feat(plugins): add Sazabi plugin

Merged
SH
1d ago
+953-0

What & why

Adds a first-party Sazabi plugin that proxies Sazabi's hosted MCP server (https://mcp.sazabi.com/mcp). Agents can ask questions about production logs and traces in plain language, find the issues Sazabi opens on its own, and read past investigations, without leaving Paradev. This follows the Slack thread with Satya about submitting a Sazabi plugin. It is modeled on the Peec AI plugin (#9087).

Connector: sazabi_mcp

  • OAuth 2.0, dynamic client. Sazabi publishes protected-resource metadata at /.well-known/oauth-protected-resource/mcp, pointing to the authorization server https://api.platform.sazabi.com/api/auth (RFC 8414 path-based metadata). That server supports dynamic client registration, PKCE S256, authorization_response_iss_parameter_supported, and the mcp + offline_access scopes. We also request openid profile email, so identity comes from the server's userinfo endpoint ($.sub / $.email), the same way posthog_mcp does it.
  • Secret key. For headless setups. The MCP server takes it in the X-Sazabi-Secret-Key header, so this method has its own bind. The plugin sets no plugin-level bind, because the method's bind wins in resolve-target.ts. Identity: GET https://api.sazabi.com/v1/me with the key as a bearer token returns the organization ($.organization.id/name) and keyName.

Skills

The Sazabi MCP server lists only two tools, search and execute, so every skill tells the agent to search for an operation, load its schema, then execute it.

  • investigate-production: checks existing issues and threads first, asks the logs one precise question at a time (sazabi/logs.ask), reads the lines behind the answer, and reports what fails, why, and who it hits before touching code.
  • verify-a-deploy: compares the targeted error or behavior before and after a deploy, checks for new kinds of errors, and only then calls the task done.
  • triage-issues: ranks the issues Sazabi opened by severity, growth and who they hit, ties each to code in the repo with log evidence, and proposes one fix per issue. Issues stay open until the fix ships.
  • instrument-with-sazabi: adds the OpenTelemetry SDK for the app's runtime, exports logs and traces over OTLP/HTTP to a Sazabi intake URL kept in configuration (from sazabi/logSources.create), and confirms the first records arrive.
  • send-agent-telemetry: points Claude Code's or Codex's built-in OTLP exporter at Sazabi so agent sessions (tool calls, model requests, tokens, cost) are searchable. Prompt export stays off unless the user opts in, and the skill warns that Codex always exports tool-call content.
  • add-logging: adds structured, stable-named log lines on the changed code path, matching the repo's logger, with no secrets or payloads.
  • use-project-memory: reads Sazabi project memory (runbooks, past incidents) before investigating, and writes back verified, durable findings (memory.search/create/update).
  • build-a-dashboard: turns a recurring question into a saved dashboard. It checks that the fields exist, runs dashboards.validate before create, and runs dashboards.render to confirm every panel returns data.

Also

Catalog entry (Developer tools), a brand-red glyph icon (desktop + marketing), sazabi.com link unfurl, a marketing plugins card translated into all 16 locales, and a docs page.

How I tested it

  • bun run check:plugins: all plugins valid and published (sazabi@1.0.0, generated via plugins publish sazabi).
  • bun run check:i18n: passes. The new string is translated in all 16 locales.
  • bun test src/lib/connectors/connectors.test.ts (trpc): 37 pass. Two new tests cover the OAuth userinfo probe and the secret-key /v1/me probe.
  • biome check on the touched files: clean. tsc --noEmit is clean for packages/shared and apps/marketing. I did not finish a full typecheck of packages/trpc or apps/desktop locally (sandbox limits). The desktop change mirrors the Peec icon and unfurl entries.
  • Live discovery: I ran authorizeUrl("sazabi_mcp", …) locally against the real Sazabi endpoints, with POSTs and the DB stubbed. It resolves mcp.sazabi.com/.well-known/oauth-protected-resource/mcp → api.platform.sazabi.com/.well-known/oauth-authorization-server/api/auth, then moves on to dynamic client registration.
  • Not verified: a full live OAuth connect and a proxied tool call. Both need this on a deployed API.

Checklist

  • PR title follows conventional commits (type(scope): subject)
  • bun run lint and bun run typecheck pass (touched files lint clean; shared + marketing typecheck clean; see above)
  • "Allow edits from maintainers" is checked on fork PRs (this fork is under the sazabi org, where GitHub doesn't offer that option; happy to give access or push changes)
  • I have signed the CLA (will sign when the bot asks)

Summary by cubic

Adds the first-party Sazabi plugin so agents can investigate production logs, traces, and issues in plain language without leaving Paradev. Includes the sazabi_mcp connector, eight skills, and supporting catalog, icon, docs, and i18n entries.

New Features

  • sazabi_mcp connector proxies Sazabi's hosted MCP server (https://mcp.sazabi.com/mcp) with two auth methods: OAuth 2.0 via dynamic client registration and PKCE, or a secret key sent in the X-Sazabi-Secret-Key header; identity comes from Sazabi's userinfo endpoint or GET https://api.sazabi.com/v1/me respectively. Paradev keeps one Sazabi connection per organization: a second secret key from the same org replaces the first, and a project-scoped key limits the agent to that project.
  • Sazabi's MCP server exposes only search and execute, so every skill browses operations with namespace: "sazabi" — an empty query without a namespace is not what lists Sazabi operations — loads each operation's schema, then runs it.
  • investigate-production skill starts from existing issues and threads, asks the logs one precise question at a time, and reports what fails, why, and who it hits before touching code.
  • verify-a-deploy skill compares the targeted error or behavior before and after a deploy, checks for new errors, and only then calls the task done.
  • Six further skills cover OpenTelemetry instrumentation, structured logging, dashboard building, project memory, issue triage, and agent telemetry; the docs page documents all eight as sazabi-<skill>.
  • Adds a catalog entry (Developer tools), brand-red glyph icon in desktop and marketing, sazabi.com link unfurl, marketing card in all 16 locales, and tests for both auth methods' identity probes.

Summary by CodeRabbit

  • New Features
    • Added the Sazabi plugin with OAuth and secret-key connection options and a dedicated icon.
    • Added Sazabi-assisted workflows for investigating production issues, verifying deployments, triaging issues, and using project memory.
    • Added guidance for instrumentation, agent telemetry, structured logging, and dashboard creation.
  • Documentation
    • Added Sazabi setup, authentication, and feature details.
  • Localization
    • Added translations of the plugin description in supported languages.