A night of alert noise deduped to the pages that matter, access reviews that actually run, and an approval trail you can hand an auditor — in one ask.
Sentry
Datadog
Cloudflare
GitHub
Slack
Drive
claude code — sec agentStacklink connectedMonitoring, repos, DNS, drives — one hosted link each, scoped grants only. The agent sees what the reviewer who signed in can see.
Triage, reviews, evidence pulls — the agent finds the right tools just-in-time; reading logs and configs never touches your meter.
Pages, revocations, config changes — held for one click, run exactly once, recorded with who approved. The trail IS the evidence.
Triage the overnight alerts — page only what matters.
·ALERT TRIAGEWho still has access they shouldn't?
·ACCESS REVIEWPull last quarter's approval trail for the audit.
·AUDIT EVIDENCEAnything expiring on our domains in 30 days?
·CERT HYGIENEWhich monitors are known-noisy, where pages go, what's change-frozen on Fridays — learned once, applied on every night shift after. Per reviewer, off by default, deletable.
stacklink · memoryRECALLED · 12msPages go to #sec-oncall, evidence attachedlearned from the last incidentThe payments repo needs two reviewerslearned from three PRs in a rowProd zones are change-frozen on Fridaysyou said it once — it stuckThe known-noisy monitors got a list; the three real incidents got pages with evidence attached — and every page waited for the on-call lead's yes.
COMPOSITE OF STAGING RUNS — NOT A CUSTOMER CLAIM. YOUR STACK WILL DIFFER; THE GUARDRAILS WON'T.Plug in once — MCP or SDK — and every product on this page is already in the run.
free tier · no card · first tool call before your coffee cools