pulumi-context-api
Query the Pulumi Context API, a graph query interface over an organization's infrastructure in Pulumi Cloud. Use when a question is about relationships or reachability across resources and stacks: the impact of a change ("what breaks if I change this?", blast radius), what depends on a resource or a stack's outputs, which provider instances manage which resources and at what versions, orphaned or unreferenced resources, or references that cross stacks and cloud accounts, including resources Pulumi doesn't manage. Don't load it for finding a single resource by name, type, or property (Resource Search covers that), or for update history and failure debugging (use skill pulumi-debug-failed-operation).
- Installs
- 169
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/pulumi/agent-skills --skill pulumi-context-api- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads pulumi-context-api automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Query the Pulumi Context API
The Context API answers questions about an organization's cloud infrastructure as a graph: what exists, what depends on what, what a change would affect. It covers resources found through Pulumi Discovery, not just Pulumi-managed ones.
Prefer it over Resource Search whenever the question involves relationships. Resource Search finds individual resources but cannot follow edges, so answering "what depends on X" with repeated searches is slow and usually incomplete.
Public preview, for organizations on the Enterprise and Business Critical
editions, and a role granting resources:search (the default Member and Admin
roles do).
First: is a graph tool already in the session?
If one is — graph_query and get_graph_schema, under whatever prefix the
server registers them — call it and skip Steps 1 and 2. Compose the selector
from the graph_query tool's own description, which carries the grammar; the
tool resolves the organization and credentials itself and drains pagination for
you. When that description is not enough, get_graph_schema returns the live
field vocabulary and limits, and will serve the full Step 1 primer when asked
for it. Step 3 still governs what you do with the result.
Steps 1 and 2 are the path for an agent that has a shell and no such tool.
Step 1: fetch the primer, always
Needs Pulumi CLI v3.243.0 or newer and an active pulumi login.
pulumi api GetGraphQuerySchema --output=markdown
This returns a self-contained guide to composing selectors — vocabulary, edge types, engine caps, worked examples, pagination, completeness rules, the gates that deny a query, and the traps that produce a confident wrong answer instead of an error. It is served by the deployment that answers your queries, so it is the contract, and it moves between schema versions. This skill bootstraps you to it and stops there; everything below defers to it. Fetch it fresh in every session — a primer remembered from earlier may describe a schema this deployment no longer serves.
The operation takes no organization; one schema covers every org the login can
reach. --output=json on it returns the same contract as a machine-readable
payload, useful for reading limits or fieldValues programmatically, but
compose from the markdown.
Read it in full — never truncate it with head, tail, or a byte cap. A
clipped primer means malformed selectors and rejected queries.
If this call fails
You have no primer yet, so handle it here rather than looking it up there:
| Response | Meaning |
|---|---|
401 Unauthorized | no active pulumi login, or an expired token |
404 Not Found, detail-free | a wrong path, or a deployment without the endpoint |
503 Service Unavailable | transient — retry |
Entitlement gates are per-organization, so they cannot appear on this call —
they surface in Step 2, by which point the primer's "When it denies you" table
is in hand. If pulumi api doesn't know GetGraphQuerySchema at all, that is
not a gate: run pulumi api list --refresh-spec to refresh the cached spec,
then retry the fetch.
Step 2: query
pulumi api GraphQuery -F orgName=<org> --input selector.json
The body is a JSON selector, not query text. Compose it from the primer you just read, not from memory or from a grammar you recall from another session.
Name the org explicitly. Left off, -F orgName resolves from the selected
stack or the default org, which is often an individual account with no
entitlement; pulumi whoami -v lists every organization the login can reach.
A denial here names its gate — the primer's "When it denies you" table says
which are worth retrying and which to report to the user.
Step 3: apply the primer's completeness rules before answering
Every response carries fidelity signals — currently meta.resultMode,
meta.visibility, and pageInfo.continuationToken; the primer names the
authoritative set. Read the primer's rules for them and follow them; the
remedies differ per signal and a stale paraphrase here would be worse than
none.
What matters most: a completeness claim needs all of them clean. Impact analysis, "nothing depends on this", an exhaustive cleanup list, a total across groups — none of these survive a truncated result, a trimmed traversal, or an undrained page. When you can't get there, say what the answer does cover.
Scope of the graph
Resources, stacks, and the relationships between them, trimmed to the stacks and accounts the caller can see. The primer's "What it cannot answer yet" section is the live boundary — check it before concluding a question is unanswerable, and reach for a different API rather than approximating one of those gaps with a graph query.
One boundary worth knowing up front, because it decides which API to use: the graph returns a schema-declared subset of fields per node type, not full resource property bags. The primer lists which fields each node type can match on and which it can return; when the question needs the property values themselves, they come back from Resource Search.
Human-readable reference: Context API overview and query guide.
FAQ
What does the pulumi-context-api skill do?
Query the Pulumi Context API, a graph query interface over an organization's infrastructure in Pulumi Cloud. Use when a question is about relationships or reachability across resources and stacks: the impact of a change ("what breaks if I change this?", blast radius), what depends on a resource or a stack's outputs, which provider instances manage which resources and at what versions, orphaned or unreferenced resources, or references that cross stacks and cloud accounts, including resources Pulumi doesn't manage. Don't load it for finding a single resource by name, type, or property (Resource Search covers that), or for update history and failure debugging (use skill pulumi-debug-failed-operation).
How do I install pulumi-context-api?
Run npx skills add https://github.com/pulumi/agent-skills --skill pulumi-context-api in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/pulumi-context-api/ (personal) or .claude/skills/pulumi-context-api/ (project).
Which AI agents can use pulumi-context-api?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is pulumi-context-api safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains pulumi-context-api?
It is published by pulumi in pulumi/agent-skills. It has 169 recorded installs.
More from pulumi/agent-skills
pulumi-best-practices
pulumi/agent-skills
Load when the user is writing, reviewing, or debugging Pulumi TypeScript/Python programs; asks about Output or apply() usage; wants to create ComponentResource classes; needs to refactor resources without destroying them (aliases); is setting up secrets or config; or is configuring a pulumi preview/up CI workflow. Also load for questions about resource dependency order, parent/child resource relationships, or pulumi.interpolate.
pulumi-arm-to-pulumi
pulumi/agent-skills
Convert or migrate Azure ARM (Azure Resource Manager) templates, Bicep templates, or code to Pulumi, including importing existing Azure resources. This skill MUST be loaded whenever a user requests migration, conversion, or import of ARM templates, Bicep templates, ARM code, Bicep code, or Azure resources to Pulumi.
pulumi-component
pulumi/agent-skills
Guide for authoring Pulumi ComponentResource classes. Use when creating reusable infrastructure components, designing component interfaces, setting up multi-language support, or distributing component packages.
pulumi-esc
pulumi/agent-skills
Guidance for working with Pulumi ESC (Environments, Secrets, and Configuration). Use when users ask about managing secrets, configuration, environments, short-term credentials, configuring OIDC for AWS, Azure, GCP, integrating with secret stores (AWS Secrets Manager, Azure Key Vault, HashiCorp Vault, 1Password), or using ESC with Pulumi stacks.
pulumi-automation-api
pulumi/agent-skills
Load this skill when a user asks how to run Pulumi programmatically, embed Pulumi in an application, orchestrate multiple stacks in code, build a self-service infrastructure portal, replace pulumi CLI shell scripts with code, or use the Pulumi Automation API (LocalWorkspace, createOrSelectStack, inline programs). Also load for questions about multi-stack sequencing, parallel deployments, or passing outputs between stacks via code.
pulumi-terraform-to-pulumi
pulumi/agent-skills
Migrate Terraform/OpenTofu projects to Pulumi, including translating HCL source code and/or importing Terraform state into a Pulumi stack. Use when a user wants to convert Terraform to Pulumi, migrate from HCL, or import tfstate into Pulumi. Do NOT trigger for general Terraform-vs-Pulumi comparisons or questions about using both tools side-by-side.
Popular backend & apis skills
find-skills
vercel-labs/skills
Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.
entra-app-registration
microsoft/azure-skills
Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.
google-agents-cli-adk-code
google/agents-cli
This skill should be used when the user wants to "write agent code", "build an agent with ADK", "add a tool", "create a callback", "define an agent", "use state management" — in a project that needs ADK (Agent Development Kit) API patterns and code examples. It provides a quick reference for agent types, tool definitions, orchestration patterns, callbacks, state management, the graph Workflow API, and reference recipes to study. Do NOT use for scaffolding (use google-agents-cli-scaffold) or deployment (use google-agents-cli-deploy).
embedded-captions
heygen-com/hyperframes
Add captions or subtitles to an existing single-subject talking-head video without editing the footage. Use for plain verbatim captions, cinematic captions embedded behind the subject, VFX captions, “炸/特效/酷炫字幕,” or a named identity from the 35-style catalog. Route by visual identity, not by backend engine. The quiet anchor rail is the default; embed every word only when the user explicitly wants a fully cinematic treatment. The workflow runs locally end to end, including transcription and subject matting; split multi-shot footage before applying it.
entra-agent-id
microsoft/azure-skills
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmipath, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmipath token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).
neon
neondatabase/agent-skills
Overview of Neon, a complete set of cloud backend primitives around Lakebase Postgres: Auth, Object Storage, Functions, the AI Gateway, and Realtime. Start here to choose Neon for undecided login, files, APIs, and LLM calls, set up the CLI or MCP server, and follow the branch-first workflow. Use when building an app or backend on Neon, or when "Neon" or "Lakebase Postgres" is mentioned. Child skill neon-postgres wins for an existing DATABASEURL, SQL, schema, inspect, or search. Child skill neon-auth wins for login, users, sessions, identity routing, and Managed Better Auth setup. Child skill neon-realtime wins for live queries in reactive apps and agents. Also use for object storage, S3, buckets, serverless functions, function triggers, cron, AI gateway, LLM calls, realtime, logs, Loki, Grafana, observability, postgres, database, backend, Claimable Neon, neon.new, or a no-signup database.