Skip to content

Built in Prompts and Workflows

Jump to bottom
Anna edited this page Jun 25, 2026 · 1 revision

Built-in Prompts & Workflows

Aura Tracker GCP ships three MCP Prompt Templates — structured multi-step workflows that guide the LLM through common operational tasks. Unlike tools (which return raw data), prompts chain multiple tool calls into a coherent analysis with a narrative conclusion.

Invoke a prompt by name in your LLM host:

"Run the audit-security-posture prompt for project my-project"

or, if the host exposes a prompt picker, select it from the list.

audit-security-posture

Purpose: Surface IAM and network security vulnerabilities in a GCP project with severity-ranked findings and remediation commands.

Parameters:

Name Required Description
project_id yes GCP project to audit
focus no iam, network, or all (default: all)

What the LLM does:

  1. Reads gcp://{project}/iam/my-permissions to check the server's own permissions and note any audit gaps.
  2. Calls gcp_iam_test_permissions to inspect IAM bindings — flags primitive Owner/Editor roles on non-admin principals, service accounts with excessive scope, and allUsers/allAuthenticatedUsers bindings.
  3. Calls gcp_cloudrun_list_services across all regions — flags services with ingress set to all (publicly reachable without IAP).
  4. Synthesizes a structured report:
CRITICAL  Public + unauthenticated exposure; primitive Owner/Editor on external identities
HIGH      Public ingress without IAP; overly broad service account roles
MEDIUM    Missing resource labels; unused service accounts; no org policy constraints

Each finding includes the affected resource, risk description, and the exact gcloud or Terraform remediation.

Prompt example:

"Audit the security posture of project my-project, focusing only on IAM."

optimize-bigquery-costs

Purpose: Analyse BigQuery table schemas and slot usage to produce a prioritised list of cost-saving recommendations.

Parameters:

Name Required Description
project_id yes GCP project
dataset_id no Specific dataset to analyse; analyses top 5 largest tables across all datasets if omitted

What the LLM does:

  1. Discovers datasets via gcp://{project}/bigquery/datasets.
  2. Reads table lists and schemas for the largest tables.
  3. Fetches 7-day slot usage via gcp_monitoring_get_metrics (bigquery.googleapis.com/slots/allocated_for_project).
  4. Produces recommendations for each table:
    • Partitioning: suggests partition column and expiration (90 days for logs, 365 for analytics, 730 for compliance)
    • Clustering: identifies columns likely used in WHERE/GROUP BY
    • Table expiration: flags _tmp, _staging, _bak, _raw tables for short TTL
    • Slot rightsizing: if peak usage < 50% of allocated slots, recommends on-demand or reduced flat-rate
    • Materialized views: detects aggregate column patterns that suggest repeated full-table scans

Returns a table ranked by estimated monthly savings (highest first).

Prompt example:

"Optimize BigQuery costs for project my-project, focusing on the analytics dataset."

incident-response-helper

Purpose: Rapid structured triage for an active Cloud Run incident — pulls service state, error logs, request metrics, and Aura Score, then produces an incident report with rollback commands.

Parameters:

Name Required Description
project_id yes GCP project
service_name yes Cloud Run service name
region yes Region the service is deployed in

What the LLM does:

  1. Reads gcp://{project}/cloudrun/{region}/{service} for current traffic splits and latest revision.
  2. Calls gcp_logging_query_recent for severity>=ERROR logs from the last 2 hours (up to 50 entries) — extracts most frequent errors, first occurrence, affected revisions.
  3. Calls gcp_monitoring_get_metrics for run.googleapis.com/request/count and run.googleapis.com/request/latencies over the last hour.
  4. Calls gcp_get_aura_score for the service.
  5. Produces an incident report:
Status     CRITICAL | DEGRADED | RECOVERING | HEALTHY
Timeline   When errors started; correlation with recent deployment
Root cause Most probable cause based on error patterns
Actions    Priority-ordered steps; if latest revision is faulty, exact
           gcp_cloudrun_update_traffic arguments to roll back traffic
Follow-up  Monitoring thresholds to set; code fixes to investigate

Prompt example:

"Run the incident-response-helper for service payments-api in region us-central1, project my-project."

Clone this wiki locally