Validate, format and generate the config cloud work runs on.

Answer a few questions, get a manifest

Generate Kubernetes manifests from a short form: Deployment, Service, Ingress, PVC and HPA, with probes and resource limits filled in sensibly.

Is this YAML valid, and where is it wrong?

Validate Kubernetes YAML and get the exact line and column of any syntax error, in plain language.

Restart loops, capacity dips and stuck drains

Work out how long a Kubernetes rollout really takes, and how long a container gets to start before the liveness probe kills it.

Will this Service have any endpoints?

Find out why a Kubernetes Service has no endpoints. Compares the selector against the pod template labels and names the key that is wrong.

What can reach what, and what just broke

Resolve NetworkPolicies to see what they actually permit and which pods they flip to default-deny.

What actually changed

Compare two sets of Kubernetes manifests by meaning, not by text. Key order and fields the cluster wrote itself are ignored.

The five junk bytes in front of your payload

Decode the five bytes in front of a Kafka payload: the magic byte, the big-endian schema id, and where the Avro actually starts.

Which partition does this key land on?

Work out which Kafka partition a key lands on. murmur2 over the UTF-8 bytes, and why adding partitions breaks ordering for existing keys.

Legal, risky, or 249 characters too long?

Check Kafka topic names for the offending character, the 249 limit, and the dot-versus-underscore collision that breaks JMX metrics.

How many brokers can you lose

Work out exactly how many broker failures a topic survives before writes are refused and before an acknowledged write is lost, from replication.

Will it start, and will it lose a record?

Check a Kafka producer config for the settings that lose records: acks=1, idempotence without acks=all, and silent batch reordering.

The first five bytes are usually not data

Decode a Kafka record payload from base64 or hex and find out what it actually is.

Does it parse, and is it formatted?

Check Terraform for syntax errors and get the exact line: unclosed braces, unterminated strings and heredocs.

It is ingress.value, not each.value

Convert repeated nested Terraform blocks into a dynamic block, with the iterator named correctly and the meta-argument blocks that cannot be dynamic flagged.

A failed check does not stop the apply

Generate Terraform precondition, postcondition and check blocks, and see which of them actually stops a run and which only warns.

From the var. references you already wrote

Generate variables.tf from the var. references in a Terraform file, with the type inferred from usage and labelled as the guess it is.

Dead variables, locals and data sources

Find Terraform variables, locals and data sources that are declared and never used, plus references with no declaration behind them.

when_modified misses your modules

Generate an atlantis.yaml for Terraform projects, with the when_modified paths that shared modules need or a module change plans nothing.

Is that a registry or a Docker Hub user?

Break an image reference into registry, namespace, repository, tag and digest, fully qualified.

What this image will do to you later

Check a Dockerfile for what costs you later: unpinned base images, containers running as root, and credentials baked into a layer forever.

And the flags that have no equivalent

Turn a docker run command into a Kubernetes Deployment and Service, with the flags that have no equivalent named rather than dropped.

And why depends_on has no equivalent

Turn a docker-compose.yml into Kubernetes Deployments, Services and PVCs, with the parts that do not translate named rather than dropped.

json-file never rotates

Generate Docker logging configuration with rotation, because the default json-file driver grows until the disk is full and takes the daemon with it.

Numeric, or Kubernetes rejects it

Generate the USER, group and ownership lines a Dockerfile needs to run as a non-root user, for Debian, Alpine or distroless bases.

Which of the 16,384 slots does this key land in?

CRC16 of the key, masked to 16,384 slots, exactly as Redis Cluster routes it.

Will these keys survive a multi-key command?

Check whether Redis keys are genuinely co-located before using them in one MGET, transaction or Lua script, or Redis answers CROSSSLOT.

Read what the server actually sent

Decode RESP2 and RESP3 into the structure redis-cli would print, with byte offsets.

What the same reply looks like on each protocol

Decode a Redis reply and see which parts need RESP3, and what a RESP2 client would have received instead after a library upgrade.

Exactly what your client puts on the socket

Turn a redis-cli command into the RESP bytes a client actually sends, with the byte count.

Redis globs are not shell globs

Test a KEYS or SCAN MATCH pattern against real key names, using Redis's own matcher.

The config, and why yours does not start

Generate an MCP server config for Claude Desktop, VS Code or .mcp.json, with the absolute-path and env-inheritance traps that stop a server starting.

Why the server never came up

Validate an MCP server config and find why the server never starts: a relative command path, npx without -y, or env the process never inherits.

The keywords the client ignores

Validate an MCP tool inputSchema against the JSON Schema subset clients actually support, and catch the keywords that are silently ignored.

What your tool list costs every request

Lint an MCP tools/list response for naming collisions, missing parameter descriptions and the token cost your tool definitions add to every request.

Request, response or notification

Validate an MCP JSON-RPC message: the id rules that separate a request from a notification, and the method names the protocol actually defines.

The print statement that broke the stream

Debug an MCP stdio session log and find the stdout writes that corrupt the JSON-RPC stream, the framing errors, and an out-of-order handshake.

Reassemble the message from the wire

Decode a raw LLM SSE stream from the Anthropic or OpenAI API, reassemble the message, and see exactly where a truncated response stopped.

Anthropic, OpenAI and MCP, both ways

Convert an LLM tool definition between Anthropic, OpenAI and MCP formats, with the fields that have no equivalent named rather than dropped.

What structured output will refuse

Check whether an LLM JSON schema survives strict structured output: recursion, minimum and maxLength are rejected, additionalProperties must be false.

Where the budget runs out

Plan an LLM context window budget across system prompt, tools, history and output, and find where max_tokens truncates the answer instead of the input.

Where to put the breakpoint

Plan LLM prompt caching breakpoints and get the break-even read count: cache writes cost 1.25x at five minutes and 2x at one hour, reads cost 0.1x.

The number that matches the invoice

Calculate LLM API cost from your own token volumes and rates, including cache reads and writes, so the number matches the invoice rather than a guess.

Does this policy actually stop anything?

Paste a Content-Security-Policy header and find out what it really enforces.

Valid JSON? And what does it grant?

Validate an AWS IAM policy and see what it actually grants: wildcards, escalation paths, and the exact line and column of any JSON error.

Is this actually allowed?

Paste your IAM policies, name an action, resource and principal, and get a straight allowed or denied with the exact statement that decided it.

Is this bucket actually public?

Paste an S3 bucket policy and get a straight answer on whether anyone on the internet can read, write or list it, plus the guardrails it is missing.

Pick a pattern, get a safe policy

Generate an S3 bucket policy for private, CloudFront, cross-account or public-read access, with HTTPS-only, SSE-KMS, VPC endpoint and organization guardrails.

Split it up, and check it is right

Break an AWS ARN into its fields and catch what makes one silently match nothing: wrong partition, missing region, or bucket versus object.

Two roles, and they are not the same

Check an AWS ECS task definition for the execution role, the legal Fargate CPU and memory pairings, secrets in the environment and blocking log writes.

Valid? And where exactly is it wrong?

Validate and format JSON with the exact line and column of any error, named for what it actually is: trailing comma, single quotes, unquoted key, comment.

The line, the column, and the reason

Validate any YAML and get the exact position of a syntax error in plain language.

Either direction, and what it costs

Convert YAML to JSON or back, with the direction detected automatically and key order preserved.

Both directions, UTF-8 done right

Encode or decode base64 with the direction detected for you. Non-ASCII survives the round trip and both alphabets are handled.

Seconds or milliseconds? It says which

Convert a Unix timestamp or a date into every other representation, in UTC and your own timezone.

Read the claims, and what is wrong with them

Decode a JWT header and payload in your browser, with every timestamp turned into a real date and a plain answer on whether it has expired.

Which of the two functions you actually want

Encode or decode a URL, and see the difference between encodeURI and encodeURIComponent that turns one query parameter into two.

Five characters, not four hundred

Encode or decode HTML entities, with the escaping context that decides whether five characters are enough or nowhere near.

Bytes, with a hex dump

Convert text to hex or hex to text, with a byte dump, and the UTF-8 byte count that is not the character count.

MD5 through SHA-512, and which to trust

Generate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 digests of any text in your browser.

The right one, and the wrong ones

Which cryptographic algorithm for which job, with real parameters: password storage, API keys, encryption at rest, signing, key derivation, MACs and randomness.

Length narrows it. Nothing identifies it

Identify a hash from its length, with every algorithm that shares it, because SHA-256, SHA3-256 and BLAKE2s-256 are all 32 bytes.

Is the cost actually adequate?

Read a bcrypt, Argon2, PBKDF2 or shadow hash and get its real cost parameters, plus the bcrypt limit that silently truncates at 72 bytes.

v4 for random, v7 for sortable

Generate UUIDs in bulk, version 4 or the newer time-ordered version 7, in any format you need.

How many hosts, and does it overlap?

Work out network, broadcast, netmask and usable hosts for any IPv4 CIDR, with the AWS host count that is five lower than the standard one.

What it means, and when it next runs

Turn a cron expression into a sentence with its next six run times, and catch the trap: day-of-month and day-of-week are ORed, not ANDed.

Lay out the whole VPC at once

Lay out every subnet in an AWS VPC at once, with the five addresses AWS reserves per subnet already taken off the usable count.

Pick a schedule, get the expression

Build a cron expression from a form, optionally wrapped in a complete Kubernetes CronJob with hardened defaults.

Estimate what you are burning

Estimate what idle instances, unattached disks, stale snapshots and orphaned IPs cost you, priced at rates you enter rather than a table that goes stale.

The tags your cost report will be missing

Check an AWS Organizations tag policy or a tag list against your naming rules, and find the resources that will fall out of cost allocation.