SkillRepo
Sign InSign Up
Catalog
mastra-ai/mastra-factory

mastra-ai

mastra-factory

Operate and supervise Mastra Factory through `mastra api factory`. Use for first-time Factory connection and login, status or queue summaries, project and work-item inspection, thread history and memory, metrics, health, decisions, attention, supervisor sessions, and user-authorized autonomous or interactive Factory operations on hosted, local, remote, or self-hosted servers.

v1.0LATEST
NewUpdated Oct 12, 2026

Mastra Factory Supervisor

Use mastra api factory as the operational control plane for Factory.

First use: connect before inspecting

Read references/connection.md. Check CLI availability, establish the user's actual Factory URL, and for platform-hosted deployments run mastra auth whoami. If logged out, offer mastra auth login rather than silently starting browser login. Local/self-hosted authentication may differ.

An explicit mastra api --url "$FACTORY_URL" factory project list works from an empty directory; no deployed repository or .mastra-project.json is required. Never assume a shared host, organization, project name, or ID. Preserve the explicit target on subsequent commands.

Default behavior

For status, inspection, diagnosis, queue review, or recommendation requests:

  1. Stay read-only.
  2. Select the sole or explicitly named project; report choices when ambiguous.
  3. Inspect project state, work items, metrics, thresholds, decisions, attention, and supervisor health/session.
  4. Correlate stages, revisions, sessions, decisions, and health findings.
  5. Report active/queued work, blocked or unhealthy items, running sessions, pending decisions, human attention, and one recommended next action.
  6. Execute a recommendation only when the current request or a previously granted operating scope authorizes it.

Required reference

Read references/factory-supervisor.md before running Factory commands for output control, contracts, the read-only workflow, mutation protocol, governance constraints, durable-session limitations, and error handling.

For “my work,” actual execution progress, thread messages, memory, or health interpretation, also read references/session-inspection.md. Distinguish card stages from running agents, historical messages from current memory, and agent claims from verified repository outcomes.

Safety boundary

  • Never read or reveal .env, bearer tokens, saved login contents, or platform/provider credentials.
  • Never invent IDs, stages, revisions, request IDs, or sessions.
  • Establish the user's operating scope before mutating. Authorization may cover one action or grant standing autonomy over named projects, resources, action types, or objectives.
  • Within a clear delegated scope, act without asking for confirmation before every mutation. Ask only when an action is ambiguous, outside scope, or materially more destructive than the granted authority.
  • Fetch current state before a write, make the smallest in-scope change, then refetch and report IDs, revisions, and final state.
  • Use transitions—not metadata updates—for stage changes, with the current revision and a fresh UUID request ID.
  • Never use private HTTP routes to bypass unsupported CLI operations.
  • If work-item start lacks a supported durable user session, report the block; never substitute the supervisor session or invent a session UUID.
Files4
4 files · 36.3 KB

Select a file to preview

Overall Score

88/100

Grade

A

Excellent

Grades are signals, not a certification. Always review a skill yourself before use.

Safety

90

Quality

90

Clarity

85

Completeness

82

Summary

Mastra Factory Supervisor is a CLI control-plane skill that guides agents to operate Factory deployments for project inspection, work-item management, decision handling, and health supervision. It emphasizes read-only defaults with explicit delegation protocols for mutations, comprehensive safety boundaries around credentials, and detailed reference documentation for CLI target resolution, session inspection, and supervisor interpretation.

Static Analysis Findings

1 finding

Patterns detected by deterministic static analysis before AI scoring. Hover over any finding code for detailed information and remediation guidance.

Credential Exposure
SEC-020Direct .env File Access2x in 2 files

Direct .env file access

SKILL.md.env
references/factory-supervisor.md.env
85% confidenceCWE-538: Sensitive Info in Externally-Accessible File

Detected Capabilities

CLI command execution (mastra api factory/thread/memory)Read-only project and work-item inspectionJSON schema discovery and validationWork-item mutations (create, update, transition, delete)Decision actions (approve, dismiss, retry)Attention item management (read, archive, restore, read-all)Work-item session starts (requires durable user session)Credential-avoiding authentication (mastra auth commands)Pagination and cursor handling for collectionsFile reading (references documentation)Shell execution for CLI invocation and jq filtering

Trigger Keywords

Phrases that agents use to match this skill to user intent.

inspect factory statusdiagnose work queuemanage work itemsreview decisionsfactory health findingsfactory supervisor operationstransition board stagesfactory session inspection

Risk Signals

INFO

Direct .env file access mentioned in guidance context

SKILL.md:Safety boundary section
INFO

Direct .env file access mentioned in references

references/factory-supervisor.md:Safety and delegation rules
INFO

Explicit credential exposure prohibition with clear guidance to use CLI auth instead

SKILL.md + references/factory-supervisor.md
INFO

Outbound network requests through mastra auth login and Factory API calls

references/connection.md + factory-supervisor.md
INFO

Shell execution through piped jq filtering for JSON projection

Multiple references (schema discovery, output parsing)
WARNING

Optional npm exec invocation for temporary CLI fallback

references/connection.md:npm exec ... -- mastra

Referenced Domains

External domains referenced in skill content, detected by static analysis.

github.comlocalhostwww.apache.org

Use Cases

  • Inspect Factory project status and work queue without modifying state
  • Diagnose blocked work, stalled decisions, and supervisor health findings
  • Review work-item sessions, thread history, and observational memory
  • Transition work items between board stages with optimistic concurrency
  • Approve, dismiss, or retry pending decisions with delegation verification
  • Manage attention/human-review items with read, archive, and restore actions
  • Start durable work-item sessions with explicit user-session validation
  • Query metrics and health thresholds to assess queue age and agent coverage

Quality Notes

  • Exceptional safety documentation: explicit boundaries on `.env` and credential files with clear instruction to use CLI authentication
  • Well-structured reference separation: connection.md, factory-supervisor.md, and session-inspection.md provide layered guidance for CLI setup, operations, and diagnostics
  • Comprehensive mutation protocol with clear step-by-step verification: requires current authority assessment, schema discovery, state fetching, scope confirmation, minimal mutation, and refetch confirmation
  • Strong emphasis on read-only defaults: default behavior is inspection without mutation authority; all delegated scopes are explicitly defined with action classes and stop conditions
  • Authoritative schema-first approach: all JSON-input commands validated against leaf --schema; positional-only commands use --help discovery without guessing
  • Detailed error handling and compatibility guidance: distinguishes shell errors from CLI JSON errors, provides recovery for revision conflicts and pagination edge cases
  • Excellent pagination and collection parsing rules: narrow projections before increasing page sizes, follow hasMore/nextCursor exactly, stop on malformed JSON
  • Session and memory inspection documentation clarifies role distinctions (card stages vs. running agents, OM events vs. activation), prevents false conclusions from incomplete evidence
  • Includes practical guardrails against common misuses: never invent IDs, never substitute supervisor session for durable user session, never use private HTTP routes to bypass CLI
  • Threading throughout: connection.md→factory-supervisor.md→session-inspection.md create a logical progression from setup to operation to advanced diagnostics
Model: claude-haiku-4-5-20251001Analyzed: Oct 12, 2026

Reviews

Add this skill to your library to leave a review.

No reviews yet

Be the first to share your experience.

Use mastra-ai/mastra-factory in your dev environment

Start a Developer trial

Command Palette

Search for a command to run...