gemini-platform-engineer
AI-powered Platform Engineering assistant for enterprises running on Google Cloud. Provides security-first deployment, CI/CD pipeline design
Open source Open in the app JSON README (API)
About
AI-powered Platform Engineering assistant for enterprises running on Google Cloud. Provides security-first deployment, CI/CD pipeline design, GitOps, cost estimation, and compliance checking.
Details
- Kind
- Plugins
- Topic
- Cloud & DevOps
- Publisher
- ashiq-ali
- Origin
- gemini
- Category
- ferramentas
- Version
- 1.0.0
- Last push
- 2026-05-28T09:02:43Z
- Repository state
- ativo
- Language
- Go
- Added
- 2026-08-30 14:13:39
- Updated
- 2026-08-30 14:13:39
- Origin id
ashiq-ali/gemini-platform-engineer
README
# gemini-platform-engineer
> **AI-powered Platform Engineering assistant for enterprises running on Google Cloud.**
> Built on the [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) — connects Gemini CLI to your real GCP environment with security-first tooling for Cloud Run, GKE, CI/CD pipelines, and GitOps.
[](https://github.com/ashiq-ali/gemini-platform-engineer/actions/workflows/ci.yml)
[](https://go.dev/dl/)
[](LICENSE)
[](https://modelcontextprotocol.io/)
---
## Architecture
**Three-tier design:**
| Tier | Technology | Purpose |
|------|-----------|---------|
| **Skills** | Markdown (SKILL.md) | Structured AI reasoning workflows — step-by-step playbooks the AI follows |
| **MCP Server** | Go 1.22, distroless container | 7 tools exposed over JSON-RPC/stdio; executes real GCP operations |
| **Knowledge Base** | Markdown (RAG context) | Production patterns pre-loaded into Gemini's context window |
---
## Features
### 🚀 Security-First Deployment (`google-platform-deploy`)
Before a single byte hits GCP, the deploy skill gates on:
1. **Secret scan** — 25+ patterns covering AWS, GCP, Azure, GitHub, Stripe, database credentials, RSA/EC/OpenSSH private keys. Blocks on `CRITICAL` or `HIGH` findings.
2. **Application analysis** — auto-detects language (Go, Node.js, Python, Java, Rust), framework, port, and recommended deploy target.
3. **Cost estimation** — shows Cloud Run, GKE, or GCS cost breakdown before committing.
4. **Compliance check** — 12 CIS-benchmark checks across Dockerfile hygiene and K8s security context (baseline / restricted / PCI-DSS / HIPAA profiles).
5. **Deploy** — Cloud Run (via `gcloud`) or GKE (generates a hardened manifest: non-root, read-only FS, HPA, PDB, network policy).
### ⚙️ CI/CD Pipeline Generation (`google-platform-pipeline-design`)
Generates production-grade pipeline YAML with:
- **Cloud Build** — 8-stage pipeline with gitleaks, language-specific tests, Semgrep SAST, docker build+push with cache, Container Analysis wait, staging deploy with tag routing, smoke test, production deploy.
- **GitHub Actions** — multi-job workflow: secret-scan → test (with Codecov) → SAST → build (WIF + Buildx + metadata-action) → vuln-scan → deploy-staging → smoke-test → deploy-production (manual gate via GitHub Environments).
- **GitLab CI** — equivalent stages with `when: manual` gate before production.
All pipelines enforce: SHA image tags (never `:latest`), Workload Identity Federation (no SA key files), Container Analysis blocking on CRITICAL/HIGH CVEs.
### 🔁 GitOps Design (`google-platform-gitops`)
Guides the App of Apps bootstrap with:
- Config repo structure (bootstrap / platform / apps / clusters)
- ArgoCD install + root Application
- External Secrets Operator → GCP Secret Manager (zero secrets in Git)
- Argo Rollouts canary strategy with automated analysis (error budget gates)
- ArgoCD Image Updater wired to Artifact Registry
- Multi-tenant RBAC (developer can sync staging; platform-engineer can sync production)
### 🔒 Comprehensive Security Scan (`google-platform-security-scan`)
Four-layer scan report:
| Layer | Tool | What it catches |
|-------|------|----------------|
| Secrets | `scan_secrets` MCP tool | Hardcoded credentials (25+ patterns) |
| SAST | Semgrep / `go vet` + `govulncheck` / `bandit` | SQL injection, path traversal, CVE-tracked deps |
| Container | Container Analysis / Trivy | CRITICAL/HIGH CVEs in base images and packages |
| Config | `check_compliance` MCP tool | K8s misconfigurations, CIS benchmark violations |
---
## Installation
### Prerequisites
| Tool | Minimum version | Install |
|------|----------------|---------|
| Gemini CLI | latest | [Install guide](https://github.com/google-gemini/gemini-cli#installation) |
| Go | 1.22 | `brew install go` |
| gcloud CLI | 470+ | [Install guide](https://cloud.google.com/sdk/docs/install) |
| kubectl | 1.28+ | `brew install kubectl` |
| Docker | 24+ | [Docker Desktop](https://www.docker.com/products/docker-desktop/) |
### Option A — Install via npm (recommended)
```bash
# The npm shim downloads the correct binary for your platform
npm install -g gemini-platform-engineer-mcp
# Add to your Gemini CLI extensions
gemini extension add gemini-platform-engineer
```
### Option B — Build from source
```bash
git clone https://github.com/ashiq-ali/gemini-platform-engineer.git
cd gemini-platform-engineer
# Build the MCP server binary
make build
# Register the extension with Gemini CLI
cp gemini-extension.json ~/.gemini/extensions/gemini-platform-engineer.json
# Edit the extension to point to the local binary
# Change: "command": "npx" → "command": "/path/to/gemini-platform-engineer/mcp-server/bin/mcp-server"
```
### Option C — Docker
```bash
docker pull us-central1-docker.pkg.dev/ashiq-ali-oss/gemini-platform-engineer/mcp-server:latest
# Run as MCP server (stdio mode)
docker run --rm -i \
-v ~/.config/gcloud:/root/.config/gcloud:ro \
us-central1-docker.pkg.dev/ashiq-ali-oss/gemini-platform-engineer/mcp-server:latest
```
---
## Quickstart
### 1. Authenticate to GCP
```bash
gcloud auth login
gcloud auth application-default login
gcloud config set project YOUR_PROJECT_ID
```
### 2. Deploy a service
Open Gemini CLI and type:
```
deploy my Go API at ./cmd/api to Cloud Run in us-central1
```
Gemini follows the deploy skill: scans for secrets → analyses the app → estimates cost → checks compliance → deploys. If any step fails, it stops and explains what to fix.
### 3. Generate a CI/CD pipeline
```
design a GitHub Actions pipeline for my Node.js Cloud Run service in project my-project
```
Gemini proposes the pipeline design in prose first, waits for approval, then generates the complete GitHub Actions YAML with WIF auth, Container Analysis, and manual prod gate.
### 4. Security scan before release
```
security scan ./src before we deploy to production
```
Runs all four layers (secrets, SAST, container, compliance) and produces a structured report with remediation guidance.
### 5. GitOps bootstrap
```
set up ArgoCD GitOps for my GKE cluster with dev/staging/prod environments
```
Gemini guides through the App of Apps bootstrap, External Secrets Operator setup, and canary rollout configuration.
---
## MCP Tools Reference
| Tool | Description | Key Parameters |
|------|-------------|----------------|
| `scan_secrets` | Scan a directory for hardcoded credentials | `path`, `exclude_patterns`, `fail_on_findings` |
| `analyze_application` | Detect language, framework, port, deploy target | `path` |
| `estimate_cost` | Calculate monthly GCP cost | `deploy_target`, `region`, `monthly_requests` |
| `check_compliance` | CIS/NIST/PCI-DSS/HIPAA compliance check | `path`, `profile` |
| `generate_pipeline` | Generate CI/CD YAML | `pipeline_type`, `language`, `deploy_target`, `project_id`, `region` |
| `deploy_to_cloud_run` | Deploy to Cloud Run via gcloud | `path`, `project_id`, `service_name`, `region`, `allow_unauthenticated` |
| `deploy_to_gke` | Deploy to GKE via kubectl | `project_id`, `cluster_name`, `cluster_zone`, `image`, `app_name`, `replicas` |
### Secret patterns detected
<details>
<summary>Click to expand — 25+ patterns</summary>
| Category | Patterns |
|----------|---------|
| AWS | Access Key ID, Secret Access Key, Session Token |
| GCP | Service Account JSON, API Key |
| Azure | Client Secret, SAS Token, Connection String |
| GitHub | Personal Access Token, App Token |
| GitLab | Personal/Project/Group Token |
| Slack | Bot Token, Webhook URL |
| Stripe | Live/Test Secret Key |
| SendGrid | API Key |
| Twilio | Auth Token |
| Databases | PostgreSQL DSN, MongoDB URI, MySQL DSN |
| TLS/SSH | RSA private key, EC private key, OpenSSH private key, PEM block |
| Generic | Password assignment, API key assignment, Bearer token |
| Docker | Registry auth config |
</details>
### Compliance profiles
| Profile | Use case | Extra checks |
|---------|----------|-------------|
| `baseline` | Standard production workloads | 12 CIS checks |
| `restricted` | CKS-level enforcement | + seccomp profile required |
| `pci-dss` | Payment card data | + seccomp + network isolation |
| `hipaa` | Healthcare / PHI | + seccomp + audit logging |
---
## Project Structure
```
gemini-platform-engineer/
├── gemini-extension.json # Gemini CLI extension manifest
├── Makefile # Build, test, lint, docker targets
│
├── mcp-server/ # Go MCP server
│ ├── cmd/server/main.go # Entry point — registers tools, ServeStdio
│ ├── internal/tools/
│ │ ├── scan.go # scan_secrets — 25+ regex patterns
│ │ ├── analyze.go # analyze_application — language/framework detection
│ │ ├── cost.go # estimate_cost — Cloud Run, GKE, GCS pricing
│ │ ├── compliance.go # check_compliance — 12 CIS checks
│ │ ├── pipeline.go # generate_pipeline — Cloud Build/GHA/GitLab CI
│ │ └── deploy.go # deploy_to_cloud_run / deploy_to_gke
│ ├── go.mod
│ └── Dockerfile # Multi-stage: golang:1.22-alpine → distroless/nonroot
│
├── skills/ # Gemini CLI skill definitions
│ ├── deploy/SKILL.md
│ ├── pipeline-design/SKILL.md
│ ├── gitops/SKILL.md
│ └── security-scan/SKILL.md
│
├── knowledge-base/patterns/ # RAG context files
│ ├── cloud-run-deployment.md
│ ├── gke-deployment.md
│ └── gitops-pipeline.md
│
├── templates/ # Production-ready YAML templates
│ ├── cloudbuild/go.yaml # Cloud Build — Go → Cloud Run
│ ├── github-actions/
│ │ └── cloud-run.yaml # GitHub Actions — Cloud Run with WIF
│ ├── kubernetes/
│ │ ├── deployment.yaml # Hardened Deployment + HPA + PDB
│ │ └── network-policy.yaml # Default-deny + selective allow
│ └── argocd/
│ └── application.yaml # App of Apps + AppProject RBAC
│
├── docs/
│ └── architecture.svg
│
└── .github/
└── workflows/
├── ci.yml # PR gates: secret-scan → lint → test → SAST → build
└── release.yml # Tag-triggered: GoReleaser + Docker + npm publish
```
---
## Design Decisions
### Why Go for the MCP server?
- **Single static binary** — no runtime dependencies; works in distroless containers
- **Fast startup** — critical for MCP stdio transport where each conversation may restart the server
- **Strong concurrency** — goroutines handle parallel tool invocations efficiently
- **`CGO_ENABLED=0`** — fully static binary, cross-compiles for Linux/macOS/Windows with one command
### Why distroless/nonroot as the base image?
- **No shell** — eliminates an entire class of container escape techniques
- **No package manager** — no `apt`, `apk`, `yum` to download additional tools post-deploy
- **Nonroot user (UID 65532)** — runs without root privileges by default
- **Minimal CVE surface** — fewer packages = fewer vulnerabilities to patch
### Why stdio transport (not HTTP)?
MCP's stdio transport is the simplest and most secure option for local tooling:
- No port binding — no network attack surface
- No authentication required — process isolation provides the security boundary
- Works in any environment (CI/CD, containers, local dev) without firewall rules
### Why Workload Identity Federation instead of SA keys?
SA keys are long-lived credentials that must be rotated, secured, and distributed. WIF provides:
- **Keyless** — no file to leak, no rotation burden
- **Short-lived** — tokens expire in 1 hour
- **Auditable** — every token exchange is logged in Cloud Audit Logs
- **Principle of least privilege** — WIF can be scoped to specific GitHub repos or branches
---
## Security
This project follows a security-first philosophy. Key measures:
- **No secrets in source** — `scan_secrets` runs in CI and blocks on any finding
- **Signed commits** — all commits to main are GPG-signed
- **Dependabot** — automatic dependency update PRs
- **govulncheck** — checks Go dependencies against the Go vulnerability database on every PR
- **Semgrep SAST** — runs on every PR; results uploaded as GitHub Security Advisories (SARIF)
- **Distroless container** — minimal attack surface for the MCP server
To report a security vulnerability, please use [GitHub Security Advisories](https://github.com/ashiq-ali/gemini-platform-engineer/security/advisories/new) rather than opening a public issue.
---
## Development
```bash
# Run all checks (matches CI)
make lint test govulncheck
# Run the server locally in debug mode
make run
# Build for all platforms
make build-all
# Run with coverage report
make test-cover && open mcp-server/coverage.html
# Build and push Docker image
make docker-build docker-push IMAGE_REPO=us-central1-docker.pkg.dev/YOUR_PROJECT/apps
```
### Adding a new tool
1. Create `mcp-server/internal/tools/mytool.go`
2. Define `MyTool() mcp.Tool` and `HandleMyTool(log) server.ToolHandlerFunc`
3. Register in `mcp-server/cmd/server/main.go`
4. Write tests in `mcp-server/internal/tools/mytool_test.go`
5. Document in this README's Tool Reference table
---
## References
- **Article that inspired this project:** [Ship code within minutes with the Gemini CLI DevOps Extension](https://cloud.google.com/blog/topics/developers-practitioners/ship-code-within-minutes-with-the-gemini-cli-devops-extension/) — Google Cloud Blog
- [Model Context Protocol specification](https://modelcontextprotocol.io/specification)
- [mark3labs/mcp-go](https://github.com/mark3labs/mcp-go) — Go MCP server library
- [Google Cloud Run documentation](https://cloud.google.com/run/docs)
- [GKE Autopilot documentation](https://cloud.google.com/kubernetes-engine/docs/concepts/autopilot-overview)
- [ArgoCD documentation](https://argo-cd.readthedocs.io/)
- [Workload Identity Federation](https://cloud.google.com/iam/docs/workload-identity-federation)
- [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes)
- [Google SRE Book — SLO/Error Budget](https://sre.google/sre-book/service-level-objectives/)
- [Gitleaks](https://github.com/gitleaks/gitleaks) — secret scanning
- [Semgrep](https://semgrep.dev/) — SAST
---
## License
MIT © [Ashiq Ali](https://github.com/ashiq-ali)
Built with the [Gemini CLI](https://github.com/google-gemini/gemini-cli) and [Model Context Protocol](https://modelcontextprotocol.io/).