Skills

parapetai-mcp init installs seven Claude Code skills into .claude/skills/. Each is a SKILL.md that tells an agent (Claude Code, or any other MCP client that reads skills) exactly which parapet_* tools to call, in what order, and what never to do — they are not separate binaries, just structured instructions plus (for parapet-quickdemo) packaged project templates.

parapet-maf

Use when: you want Parapet added to an existing project that already uses Microsoft Agent Framework (agent_framework) — governing an agent that's already there, provisioning a Parapet agent for it, or wiring up parapetai-agent[maf] env vars.

It checks for from agent_framework... imports before applying anything, authenticates, provisions an agent via parapet_provision_agent, and instruments the codebase — swapping in GovernedAgent/build_middleware() and wiring the resulting agent_id/agent_secret/control_plane_url into the project's env config.

For a Google ADK project use parapet-adk instead, and for a LangGraph/ LangChain (langchain.agents.create_agent) project use parapet-langgraph — the instrumentation procedure is genuinely different for each, not just a naming difference.

parapet-adk

Mirror of parapet-maf for an existing Google ADK (google.adk) codebase: checks for google.adk imports first, then provisions and instruments with GovernedRunner/build_plugin().

parapet-langgraph

Mirror of parapet-maf/parapet-adk for an existing LangGraph/ LangChain (langchain.agents.create_agent) codebase: checks for create_agent/create_react_agent usage first, then provisions and instruments with build_middleware() registered via create_agent(..., middleware=[...]) — there is no wrapper class here the way MAF has GovernedAgent/ADK has GovernedRunner. Coverage is per-create_agent call site, same as parapet-maf's per-construction-site model, not parapet-adk's single-Runner model. parapet_get_quickstart does not yet return LangGraph-specific install/model fields — see the skill's own step 3 for what to use instead.

parapet-quickdemo

Use when: there's no existing project — "build me a Parapet demo", "show me governance in action", "generate an example governed agent".

Generates a small, self-contained, runnable project from packaged templates demonstrating identity-based tool access: two people in different orgs (Tony in Sales, Sally in HR) share one agent with two tools, and a Cedar policy scoped to org lets each of them reach only their own tool. Runs against a mock model by default (no API key needed) and a real Parapet control plane behind it, so the allow/deny decisions and audit trail are real and clickable — not simulated. Also supports a fully local mode (PARAPETAI_MODE=local, no control plane at all) for fast policy iteration; see the generated project's own README for the toggle.

Distinct from parapet-maf/parapet-adk/parapet-langgraph, which retrofit an existing project — this one creates a new one from nothing, in a directory you name (templates exist for all three frameworks).

parapet-install-prereqs

Use when: parapet_check_prerequisites (or another skill about to run it) reports something missing — Python 3.12+, pipx, or uv not on PATH.

Calls parapet_check_prerequisites, reports each failing check's detail and install_cmd, and asks before running each install command, one at a time — never installs anything without explicit per-step approval. On macOS, Homebrew has to succeed before pipx/uv's own install commands will, so ordering matters and this skill enforces it.

parapet-audit

Use when: you want to know how exposed an existing codebase is before touching it — "audit my codebase for governance risks", "scan for ungoverned model/tool calls", "how exposed are we without Parapet".

Read-only. Runs parapet_audit_codebase (a local, static AST scan — no control plane call, nothing sent anywhere) and reports the high/medium/low findings, pointing at the saved Markdown report (.parapet/audit/report.md by default). Never edits, deletes, or moves any file in the audited codebase itself. Explicitly honest about what the scanner is: precision-favoring and best-effort against a curated set of known import/call shapes — a clean result is not a certification, and files_skipped is reported so blind spots stay visible.

parapet-audit-fix

Use when: you have a report from parapet-audit and want to act on it — "fix the audit findings", "wrap the flagged calls in GovernedAgent/GovernedRunner".

Edits files — the one skill here that isn't read-only by default, unlike parapet-audit. Triages each finding by category first (a raw Agent/Runner construction gets the actual GovernedAgent/GovernedRunner wrap, following parapet-maf/parapet-adk's own instrumentation procedure per the finding's framework field; a build_middleware()/ build_plugin() result that was never registered gets a smaller, mechanical wiring fix; a raw model client with no framework in use gets pointed at Governor instead, never force-fit into a framework wrapper that doesn't apply), then re-runs the audit afterward to confirm the finding count actually dropped rather than just reporting "fixed."

How they fit together

graph TD
    A["parapetai-mcp init"] --> B[".claude/skills/parapet-*"]
    C["user: build me a demo"] --> D[parapet-quickdemo]
    E["user: govern my MAF agent"] --> F[parapet-maf]
    G["user: govern my ADK agent"] --> H[parapet-adk]
    S["user: govern my LangGraph agent"] --> T[parapet-langgraph]
    N["user: audit my codebase"] --> O[parapet-audit]
    D --> I[parapet_check_prerequisites]
    F --> I
    H --> I
    T --> I
    I -->|missing| J[parapet-install-prereqs]
    D --> K["parapet_login_start / parapet_login_wait / parapet_whoami"]
    F --> K
    H --> K
    T --> K
    K --> L[parapet_provision_agent]
    L --> M["parapet_push_policy_file (quickdemo only)"]
    O --> P[parapet_audit_codebase]
    P --> Q[".parapet/audit/report.md"]
    Q -->|"user: fix these"| R[parapet-audit-fix]
    R -->|"maf findings"| F
    R -->|"adk findings"| H
    R --> P

Every skill is careful about two things that show up repeatedly in their instructions: never print an agent secret, CLI token, or the contents of ~/.parapet/credentials.json into chat once it's written to disk; and never suggest disabling fail-closed defaults or weakening a policy to make something "just work" — a denial is the product working, not a bug to route around.