\ndesign a GitHub Actions pipeline for my Node.js Cloud Run service in project my-project\n```\n\nGemini proposes the pipeline design in prose first, waits for approval, then generates the complete GitHub Actions YAML with WIF auth, Container Analysis, and manual prod gate.\n\n### 4. Security scan before release\n\n```\nsecurity scan ./src before we deploy to production\n```\n\nRuns all four layers (secrets, SAST, container, compliance) and produces a structured report with remediation guidance.\n\n### 5. GitOps bootstrap\n\n```\nset up ArgoCD GitOps for my GKE cluster with dev/staging/prod environments\n```\n\nGemini guides through the App of Apps bootstrap, External Secrets Operator setup, and canary rollout configuration.\n\n---\n\n## MCP Tools Reference\n\n| Tool | Description | Key Parameters |\n|------|-------------|----------------|\n| `scan_secrets` | Scan a directory for hardcoded credentials | `path`, `exclude_patterns`, `fail_on_findings` |\n| `analyze_application` | Detect language, framework, port, deploy target | `path` |\n| `estimate_cost` | Calculate monthly GCP cost | `deploy_target`, `region`, `monthly_requests` |\n| `check_compliance` | CIS/NIST/PCI-DSS/HIPAA compliance check | `path`, `profile` |\n| `generate_pipeline` | Generate CI/CD YAML | `pipeline_type`, `language`, `deploy_target`, `project_id`, `region` |\n| `deploy_to_cloud_run` | Deploy to Cloud Run via gcloud | `path`, `project_id`, `service_name`, `region`, `allow_unauthenticated` |\n| `deploy_to_gke` | Deploy to GKE via kubectl | `project_id`, `cluster_name`, `cluster_zone`, `image`, `app_name`, `replicas` |\n\n### Secret patterns detected\n\n<details>\n<summary>Click to expand — 25+ patterns</summary>\n\n| Category | Patterns |\n|----------|---------|\n| AWS | Access Key ID, Secret Access Key, Session Token |\n| GCP | Service Account JSON, API Key |\n| Azure | Client Secret, SAS Token, Connection String |\n| GitHub | Personal Access Token, App Token |\n| GitLab | Personal/Project/Group Token |\n| Slack | Bot Token, Webhook URL |\n| Stripe | Live/Test Secret Key |\n| SendGrid | API Key |\n| Twilio | Auth Token |\n| Databases | PostgreSQL DSN, MongoDB URI, MySQL DSN |\n| TLS/SSH | RSA private key, EC private key, OpenSSH private key, PEM block |\n| Generic | Password assignment, API key assignment, Bearer token |\n| Docker | Registry auth config |\n\n</details>\n\n### Compliance profiles\n\n| Profile | Use case | Extra checks |\n|---------|----------|-------------|\n| `baseline` | Standard production workloads | 12 CIS checks |\n| `restricted` | CKS-level enforcement | + seccomp profile required |\n| `pci-dss` | Payment card data | + seccomp + network isolation |\n| `hipaa` | Healthcare / PHI | + seccomp + audit logging |\n\n---\n\n## Project Structure\n\n```\ngemini-platform-engineer/\n├── gemini-extension.json          # Gemini CLI extension manifest\n├── Makefile                       # Build, test, lint, docker targets\n│\n├── mcp-server/                    # Go MCP server\n│   ├── cmd/server/main.go         # Entry point — registers tools, ServeStdio\n│   ├── internal/tools/\n│   │   ├── scan.go                # scan_secrets — 25+ regex patterns\n│   │   ├── analyze.go             # analyze_application — language/framework detection\n│   │   ├── cost.go                # estimate_cost — Cloud Run, GKE, GCS pricing\n│   │   ├── compliance.go          # check_compliance — 12 CIS checks\n│   │   ├── pipeline.go            # generate_pipeline — Cloud Build/GHA/GitLab CI\n│   │   └── deploy.go              # deploy_to_cloud_run / deploy_to_gke\n│   ├── go.mod\n│   └── Dockerfile                 # Multi-stage: golang:1.22-alpine → distroless/nonroot\n│\n├── skills/                        # Gemini CLI skill definitions\n│   ├── deploy/SKILL.md\n│   ├── pipeline-design/SKILL.md\n│   ├── gitops/SKILL.md\n│   └── security-scan/SKILL.md\n│\n├── knowledge-base/patterns/       # RAG context files\n│   ├── cloud-run-deployment.md\n│   ├── gke-deployment.md\n│   └── gitops-pipeline.md\n│\n├── templates/                     # Production-ready YAML templates\n│   ├── cloudbuild/go.yaml         # Cloud Build — Go → Cloud Run\n│   ├── github-actions/\n│   │   └── cloud-run.yaml         # GitHub Actions — Cloud Run with WIF\n│   ├── kubernetes/\n│   │   ├── deployment.yaml        # Hardened Deployment + HPA + PDB\n│   │   └── network-policy.yaml    # Default-deny + selective allow\n│   └── argocd/\n│       └── application.yaml       # App of Apps + AppProject RBAC\n│\n├── docs/\n│   └── architecture.svg\n│\n└── .github/\n    └── workflows/\n        ├── ci.yml                 # PR gates: secret-scan → lint → test → SAST → build\n        └── release.yml            # Tag-triggered: GoReleaser + Docker + npm publish\n```\n\n---\n\n## Design Decisions\n\n### Why Go for the MCP server?\n\n- **Single static binary** — no runtime dependencies; works in distroless containers\n- **Fast startup** — critical for MCP stdio transport where each conversation may restart the server\n- **Strong concurrency** — goroutines handle parallel tool invocations efficiently\n- **`CGO_ENABLED=0`** — fully static binary, cross-compiles for Linux/macOS/Windows with one command\n\n### Why distroless/nonroot as the base image?\n\n- **No shell** — eliminates an entire class of container escape techniques\n- **No package manager** — no `apt`, `apk`, `yum` to download additional tools post-deploy\n- **Nonroot user (UID 65532)** — runs without root privileges by default\n- **Minimal CVE surface** — fewer packages = fewer vulnerabilities to patch\n\n### Why stdio transport (not HTTP)?\n\nMCP's stdio transport is the simplest and most secure option for local tooling:\n- No port binding — no network attack surface\n- No authentication required — process isolation provides the security boundary\n- Works in any environment (CI/CD, containers, local dev) without firewall rules\n\n### Why Workload Identity Federation instead of SA keys?\n\nSA keys are long-lived credentials that must be rotated, secured, and distributed. WIF provides:\n- **Keyless** — no file to leak, no rotation burden\n- **Short-lived** — tokens expire in 1 hour\n- **Auditable** — every token exchange is logged in Cloud Audit Logs\n- **Principle of least privilege** — WIF can be scoped to specific GitHub repos or branches\n\n---\n\n## Security\n\nThis project follows a security-first philosophy. Key measures:\n\n- **No secrets in source** — `scan_secrets` runs in CI and blocks on any finding\n- **Signed commits** — all commits to main are GPG-signed\n- **Dependabot** — automatic dependency update PRs\n- **govulncheck** — checks Go dependencies against the Go vulnerability database on every PR\n- **Semgrep SAST** — runs on every PR; results uploaded as GitHub Security Advisories (SARIF)\n- **Distroless container** — minimal attack surface for the MCP server\n\nTo report a security vulnerability, please use [GitHub Security Advisories](https://github.com/ashiq-ali/gemini-platform-engineer/security/advisories/new) rather than opening a public issue.\n\n---\n\n## Development\n\n```bash\n# Run all checks (matches CI)\nmake lint test govulncheck\n\n# Run the server locally in debug mode\nmake run\n\n# Build for all platforms\nmake build-all\n\n# Run with coverage report\nmake test-cover && open mcp-server/coverage.html\n\n# Build and push Docker image\nmake docker-build docker-push IMAGE_REPO=us-central1-docker.pkg.dev/YOUR_PROJECT/apps\n```\n\n### Adding a new tool\n\n1. Create `mcp-server/internal/tools/mytool.go`\n2. Define `MyTool() mcp.Tool` and `HandleMyTool(log) server.ToolHandlerFunc`\n3. Register in `mcp-server/cmd/server/main.go`\n4. Write tests in `mcp-server/internal/tools/mytool_test.go`\n5. Document in this README's Tool Reference table\n\n---\n\n## References\n\n- **Article that inspired this project:** [Ship code within minutes with the Gemini CLI DevOps Extension](https://cloud.google.com/blog/topics/developers-practitioners/ship-code-within-minutes-with-the-gemini-cli-devops-extension/) — Google Cloud Blog\n- [Model Context Protocol specification](https://modelcontextprotocol.io/specification)\n- [mark3labs/mcp-go](https://github.com/mark3labs/mcp-go) — Go MCP server library\n- [Google Cloud Run documentation](https://cloud.google.com/run/docs)\n- [GKE Autopilot documentation](https://cloud.google.com/kubernetes-engine/docs/concepts/autopilot-overview)\n- [ArgoCD documentation](https://argo-cd.readthedocs.io/)\n- [Workload Identity Federation](https://cloud.google.com/iam/docs/workload-identity-federation)\n- [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes)\n- [Google SRE Book — SLO/Error Budget](https://sre.google/sre-book/service-level-objectives/)\n- [Gitleaks](https://github.com/gitleaks/gitleaks) — secret scanning\n- [Semgrep](https://semgrep.dev/) — SAST\n\n---\n\n## License\n\nMIT © [Ashiq Ali](https://github.com/ashiq-ali)\n\nBuilt with the [Gemini CLI](https://github.com/google-gemini/gemini-cli) and [Model Context Protocol](https://modelcontextprotocol.io/).\n",
  "bytes": 14719,
  "sha": "054690096c3cce6038a61e399471b99aebd59949abbe36872cf63a1616fec533",
  "repo_slug": "ashiq-ali/gemini-platform-engineer",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_ashiq_ali_gemini_platform_engineer_53958b95/readme"
}