/mittwald

name: mittwald
description: "Read and inspect mittwald mStudio projects, apps, runtimes, databases, domains, mail, backups, files, containers, and access users through SecretRef-backed API requests."
user-invocable: true
requires:
  bins:
    - node
credentials:
  - id: mittwald-api-token
    kind: bearer
    required: true
    secret_ref:
      source: store
      id: MITTWALD_API_TOKEN
    scope: "https://api.mittwald.de Authorization bearer"
    how_to_obtain: |
      Create an API token in mittwald mStudio under the user profile API token
      settings. Set `MITTWALD_API_TOKEN` through browser admin at
      `/admin/secrets`; if browser admin is unavailable,
      use `/secret set MITTWALD_API_TOKEN "<token>"` in browser `/chat` or TUI;
      local console fallback:
      `hybridclaw secret set MITTWALD_API_TOKEN "<token>"`.
metadata:
  hybridclaw:
    category: infrastructure
    short_description: "mittwald mStudio read operations and guarded production planning."
    tags:
      - mittwald
      - mstudio
      - hosting
      - infrastructure
      - production
    related_roadmap:
      - R21.104
    issue: 1068
    stakes_tiers:
      green:
        - whoami
        - projects
        - project
        - apps
        - app
        - app-status
        - app-system-software
        - databases
        - mysql-databases
        - redis-databases
        - domains
        - dns-zones
        - ingresses
        - backups
        - backup
        - backup-path
        - backup-database-dumps
        - cronjobs
        - ssh-users
        - sftp-users
        - mail-addresses
        - delivery-boxes
        - mail-settings
        - stacks
        - services
        - service
        - volumes
        - registries
        - service-logs
        - file-info
        - directory
        - disk-usage
        - extension-orders
        - extension-instances
        - extension-instance
        - licenses
        - check-domain-availability
      amber:
        - create-redis-database
        - create-mysql-database
        - create-app-installation
        - create-cronjob
        - change-domain-project
        - update-domain-nameservers
        - cancel-domain-deletion
        - validate-license-key
        - create-delivery-box
      red:
        - service-action
        - restore-backup
        - restore-backup-path
        - schedule-domain-deletion
        - order-extension
    escalation:
      writes: confirm-each
      route: f14
    cost_measurement:
      system: UsageTotals
      sub_limit_key: mittwald

mittwald

Use this skill for mittwald mStudio / Kundencenter production-platform work: project inventory, app/runtime inspection, deployment readiness, databases, domains/DNS/SSL/ingress, mail resources, backups, files, containers, SSH/SFTP users, and marketplace/license readouts.

Default Workflow

1. Read first. Use `mittwald.cjs` to generate allowlisted `http_request` payloads and pass only the emitted `httpRequest` value to the built-in `http_request` tool. 2. Treat `MITTWALD_API_TOKEN` as a SecretRef only. The helper sets `bearerSecretName: "MITTWALD_API_TOKEN"` so the gateway injects `Authorization: Bearer ...` server-side. Never ask the user to paste the token, inspect it, or write raw `Authorization` headers. 3. For prompt/user testing, stop after `plan` or helper `http-request` payload generation. Do not call `http_request` unless live mittwald data is needed for the user's request. 4. For live calls, stop after the first 401 or 403. Report a credential or API role setup problem and ask the operator to verify `MITTWALD_API_TOKEN` in this order: browser admin at the active `/admin/secrets` route, `/secret set MITTWALD_API_TOKEN "<mittwald-api-token>"` in browser `/chat` or TUI, then local console fallback `hybridclaw secret set MITTWALD_API_TOKEN "<mittwald-api-token>"`. 5. For 429 responses, report rate-limit guidance from `Retry-After`, `X-RateLimit-Reset`, `X-RateLimit-Remaining`, and `X-RateLimit-Limit` when present. Do not start retry loops. 6. For guarded writes, require exact F8/F14 operator approval for the named target and pass `--operator-grant` only after that approval. The helper includes the target resource id in `approval.requiredGrant`. 7. Account for eventual consistency after writes: mutating responses may return an `etag` event id. Run the emitted `event-follow-up` command with `--event-id <etag>` so the read uses `if-event-reached` before reporting completion. 8. Do not use `curl` as the normal execution path when `http_request` is available.

The helper is read-first. Guarded write operations exist only for allowlisted mittwald API shapes and require exact F8/F14 approval: service actions, database creation, app installation creation, cronjob creation, domain project/nameserver/deletion changes, backup restore, delivery box creation, license-key validation, and extension ordering. App installation runtime actions are intentionally not exposed because the current mittwald OpenAPI marks that endpoint deprecated and non-functional. Do not create API tokens or use unlisted marketplace mutations.

Command Contract

node skills/mittwald/mittwald.cjs --help

Build core read requests:

node skills/mittwald/mittwald.cjs --format json http-request whoami
node skills/mittwald/mittwald.cjs --format json http-request projects --limit 50
node skills/mittwald/mittwald.cjs --format json http-request project --project-id <project-id>
node skills/mittwald/mittwald.cjs --format json http-request apps --project-id <project-id> --limit 50
node skills/mittwald/mittwald.cjs --format json http-request domains --project-id <project-id> --limit 50
node skills/mittwald/mittwald.cjs --format json http-request backups --project-id <project-id> --limit 50

Build database and runtime requests:

node skills/mittwald/mittwald.cjs --format json http-request databases --pro