Review evidence

pulumi/docs PR #22287 6de586eee6 generated 2026-10-23T18:18:33Z

Verification trail

#1 ✅ Verified
config/_default/menus.yml:369
url: /docs/ai/agents/integrations/#repositories
evidence: The menu link works. content/docs/ai/agents/integrations.md exists, it is the menu identifier `ai-agents-integrations` that this entry uses as its parent, and line 82 has the heading `### Repositories`. Hugo turns that heading into the…; source: repo:content/docs/ai/agents/integrations.md#L82
source: repo:content/docs/ai/agents/integrations.md#L82
pass1 · url · high confidence
#2 ✅ Verified
config/_default/menus.yml:374
url: /docs/ai/mcp-server/#tools
framing: This is a menu link, and the anchor matches the page's "## Tools" heading.; evidence: The target page exists at content/docs/ai/mcp-server/index.md, which Hugo serves at /docs/ai/mcp-server/. Line 156 has the heading "## Tools", so the `#tools` anchor resolves. I didn't need the unreadable marketing-web#252 to settle this.; source: repo:content/docs/ai/mcp-server/index.md (L156 "## Tools")
source: repo:content/docs/ai/mcp-server/index.md (L156 "## Tools")
framing: exact-match — This is a menu link, and the anchor matches the page's "## Tools" heading.
pass1 · url · high confidence
#3 ✅ Verified
config/_default/menus.yml:379
url: /docs/ai/neo/integrations/mcp/#atlassian-jira-and-confluence
evidence: The menu URL resolves. content/docs/ai/neo/integrations/mcp/_index.md exists and is served at /docs/ai/neo/integrations/mcp/. Its line 53 has the heading "### Atlassian (Jira and Confluence)", which Hugo turns into the anchor…; source: repo:content/docs/ai/neo/integrations/mcp/_index.md#L53
source: repo:content/docs/ai/neo/integrations/mcp/_index.md#L53
pass1 · url · high confidence
#4 ✅ Verified
config/_default/menus.yml:384
url: /docs/ai/neo/integrations/mcp/#cloudflare
evidence: The link target exists: content/docs/ai/neo/integrations/mcp/_index.md has a heading at L62, "### Cloudflare", which Hugo renders with the anchor #cloudflare. The menu entry also follows the same pattern as its sibling entries…; source: repo:content/docs/ai/neo/integrations/mcp/_index.md (L62); repo:config/_default/menus.yml (L376-420)
source: repo:content/docs/ai/neo/integrations/mcp/_index.md (L62); repo:config/_default/menus.yml (L376-420)
pass1 · url · high confidence
#5 ✅ Verified
config/_default/menus.yml:389
url: /docs/ai/neo/integrations/mcp/#dash0
evidence: The menu link resolves: content/docs/ai/neo/integrations/mcp/_index.md has no url override, so Hugo publishes it at /docs/ai/neo/integrations/mcp/. Line 68 has the heading "### Dash0", which produces the #dash0 anchor. The unreadable…; source: repo:content/docs/ai/neo/integrations/mcp/_index.md (L1-14, L68)
source: repo:content/docs/ai/neo/integrations/mcp/_index.md (L1-14, L68)
pass1 · url · high confidence
#6 ✅ Verified
config/_default/menus.yml:394
url: /docs/ai/neo/integrations/mcp/#honeycomb
evidence: content/docs/ai/neo/integrations/mcp/_index.md exists, so it builds to /docs/ai/neo/integrations/mcp/. Line 80 has the heading "### Honeycomb", which Hugo turns into the #honeycomb anchor.; source: repo:content/docs/ai/neo/integrations/mcp/_index.md#L80
source: repo:content/docs/ai/neo/integrations/mcp/_index.md#L80
pass1 · url · high confidence
#7 ✅ Verified
config/_default/menus.yml:399
url: /docs/ai/neo/integrations/mcp/#linear
evidence: The target page content/docs/ai/neo/integrations/mcp/_index.md exists, and line 90 has the heading "### Linear". That heading generates the #linear anchor, so the link resolves. The unreadable marketing-web#252 wasn't needed.; source: repo:content/docs/ai/neo/integrations/mcp/_index.md#L90
source: repo:content/docs/ai/neo/integrations/mcp/_index.md#L90
pass1 · url · high confidence
#8 ✅ Verified
config/_default/menus.yml:404
url: /docs/ai/neo/integrations/mcp/#new-relic
evidence: The menu URL resolves. content/docs/ai/neo/integrations/mcp/_index.md exists and has a heading "### New Relic" at L104, which Hugo turns into the anchor #new-relic. I didn't need the unreadable marketing-web#252 to check this.; source: repo:content/docs/ai/neo/integrations/mcp/_index.md#L104
source: repo:content/docs/ai/neo/integrations/mcp/_index.md#L104
pass1 · url · high confidence
#9 ✅ Verified
config/_default/menus.yml:409
url: /docs/ai/neo/integrations/mcp/#pagerduty
evidence: The menu URL resolves to content/docs/ai/neo/integrations/mcp/_index.md. That file has a "### PagerDuty" heading at L112, and Hugo turns that heading into the #pagerduty anchor. The unreadable marketing-web#252 wasn't needed to settle this.; source: repo:content/docs/ai/neo/integrations/mcp/_index.md#L112
source: repo:content/docs/ai/neo/integrations/mcp/_index.md#L112
pass1 · url · high confidence
#10 ✅ Verified
config/_default/menus.yml:414
url: /docs/ai/neo/integrations/mcp/#sentry
framing: The link target path and its #sentry anchor both exist in the repo.; evidence: The target page is content/docs/ai/neo/integrations/mcp/_index.md. It has no url override, so it renders at /docs/ai/neo/integrations/mcp/. It contains a "### Sentry" heading (L123), which Hugo turns into the #sentry anchor, so the menu…; source: repo:content/docs/ai/neo/integrations/mcp/_index.md
source: repo:content/docs/ai/neo/integrations/mcp/_index.md
framing: exact-match — The link target path and its #sentry anchor both exist in the repo.
pass1 · url · high confidence
#11 ✅ Verified
config/_default/menus.yml:419
url: /docs/ai/neo/integrations/mcp/#supabase
evidence: The target page content/docs/ai/neo/integrations/mcp/_index.md exists, and line 131 has the heading "### Supabase", which generates the #supabase anchor. The menu link resolves without needing the unreadable marketing-web#252.; source: repo:content/docs/ai/neo/integrations/mcp/_index.md#L131
source: repo:content/docs/ai/neo/integrations/mcp/_index.md#L131
pass1 · url · high confidence
#12 ✅ Verified
content/docs/ai/_index.md:3
Coding agents including Claude Code, Codex, and Cursor can be used with Pulumi to write, preview, and deploy infrastructure code.
framing: The README names the three agents plus others and describes Pulumi workflow skills. The claim is a general statement of the same capability.; evidence: The pulumi/agent-skills README says the Pulumi skills "teach AI coding assistants how to help with infrastructure" and "work with: Claude Code ... Cursor ... OpenAI Codex". It also lists skills for writing Pulumi programs and debugging…; source: gh api repos/pulumi/agent-skills/readme
source: gh api repos/pulumi/agent-skills/readme
framing: entailed-narrower — The README names the three agents plus others and describes Pulumi workflow skills. The claim is a general statement of the same capability.
pass1 · feature · medium confidence
#13 ✅ Verified
content/docs/ai/_index.md:3
Pulumi provides an MCP (Model Context Protocol) server that can be connected to a coding agent to provide cloud context.
framing: "Cloud context" is a loose paraphrase of what the server exposes: access to Pulumi Cloud resources and the Registry.; evidence: (escalated from pass1) Pulumi publishes an official MCP server (github.com/pulumi/mcp-server, npm @pulumi/mcp-server, hosted at mcp.ai.pulumi.com/mcp). The npm package says it "enables advanced Infrastructure as Code development…; source: https://www.npmjs.com/package/@pulumi/mcp-server; https://hub.docker.com/r/mcp/pulumi; https://www.pulumi.com/docs/ai/mcp-server/
source: https://www.npmjs.com/package/@pulumi/mcp-server; https://hub.docker.com/r/mcp/pulumi; https://www.pulumi.com/docs/ai/mcp-server/
framing: "Cloud context" is a loose paraphrase of what the server exposes: access to Pulumi Cloud resources and the Registry.
pass3 · feature · high confidence
#14 ✅ Verified
content/docs/ai/_index.md:23
Pulumi Agents can be given ongoing responsibilities, such as investigating incidents or maintaining infrastructure dependencies.
framing: Linked page says "maintaining dependencies" and the claim says "maintaining infrastructure dependencies". The page's surrounding sentence is about "ongoing…; evidence: The linked target page says: "Use a pre-built agent or build your own to take on ongoing infrastructure responsibilities, such as investigating incidents or maintaining dependencies." The claim's link points to this page and matches it.…; source: repo:content/docs/ai/agents/_index.md
source: repo:content/docs/ai/agents/_index.md
framing: exact-match — Linked page says "maintaining dependencies" and the claim says "maintaining infrastructure dependencies". The page's surrounding sentence is about "ongoing infrastructure responsibilities", so the meaning is the same.
pass1 · url · medium confidence
#15 ✅ Verified
content/docs/ai/_index.md:24
Pulumi Agents can be given ongoing responsibilities, such as investigating incidents or maintaining infrastructure dependencies, with instructions and access…
evidence: The sibling page content/docs/ai/agents/_index.md backs up the claim: "Use a pre-built agent or build your own to take on ongoing infrastructure responsibilities, such as investigating incidents or maintaining dependencies." It also says…; source: repo:content/docs/ai/agents/_index.md
source: repo:content/docs/ai/agents/_index.md
pass1 · feature · low confidence
#16 ✅ Verified
content/docs/ai/_index.md:27
The page /docs/ai/coding-agents/ exists as the documentation for using Pulumi with a coding agent.
evidence: The repo has content/docs/ai/coding-agents/_index.md, so the page /docs/ai/coding-agents/ exists. Its title is "Use your coding agent" and its h1 is "Use your coding agent with Pulumi". I didn't need the unreadable marketing-web#252 to…; source: repo:content/docs/ai/coding-agents/_index.md
source: repo:content/docs/ai/coding-agents/_index.md
framing: exact-match
pass1 · url · high confidence
#17 ✅ Verified
content/docs/ai/_index.md:28
MCP (Model Context Protocol) can be connected to a coding agent to provide Pulumi cloud context.
evidence: The coding-agents page linked from this card (a separate file, not the one under review) backs it up: "Pulumi provides skills for infrastructure workflows, an MCP server for cloud context" and "The MCP server lets your coding agent query…; source: repo:content/docs/ai/coding-agents/_index.md L14-L22
source: repo:content/docs/ai/coding-agents/_index.md L14-L22
pass1 · feature · medium confidence
#22 ✅ Verified
content/docs/ai/agents/_index.md:17
Neo works on the user's behalf using the user's existing Pulumi Cloud access.
framing: source: 'acts on behalf of the user invoking it' / 'works with your Pulumi Cloud permissions' vs claim: 'works on the user's behalf using the user's existing…; evidence: The linked Neo page says Neo "works with your Pulumi Cloud permissions," and the Neo permissions reference says "Neo acts on behalf of the user invoking it, and Neo can only do what that user could do themselves." Both are pulumi.com…; source: repo:content/docs/ai/neo/_index.md L18; repo:content/docs/ai/neo/permissions/_index.md L20-23
source: repo:content/docs/ai/neo/_index.md L18; repo:content/docs/ai/neo/permissions/_index.md L20-23
framing: exact-match — source: 'acts on behalf of the user invoking it' / 'works with your Pulumi Cloud permissions' vs claim: 'works on the user's behalf using the user's existing Pulumi Cloud access'
pass1 · url · medium confidence
#23 ✅ Verified
content/docs/ai/agents/_index.md:23
Pulumi provides pre-built agents for incident investigation, drift response, deployment troubleshooting, and other infrastructure work.
framing: The anchor resolves, and the three named agents appear in the target page's pre-built agent table along with three others.; evidence: The link target heading "## Start with a pre-built agent" exists in content/docs/ai/agents/configure.md (L21). Its table lists "Incident investigation", "Deployment troubleshooting", "Drift response", plus Upgrade maintenance, Security…; source: repo:content/docs/ai/agents/configure.md#L21-L32
source: repo:content/docs/ai/agents/configure.md#L21-L32
framing: exact-match — The anchor resolves, and the three named agents appear in the target page's pre-built agent table along with three others.
pass1 · url · medium confidence
#25 ✅ Verified
content/docs/ai/agents/_index.md:29
A custom Pulumi agent investigating checkout failures can correlate application errors with recent deployments and cloud configuration, follow an incident…
framing: The claim restates the custom-agent page's checkout example (errors vs. deployments/config, follows a runbook, prepares a fix for review). Both are Pulumi…; evidence: The linked page uses the same example: "a checkout investigation agent can use application logs, recent deployments, and cloud configuration to diagnose failures and prepare fixes for review." Its sample system prompt says to "Compare…; source: repo:content/docs/ai/agents/custom.md
source: repo:content/docs/ai/agents/custom.md
framing: exact-match — The claim restates the custom-agent page's checkout example (errors vs. deployments/config, follows a runbook, prepares a fix for review). Both are Pulumi docs pages, so this shows they agree but doesn't confirm the product behavior from…
pass1 · url · medium confidence
#26 ✅ Verified
content/docs/ai/agents/_index.md:33
Pulumi Agents can be connected to tools so they can work with cloud resources, code, logs, and issues; see /docs/ai/agents/integrations/.
framing: Link-target check: the page exists and describes the same scope as the claim. It is a same-site page, so it confirms the link and wording, not the product…; evidence: The link target exists at content/docs/ai/agents/integrations.md. Its meta_desc says "Connect Pulumi Agents to repositories, cloud providers, monitoring tools, and issue trackers." It also has sections for Repositories, Cloud accounts…; source: repo:content/docs/ai/agents/integrations.md
source: repo:content/docs/ai/agents/integrations.md
framing: exact-match — Link-target check: the page exists and describes the same scope as the claim. It is a same-site page, so it confirms the link and wording, not the product capability itself.
pass1 · url · medium confidence
#27 ✅ Verified
content/docs/ai/agents/_index.md:37
Work can be assigned directly to Pulumi Agents (/docs/ai/agents/tasks/), or started automatically using events and schedules (/docs/ai/agents/triggers/).
framing: Link targets match the anchors: direct assignment is covered on /tasks/, and events and schedules on /triggers/.; evidence: Both link targets exist in the repo and say what the sentence says they do. tasks.md: "Start a task by giving an agent an assignment in Pulumi Cloud or Slack". triggers.md: "Configure an agent to start tasks automatically when a Pulumi…; source: repo:content/docs/ai/agents/tasks.md; repo:content/docs/ai/agents/triggers.md
source: repo:content/docs/ai/agents/tasks.md; repo:content/docs/ai/agents/triggers.md
framing: exact-match — Link targets match the anchors: direct assignment is covered on /tasks/, and events and schedules on /triggers/.
pass1 · url · high confidence
#28 ✅ Verified
content/docs/ai/agents/_index.md:41
Users can collaborate with Pulumi Agents in tasks or Slack threads to add context, answer questions, and refine the agent's work; the tasks page has a…
framing: The anchor exists, and the target section plus the Slack section both support collaborating in tasks or Slack threads to add context, answer questions, and…; evidence: The tasks page has a "## Work with teammates" heading, which produces the #work-with-teammates anchor. The section says teammates "can reply in the task to add evidence, answer questions, or request changes", and line 33 says "Continue…; source: repo:content/docs/ai/agents/tasks.md L15-L37
source: repo:content/docs/ai/agents/tasks.md L15-L37
framing: exact-match — The anchor exists, and the target section plus the Slack section both support collaborating in tasks or Slack threads to add context, answer questions, and refine the work.
pass1 · url · high confidence
#29 ✅ Verified
content/docs/ai/agents/_index.md:45
Pulumi Cloud roles, external credentials, and approval settings work together to govern agent permissions, as described at /docs/ai/agents/permissions/.
framing: This only checks that the link target exists and covers the topic the claim describes. The unreadable marketing-web#252 isn't needed to settle it.; evidence: The linked page exists in the repo. Its meta_desc reads "Scope Pulumi Agents access with Pulumi Cloud roles, external credentials, and approval settings." It has sections on Pulumi Cloud roles, credentials for connected tools, and…; source: repo:content/docs/ai/agents/permissions.md
source: repo:content/docs/ai/agents/permissions.md
framing: exact-match — This only checks that the link target exists and covers the topic the claim describes. The unreadable marketing-web#252 isn't needed to settle it.
pass1 · url · high confidence
#30 ✅ Verified
content/docs/ai/agents/_index.md:49
The pages /docs/ai/agents/create-and-manage/, /docs/ai/agents/tasks/, and /docs/ai/neo/ (with a 'use-neo' section) exist and cover creating/managing agents…
evidence: All three pages are in the repo: create-and-manage/_index.md ("Create and manage agents"), agents/tasks.md ("Start a task by giving an agent an assignment"), and neo/_index.md, which has a "## Use Neo" heading, so the #use-neo anchor…; source: repo:content/docs/ai/agents/create-and-manage/_index.md; repo:content/docs/ai/agents/tasks.md; repo:content/docs/ai/neo/_index.md
source: repo:content/docs/ai/agents/create-and-manage/_index.md; repo:content/docs/ai/agents/tasks.md; repo:content/docs/ai/neo/_index.md
framing: exact-match
pass1 · url · high confidence
#39 ✅ Verified
content/docs/ai/agents/configure.md:36
The page /docs/ai/agents/custom/ ('Build a custom agent') exists and explains defining an agent's job and writing its instructions.
evidence: content/docs/ai/agents/custom.md exists with title "Build a custom agent". Its meta_desc reads "Define a custom agent's job, write reusable instructions, and connect the tools it needs to work.", and it includes a "## Write its…; source: repo:content/docs/ai/agents/custom.md
source: repo:content/docs/ai/agents/custom.md
framing: exact-match
pass1 · url · high confidence
#46 ✅ Verified
content/docs/ai/agents/configure.md:54
In Pulumi Agents, CLI integrations such as AWS are available from the organization's connections without a per-task selection.
framing: Linked page: "connected CLI integrations are available without a selection step" for configured agents. Claim: "available from the organization's connections…; evidence: The linked page exists at content/docs/ai/neo/integrations/cli/_index.md and says: "For an agent your team has configured, connected CLI integrations are available without a selection step," and "Neo provides a per-task CLI selector.…; source: repo:content/docs/ai/neo/integrations/cli/_index.md
source: repo:content/docs/ai/neo/integrations/cli/_index.md
framing: exact-match — Linked page: "connected CLI integrations are available without a selection step" for configured agents. Claim: "available from the organization's connections without a per-task selection". Same assertion.
pass1 · url · medium confidence
#49 ✅ Verified
content/docs/ai/agents/configure.md:67
A page exists at /docs/ai/agents/permissions/ describing access and approval controls.
evidence: The repo contains content/docs/ai/agents/permissions.md, so the page renders at /docs/ai/agents/permissions/. Its meta_desc reads "Scope Pulumi Agents access with Pulumi Cloud roles, external credentials, and approval settings.", and it…; source: repo:content/docs/ai/agents/permissions.md
source: repo:content/docs/ai/agents/permissions.md
framing: exact-match
pass1 · cross-reference · high confidence
#54 ✅ Verified
content/docs/ai/agents/configure.md:78
The page /docs/ai/agents/triggers/ ('Events and schedules') exists and explains adding events or schedules to a saved agent.
evidence: content/docs/ai/agents/triggers.md exists in the repo with the title "Events and schedules". It says: "Add automations to an existing agent from **Automations**." It also has sections on Pulumi operation events, webhooks, and schedules.; source: repo:content/docs/ai/agents/triggers.md
source: repo:content/docs/ai/agents/triggers.md
framing: exact-match
pass1 · url · high confidence
#57 ✅ Verified
content/docs/ai/agents/configure.md:86
The page /docs/ai/agents/tasks/ ('Tasks and collaboration') exists and explains continuing assignments and collaborating with teammates.
evidence: The repo file content/docs/ai/agents/tasks.md exists, titled "Tasks and collaboration". It covers continuing work ("Continue the assignment in its Slack thread") and has a "Work with teammates" section: "Teammates with permission to…; source: repo:content/docs/ai/agents/tasks.md
source: repo:content/docs/ai/agents/tasks.md
framing: exact-match
pass1 · url · high confidence
#59 ✅ Verified
content/docs/ai/agents/configure.md:90
A section 'Change saved configuration' exists at /docs/ai/agents/manage/#change-saved-configuration describing when changes take effect.
evidence: The section exists at manage.md L17 and says when changes take effect: "## Change saved configuration ... Changes apply to new tasks and to existing tasks when the agent next resumes work."; source: repo:content/docs/ai/agents/manage.md#L17-L19
source: repo:content/docs/ai/agents/manage.md#L17-L19
framing: exact-match
pass1 · url · high confidence
#60 ✅ Verified
content/docs/ai/agents/configure.md:92
The page /docs/ai/agents/manage/ ('Manage and troubleshoot') exists and covers lifecycle controls and troubleshooting.
evidence: content/docs/ai/agents/manage.md exists with menu name "Manage and troubleshoot" and states: "Edit, pause, or delete an agent, and troubleshoot tasks that fail to start or cannot access the resources they need."; source: repo:content/docs/ai/agents/manage.md
source: repo:content/docs/ai/agents/manage.md
framing: exact-match
pass1 · url · high confidence
#61 ✅ Verified
content/docs/ai/agents/create-and-manage/_index.md:6
In Pulumi Agents, you can set up a pre-built agent, or build a custom agent, and assign it a role.
framing: The link resolves, and the target page covers pre-built setup, custom agents, and role assignment.; evidence: The link target exists as content/docs/ai/agents/configure.md (menu name "Configure a pre-built agent"). It says "In the agent catalog, choose an agent and select **Set up agent**", links to Build a custom agent, and has a **Role**…; source: repo:content/docs/ai/agents/configure.md; repo:content/docs/ai/agents/custom.md
source: repo:content/docs/ai/agents/configure.md; repo:content/docs/ai/agents/custom.md
framing: exact-match — The link resolves, and the target page covers pre-built setup, custom agents, and role assignment.
pass1 · url · medium confidence
#66 ✅ Verified
content/docs/ai/agents/create-and-manage/_index.md:25
With Pulumi agents, teammates can continue a task conversation together and review the agent's findings or proposed pull request.
framing: The source's "work and results" covers "findings". "Proposed pull request" is a specific example that the linked page doesn't name. This is a same-site page…; evidence: The linked tasks page says "Each task contains the agent's work and results. You and your teammates can reply to answer questions, add context, or ask for changes." That supports teammates continuing a task together and reviewing its…; source: repo:content/docs/ai/agents/tasks.md#L15,L37
source: repo:content/docs/ai/agents/tasks.md#L15,L37
framing: entailed-narrower — The source's "work and results" covers "findings". "Proposed pull request" is a specific example that the linked page doesn't name. This is a same-site page that corroborates the claim; I didn't check it against product source.
pass1 · url · medium confidence
#69 ✅ Verified
content/docs/ai/agents/create-and-manage/_index.md:33
A guide for editing, pausing, or deleting an agent, and troubleshooting tasks that fail to start or cannot access needed tools, exists at…
framing: Small wording difference: the claim says "tools", the target page says "resources". Both mean what the agent can reach through integrations, so the meaning…; evidence: The link resolves to repo:content/docs/ai/agents/manage.md, titled "Manage and troubleshoot agents". Its intro says: "Edit, pause, or delete an agent, and troubleshoot tasks that fail to start or cannot access the resources they need."…; source: repo:content/docs/ai/agents/manage.md
source: repo:content/docs/ai/agents/manage.md
framing: exact-match — Small wording difference: the claim says "tools", the target page says "resources". Both mean what the agent can reach through integrations, so the meaning is the same.
pass1 · url · high confidence
#70 ✅ Verified
content/docs/ai/agents/custom.md:5
The 'pulumi-agents' pulumi_cloud_feature frontmatter value refers to an existing Pulumi Cloud feature identifier.
evidence: `pulumi-agents` is a defined feature ID in data/pulumi_editions.yaml (L190-193): "- id: pulumi-agents / name: Pulumi Agents / min_edition: pro / hidden: true". So the frontmatter value points to a real feature ID. The unreadable…; source: repo:data/pulumi_editions.yaml#L190-193; intuition: The feature is marked hidden: true, so it may not show up in the public edition tables even though the ID exists.
source: repo:data/pulumi_editions.yaml#L190-193
pass1 · cross-reference · high confidence
#79 ✅ Verified
content/docs/ai/agents/custom.md:47
In Pulumi Agents, roles and credentials are the mechanism used to enforce access restrictions on an agent.
framing: This rests only on a same-site sibling page, with no product source behind it.; evidence: I couldn't check this against product source: GitHub code search returned HTTP 429 (rate limit), and the cited marketing-web#252 is unreadable (404). The only support is a sibling docs page, configure.md L44: "Instructions guide its…; source: repo:content/docs/ai/agents/configure.md L44, L58-67; gh search code --owner pulumi "Agent Read Only" (HTTP 429)
source: repo:content/docs/ai/agents/configure.md L44, L58-67; gh search code --owner pulumi "Agent Read Only" (HTTP 429)
framing: This rests only on a same-site sibling page, with no product source behind it.
pass1 · behavior · low confidence
#80 ✅ Verified
content/docs/ai/agents/custom.md:51
For a Pulumi agent to push branches and open pull requests, the version control integration must permit pushing branches and opening pull requests.
evidence: The GitHub app docs say Neo/agent writes go through the version control integration: "[Neo] writes to GitHub, such as opening pull requests, pushing commits, commenting, and creating repositories" run as the shared app installation or…; source: repo:content/docs/integrations/version-control/github-app.md (L107, L142); repo:content/docs/ai/agents/configure.md L19; intuition: Near-tautological setup guidance (it needs permission to push and open PRs); the only support is same-site editorial…
source: repo:content/docs/integrations/version-control/github-app.md (L107, L142); repo:content/docs/ai/agents/configure.md L19
pass1 · behavior · low confidence
#81 ✅ Verified
content/docs/ai/agents/custom.md:51
The Pulumi Agents configure page at /docs/ai/agents/configure/ has sections with anchors 'connect-the-tools-it-needs' and 'set-its-access' covering…
evidence: configure.md contains the headings "## Connect the tools it needs" (L46) and "## Set its access" (L58). Hugo turns these into the anchors #connect-the-tools-it-needs and #set-its-access. The first section covers selecting MCP…; source: repo:content/docs/ai/agents/configure.md
source: repo:content/docs/ai/agents/configure.md
framing: exact-match
pass1 · url · high confidence
#82 ✅ Verified
content/docs/ai/agents/custom.md:55
The Pulumi Agents configure page at /docs/ai/agents/configure/ has a section with anchor 'save-and-assign-a-task' covering saving the agent and assigning a…
evidence: configure.md line 80 has the heading "## Save and assign a task", which Hugo turns into the anchor #save-and-assign-a-task. The section says to "select **Create agent**" and then "enter an assignment in **Describe the task for this…; source: repo:content/docs/ai/agents/configure.md#L80-L86
source: repo:content/docs/ai/agents/configure.md#L80-L86
framing: exact-match
pass1 · url · high confidence
#83 ✅ Verified
content/docs/ai/agents/custom.md:61
Pulumi agents support adding a schedule or event trigger to run automatically, documented at /docs/ai/agents/triggers/.
framing: The claim's description of the link target matches the target page's own intro.; evidence: The link target is real: content/docs/ai/agents/triggers.md exists in the repo and covers schedule and event triggers. It says: "Configure an agent to start tasks automatically when a Pulumi operation completes, an external tool sends a…; source: repo:content/docs/ai/agents/triggers.md
source: repo:content/docs/ai/agents/triggers.md
framing: exact-match — The claim's description of the link target matches the target page's own intro.
pass1 · url · medium confidence
#84 ✅ Verified
content/docs/ai/agents/integrations.md:5
Pulumi Agents can connect to repositories, cloud providers, monitoring tools, and issue trackers.
framing: This is backed only by another Pulumi docs page, not by product source.; evidence: The sibling Neo integrations doc backs up all four categories: "MCP brings context in from issue trackers, observability platforms, runbook wikis, and on-call tools. CLI integrations cover what MCP doesn't reach, calling out to…; source: repo:content/docs/ai/neo/integrations/_index.md
source: repo:content/docs/ai/neo/integrations/_index.md
framing: This is backed only by another Pulumi docs page, not by product source.
pass1 · feature · medium confidence
#85 ✅ Verified
content/docs/ai/agents/integrations.md:14
Pulumi Agents integrates with repositories: GitHub, GitLab, Bitbucket, Azure DevOps, and other Git servers (via custom VCS).
framing: The sibling docs describe Neo's repo support across native and Custom VCS integrations. The claim applies it to Pulumi Agents, which share Neo's connections.; evidence: The Custom VCS docs say "Neo... can clone and push to Git and Mercurial repositories registered with a Custom VCS integration." They also list native integrations (GitHub, GitLab, Azure DevOps, Bitbucket) with "Neo clone/push to repos |…; source: repo:content/docs/integrations/version-control/custom-vcs.md L15-19, L209
source: repo:content/docs/integrations/version-control/custom-vcs.md L15-19, L209
framing: entailed-narrower — The sibling docs describe Neo's repo support across native and Custom VCS integrations. The claim applies it to Pulumi Agents, which share Neo's connections.
pass1 · feature · medium confidence
#86 ✅ Verified
content/docs/ai/agents/integrations.md:16
Integration link targets exist for version control: /docs/integrations/version-control/github-app/, gitlab/, bitbucket/, azure-devops-integration/, custom-vcs/.
evidence: I found all five link targets in the repo as content files under content/docs/integrations/version-control/: github-app.md ("title: Pulumi GitHub App"), gitlab.md, bitbucket.md, azure-devops-integration.md and custom-vcs.md. Each one has…; source: repo:content/docs/integrations/version-control/{github-app,gitlab,bitbucket,azure-devops-integration,custom-vcs}.md
source: repo:content/docs/integrations/version-control/{github-app,gitlab,bitbucket,azure-devops-integration,custom-vcs}.md
framing: exact-match
pass1 · url · high confidence
#87 ✅ Verified
content/docs/ai/agents/integrations.md:19
Pages exist at /docs/integrations/version-control/gitlab/, /bitbucket/, /azure-devops-integration/, and /custom-vcs/.
evidence: The pulumi/docs default branch has gitlab.md, bitbucket.md, azure-devops-integration.md and custom-vcs.md under content/docs/integrations/version-control/, so all four pages exist at /docs/integrations/version-control/<name>/. I…; source: gh api repos/pulumi/docs/contents/content/docs/integrations/version-control
source: gh api repos/pulumi/docs/contents/content/docs/integrations/version-control
framing: exact-match
pass1 · url · high confidence
#88 ✅ Verified
content/docs/ai/agents/integrations.md:22
link: /docs/integrations/version-control/bitbucket/
evidence: The internal link target is in the repo at content/docs/integrations/version-control/bitbucket.md (title "Bitbucket", parent integrations-version-control), so /docs/integrations/version-control/bitbucket/ resolves. The unreadable…; source: repo:content/docs/integrations/version-control/bitbucket.md
source: repo:content/docs/integrations/version-control/bitbucket.md
pass1 · url · high confidence
#89 ✅ Verified
content/docs/ai/agents/integrations.md:25
link: /docs/integrations/version-control/azure-devops-integration/
evidence: The internal link target is real: content/docs/integrations/version-control/azure-devops-integration.md exists, with title "Azure DevOps Integration" and menu parent integrations-version-control, so the path resolves to…; source: repo:content/docs/integrations/version-control/azure-devops-integration.md
source: repo:content/docs/integrations/version-control/azure-devops-integration.md
framing: exact-match
pass1 · url · high confidence
#90 ✅ Verified
content/docs/ai/agents/integrations.md:28
link: /docs/integrations/version-control/custom-vcs/
evidence: The internal link target exists in the repo: content/docs/integrations/version-control/custom-vcs.md, titled "Custom VCS". The page also says Neo "can clone and push to Git and Mercurial repositories registered with a Custom VCS…; source: repo:content/docs/integrations/version-control/custom-vcs.md
source: repo:content/docs/integrations/version-control/custom-vcs.md
pass1 · url · high confidence
#91 ✅ Verified
content/docs/ai/agents/integrations.md:30
Link targets exist under /docs/ai/neo/integrations/mcp/ (anchors cloudflare, supabase, atlassian-jira-and-confluence, dash0, honeycomb, linear, new-relic…
framing: Anchors are slugs Hugo generates from the headings, e.g. "Atlassian (Jira and Confluence)" → atlassian-jira-and-confluence. I didn't need the unreadable…; evidence: The link targets all exist in the repo. content/docs/ai/neo/integrations/mcp/_index.md has the headings "### Atlassian (Jira and Confluence)", "### Cloudflare", "### Dash0", "### Honeycomb", "### Linear", "### New Relic", "###…; source: repo:content/docs/ai/neo/integrations/mcp/_index.md; repo:content/docs/ai/neo/integrations/cli/_index.md; repo:content/docs/ai/agents/integrations/{aws,google-cloud,azure,datadog}.md
source: repo:content/docs/ai/neo/integrations/mcp/_index.md; repo:content/docs/ai/neo/integrations/cli/_index.md; repo:content/docs/ai/agents/integrations/{aws,google-cloud,azure,datadog}.md
framing: exact-match — Anchors are slugs Hugo generates from the headings, e.g. "Atlassian (Jira and Confluence)" → atlassian-jira-and-confluence. I didn't need the unreadable marketing-web#252 to check this.
pass1 · url · high confidence
#92 ✅ Verified
content/docs/ai/agents/integrations.md:35
link: /docs/ai/agents/integrations/aws/
evidence: The internal link target exists in the repo: content/docs/ai/agents/integrations/aws.md has front matter "title: Connect AWS", so it builds to /docs/ai/agents/integrations/aws/. The unreadable marketing-web#252 wasn't needed.; source: repo:content/docs/ai/agents/integrations/aws.md
source: repo:content/docs/ai/agents/integrations/aws.md
pass1 · url · high confidence
#93 ✅ Verified
content/docs/ai/agents/integrations.md:38
link: /docs/ai/agents/integrations/google-cloud/
evidence: The link target exists in the repo: content/docs/ai/agents/integrations/google-cloud.md (front matter "title: Connect Google Cloud") is served at /docs/ai/agents/integrations/google-cloud/. The unreadable marketing-web#252 wasn't needed…; source: repo:content/docs/ai/agents/integrations/google-cloud.md
source: repo:content/docs/ai/agents/integrations/google-cloud.md
pass1 · url · high confidence
#94 ✅ Verified
content/docs/ai/agents/integrations.md:41
link: /docs/ai/agents/integrations/azure/
evidence: The internal link target exists in the repo as content/docs/ai/agents/integrations/azure.md (title: "Connect Azure"), so /docs/ai/agents/integrations/azure/ resolves. I didn't need the unreadable pulumi/marketing-web#252 to settle this.; source: repo:content/docs/ai/agents/integrations/azure.md
source: repo:content/docs/ai/agents/integrations/azure.md
pass1 · url · high confidence
#95 ✅ Verified
content/docs/ai/agents/integrations.md:44
link: /docs/ai/neo/integrations/cli/#kubernetes
evidence: The link target resolves. content/docs/ai/neo/integrations/cli/_index.md exists, which serves /docs/ai/neo/integrations/cli/, and line 51 has the heading "#### Kubernetes", which Hugo turns into the #kubernetes anchor. Reading…; source: repo:content/docs/ai/neo/integrations/cli/_index.md#L51
source: repo:content/docs/ai/neo/integrations/cli/_index.md#L51
pass1 · url · high confidence
#96 ✅ Verified
content/docs/ai/agents/integrations.md:47
link: /docs/ai/neo/integrations/mcp/#supabase
evidence: The target page content/docs/ai/neo/integrations/mcp/_index.md exists (no url override, so it renders at /docs/ai/neo/integrations/mcp/) and has a "### Supabase" heading at L131, so the #supabase anchor resolves. I didn't need…; source: repo:content/docs/ai/neo/integrations/mcp/_index.md#L131
source: repo:content/docs/ai/neo/integrations/mcp/_index.md#L131
pass1 · url · high confidence
#97 ✅ Verified
content/docs/ai/agents/integrations.md:49
Pulumi Agents/Neo supports monitoring and issue-tracking integrations with Atlassian (Jira and Confluence), Dash0, Datadog, Honeycomb, Linear, New Relic…
framing: The claim lists 8 of the 10 supported providers (Cloudflare and Supabase are left out; Supabase appears under another category in the reviewed file). A…; evidence: The sibling MCP integrations page (outside the file under review) says: "Supported integrations are Atlassian (Jira and Confluence), Cloudflare, Dash0, Datadog, Honeycomb, Linear, New Relic, PagerDuty, Sentry, and Supabase." It also has…; source: repo:content/docs/ai/neo/integrations/mcp/_index.md L21, L68
source: repo:content/docs/ai/neo/integrations/mcp/_index.md L21, L68
framing: entailed-narrower — The claim lists 8 of the 10 supported providers (Cloudflare and Supabase are left out; Supabase appears under another category in the reviewed file). A subset of the source list is entailed.
pass1 · url · medium confidence
#98 ✅ Verified
content/docs/ai/agents/integrations.md:51
link: /docs/ai/neo/integrations/mcp/#atlassian-jira-and-confluence
framing: The link path matches where the file sits in the repo, and the anchor matches the heading's slug.; evidence: The target page content/docs/ai/neo/integrations/mcp/_index.md exists, so it is served at /docs/ai/neo/integrations/mcp/. Line 53 has the heading "### Atlassian (Jira and Confluence)", which Hugo turns into the anchor…; source: repo:content/docs/ai/neo/integrations/mcp/_index.md#L53
source: repo:content/docs/ai/neo/integrations/mcp/_index.md#L53
framing: exact-match — The link path matches where the file sits in the repo, and the anchor matches the heading's slug.
pass1 · url · high confidence
#99 ✅ Verified
content/docs/ai/agents/integrations.md:57
link: /docs/ai/agents/integrations/datadog/
evidence: The internal link target exists: content/docs/ai/agents/integrations/datadog.md is in the repo, titled "Connect Datadog", so /docs/ai/agents/integrations/datadog/ resolves. Settling this didn't require the unreadable marketing-web#252.; source: repo:content/docs/ai/agents/integrations/datadog.md
source: repo:content/docs/ai/agents/integrations/datadog.md
framing: exact-match
pass1 · url · high confidence
#100 ✅ Verified
content/docs/ai/agents/integrations.md:60
link: /docs/ai/neo/integrations/mcp/#honeycomb
evidence: The target page content/docs/ai/neo/integrations/mcp/_index.md exists, has no url override, so it resolves to /docs/ai/neo/integrations/mcp/. Its heading "### Honeycomb" (L80) produces the #honeycomb anchor. I didn't need the unreadable…; source: repo:content/docs/ai/neo/integrations/mcp/_index.md#L80
source: repo:content/docs/ai/neo/integrations/mcp/_index.md#L80
pass1 · url · high confidence
#101 ✅ Verified
content/docs/ai/agents/integrations.md:63
link: /docs/ai/neo/integrations/mcp/#linear
evidence: The target page exists at content/docs/ai/neo/integrations/mcp/_index.md, which Hugo serves at /docs/ai/neo/integrations/mcp/. Its heading "### Linear" (line 90) produces the #linear anchor. I didn't need the unreadable marketing-web#252…; source: repo:content/docs/ai/neo/integrations/mcp/_index.md
source: repo:content/docs/ai/neo/integrations/mcp/_index.md
framing: exact-match
pass1 · url · high confidence
#103 ✅ Verified
content/docs/ai/agents/integrations.md:66
link: /docs/ai/neo/integrations/mcp/#new-relic
evidence: The target page content/docs/ai/neo/integrations/mcp/_index.md exists and has a "### New Relic" heading at L104, so the #new-relic anchor resolves. I didn't need the unreadable marketing-web#252 to settle this.; source: repo:content/docs/ai/neo/integrations/mcp/_index.md#L104
source: repo:content/docs/ai/neo/integrations/mcp/_index.md#L104
pass1 · url · high confidence
#104 ✅ Verified
content/docs/ai/agents/integrations.md:69
link: /docs/ai/neo/integrations/mcp/#sentry
evidence: The link target resolves. content/docs/ai/neo/integrations/mcp/_index.md exists with no url override, so it renders at /docs/ai/neo/integrations/mcp/, and line 123 has the heading "### Sentry", which Hugo turns into the #sentry anchor.…; source: repo:content/docs/ai/neo/integrations/mcp/_index.md#L123
source: repo:content/docs/ai/neo/integrations/mcp/_index.md#L123
framing: exact-match
pass1 · url · high confidence
#105 ✅ Verified
content/docs/ai/agents/integrations.md:72
link: /docs/ai/neo/integrations/mcp/#pagerduty
evidence: The target page content/docs/ai/neo/integrations/mcp/_index.md exists, has no URL override, so it is served at /docs/ai/neo/integrations/mcp/. Its heading "### PagerDuty" at line 112 produces the #pagerduty anchor. No need to read the…; source: repo:content/docs/ai/neo/integrations/mcp/_index.md#L112
source: repo:content/docs/ai/neo/integrations/mcp/_index.md#L112
pass1 · url · high confidence
#106 ✅ Verified
content/docs/ai/agents/integrations.md:76
The Permissions page (/docs/ai/agents/permissions/) has a section 'design-access-around-the-job' on choosing the access to grant.
evidence: permissions.md L16 has "## Design access around the job", which Hugo turns into the anchor #design-access-around-the-job. The section begins: "Grant the required actions on the relevant resources. Use a dedicated role or service account…; source: repo:content/docs/ai/agents/permissions.md#L16-L22
source: repo:content/docs/ai/agents/permissions.md#L16-L22
framing: exact-match
pass1 · url · high confidence
#107 ✅ Verified
content/docs/ai/agents/integrations.md:78
Integration connections are shared across Neo and the agents you configure.
framing: Backed only by sibling docs pages, which are editorial, not product source.; evidence: Other Pulumi docs back this up but don't prove it. The Neo integrations page says "All integrations are configured at the organization level by an administrator. Once enabled, they're available to every Neo task in the organization." The…; source: repo:content/docs/ai/neo/integrations/_index.md L26; repo:content/docs/ai/agents/configure.md L48-54
source: repo:content/docs/ai/neo/integrations/_index.md L26; repo:content/docs/ai/agents/configure.md L48-54
framing: Backed only by sibling docs pages, which are editorial, not product source.
pass1 · behavior · low confidence
#108 ✅ Verified
content/docs/ai/agents/integrations.md:90
For AWS, Google Cloud, Azure, and Kubernetes, configure credentials in Pulumi ESC, then [connect the environment to a CLI…
framing: The link text ("connect the environment to a CLI tool") matches what the target section describes: connecting each CLI to an ESC environment.; evidence: The link target exists at content/docs/ai/neo/integrations/cli/_index.md, which has no `url` override, so it is served at /docs/ai/neo/integrations/cli/. Line 58 is the heading "## Setting up a CLI integration", which produces the…; source: repo:content/docs/ai/neo/integrations/cli/_index.md (L22, L58-60)
source: repo:content/docs/ai/neo/integrations/cli/_index.md (L22, L58-60)
framing: exact-match — The link text ("connect the environment to a CLI tool") matches what the target section describes: connecting each CLI to an ESC environment.
pass1 · url · high confidence
#109 ✅ Verified
content/docs/ai/agents/integrations.md:98
MCP integrations are selected in the agent's configuration, and the selection can be edited to add integrations connected later.
framing: The link target says the same thing as the claim. The only evidence is another Pulumi docs page, not product source.; evidence: The linked anchor exists (configure.md L46, "## Connect the tools it needs") and says: "Creating an agent saves the selected MCP integrations. To give it access to an integration connected later, edit the agent and add that integration…; source: repo:content/docs/ai/agents/configure.md#L46-L50
source: repo:content/docs/ai/agents/configure.md#L46-L50
framing: exact-match — The link target says the same thing as the claim. The only evidence is another Pulumi docs page, not product source.
pass1 · url · medium confidence
#110 ✅ Verified
content/docs/ai/agents/integrations.md:100
For Neo, access to CLI connections depends on the user's Pulumi Cloud permissions, and CLI connections can be selected for each task.
framing: Matches the linked page on both points: Neo access comes from the user's permissions, and CLI integrations can be selected per task.; evidence: The linked page exists and has a "## Per-task selection" heading, so the #per-task-selection anchor works. It says: "For Neo, the user running the task needs access." and "Neo provides a per-task CLI selector... toggle individual…; source: repo:content/docs/ai/neo/integrations/cli/_index.md L60-63, L87-93
source: repo:content/docs/ai/neo/integrations/cli/_index.md L60-63, L87-93
framing: exact-match — Matches the linked page on both points: Neo access comes from the user's permissions, and CLI integrations can be selected per task.
pass1 · url · medium confidence
#112 ✅ Verified
content/docs/ai/agents/integrations.md:104
Agents can be worked with from Slack, as described in /docs/ai/agents/tasks/; automatic runs are covered in /docs/ai/agents/triggers/ (Events and schedules).
framing: I checked the link targets in the repo. I didn't need the cited marketing-web#252, which I couldn't read.; evidence: Both link targets exist and cover what the claim says. tasks.md has a "## Work from Slack" section ("Mention `@pulumi` in a channel with your request"), and triggers.md is titled "Events and schedules" and says to "Configure an agent to…; source: repo:content/docs/ai/agents/tasks.md L29-33; repo:content/docs/ai/agents/triggers.md L1-15
source: repo:content/docs/ai/agents/tasks.md L29-33; repo:content/docs/ai/agents/triggers.md L1-15
framing: exact-match — I checked the link targets in the repo. I didn't need the cited marketing-web#252, which I couldn't read.
pass1 · url · high confidence
#113 ✅ Verified
content/docs/ai/agents/integrations/aws.md:5
Pulumi ESC supplies temporary AWS credentials to the agent when the task runs.
framing: Credentials are only temporary with the OIDC setup the page recommends. The aws-login static input can also supply long-lived IAM user keys.; evidence: The ESC aws-login docs confirm that, with OIDC, ESC produces temporary AWS credentials: "Pulumi Cloud exchanges a short-lived OIDC token for temporary AWS credentials by assuming an IAM role." The agent connection flow has you choose…; source: repo:content/docs/esc/providers/login/aws-login.md (L24); repo:layouts/partials/docs/agent-cli-connection.md
source: repo:content/docs/esc/providers/login/aws-login.md (L24); repo:layouts/partials/docs/agent-cli-connection.md
framing: Credentials are only temporary with the OIDC setup the page recommends. The aws-login static input can also supply long-lived IAM user keys.
pass1 · behavior · medium confidence
#116 ✅ Verified
content/docs/ai/agents/integrations/aws.md:17
The AWS S3 API documentation page API_GetBucketVersioning describes the GetBucketVersioning action, which corresponds to the `s3:GetBucketVersioning`…
framing: The AWS API page confirms the action. The permission mapping comes from the standard S3 IAM action naming, not from a passage on that page.; evidence: (escalated from pass1) The AWS page API_GetBucketVersioning is live and documents the GetBucketVersioning action: "Returns the versioning state of a bucket." The `s3:GetBucketVersioning` permission name follows AWS's standard S3 IAM…; source: https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketVersioning.html; https://www.scaleway.com/en/docs/object-storage/reference-content/s3-iam-permissions-equivalence/
source: https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketVersioning.html; https://www.scaleway.com/en/docs/object-storage/reference-content/s3-iam-permissions-equivalence/
framing: entailed-narrower — The AWS API page confirms the action. The permission mapping comes from the standard S3 IAM action naming, not from a passage on that page.
pass3 · cross-reference · medium confidence
#118 ✅ Verified
content/docs/ai/agents/integrations/aws.md:19
The Pulumi docs page /docs/ai/agents/permissions/ has a section 'Design access around the job' giving guidance on identities and credential scope.
evidence: content/docs/ai/agents/permissions.md L16 contains the heading "## Design access around the job", so the anchor #design-access-around-the-job exists. The section says to "Use a dedicated role or service account where supported" and to…; source: repo:content/docs/ai/agents/permissions.md#L16-L22
source: repo:content/docs/ai/agents/permissions.md#L16-L22
framing: exact-match
pass1 · url · high confidence
#119 ✅ Verified
content/docs/ai/agents/integrations/aws.md:23
A Pulumi docs guide exists at /docs/esc/guides/configuring-oidc/aws/ for configuring OpenID Connect for AWS in Pulumi ESC to create an environment that…
evidence: content/docs/esc/guides/configuring-oidc/aws.md exists (h1 "Configuring OpenID Connect for AWS") and resolves to /docs/esc/guides/configuring-oidc/aws/. It includes the section "Configure ESC for OIDC", which says "create a new…; source: repo:content/docs/esc/guides/configuring-oidc/aws.md
source: repo:content/docs/esc/guides/configuring-oidc/aws.md
framing: exact-match
pass1 · url · high confidence
#120 ✅ Verified
content/docs/ai/agents/integrations/aws.md:25
The Pulumi ESC AWS login provider has an OIDC configuration (documented at /docs/esc/providers/login/aws-login/#oidc) that exposes temporary credentials as…
framing: The provider itself returns the outputs accessKeyId, secretAccessKey and sessionToken. The documented OIDC example's `environmentVariables` block is what…; evidence: The target page has a `### OIDC` heading, so the #oidc anchor resolves. Its OIDC example maps the provider outputs to environment variables: "AWS_ACCESS_KEY_ID: ${aws.login.accessKeyId} / AWS_SECRET_ACCESS_KEY…; source: repo:content/docs/esc/providers/login/aws-login.md L22-46
source: repo:content/docs/esc/providers/login/aws-login.md L22-46
framing: entailed-narrower — The provider itself returns the outputs accessKeyId, secretAccessKey and sessionToken. The documented OIDC example's `environmentVariables` block is what puts them into the AWS_* variables. So "exposes as environment variables" is true…
pass1 · url · medium confidence
#121 ✅ Verified
content/docs/ai/agents/integrations/aws.md:27
The agent needs permission to open the ESC environment, as described in the 'Scope Pulumi Cloud access' section of the Pulumi Agents permissions page.
framing: The linked section covers role-based access to ESC environments. The literal sentence "permission to open the environment" is in the next section, "Scope…; evidence: The anchor exists: permissions.md L24 has "## Scope Pulumi Cloud access", and L26 says to select a role that grants "access to relevant stacks and ESC environments". The exact wording about opening an environment is in the next section…; source: repo:content/docs/ai/agents/permissions.md#L24-L34
source: repo:content/docs/ai/agents/permissions.md#L24-L34
framing: entailed-narrower — The linked section covers role-based access to ESC environments. The literal sentence "permission to open the environment" is in the next section, "Scope credentials for connected tools", but that sentence ties the access back to the…
pass1 · url · high confidence
#125 ✅ Verified
content/docs/ai/agents/integrations/azure.md:17
The Pulumi Agents permissions docs have a section titled 'Design access around the job' (anchor #design-access-around-the-job) at…
evidence: content/docs/ai/agents/permissions.md L16 has the heading "## Design access around the job", which produces the anchor #design-access-around-the-job. The section covers credential scope and lifecycle: "Prefer short-lived credentials. For…; source: repo:content/docs/ai/agents/permissions.md#L16-L22
source: repo:content/docs/ai/agents/permissions.md#L16-L22
framing: exact-match
pass1 · url · high confidence
#128 ✅ Verified
content/docs/ai/agents/integrations/azure.md:30
The Pulumi Agents permissions docs have a section 'Scope Pulumi Cloud access' (anchor #scope-pulumi-cloud-access) describing the permission the agent needs…
framing: The anchor's section covers the role controlling ESC environment access. The explicit 'permission to open the environment' wording is in the next section…; evidence: permissions.md L24 has the heading "## Scope Pulumi Cloud access", so the #scope-pulumi-cloud-access anchor exists. That section says: "Select a role in the agent's **Role** field that grants only the access its work requires, including…; source: repo:content/docs/ai/agents/permissions.md L24-34
source: repo:content/docs/ai/agents/permissions.md L24-34
framing: exact-match — The anchor's section covers the role controlling ESC environment access. The explicit 'permission to open the environment' wording is in the next section, 'Scope credentials for connected tools', but both point to the role.
pass1 · url · high confidence
#129 ✅ Verified
content/docs/ai/agents/integrations/azure.md:34
The `agent-cli-connection` shortcode with tool="Azure" renders the steps for an organization administrator to connect the Azure CLI environment to Pulumi…
evidence: The shortcode passes `tool` to the partial `docs/agent-cli-connection.md`. That partial renders the connection steps: "Open your organization's **Agent settings** > **Integrations** > **CLI tools**", then "choose **{{ .tool }}** and…; source: repo:layouts/shortcodes/agent-cli-connection.html; repo:layouts/partials/docs/agent-cli-connection.md
source: repo:layouts/shortcodes/agent-cli-connection.html; repo:layouts/partials/docs/agent-cli-connection.md
pass1 · behavior · high confidence
#130 ✅ Verified
content/docs/ai/agents/integrations/azure.md:40
The Azure CLI requires an explicit service principal sign-in (az login --service-principal), documented at learn.microsoft.com/en-us/cli/azure/authenticate-azu…
framing: The command and the URL match the page exactly. The "requires" part comes from the doc's own context (the CLI does not sign in from environment variables on…; evidence: The cited page loads (HTTP 200) and documents service principal sign-in with that command: "To log in with a client secret, use the following command: az login --service-principal --username APP_ID --password CLIENT_SECRET --tenant…; source: https://learn.microsoft.com/en-us/cli/azure/authenticate-azure-cli-service-principal
source: https://learn.microsoft.com/en-us/cli/azure/authenticate-azure-cli-service-principal
framing: exact-match — The command and the URL match the page exactly. The "requires" part comes from the doc's own context (the CLI does not sign in from environment variables on its own), and this page does not state it outright.
pass2 · url · medium confidence
#131 ✅ Verified
content/docs/ai/agents/integrations/azure.md:42
`az login --service-principal` accepts the service principal's client ID as the username, the client secret as the password, and the tenant ID as the tenant.
framing: The Microsoft docs call the username value APP_ID; that is the same thing as the client ID.; evidence: (escalated from pass1) The official Microsoft Learn page gives the client-secret login as "az login --service-principal --username APP_ID --password CLIENT_SECRET --tenant TENANT_ID". That matches the claim: app (client) ID as the…; source: https://learn.microsoft.com/en-us/cli/azure/authenticate-azure-cli-service-principal?view=azure-cli-latest
source: https://learn.microsoft.com/en-us/cli/azure/authenticate-azure-cli-service-principal?view=azure-cli-latest
framing: exact-match — The Microsoft docs call the username value APP_ID; that is the same thing as the client ID.
pass3 · api-surface · high confidence
#132 ✅ Verified
content/docs/ai/agents/integrations/azure.md:42
`az account show --subscription <subscription-id>` shows the tenant and subscription for the given subscription, so they can be compared against the connection.
evidence: (escalated from pass1) Microsoft's Azure CLI docs say to "use az account tenant list or az account show to get the active tenant ID". They also say subscription commands accept the `--subscription` parameter. A third-party tutorial shows…; source: https://learn.microsoft.com/en-us/cli/azure/manage-azure-subscriptions-azure-cli?view=azure-cli-latest; https://azurelessons.com/az-account-show/
source: https://learn.microsoft.com/en-us/cli/azure/manage-azure-subscriptions-azure-cli?view=azure-cli-latest; https://azurelessons.com/az-account-show/
pass3 · api-surface · medium confidence
#133 ✅ Verified
content/docs/ai/agents/integrations/azure.md:42
The Azure CLI accepts a `--subscription <subscription-id>` option on subscription-scoped commands.
framing: Microsoft's docs say the flag takes a name or an ID; the claim's `<subscription-id>` placeholder is one valid form of that.; evidence: (escalated from pass1) Microsoft's Azure CLI reference pages list `--subscription` as a global parameter on subscription-scoped commands, described as "Name or ID of subscription. You can configure the default subscription using az…; source: https://learn.microsoft.com/en-us/cli/azure/billing/subscription?view=azure-cli-latest
source: https://learn.microsoft.com/en-us/cli/azure/billing/subscription?view=azure-cli-latest
framing: Microsoft's docs say the flag takes a name or an ID; the claim's `<subscription-id>` placeholder is one valid form of that.
pass3 · api-surface · high confidence
#134 ✅ Verified
content/docs/ai/agents/integrations/azure.md:46
The Pulumi Agents 'Tasks and collaboration' page exists at /docs/ai/agents/tasks/ and covers assigning work and reviewing results.
framing: The page covers reviewing results only briefly, by saying the task holds the work and results and that teammates can reply. It has no dedicated review section.; evidence: content/docs/ai/agents/tasks.md exists with title "Tasks and collaboration". It covers starting tasks ("Start a task by giving an agent an assignment in Pulumi Cloud or Slack") and results ("Each task contains the agent's work and…; source: repo:content/docs/ai/agents/tasks.md
source: repo:content/docs/ai/agents/tasks.md
framing: exact-match — The page covers reviewing results only briefly, by saying the task holds the work and results and that teammates can reply. It has no dedicated review section.
pass1 · url · high confidence
#138 ✅ Verified
content/docs/ai/agents/integrations/datadog.md:17
The Datadog service account also needs resource-level permissions for the data the agent needs to access, in addition to MCP Read.
framing: Datadog states the requirement for any user or role holding mcp_read; the claim applies it to the agent's service account, which is a special case.; evidence: (escalated from pass1) Datadog's MCP setup docs say: "In addition to mcp_read or mcp_write, users need the standard Datadog permissions for the underlying resource." They also recommend API and app keys "from a service account that has…; source: https://docs.datadoghq.com/mcp_server/setup/
source: https://docs.datadoghq.com/mcp_server/setup/
framing: entailed-narrower — Datadog states the requirement for any user or role holding mcp_read; the claim applies it to the agent's service account, which is a special case.
pass3 · url · high confidence
#139 ✅ Verified
content/docs/ai/agents/integrations/datadog.md:21
Datadog Organization Settings has a **Service Accounts** section where service accounts can be created or selected.
evidence: (escalated from pass1) Datadog's official Service Accounts doc tells users to "Navigate to **Organization Settings** > **Service Accounts** and click a service account." It also documents a "New Service Account" button for creating one…; source: https://docs.datadoghq.com/account_management/org_settings/service_accounts/
source: https://docs.datadoghq.com/account_management/org_settings/service_accounts/
framing: exact-match
pass3 · feature · high confidence
#145 ✅ Verified
content/docs/ai/agents/integrations/datadog.md:36
Pulumi's agent configuration docs include a section 'Connect the tools it needs' at /docs/ai/agents/configure/#connect-the-tools-it-needs where Datadog can…
framing: The section covers selecting any connected MCP service. Datadog is one of those, so the claim is a special case of what the section says.; evidence: The anchor resolves: content/docs/ai/agents/configure.md has a "## Connect the tools it needs" heading at L46, which says "select the connected MCP services the agent needs". Datadog is documented as an MCP integration (its menu parent…; source: repo:content/docs/ai/agents/configure.md#L46-L52
source: repo:content/docs/ai/agents/configure.md#L46-L52
framing: entailed-narrower — The section covers selecting any connected MCP service. Datadog is one of those, so the claim is a special case of what the section says.
pass1 · url · high confidence
#147 ✅ Verified
content/docs/ai/agents/integrations/google-cloud.md:17
The page links to the 'Design access around the job' section of the /docs/ai/agents/permissions/ page for guidance on credential scope and lifecycle; that…
evidence: The heading `## Design access around the job` is on line 16 of content/docs/ai/agents/permissions.md, so the anchor #design-access-around-the-job resolves. The section covers credential scope and lifecycle: "Prefer short-lived…; source: repo:content/docs/ai/agents/permissions.md#L16-L22
source: repo:content/docs/ai/agents/permissions.md#L16-L22
framing: exact-match
pass1 · url · high confidence
#148 ✅ Verified
content/docs/ai/agents/integrations/google-cloud.md:21
In a Pulumi ESC environment, the `environmentVariables` output (documented at /docs/esc/concepts/outputs/#environmentvariables) can export a value as an…
framing: Both sources are editorial Pulumi docs, and they agree with the claim. I couldn't check product source because gh code search hit its rate limit (HTTP 429)…; evidence: The cited gcp-login page has an example that sets `environmentVariables: ... CLOUDSDK_AUTH_ACCESS_TOKEN: ${gcp.login.accessToken}`. The outputs page also has the `## environmentVariables` anchor, which says that this reserved property…; source: repo:content/docs/esc/providers/login/gcp-login.md L56-60; repo:content/docs/esc/concepts/outputs.md L29-31
source: repo:content/docs/esc/providers/login/gcp-login.md L56-60; repo:content/docs/esc/concepts/outputs.md L29-31
framing: exact-match — Both sources are editorial Pulumi docs, and they agree with the claim. I couldn't check product source because gh code search hit its rate limit (HTTP 429), so confidence is medium.
pass1 · api-surface · medium confidence
#149 ✅ Verified
content/docs/ai/agents/integrations/google-cloud.md:21
The `gcloud` CLI reads the environment variable `CLOUDSDK_AUTH_ACCESS_TOKEN` as the access token used for authentication.
framing: Source: gcloud uses the token from the CLOUDSDK_AUTH_ACCESS_TOKEN env var for authentication. The claim says the same thing.; evidence: (escalated from pass1) Google's official gcloud authentication docs say: "Set the CLOUDSDK_AUTH_ACCESS_TOKEN environment variable to the access token string." The docs also list it first in credentials priority. The unreadable…; source: https://docs.cloud.google.com/sdk/docs/authenticate
source: https://docs.cloud.google.com/sdk/docs/authenticate
framing: exact-match — Source: gcloud uses the token from the CLOUDSDK_AUTH_ACCESS_TOKEN env var for authentication. The claim says the same thing.
pass3 · behavior · high confidence
#150 ✅ Verified
content/docs/ai/agents/integrations/google-cloud.md:23
The page links to the 'Scope Pulumi Cloud access' section of /docs/ai/agents/permissions/ for the permission an agent needs to open an ESC environment; that…
framing: The sentence that most directly states the ESC point ("the agent also needs permission to open the environment. Its Pulumi Cloud role controls that access")…; evidence: Line 24 of permissions.md has "## Scope Pulumi Cloud access" (anchor #scope-pulumi-cloud-access), and it says: "Select a role in the agent's **Role** field that grants only the access its work requires, including access to relevant…; source: repo:content/docs/ai/agents/permissions.md L24-26
source: repo:content/docs/ai/agents/permissions.md L24-26
framing: exact-match — The sentence that most directly states the ESC point ("the agent also needs permission to open the environment. Its Pulumi Cloud role controls that access") is at L34, under the next heading, "Scope credentials for connected tools". The…
pass1 · url · high confidence
#152 ✅ Verified
content/docs/ai/agents/integrations/google-cloud.md:29
The `agent-cli-connection` shortcode with tool="Google Cloud" exists and renders the connection steps for Google Cloud.
evidence: The shortcode is there. It passes the `tool` parameter to a partial, which renders the generic connection steps with the tool name filled in: "Under **Available**, choose **{{ .tool }}** and select **Connect**." Calling it with…; source: repo:layouts/shortcodes/agent-cli-connection.html; repo:layouts/partials/docs/agent-cli-connection.md
source: repo:layouts/shortcodes/agent-cli-connection.html; repo:layouts/partials/docs/agent-cli-connection.md
pass1 · api-surface · high confidence
#153 ✅ Verified
content/docs/ai/agents/integrations/google-cloud.md:31
A Pulumi Agents connection can be given a name and notes, in which the project ID and region or zone restrictions can be recorded.
evidence: The shared connection partial that this page includes describes the UI flow: "Enter a **Name** and select the **ESC environment**…" and "In **Notes (optional)**, describe when the agent should use this connection." That supports the Name…; source: repo:layouts/partials/docs/agent-cli-connection.md; intuition: The only support is a same-site partial that may be part of this PR. A screenshot of the Pulumi Cloud UI or a check…
source: repo:layouts/partials/docs/agent-cli-connection.md
pass1 · feature · low confidence
#154 ✅ Verified
content/docs/ai/agents/integrations/google-cloud.md:35
The page links to /docs/ai/agents/tasks/ ('Tasks and collaboration'), which explains how to assign work and review results; that target exists.
evidence: content/docs/ai/agents/tasks.md exists, so /docs/ai/agents/tasks/ resolves. Its title is "Tasks and collaboration", and it covers assigning work ("Start a task by giving an agent an assignment...") and results ("Each task contains the…; source: repo:content/docs/ai/agents/tasks.md
source: repo:content/docs/ai/agents/tasks.md
framing: exact-match
pass1 · url · high confidence
#164 ✅ Verified
content/docs/ai/agents/manage.md:44
The page /docs/ai/agents/triggers/ (Events and schedules) exists and provides setup instructions for Pulumi Agents automations.
evidence: content/docs/ai/agents/triggers.md is in the repo with title "Events and schedules". It gives step-by-step automation setup: "In Pulumi Cloud, open **Automations** and select **Set up trigger**", with sections covering Pulumi operations…; source: repo:content/docs/ai/agents/triggers.md
source: repo:content/docs/ai/agents/triggers.md
framing: exact-match
pass1 · url · high confidence
#166 ✅ Verified
content/docs/ai/agents/manage.md:54
The page /docs/ai/agents/integrations/ (Integrations) exists and covers credential setup for Pulumi Agents.
evidence: content/docs/ai/agents/integrations.md exists with the title "Integrations", which matches the link. It covers credential setup: "For AWS, Google Cloud, Azure, and Kubernetes, configure credentials in Pulumi ESC, then connect the…; source: repo:content/docs/ai/agents/integrations.md
source: repo:content/docs/ai/agents/integrations.md
framing: exact-match
pass1 · url · high confidence
#168 ✅ Verified
content/docs/ai/agents/manage.md:62
The pages /docs/ai/agents/configure/, /docs/ai/agents/triggers/, and /docs/ai/agents/permissions/ exist.
evidence: All three content files are in the repo: configure.md ("title: Create and configure an agent"), triggers.md ("title: Events and schedules") and permissions.md ("title: Permissions"). None has an alias or url override that would move it…; source: repo:content/docs/ai/agents/configure.md; repo:content/docs/ai/agents/triggers.md; repo:content/docs/ai/agents/permissions.md
source: repo:content/docs/ai/agents/configure.md; repo:content/docs/ai/agents/triggers.md; repo:content/docs/ai/agents/permissions.md
pass1 · url · high confidence
#169 ✅ Verified
content/docs/ai/agents/manage.md:63
- [Check event and schedule setup](/docs/ai/agents/triggers/).
evidence: The internal link target exists as content/docs/ai/agents/triggers.md, titled "Events and schedules", and its description reads "Start agent tasks from Pulumi events, external webhooks, or recurring schedules". That fits the link text…; source: repo:content/docs/ai/agents/triggers.md
source: repo:content/docs/ai/agents/triggers.md
framing: exact-match
pass1 · url · high confidence
#172 ✅ Verified
content/docs/ai/agents/permissions.md:14
Neo uses the user's existing Pulumi Cloud permissions rather than a separate agent role.
framing: Only same-site docs corroborate this; I didn't check product source (gh search was rate-limited), and I didn't read marketing-web#252 (it's inaccessible).; evidence: The canonical Neo permissions page says: "Neo has no identity of its own: by default a task carries the acting user's full set of role assignments," and "Neo acts on behalf of the user invoking it." One caveat: on Pro/Enterprise, a task…; source: repo:content/docs/ai/neo/permissions/_index.md L20-29
source: repo:content/docs/ai/neo/permissions/_index.md L20-29
framing: exact-match — Only same-site docs corroborate this; I didn't check product source (gh search was rate-limited), and I didn't read marketing-web#252 (it's inaccessible).
pass1 · url · medium confidence
#174 ✅ Verified
content/docs/ai/agents/permissions.md:18
Pulumi Agents integrations support a dedicated role or service account in some cases, allowing agent access to be revoked independently of a teammate's access.
framing: The claim is mostly best-practice guidance hedged with "where supported"; sibling integration guides show such support exists.; evidence: The cloud integrations get credentials from Pulumi ESC. The Google Cloud guide tells users to "Use a service account with access to the projects and resources the agent needs" through the ESC gcp-login provider, and the GitHub repository…; source: repo:content/docs/ai/agents/integrations/google-cloud.md L15-21; repo:content/docs/ai/agents/integrations.md
source: repo:content/docs/ai/agents/integrations/google-cloud.md L15-21; repo:content/docs/ai/agents/integrations.md
framing: The claim is mostly best-practice guidance hedged with "where supported"; sibling integration guides show such support exists.
pass1 · feature · medium confidence
#175 ✅ Verified
content/docs/ai/agents/permissions.md:20
Credentials for Pulumi Agents integrations can be stored through the integration's setup flow or Pulumi ESC.
evidence: The sibling integrations page backs up both storage paths. It says: "For AWS, Google Cloud, Azure, and Kubernetes, configure credentials in Pulumi ESC, then connect the environment to a CLI tool." MCP and repository integrations are…; source: repo:content/docs/ai/agents/integrations.md
source: repo:content/docs/ai/agents/integrations.md
pass1 · feature · medium confidence
#176 ✅ Verified
content/docs/ai/agents/permissions.md:22
The /docs/ai/agents/integrations/ page contains integration guides that apply credential-scoping choices to each provider.
framing: Only some providers (AWS, Google Cloud, Azure, Datadog) have dedicated agents guides. The rest link to Neo MCP/CLI pages, so "each provider" is a slight…; evidence: The link resolves: content/docs/ai/agents/integrations.md exists ("Connect the tools an agent needs... See [Permissions](/docs/ai/agents/permissions/#design-access-around-the-job) to choose the access to grant") and links to per-provider…; source: repo:content/docs/ai/agents/integrations.md; repo:content/docs/ai/agents/integrations/aws.md
source: repo:content/docs/ai/agents/integrations.md; repo:content/docs/ai/agents/integrations/aws.md
framing: entailed-narrower — Only some providers (AWS, Google Cloud, Azure, Datadog) have dedicated agents guides. The rest link to Neo MCP/CLI pages, so "each provider" is a slight stretch.
pass1 · url · medium confidence
#180 ✅ Verified
content/docs/ai/agents/permissions.md:34
For an ESC-based integration, the credentials supplied by the ESC environment control access to the connected tool.
evidence: The sibling CLI integration page describes the same mechanism: the agent runs `pulumi env run <org>/<project>/<env> -- <cli> <args>`, and "The credentials in the environment determine what the CLI can do in the cloud account." That page…; source: repo:content/docs/ai/neo/integrations/cli/_index.md L26-32, L65
source: repo:content/docs/ai/neo/integrations/cli/_index.md L26-32, L65
pass1 · behavior · medium confidence
#183 ✅ Verified
content/docs/ai/agents/permissions.md:40
The /docs/ai/neo/permissions/ page has a section on permission mode and approval mode (anchor #permission-mode-and-approval-mode).
evidence: content/docs/ai/neo/permissions/_index.md line 73 has the heading "## Permission mode and approval mode", which Hugo turns into the anchor #permission-mode-and-approval-mode. The same page also links to that anchor itself, at line 55.…; source: repo:content/docs/ai/neo/permissions/_index.md#L73
source: repo:content/docs/ai/neo/permissions/_index.md#L73
framing: exact-match
pass1 · url · high confidence
#188 ✅ Verified
content/docs/ai/agents/permissions.md:54
The /docs/ai/agents/manage/ page has a section on pausing future work and stopping current work (anchor #pause-future-work-and-stop-current-work).
evidence: content/docs/ai/agents/manage.md has the heading "## Pause future work and stop current work" at line 23. Hugo turns that heading into the anchor #pause-future-work-and-stop-current-work, and the page is served at /docs/ai/agents/manage/.; source: repo:content/docs/ai/agents/manage.md#L23
source: repo:content/docs/ai/agents/manage.md#L23
framing: exact-match
pass1 · url · high confidence
#189 ✅ Verified
content/docs/ai/agents/reference.md:2
The Pulumi Cloud REST API documentation at /docs/reference/cloud-rest-api/neo/ has an anchor #post-apipreviewagentsorgnametasks describing the preview…
framing: The page and the endpoint are confirmed. The anchor fragment is plausible but wasn't checked against the rendered HTML IDs.; evidence: (escalated from pass1) The live Neo REST API page documents "POST /api/preview/agents/{orgName}/tasks. Creates a new agent task for the specified organization," and marks the agents endpoints as Preview. Search results don't show the…; source: https://www.pulumi.com/docs/reference/cloud-rest-api/neo/
source: https://www.pulumi.com/docs/reference/cloud-rest-api/neo/
framing: exact-match — The page and the endpoint are confirmed. The anchor fragment is plausible but wasn't checked against the rendered HTML IDs.
pass3 · url · medium confidence
#191 ✅ Verified
content/docs/ai/agents/reference.md:18
A Hugo shortcode named `pulumi-cloud` with the argument `pulumi-agents` exists and renders content on the page.
evidence: The `layouts/shortcodes/pulumi-cloud.html` shortcode exists. It takes a positional feature id from data/pulumi_editions.yaml and renders a "cloud" notes box. That data file has "id: pulumi-agents / name: Pulumi Agents / min_edition: pro…; source: repo:layouts/shortcodes/pulumi-cloud.html; repo:layouts/partials/cloud-availability-body.html; repo:data/pulumi_editions.yaml L190-193
source: repo:layouts/shortcodes/pulumi-cloud.html; repo:layouts/partials/cloud-availability-body.html; repo:data/pulumi_editions.yaml L190-193
pass1 · cross-reference · high confidence
#194 ✅ Verified
content/docs/ai/agents/tasks.md:17
The Pulumi Agents task instructions on this page apply to agents created for your organization, not to personal tasks with Neo.
framing: The link text "Neo tasks" matches the target page's h1, "Tasks in Pulumi Neo".; evidence: The link target /docs/ai/neo/tasks/ resolves to content/docs/ai/neo/tasks/_index.md, titled "Tasks in Pulumi Neo" with meta_desc "Learn about tasks, the primary entity for interacting with Neo to perform infrastructure operations." So…; source: repo:content/docs/ai/neo/tasks/_index.md
source: repo:content/docs/ai/neo/tasks/_index.md
framing: exact-match — The link text "Neo tasks" matches the target page's h1, "Tasks in Pulumi Neo".
pass1 · url · high confidence
#196 ✅ Verified
content/docs/ai/agents/tasks.md:27
Editing a Pulumi Agent changes its instructions or access across tasks, and the page /docs/ai/agents/configure/ has a section anchored…
framing: The anchor target exists and its section is about editing a saved agent. It sends readers to the manage page to find out when changes take effect.; evidence: configure.md L88 has the heading "## Change an existing agent", so the #change-an-existing-agent anchor resolves. The section reads: "Select **Edit** on the agent's page... Add information to the task conversation when it applies only to…; source: repo:content/docs/ai/agents/configure.md#L88-L90
source: repo:content/docs/ai/agents/configure.md#L88-L90
framing: exact-match — The anchor target exists and its section is about editing a saved agent. It sends readers to the manage page to find out when changes take effect.
pass1 · url · high confidence
#197 ✅ Verified
content/docs/ai/agents/tasks.md:31
Pulumi Agent Slack setup uses the Slack installation and account-linking steps documented at /docs/ai/neo/integrations/slack/ under the section…
framing: The target section is installation (step 1) plus account linking (step 2), which matches the link text 'Slack installation and account-linking steps'.; evidence: The link target is real. content/docs/ai/neo/integrations/slack/_index.md has the heading "## Setting up the integration" (L27), which gives Hugo the anchor #setting-up-the-integration. Under it are the steps "Install the Pulumi Neo…; source: repo:content/docs/ai/neo/integrations/slack/_index.md (L19, L27-35); intuition: The linked section names the 'Pulumi Neo Slack app' and says to mention @Neo, but tasks.md L31 says to mention…
source: repo:content/docs/ai/neo/integrations/slack/_index.md (L19, L27-35)
framing: exact-match — The target section is installation (step 1) plus account linking (step 2), which matches the link text 'Slack installation and account-linking steps'.
pass1 · url · high confidence
#198 ✅ Verified
content/docs/ai/agents/tasks.md:33
In Slack, each participant must link their own Pulumi account and have permission to contribute to the agent; Slack channel membership alone does not grant…
framing: The anchor page covers contribute permissions in general. The Slack account-linking rule appears only on the sibling Slack page, which is not product source.; evidence: The link target exists (permissions.md L42 "## Give teammates access") and covers contribute access: "teammates with access to the agent can view and contribute to its tasks… `agent_task:contribute` allows replies." The Slack-specific…; source: repo:content/docs/ai/agents/permissions.md#L42-L48; repo:content/docs/ai/neo/integrations/slack/_index.md#L47-L51
source: repo:content/docs/ai/agents/permissions.md#L42-L48; repo:content/docs/ai/neo/integrations/slack/_index.md#L47-L51
framing: entailed-narrower — The anchor page covers contribute permissions in general. The Slack account-linking rule appears only on the sibling Slack page, which is not product source.
pass1 · url · low confidence
#199 ✅ Verified
content/docs/ai/agents/tasks.md:37
Teammates with permission to contribute can reply in a Pulumi Agent task to add evidence, answer questions, or request changes.
framing: The linked section covers permission to contribute or reply. The claim's list of reasons to reply describes how replies are used, not a separate permission…; evidence: The link target resolves: permissions.md has a "## Give teammates access" heading (L42), and that section says "teammates with access to the agent can view and contribute to its tasks" and "`agent_task:contribute` allows replies." The…; source: repo:content/docs/ai/agents/permissions.md L42-L48
source: repo:content/docs/ai/agents/permissions.md L42-L48
framing: entailed-narrower — The linked section covers permission to contribute or reply. The claim's list of reasons to reply describes how replies are used, not a separate permission claim.
pass1 · url · medium confidence
#200 ✅ Verified
content/docs/ai/agents/tasks.md:41
The pages /docs/ai/agents/triggers/, /docs/ai/agents/permissions/ and /docs/ai/agents/manage/ exist, covering events or schedules, access and approval…
evidence: All three pages are in the repo. triggers.md has the meta_desc "Start agent tasks from Pulumi events, external webhooks, or recurring schedules". permissions.md has "Scope Pulumi Agents access with Pulumi Cloud roles, external…; source: repo:content/docs/ai/agents/triggers.md; repo:content/docs/ai/agents/permissions.md; repo:content/docs/ai/agents/manage.md
source: repo:content/docs/ai/agents/triggers.md; repo:content/docs/ai/agents/permissions.md; repo:content/docs/ai/agents/manage.md
framing: exact-match
pass1 · url · high confidence
#201 ✅ Verified
content/docs/ai/agents/tasks.md:42
- [Review access and approval controls](/docs/ai/agents/permissions/).
evidence: content/docs/ai/agents/permissions.md exists and resolves to /docs/ai/agents/permissions/. It covers access and approvals: menu name "Permissions and approvals", meta_desc "Scope Pulumi Agents access with Pulumi Cloud roles, external…; source: repo:content/docs/ai/agents/permissions.md
source: repo:content/docs/ai/agents/permissions.md
framing: exact-match
pass1 · url · high confidence
#202 ✅ Verified
content/docs/ai/agents/tasks.md:43
- [Stop or troubleshoot work](/docs/ai/agents/manage/).
evidence: The link target is there: content/docs/ai/agents/manage.md resolves to /docs/ai/agents/manage/. Its title is "Manage and troubleshoot agents", and it has sections titled "Pause future work and stop current work" and "A task does not…; source: repo:content/docs/ai/agents/manage.md
source: repo:content/docs/ai/agents/manage.md
framing: exact-match
pass1 · url · high confidence
#204 ✅ Verified
content/docs/ai/agents/triggers.md:17
The agent creation flow includes a 'Choose how the agent starts' section on the /docs/ai/agents/configure/ page, where the agent's first trigger can be…
framing: This is a link and anchor check: the target page has the named section, and that section covers configuring the agent's first trigger.; evidence: The heading exists in content/docs/ai/agents/configure.md at L69, "## Choose how the agent starts", so the #choose-how-the-agent-starts anchor resolves. The section describes the trigger setup: "Configure a trigger to start tasks from…; source: repo:content/docs/ai/agents/configure.md#L69-L78
source: repo:content/docs/ai/agents/configure.md#L69-L78
framing: exact-match — This is a link and anchor check: the target page has the named section, and that section covers configuring the agent's first trigger.
pass1 · url · high confidence
#205 ✅ Verified
content/docs/ai/agents/triggers.md:19
Neo has scheduled tasks documented on the /docs/ai/neo/automations/ page ('Neo automations').
framing: The link text "Neo automations" matches the page's title_tag "Neo Automations", and the page documents Neo scheduled tasks.; evidence: The link target exists as content/docs/ai/neo/automations/_index.md, with title_tag "Neo Automations" and pulumi_cloud_feature "neo-scheduled-tasks". It covers scheduled tasks directly: "Automations turn any Neo task into recurring work.…; source: repo:content/docs/ai/neo/automations/_index.md
source: repo:content/docs/ai/neo/automations/_index.md
framing: exact-match — The link text "Neo automations" matches the page's title_tag "Neo Automations", and the page documents Neo scheduled tasks.
pass1 · url · high confidence
#206 ✅ Verified
content/docs/ai/agents/triggers.md:23
Instructions that apply across all of a Pulumi agent's tasks are kept in the agent's configuration, documented at /docs/ai/agents/configure/.
framing: The configure page puts the agent's standing instructions in its System prompt and per-run details in the task. That covers the claim that cross-task…; evidence: The link target exists at content/docs/ai/agents/configure.md, titled "Create and configure an agent". Its "Customize the instructions" section covers agent-wide instructions: "In **System prompt**, describe the agent's job..." and "Keep…; source: repo:content/docs/ai/agents/configure.md (L38-44)
source: repo:content/docs/ai/agents/configure.md (L38-44)
framing: entailed-narrower — The configure page puts the agent's standing instructions in its System prompt and per-run details in the task. That covers the claim that cross-task instructions belong in the agent's configuration.
pass1 · url · medium confidence
#216 ✅ Verified
content/docs/ai/agents/triggers.md:58
A webhook trigger delivers only the event payload; to retrieve more information the agent needs an integration with the sending system (documented at…
framing: The link at L58 resolves to the Integrations page, which matches what the sentence says it is. The claim says "only the event payload"; the doc line says "A…; evidence: The link target exists as content/docs/ai/agents/integrations.md ("Connect the tools an agent needs to do its work..."), and its tools list includes PagerDuty, which matches the example at L58. I couldn't check the claim that a webhook…; source: repo:content/docs/ai/agents/integrations.md
source: repo:content/docs/ai/agents/integrations.md
framing: exact-match — The link at L58 resolves to the Integrations page, which matches what the sentence says it is. The claim says "only the event payload"; the doc line says "A webhook delivers the event payload."
pass1 · url · medium confidence
#220 ✅ Verified
content/docs/ai/agents/triggers.md:81
Pausing a Pulumi agent stops new work across all of that agent's triggers and schedules; this is documented at /docs/ai/agents/manage/#pause-future-work-and-st…
framing: The target page says "prevent new tasks" and that skipped "scheduled runs and events" are not replayed. That implies the claim's "stops new work across all…; evidence: The anchor exists: manage.md L23 has the heading "## Pause future work and stop current work". The section says: "Select **Pause** on the agent's page to prevent new tasks and block further work in existing tasks... Scheduled runs and…; source: repo:content/docs/ai/agents/manage.md#L23-L27
source: repo:content/docs/ai/agents/manage.md#L23-L27
framing: entailed-narrower — The target page says "prevent new tasks" and that skipped "scheduled runs and events" are not replayed. That implies the claim's "stops new work across all triggers and schedules" without stating it word for word.
pass1 · url · medium confidence
#222 ✅ Verified
content/docs/ai/cli-for-agents/index.md:15
[Pulumi Agent Skills](/docs/ai/skills/) teach agents Pulumi workflows. The [Pulumi MCP server](/docs/ai/mcp-server/) lets them query Pulumi Cloud and the…
framing: Each link's description matches what its target page says it is.; evidence: All three link targets exist locally. Skills page: "Pulumi Agent Skills are knowledge packages that teach AI coding assistants domain-specific Pulumi workflows." MCP page: "Connect Claude Code, Cursor, Windsurf, and other AI agents to…; source: repo:content/docs/ai/skills/index.md; repo:content/docs/ai/mcp-server/index.md; repo:content/docs/ai/coding-agents/_index.md
source: repo:content/docs/ai/skills/index.md; repo:content/docs/ai/mcp-server/index.md; repo:content/docs/ai/coding-agents/_index.md
framing: exact-match — Each link's description matches what its target page says it is.
pass1 · url · high confidence
#223 ✅ Verified
content/docs/ai/cli-for-agents/index.md:30
[`pulumi do`](/docs/iac/cli/direct-resource-operations/) performs direct operations on cloud resources without requiring a Pulumi program. It exposes the…
framing: The claim restates the linked page's intro sentence. The source says "without requiring a project, program, or state file"; the claim says "without requiring…; evidence: The linked page backs up the claim's description almost word for word: "The `pulumi do` command provides direct operations on cloud resources through the Pulumi CLI without requiring a project, program, or state file. It exposes the full…; source: repo:content/docs/iac/cli/direct-resource-operations/_index.md
source: repo:content/docs/iac/cli/direct-resource-operations/_index.md
framing: exact-match — The claim restates the linked page's intro sentence. The source says "without requiring a project, program, or state file"; the claim says "without requiring a Pulumi program", a narrower wording that the source fully supports.
pass1 · url · medium confidence
#225 ✅ Verified
content/docs/ai/cli-for-agents/index.md:68
- [Pulumi MCP server](/docs/ai/mcp-server/): query Pulumi Cloud and the Pulumi Registry through the [Model Context Protocol](/what-is/mcp-for-infrastructure-as…
framing: The link text's description ("query Pulumi Cloud and the Pulumi Registry") matches the target page's own description of the server.; evidence: Both link targets exist in the repo. The MCP server page's meta_desc reads "Connect ... AI agents to Pulumi Cloud and the Pulumi Registry with Pulumi's hosted Model Context Protocol (MCP) server", and it documents Pulumi Cloud and…; source: repo:content/docs/ai/mcp-server/index.md; repo:content/what-is/mcp-for-infrastructure-as-code.md
source: repo:content/docs/ai/mcp-server/index.md; repo:content/what-is/mcp-for-infrastructure-as-code.md
framing: exact-match — The link text's description ("query Pulumi Cloud and the Pulumi Registry") matches the target page's own description of the server.
pass1 · url · high confidence
#226 ✅ Verified
content/docs/ai/coding-agents/_index.md:5
Pulumi can be used with Claude Code, Codex, Cursor, and other coding agents (Pulumi skills, the MCP server, and the CLI work with these coding agents).
framing: The skills part is confirmed directly by product source. The MCP and CLI parts are inferred from how they work, not from a source I read.; evidence: The pulumi/agent-skills README lists support for "Claude Code", "Cursor", and "OpenAI Codex", includes Codex and Claude Code install steps, and says "This works with Claude Code, Cursor, Copilot, Codex, and other agent tools." I couldn't…; source: gh api repos/pulumi/agent-skills/readme
source: gh api repos/pulumi/agent-skills/readme
framing: The skills part is confirmed directly by product source. The MCP and CLI parts are inferred from how they work, not from a source I read.
pass1 · feature · medium confidence
#231 ✅ Verified
content/docs/ai/coding-agents/handoff.md:16
The page /docs/ai/neo/pulumi-cli/ has an 'agent handoff' section (anchor #agent-handoff) that covers local execution, permissions, and setup for Neo in the…
framing: Doc line says the linked page covers "local execution, permissions, and setup". That's true of the page, but the anchored section itself only covers the…; evidence: The page content/docs/ai/neo/pulumi-cli/_index.md has a heading "## Agent handoff" (L36), so the #agent-handoff anchor resolves. The same page also has "## What local execution unlocks" (L18), "## How permissions work" (L40) and "## Get…; source: repo:content/docs/ai/neo/pulumi-cli/_index.md
source: repo:content/docs/ai/neo/pulumi-cli/_index.md
framing: entailed-narrower — Doc line says the linked page covers "local execution, permissions, and setup". That's true of the page, but the anchored section itself only covers the handoff skill.
pass1 · url · high confidence
#233 ✅ Verified
content/docs/ai/neo/_index.md:5
Neo can be used from Pulumi Cloud, the terminal, and the editor to investigate infrastructure and make changes.
framing: Editor support is inferred from the ACP adapter files; no editor-specific docs page was read.; evidence: The pulumi/pulumi master branch has a `neo` CLI command at pkg/cmd/pulumi/neo, so Neo runs from the terminal. The same directory has an ACP adapter (acp_adapter.go, acp_session.go). ACP is the Agent Client Protocol, which editors use to…; source: gh api repos/pulumi/pulumi/contents/pkg/cmd/pulumi/neo
source: gh api repos/pulumi/pulumi/contents/pkg/cmd/pulumi/neo
framing: Editor support is inferred from the ACP adapter files; no editor-specific docs page was read.
pass1 · feature · medium confidence
#234 ✅ Verified
content/docs/ai/neo/_index.md:18
Neo works with the user's Pulumi Cloud permissions to investigate infrastructure, preview changes, and update Pulumi code.
evidence: The separate Neo permissions reference page backs up every part of the claim. It says "Neo acts on behalf of the user invoking it, and Neo can only do what that user could do themselves." Its access table says Neo reads stack state and…; source: repo:content/docs/ai/neo/permissions/_index.md
source: repo:content/docs/ai/neo/permissions/_index.md
pass1 · behavior · medium confidence
#235 ✅ Verified
content/docs/ai/neo/_index.md:22
Neo is ready to use without creating an agent or assigning it a role; a user can start a task directly.
framing: Supported only by a sibling Pulumi docs page, which can back the claim up but isn't ground truth. The cited pulumi/marketing-web#252 returned 404 and…; evidence: The sibling get-started page agrees: "Neo is enabled by default", "Neo is included on the Essentials, Pro, and Enterprise editions and is on by default, so there is nothing to turn on", and "Neo operates within the conversing user's RBAC…; source: repo:content/docs/ai/neo/get-started/_index.md
source: repo:content/docs/ai/neo/get-started/_index.md
framing: Supported only by a sibling Pulumi docs page, which can back the claim up but isn't ground truth. The cited pulumi/marketing-web#252 returned 404 and couldn't be read.
pass1 · behavior · medium confidence
#236 ✅ Verified
content/docs/ai/neo/_index.md:24
To create an agent for a team, a user can configure a pre-built agent (see /docs/ai/agents/configure/) or build a custom agent (see /docs/ai/agents/custom/).
framing: Each link lands on the page the sentence describes: pre-built agent setup and custom agent build.; evidence: Both link targets are in the repo and cover what the line says they do. configure.md is titled "Create and configure an agent", and its menu entry is "Configure a pre-built agent" ("In the agent catalog, choose an agent and select **Set…; source: repo:content/docs/ai/agents/configure.md; repo:content/docs/ai/agents/custom.md
source: repo:content/docs/ai/agents/configure.md; repo:content/docs/ai/agents/custom.md
framing: exact-match — Each link lands on the page the sentence describes: pre-built agent setup and custom agent build.
pass1 · url · high confidence
#237 ✅ Verified
content/docs/ai/neo/_index.md:28
A Neo task contains the user's request, the conversation, and Neo's work; users can provide context, answer questions, and ask Neo to revise its approach as…
framing: The claim paraphrases the tasks page: "conversation where you describe what you want" and "iterates with you… ask for alternatives" back "request…; evidence: The linked tasks page says "Each task is a conversation where you describe what you want to accomplish, and Neo handles the infrastructure changes." It also says users can set stack/repository context and iterate "through normal…; source: repo:content/docs/ai/neo/tasks/_index.md
source: repo:content/docs/ai/neo/tasks/_index.md
framing: entailed-narrower — The claim paraphrases the tasks page: "conversation where you describe what you want" and "iterates with you… ask for alternatives" back "request, conversation, Neo's work" and "revise its approach". "Answer questions" is implied rather…
pass1 · url · medium confidence
#238 ✅ Verified
content/docs/ai/neo/_index.md:30
Neo's approval settings control when Neo asks before taking an action; approval does not grant additional access.
framing: The source says approval mode governs only "when Neo pauses" and is separate from permissions. That supports the claim that approval doesn't grant extra access.; evidence: The linked permissions page treats approval mode and permission mode as separate controls: approval mode governs "*When Neo pauses for your approval*", while access is set by "Permission mode ... *What Neo can change*". It adds: "Neo has…; source: repo:content/docs/ai/neo/permissions/_index.md L73-100
source: repo:content/docs/ai/neo/permissions/_index.md L73-100
framing: entailed-narrower — The source says approval mode governs only "when Neo pauses" and is separate from permissions. That supports the claim that approval doesn't grant extra access.
pass1 · url · medium confidence
#239 ✅ Verified
content/docs/ai/neo/_index.md:34
Users can start their first Neo task in Pulumi Cloud (/docs/ai/neo/get-started/), or use Neo from the terminal (/docs/ai/neo/pulumi-cli/) or editor…
evidence: I found all three link targets in the repo, and each one covers what the claim says it does. get-started is "Getting started with Pulumi Neo" ("run your first infrastructure task"). pulumi-cli is "Neo in the Pulumi CLI" ("Run pulumi neo…; source: repo:content/docs/ai/neo/get-started/_index.md; repo:content/docs/ai/neo/pulumi-cli/_index.md; repo:content/docs/ai/neo/editors/_index.md
source: repo:content/docs/ai/neo/get-started/_index.md; repo:content/docs/ai/neo/pulumi-cli/_index.md; repo:content/docs/ai/neo/editors/_index.md
framing: exact-match
pass1 · url · high confidence
#240 ✅ Verified
content/docs/ai/neo/_index.md:36
In a Neo task, some actions require user approval, which users can review.
framing: Whether an approval is required depends on the task mode (Auto mode asks for none), so "some actions" is accurate.; evidence: The sibling tasks page backs this up: "Depending on the task mode, Neo seeks approval before taking certain actions like running `pulumi up` or opening a PR," and "Review mode (default): Neo requires approval before running `pulumi…; source: repo:content/docs/ai/neo/tasks/_index.md L57-65
source: repo:content/docs/ai/neo/tasks/_index.md L57-65
framing: Whether an approval is required depends on the task mode (Auto mode asks for none), so "some actions" is accurate.
pass1 · behavior · medium confidence
#241 ✅ Verified
content/docs/ai/neo/_index.md:36
In Neo tasks, some actions require user approval.
framing: The source says approval needs depend on the task mode (in Auto mode Neo requests no approvals). The claim "some actions require user approval" is a hedged…; evidence: The link target exists, and it describes approvals that depend on the task mode: "Depending on the task mode, Neo seeks approval before taking certain actions like running `pulumi up` or opening a PR." In the default Review mode, "Neo…; source: repo:content/docs/ai/neo/tasks/_index.md L57-65
source: repo:content/docs/ai/neo/tasks/_index.md L57-65
framing: entailed-narrower — The source says approval needs depend on the task mode (in Auto mode Neo requests no approvals). The claim "some actions require user approval" is a hedged special case of that.
pass1 · url · medium confidence
#242 ✅ Verified
content/docs/ai/neo/_index.md:36
Linked pages exist for Neo tasks, pull requests, running previews, code reviews, automations, settings (/docs/ai/neo/settings/), and agent integrations…
evidence: I found a page in the repo for each link on L36-39: neo/tasks/_index.md ("title: Tasks"), neo/pull-requests/_index.md ("title: Pull requests"), neo/running-previews/_index.md ("title: Previews"), neo/code-reviews/_index.md…; source: repo:content/docs/ai/neo/{tasks,pull-requests,running-previews,code-reviews,automations,settings}/_index.md; repo:content/docs/ai/agents/integrations.md
source: repo:content/docs/ai/neo/{tasks,pull-requests,running-previews,code-reviews,automations,settings}/_index.md; repo:content/docs/ai/agents/integrations.md
pass1 · url · high confidence
#243 ✅ Verified
content/docs/ai/neo/_index.md:38
Neo can review code (/docs/ai/neo/code-reviews/) and schedule recurring work (/docs/ai/neo/automations/).
evidence: I checked both link targets and both pages exist in the repo, and each covers what the sentence says it does. code-reviews/_index.md says "Neo code reviews analyze pull requests ... and leave feedback in the pull request", and…; source: repo:content/docs/ai/neo/code-reviews/_index.md; repo:content/docs/ai/neo/automations/_index.md
source: repo:content/docs/ai/neo/code-reviews/_index.md; repo:content/docs/ai/neo/automations/_index.md
framing: exact-match
pass1 · url · high confidence
#244 ✅ Verified
content/docs/ai/neo/_index.md:39
Neo can be configured (/docs/ai/neo/settings/) and connected to tools via integrations (/docs/ai/agents/integrations/).
framing: Both linked pages exist, and each one's description matches the anchor text pointing to it.; evidence: Both link targets exist in the repo. content/docs/ai/neo/settings/_index.md has the h1 "Neo settings" and the description "Configure Neo instructions, model providers, integrations...". content/docs/ai/agents/integrations.md has the…; source: repo:content/docs/ai/neo/settings/_index.md; repo:content/docs/ai/agents/integrations.md
source: repo:content/docs/ai/neo/settings/_index.md; repo:content/docs/ai/agents/integrations.md
framing: exact-match — Both linked pages exist, and each one's description matches the anchor text pointing to it.
pass1 · url · high confidence
#245 ✅ Verified
content/docs/ai/neo/integrations/_index.md:28
To configure AWS or Datadog access, follow [Connect AWS](/docs/ai/agents/integrations/aws/) or [Connect Datadog](/docs/ai/agents/integrations/datadog/).
framing: The link text "Connect AWS"/"Connect Datadog" is the same as each target page's title.; evidence: Both link targets are in the repo: content/docs/ai/agents/integrations/aws.md has "title: Connect AWS" and datadog.md has "title: Connect Datadog". So both links resolve, and the link text matches the page titles.; source: repo:content/docs/ai/agents/integrations/aws.md; repo:content/docs/ai/agents/integrations/datadog.md
source: repo:content/docs/ai/agents/integrations/aws.md; repo:content/docs/ai/agents/integrations/datadog.md
framing: exact-match — The link text "Connect AWS"/"Connect Datadog" is the same as each target page's title.
pass1 · url · high confidence
#246 ✅ Verified
content/docs/ai/neo/integrations/cli/_index.md:11
The menu parent identifier `ai-agents-integrations` exists as a parent menu entry in the AI docs menu.
evidence: I found `ai-agents-integrations` defined as a menu entry in the `ai` menu in content/docs/ai/agents/integrations.md: "menu: ai: name: Integrations, parent: ai-home, identifier: ai-agents-integrations, weight: 40".…; source: repo:content/docs/ai/agents/integrations.md (L6-11); repo:config/_default/menus.yml (L366-370)
source: repo:content/docs/ai/agents/integrations.md (L6-11); repo:config/_default/menus.yml (L366-370)
pass1 · cross-reference · high confidence
#251 ✅ Verified
content/docs/ai/neo/integrations/cli/_index.md:32
The CLI connection stores a reference to the ESC environment; when the command runs, ESC opens the environment and supplies its variables and temporary files…
framing: I only checked the claim's ESC runtime half (env run opens the environment and passes variables to the command) against product source. The 'stores a…; evidence: The ESC half checks out in pulumi/esc's `env run` command: "This command opens the environment with the given name and runs the given command... each key-value pair in the object is made available to the command as an environment…; source: gh api repos/pulumi/esc/contents/cmd/esc/cli/env_run.go (L99-L150)
source: gh api repos/pulumi/esc/contents/cmd/esc/cli/env_run.go (L99-L150)
framing: I only checked the claim's ESC runtime half (env run opens the environment and passes variables to the command) against product source. The 'stores a reference' half is internal to the service and isn't available in any public repo.
pass1 · behavior · medium confidence
#253 ✅ Verified
content/docs/ai/neo/integrations/cli/_index.md:45
For AWS CLI integrations, ESC's `aws-login` provider can issue temporary credentials for an IAM role.
framing: The source says the OIDC mode issues temporary credentials by assuming an IAM role, and the claim says the same thing. The claim leaves out that the static…; evidence: The linked page exists (content/docs/ai/agents/integrations/aws.md) and says to "Use the AWS login provider's OIDC configuration to expose temporary credentials". The ESC aws-login provider docs back this up: "Pulumi Cloud exchanges a…; source: repo:content/docs/ai/agents/integrations/aws.md L25; repo:content/docs/esc/providers/login/aws-login.md L24
source: repo:content/docs/ai/agents/integrations/aws.md L25; repo:content/docs/esc/providers/login/aws-login.md L24
framing: entailed-narrower — The source says the OIDC mode issues temporary credentials by assuming an IAM role, and the claim says the same thing. The claim leaves out that the static mode accepts credentials you supply instead of generating them, but its "can…
pass1 · url · medium confidence
#254 ✅ Verified
content/docs/ai/neo/integrations/cli/_index.md:46
For Google Cloud CLI integrations, the `gcp-login` provider's access token can be exported as `CLOUDSDK_AUTH_ACCESS_TOKEN`.
framing: Linked page: "export its `accessToken` output as `CLOUDSDK_AUTH_ACCESS_TOKEN`". Claim: "export the `gcp-login` provider's access token as…; evidence: The linked page says: "export its `accessToken` output as `CLOUDSDK_AUTH_ACCESS_TOKEN`". The gcp-login provider doc shows the same mapping: "CLOUDSDK_AUTH_ACCESS_TOKEN: ${gcp.login.accessToken}". gcloud's auth/access_token property reads…; source: repo:content/docs/ai/agents/integrations/google-cloud.md L21; repo:content/docs/esc/providers/login/gcp-login.md L56-60
source: repo:content/docs/ai/agents/integrations/google-cloud.md L21; repo:content/docs/esc/providers/login/gcp-login.md L56-60
framing: exact-match — Linked page: "export its `accessToken` output as `CLOUDSDK_AUTH_ACCESS_TOKEN`". Claim: "export the `gcp-login` provider's access token as `CLOUDSDK_AUTH_ACCESS_TOKEN`".
pass1 · url · medium confidence
#256 ✅ Verified
content/docs/ai/neo/integrations/cli/_index.md:49
An ESC environment configured for a Pulumi provider may emit different variables from those required by the corresponding cloud CLI.
framing: Supported by a sibling ESC provider doc (one other pulumi.com page backs it up, not product source); the GOOGLE_* vs CLOUDSDK_* split is well-known upstream…; evidence: The ESC gcp-login provider docs show this: the Pulumi provider setup emits `GOOGLE_CLOUD_PROJECT`/`GOOGLE_OAUTH_ACCESS_TOKEN`, while "The `gcloud` CLI reads the project ID ... and the access token from its own `CLOUDSDK_*` environment…; source: repo:content/docs/esc/providers/login/gcp-login.md L36-61
source: repo:content/docs/esc/providers/login/gcp-login.md L36-61
framing: Supported by a sibling ESC provider doc (one other pulumi.com page backs it up, not product source); the GOOGLE_* vs CLOUDSDK_* split is well-known upstream behavior.
pass1 · behavior · medium confidence
#258 ✅ Verified
content/docs/ai/neo/integrations/cli/_index.md:55
A stack-output kubeconfig is the recommended approach for Pulumi-managed clusters, and the connection reads the kubeconfig from the stack output when the…
framing: The runtime read on open matches the source. "Recommended for Pulumi-managed clusters" is the docs author's own advice, not something the source says ("you…; evidence: The mechanism is confirmed. The pulumi-stacks provider "enables you to import stack outputs from Pulumi into your environment" via `fn::open::pulumi-stacks`. The Kubernetes guide adds that it lets you "read Pulumi IaC stack outputs (in…; source: repo:content/docs/esc/providers/iac/pulumi-stacks.md; repo:content/docs/esc/guides/integrate-with/kubernetes-cluster-access.md L65-82, L174
source: repo:content/docs/esc/providers/iac/pulumi-stacks.md; repo:content/docs/esc/guides/integrate-with/kubernetes-cluster-access.md L65-82, L174
framing: exact-match — The runtime read on open matches the source. "Recommended for Pulumi-managed clusters" is the docs author's own advice, not something the source says ("you also have the option").
pass1 · url · medium confidence
#259 ✅ Verified
content/docs/ai/neo/integrations/cli/_index.md:56
A static kubeconfig can be placed directly into `files.KUBECONFIG` for clusters not managed by a Pulumi program.
framing: The guide shows a static kubeconfig in files.KUBECONFIG as a general ESC pattern. The claim applies that pattern to the Neo kubectl connection. The evidence…; evidence: The ESC Kubernetes Cluster Access guide shows a hardcoded kubeconfig under `values: files: KUBECONFIG: | apiVersion: v1 ...`. It says `pulumi env run` "renders the kubeconfig as a temporary file, sets the `KUBECONFIG` environment…; source: repo:content/docs/esc/guides/integrate-with/kubernetes-cluster-access.md L40-67
source: repo:content/docs/esc/guides/integrate-with/kubernetes-cluster-access.md L40-67
framing: entailed-narrower — The guide shows a static kubeconfig in files.KUBECONFIG as a general ESC pattern. The claim applies that pattern to the Neo kubectl connection. The evidence is another pulumi.com docs page that agrees with the claim, not product source…
pass1 · behavior · medium confidence
#263 ✅ Verified
content/docs/ai/neo/integrations/cli/_index.md:65
The credentials in the ESC environment determine what the CLI can do in the cloud account.
framing: The source says "credentials supplied by the environment control access to the connected tool". The claim is the CLI-specific case: the credentials in the…; evidence: The linked target content/docs/ai/agents/permissions.md exists, so /docs/ai/agents/permissions/ resolves. It supports the sentence: "If an integration uses Pulumi ESC, the agent also needs permission to open the environment... the…; source: repo:content/docs/ai/agents/permissions.md L30-34
source: repo:content/docs/ai/agents/permissions.md L30-34
framing: entailed-narrower — The source says "credentials supplied by the environment control access to the connected tool". The claim is the CLI-specific case: the credentials in the environment "determine what the CLI can do in the cloud account". The source is a…
pass1 · url · medium confidence
#279 ✅ Verified
content/docs/ai/neo/integrations/mcp/_index.md:19
The Pulumi MCP server documentation at /docs/ai/mcp-server/ describes giving an external coding agent access to Pulumi context.
framing: Link text "give an external coding agent access to Pulumi context" matches the page's "gives the AI agent you already use access to Pulumi".; evidence: The target page exists at content/docs/ai/mcp-server/index.md, which serves /docs/ai/mcp-server/. It says: "The Pulumi Model Context Protocol (MCP) server gives the AI agent you already use access to Pulumi" and "This page is about…; source: repo:content/docs/ai/mcp-server/index.md L18-23
source: repo:content/docs/ai/mcp-server/index.md L18-23
framing: exact-match — Link text "give an external coding agent access to Pulumi context" matches the page's "gives the AI agent you already use access to Pulumi".
pass1 · url · high confidence
#291 ✅ Verified
content/docs/ai/neo/integrations/mcp/_index.md:55
In the Atlassian setup, in admin.atlassian.com one opens Rovo MCP and enables API token authentication.
framing: The source gives the full path (Rovo → Rovo MCP server → Authentication tab). The claim shortens it to "open Rovo MCP and enable API token authentication,"…; evidence: (escalated from pass1) Atlassian's official MCP server README says "An organization admin must enable API token authentication for the Atlassian MCP Server (Atlassian Administration → Rovo → Rovo MCP server → Authentication)." That…; source: https://github.com/atlassian/atlassian-mcp-server/blob/main/README.md; https://developer.atlassian.com/cloud/rovo-mcp/guides/configuring-authentication-via-api-token/
source: https://github.com/atlassian/atlassian-mcp-server/blob/main/README.md; https://developer.atlassian.com/cloud/rovo-mcp/guides/configuring-authentication-via-api-token/
framing: entailed-narrower — The source gives the full path (Rovo → Rovo MCP server → Authentication tab). The claim shortens it to "open Rovo MCP and enable API token authentication," which the source still supports.
pass3 · behavior · high confidence
#293 ✅ Verified
content/docs/ai/neo/integrations/mcp/_index.md:64
Cloudflare MCP integration setup: in Cloudflare open Manage Account > Account API Tokens and create an account-owned token that includes Account Resources…
framing: Doc's "so the MCP server can identify the account" restates the README's "so the server can auto-detect your account ID".; evidence: (escalated from pass1) Cloudflare docs say to "Go to Manage Account > Account API Tokens" to create an account-owned token. The official cloudflare/mcp README says: "For account tokens, include the Account Resources : Read permission so…; source: https://developers.cloudflare.com/fundamentals/api/get-started/account-owned-tokens/ ; https://github.com/cloudflare/mcp
source: https://developers.cloudflare.com/fundamentals/api/get-started/account-owned-tokens/ ; https://github.com/cloudflare/mcp
framing: exact-match — Doc's "so the MCP server can identify the account" restates the README's "so the server can auto-detect your account ID".
pass3 · api-surface · medium confidence
#296 ✅ Verified
content/docs/ai/neo/integrations/mcp/_index.md:78
A Connect Datadog guide exists at /docs/ai/agents/integrations/datadog/ describing creating a service account, setting permissions, and connecting it to Pulumi.
evidence: content/docs/ai/agents/integrations/datadog.md exists with no URL override, so it serves at /docs/ai/agents/integrations/datadog/. Its title is "Connect Datadog" and it has sections on the service account ("create or select the…; source: repo:content/docs/ai/agents/integrations/datadog.md
source: repo:content/docs/ai/agents/integrations/datadog.md
framing: exact-match
pass1 · url · high confidence
#297 ✅ Verified
content/docs/ai/neo/integrations/mcp/_index.md:85
Honeycomb MCP integration: Read permission is required for all Honeycomb MCP operations (for both MCP and Environments), Write is required for the…
framing: Honeycomb's current docs say Write is required for every create/update tool (Boards, Triggers, SLOs, recipients, Canvas). The claim names only create_board…; evidence: (escalated from pass1) Honeycomb's MCP configuration guide says "Read: Required for all Honeycomb MCP operations. Be sure to grant read for both MCP and Environments." It also says Write is required for tools that create or update…; source: https://docs.honeycomb.io/integrations/mcp/configuration-guide; intuition: Honeycomb now requires Write for more than create_board (triggers, SLOs, recipients, canvas). The doc's line about…
source: https://docs.honeycomb.io/integrations/mcp/configuration-guide
framing: entailed-narrower — Honeycomb's current docs say Write is required for every create/update tool (Boards, Triggers, SLOs, recipients, Canvas). The claim names only create_board, which is a special case of that and still true. An older mirror of the docs said…
pass3 · api-surface · medium confidence
#299 ✅ Verified
content/docs/ai/neo/integrations/mcp/_index.md:93
Linear API keys are personal tokens, and all actions an agent takes through the Linear integration are attributed to the user who created the token…
framing: The Linear-side fact is confirmed by several third-party sources, but not by Linear's own docs. The claim that attribution doesn't depend on who creates the…; evidence: (escalated from pass1) Third-party integration docs agree that Linear API keys are personal and tied to a user. Sim's docs say "Keys are bound to the user who creates them: every action a workflow takes is attributed to that user," and…; source: https://docs.sim.ai/integrations/linear-service-account; https://chat-sdk.dev/adapters/official/linear; https://swrly.com/blog/linear-api-key-guide
source: https://docs.sim.ai/integrations/linear-service-account; https://chat-sdk.dev/adapters/official/linear; https://swrly.com/blog/linear-api-key-guide
framing: The Linear-side fact is confirmed by several third-party sources, but not by Linear's own docs. The claim that attribution doesn't depend on who creates the task is about Neo's design and needs checking against Pulumi source.
pass3 · behavior · medium confidence
#300 ✅ Verified
content/docs/ai/neo/integrations/mcp/_index.md:96
Linear permissions: Read is required for all operations; Create issues and Create comments are required to file or comment on issues; Write or Admin is…
framing: Linear's docs list the menu path as Settings > Account > Security & Access, but the claim leaves out the "Account" level. A third-party guide…; evidence: (escalated from pass1) Linear's docs say you can create a personal API key from "Settings > Account > Security & Access" and limit it to certain permissions: "Read, Write, Admin, Create issues, Create comments". They also say "You can…; source: https://linear.app/docs/api-and-webhooks
source: https://linear.app/docs/api-and-webhooks
framing: Linear's docs list the menu path as Settings > Account > Security & Access, but the claim leaves out the "Account" level. A third-party guide (docs.synqly.com) uses the same Settings > Security & access path as the claim, so this is a…
pass3 · api-surface · medium confidence
#301 ✅ Verified
content/docs/ai/neo/integrations/mcp/_index.md:96
For Linear, create an API key under Settings > Security & Access; Read is required for all operations, Create issues and Create comments are required to file…
framing: The claim shortens Linear's path 'Settings > Account > Security & Access' to 'Settings > Security & Access'. The permission names and team restriction match.…; evidence: (escalated from pass1) Linear's docs say keys are created "from Settings > Account > Security & Access" and can be restricted to "Read, Write, Admin, Create issues, Create comments" and to specific teams. Linear's OAuth scope model backs…; source: https://linear.app/docs/api-and-webhooks
source: https://linear.app/docs/api-and-webhooks
framing: entailed-narrower — The claim shortens Linear's path 'Settings > Account > Security & Access' to 'Settings > Security & Access'. The permission names and team restriction match. The mapping of operations to permissions is inferred from Linear's scope…
pass3 · api-surface · medium confidence
#306 ✅ Verified
content/docs/ai/neo/integrations/mcp/_index.md:115
PagerDuty User API Tokens are tied to a single user account, and actions an agent takes through the integration are attributed to the token's creator…
framing: PagerDuty docs back up the token-scoping and attribution facts. The Neo multi-user attribution is inferred from how a shared org-level token works, not taken…; evidence: (escalated from pass1) PagerDuty developer docs say "User API Keys are useful for scripts and personal projects but are also tied to that single user." The python-pagerduty guide adds that with a user's API key "the user will be derived…; source: https://developer.pagerduty.com/docs/f59fdbd94ceab-o-auth-functionality; https://pagerduty.github.io/python-pagerduty/user_guide.html
source: https://developer.pagerduty.com/docs/f59fdbd94ceab-o-auth-functionality; https://pagerduty.github.io/python-pagerduty/user_guide.html
framing: PagerDuty docs back up the token-scoping and attribution facts. The Neo multi-user attribution is inferred from how a shared org-level token works, not taken from any source.
pass3 · behavior · medium confidence
#307 ✅ Verified
content/docs/ai/neo/integrations/mcp/_index.md:118
A PagerDuty User API Token inherits the user's existing PagerDuty permissions, so its access matches whatever the user can see in the PagerDuty UI.
framing: PagerDuty's wording is "access to all data the associated user has access to." The claim restates this as "matches whatever the user can see in the UI,"…; evidence: (escalated from pass1) PagerDuty's developer docs say user API tokens "have access to all of the data that the associated user account has access to," and its support docs say requests made with a personal key "are restricted to your own…; source: https://docs.pagerduty.com/developer/authentication; https://support.pagerduty.com/main/docs/api-access-keys
source: https://docs.pagerduty.com/developer/authentication; https://support.pagerduty.com/main/docs/api-access-keys
framing: PagerDuty's wording is "access to all data the associated user has access to." The claim restates this as "matches whatever the user can see in the UI," which is a fair paraphrase. The cited marketing-web#252 was unreadable and wasn't…
pass3 · behavior · high confidence
#310 ✅ Verified
content/docs/ai/neo/integrations/mcp/_index.md:134
Supabase Access Tokens are tied to a single user account, and Supabase does not offer service-account credentials for the MCP server.
evidence: (escalated from pass1) Supabase's official docs describe the Management API/MCP credential as a personal access token tied to the user's account. Even the new scoped tokens are still personal: "A scoped personal access token's…; source: https://supabase.com/docs/guides/platform/personal-access-tokens; https://supabase.com/docs/guides/ai-tools/mcp; intuition: Negative claim ("does not offer service-account credentials") rests on not finding one. OAuth apps with a client ID…
source: https://supabase.com/docs/guides/platform/personal-access-tokens; https://supabase.com/docs/guides/ai-tools/mcp
pass3 · feature · medium confidence
#311 ✅ Verified
content/docs/ai/neo/integrations/mcp/_index.md:137
Supabase setup: on supabase.com open Account Preferences > Access Tokens, select Generate New Token, and enter the Access Token in the integration form.
evidence: (escalated from pass1) A third-party guide (Infisical) describes the same navigation: profile image → 'Account Preferences', then "In the sidebar, select 'Access Tokens'… click on 'Generate New Token'". Supabase's own MCP docs agree in…; source: https://infisical.com/docs/integrations/app-connections/supabase; https://supabase.com/docs/guides/getting-started/mcp; intuition: Supabase's scoped-PAT GA changelog (about 2 weeks old) reworked token creation and added a separate "Create legacy…
source: https://infisical.com/docs/integrations/app-connections/supabase; https://supabase.com/docs/guides/getting-started/mcp
pass3 · behavior · low confidence
#312 ✅ Verified
content/docs/ai/neo/integrations/slack/_index.md:19
To assign work to an agent your team has configured, follow [Work from Slack](/docs/ai/agents/tasks/#work-from-slack). Both use the Slack app and…
framing: The link target and anchor exist, and the section says what the claim says about it.; evidence: The target page has a "## Work from Slack" heading (anchor #work-from-slack). Under it: "Follow the [Slack installation and account-linking steps](/docs/ai/neo/integrations/slack/#setting-up-the-integration). Mention `@pulumi`... If…; source: repo:content/docs/ai/agents/tasks.md#L29-L33
source: repo:content/docs/ai/agents/tasks.md#L29-L33
framing: exact-match — The link target and anchor exist, and the section says what the claim says about it.
pass1 · url · high confidence
#313 ✅ Verified
content/docs/ai/neo/integrations/slack/_index.md:51
To contribute to a configured agent's task, each participant must link their Pulumi account and have permission to contribute. Joining a Slack channel does…
framing: The link is described as covering "agent roles and access to connected tools". The page has sections "Scope Pulumi Cloud access" (the Role field) and "Scope…; evidence: The link target exists at content/docs/ai/agents/permissions.md and covers both topics the sentence promises: "assign a Pulumi Cloud role to control access to stacks and ESC environments... Credentials for connected tools control access…; source: repo:content/docs/ai/agents/permissions.md
source: repo:content/docs/ai/agents/permissions.md
framing: exact-match — The link is described as covering "agent roles and access to connected tools". The page has sections "Scope Pulumi Cloud access" (the Role field) and "Scope credentials for connected tools".
pass1 · url · medium confidence
#314 ✅ Verified
content/docs/ai/neo/permissions/_index.md:16
To scope credentials for cloud accounts and other integrations, see [Design access around the job](/docs/ai/agents/permissions/#design-access-around-the-job).
framing: The link target and anchor resolve to a section about scoping credentials for integrations, which matches the link text. Settling this claim didn't need the…; evidence: The target page exists at content/docs/ai/agents/permissions.md, and line 16 has the heading "## Design access around the job", which produces the anchor #design-access-around-the-job. The section covers scoping credentials: "Grant the…; source: repo:content/docs/ai/agents/permissions.md L16-22
source: repo:content/docs/ai/agents/permissions.md L16-22
framing: exact-match — The link target and anchor resolve to a section about scoping credentials for integrations, which matches the link text. Settling this claim didn't need the unreadable marketing-web#252.
pass1 · url · high confidence
#315 ✅ Verified
content/docs/get-started/_index.md:74
Continue with [your coding agent](/docs/ai/coding-agents/) to write code and preview changes. Use [Pulumi Agents](/docs/ai/agents/) to investigate incidents…
evidence: Both link targets are in the repo and match the anchor text. content/docs/ai/coding-agents/_index.md is titled "Use your coding agent". content/docs/ai/agents/_index.md says agents "run in Pulumi Cloud" and handle "ongoing infrastructure…; source: repo:content/docs/ai/coding-agents/_index.md; repo:content/docs/ai/agents/_index.md
source: repo:content/docs/ai/coding-agents/_index.md; repo:content/docs/ai/agents/_index.md
framing: exact-match
pass1 · url · high confidence
#316 ✅ Verified
layouts/index.llms.txt:102
- [Infrastructure AI](https://www.pulumi.com/docs/ai/): Investigate incidents and maintain infrastructure with [Pulumi Agents](https://www.pulumi.com/docs/ai/a…
framing: The llms.txt summary closely paraphrases the card headings and descriptions on the /docs/ai/ landing page.; evidence: I checked the repo's docs content: /docs/ai/ exists and is titled "Infrastructure AI", and it links to both /docs/ai/agents/ ("Pulumi Agents... Give them ongoing responsibilities, such as investigating incidents or maintaining…; source: repo:content/docs/ai/_index.md
source: repo:content/docs/ai/_index.md
framing: exact-match — The llms.txt summary closely paraphrases the card headings and descriptions on the /docs/ai/ landing page.
pass1 · url · high confidence
#18 🤝 Matches
content/docs/ai/_index.md:32
Pulumi has a community Slack at slack.pulumi.com, a GitHub organization at github.com/pulumi, and a /support/ contact page.
evidence: L32 of the AI page matches the "Have questions?" block on the sibling content/docs/iac/_index.md L124 word for word: "reach out on <a href=\"https://slack.pulumi.com\">community Slack</a>, <a…; source: repo:content/docs/iac/_index.md L122-124; repo:content/docs/support/_index.md L54-57
source: repo:content/docs/iac/_index.md L122-124; repo:content/docs/support/_index.md L54-57
pass1 · cross-reference · high confidence
#19 🤝 Matches
content/docs/ai/_index.md:32
The /support/ page exists for contacting Pulumi support.
framing: /support/ is a redirect stub to /support/new/, not a standalone page; evidence: The repo has content/support/_index.md with front matter `redirect_to: "/support/new/"`, so the /support/ link resolves (by redirect) to the support contact form. I didn't need the unreadable pulumi/marketing-web#252 to settle this. A…; source: repo:content/support/_index.md
source: repo:content/support/_index.md
framing: /support/ is a redirect stub to /support/new/, not a standalone page
pass1 · cross-reference · medium confidence
#65 🤝 Matches
content/docs/ai/agents/create-and-manage/_index.md:17
Neo is a pre-built personal agent that uses the individual user's permissions, as distinct from agents created for an organization in Pulumi Agents.
framing: Neo page: 'pre-built personal agent ... works with your Pulumi Cloud permissions'; claim: 'pre-built personal agent that uses your permissions'; evidence: The linked Neo page agrees with this line. It says "Neo is the pre-built personal agent each user gets with Pulumi Agents. It works with your Pulumi Cloud permissions," and it contrasts Neo with agents you configure, which get a Pulumi…; source: repo:content/docs/ai/neo/_index.md L18-34
source: repo:content/docs/ai/neo/_index.md L18-34
framing: exact-match — Neo page: 'pre-built personal agent ... works with your Pulumi Cloud permissions'; claim: 'pre-built personal agent that uses your permissions'
pass1 · entity-spec · medium confidence
#67 🤝 Matches
content/docs/ai/agents/create-and-manage/_index.md:29
In Pulumi Agents, events and schedules can start agent tasks from Pulumi operations, incoming webhooks, or recurring schedules.
framing: The link description ("start tasks from Pulumi operations, incoming webhooks, or recurring schedules") lines up with the target page's meta_desc: "Start…; evidence: The link target exists, and its intro covers all three start sources: "Configure an agent to start tasks automatically when a Pulumi operation completes, an external tool sends a webhook, or a schedule runs." It has sections for Pulumi…; source: repo:content/docs/ai/agents/triggers.md
source: repo:content/docs/ai/agents/triggers.md
framing: exact-match — The link description ("start tasks from Pulumi operations, incoming webhooks, or recurring schedules") lines up with the target page's meta_desc: "Start agent tasks from Pulumi events, external webhooks, or recurring schedules".
pass1 · url · medium confidence
#111 🤝 Matches
content/docs/ai/agents/integrations.md:102
Selecting an integration for an agent does not restrict the credentials the agent has access to.
framing: Permissions page: 'Selecting an integration ... does not narrow those credentials'; claim: 'Selecting an integration does not restrict its credentials'.; evidence: The linked Permissions page agrees with this claim: "Limit each integration's credentials to the resources and actions the agent needs. Selecting an integration or adding restrictions to the agent's instructions does not narrow those…; source: repo:content/docs/ai/agents/permissions.md#L32
source: repo:content/docs/ai/agents/permissions.md#L32
framing: exact-match — Permissions page: 'Selecting an integration ... does not narrow those credentials'; claim: 'Selecting an integration does not restrict its credentials'.
pass1 · url · medium confidence
#137 🤝 Matches
content/docs/ai/agents/integrations/datadog.md:17
Pulumi's agent permissions docs include a section titled 'Design access around the job' at /docs/ai/agents/permissions/#design-access-around-the-job that…
evidence: content/docs/ai/agents/permissions.md L16 has the heading "## Design access around the job", which yields the anchor #design-access-around-the-job. The section gives shared guidance: "Grant the required actions on the relevant resources.…; source: repo:content/docs/ai/agents/permissions.md#L16-L22
source: repo:content/docs/ai/agents/permissions.md#L16-L22
framing: exact-match
pass1 · cross-reference · high confidence
#162 🤝 Matches
content/docs/ai/agents/manage.md:39
In Pulumi Agents, a manual request to an agent requires the requester to have permission to use the agent, as described in the permissions page section…
framing: Source: "a teammate needs agent_task:create and access to the agent". Claim: "permission to use the agent", a shorter summary that the source supports.; evidence: The link target exists: permissions.md L42 has the heading "## Give teammates access", which resolves to the #give-teammates-access anchor. Its text says: "To start a task, a teammate needs `agent_task:create` and access to the agent."…; source: repo:content/docs/ai/agents/permissions.md#L42-L44
source: repo:content/docs/ai/agents/permissions.md#L42-L44
framing: entailed-narrower — Source: "a teammate needs agent_task:create and access to the agent". Claim: "permission to use the agent", a shorter summary that the source supports.
pass1 · url · high confidence
#167 🤝 Matches
content/docs/ai/agents/manage.md:58
In Pulumi Agents, for tasks started by an automation, access to that automation matters for teammate view/reply access; holding the agent's role alone may…
framing: The linked page says the agent's role alone "does not grant access" to tasks from organization-owned automations. The claim's softer "may not be enough" fits…; evidence: The linked anchor exists and agrees with the claim: "For tasks started by an organization-owned automation, `agent_automations:read` grants viewing access, and `agent_automations:update` grants access to reply and approve actions.…; source: repo:content/docs/ai/agents/permissions.md#L42-L48
source: repo:content/docs/ai/agents/permissions.md#L42-L48
framing: entailed-narrower — The linked page says the agent's role alone "does not grant access" to tasks from organization-owned automations. The claim's softer "may not be enough" fits that, and also leaves room for personal schedules and task-specific grants.
pass1 · url · medium confidence
#184 🤝 Matches
content/docs/ai/agents/permissions.md:44
The page /docs/administration/concepts/rbac/roles/ documents role assignments.
evidence: The link target is at content/docs/administration/concepts/rbac/roles.md. That page has a "## Role assignment" section (L169), which says: "Roles can be assigned to organization access tokens, users, and teams." It also has subsections…; source: repo:content/docs/administration/concepts/rbac/roles.md (L169-185)
source: repo:content/docs/administration/concepts/rbac/roles.md (L169-185)
framing: exact-match
pass1 · cross-reference · high confidence
#255 🤝 Matches
content/docs/ai/neo/integrations/cli/_index.md:47
For Azure CLI integrations, the setup is to supply service principal credentials and include the Azure CLI sign-in instructions in the connection notes.
framing: This is a cross-reference summary of the linked sibling page, and the two agree. It is not checked against product source.; evidence: The summary at L47 is consistent with the linked page. The Azure integration page (content/docs/ai/agents/integrations/azure.md) says to "Use a service principal", lists AZURE_CLIENT_ID, AZURE_CLIENT_SECRET and AZURE_TENANT_ID, and…; source: repo:content/docs/ai/agents/integrations/azure.md
source: repo:content/docs/ai/agents/integrations/azure.md
framing: exact-match — This is a cross-reference summary of the linked sibling page, and the two agree. It is not checked against product source.
pass1 · url · high confidence
#257 🤝 Matches
content/docs/ai/neo/integrations/cli/_index.md:53
The Kubernetes Cluster Access guide at /docs/esc/guides/integrate-with/kubernetes-cluster-access/ walks through both the stack-output kubeconfig and static…
framing: The guide calls the static option a "hardcoded" kubeconfig, which is the same thing as the claim's "static kubeconfig".; evidence: The guide has a section on a static kubeconfig, "### Generate a kubeconfig file" ("The following environment defines a kubeconfig file to connect to a local cluster", L40-54), and one on stack outputs, "### Use stack outputs to generate…; source: repo:content/docs/esc/guides/integrate-with/kubernetes-cluster-access.md
source: repo:content/docs/esc/guides/integrate-with/kubernetes-cluster-access.md
framing: exact-match — The guide calls the static option a "hardcoded" kubeconfig, which is the same thing as the claim's "static kubeconfig".
pass1 · cross-reference · high confidence
#264 🤝 Matches
content/docs/ai/neo/integrations/cli/_index.md:75
The CLI connection form steps are provided by the `agent-cli-connection` shortcode, which must exist in the site's shortcodes.
evidence: The shortcode is at layouts/shortcodes/agent-cli-connection.html and renders partial "docs/agent-cli-connection.md". That partial exists and holds the connection steps ("Open your organization's **Agent settings** > **Integrations** >…; source: repo:layouts/shortcodes/agent-cli-connection.html; repo:layouts/partials/docs/agent-cli-connection.md
source: repo:layouts/shortcodes/agent-cli-connection.html; repo:layouts/partials/docs/agent-cli-connection.md
pass1 · cross-reference · high confidence
#277 🤝 Matches
content/docs/ai/neo/integrations/mcp/_index.md:11
The page's menu parent is ai-agents-integrations.
evidence: The MCP page's front matter has `parent: ai-agents-integrations` (weight 30). That matches its siblings: the CLI integrations page (`parent: ai-agents-integrations`, weight 20) and the "Version control" entry in config/_default/menus.yml…; source: repo:content/docs/ai/neo/integrations/mcp/_index.md L11; repo:content/docs/ai/neo/integrations/cli/_index.md L11; repo:config/_default/menus.yml L366-370; repo:content/docs/ai/agents/integrations/datadog.md L9
source: repo:content/docs/ai/neo/integrations/mcp/_index.md L11; repo:content/docs/ai/neo/integrations/cli/_index.md L11; repo:config/_default/menus.yml L366-370; repo:content/docs/ai/agents/integrations/datadog.md L9
pass1 · cross-reference · high confidence
#287 🤝 Matches
content/docs/ai/neo/integrations/mcp/_index.md:41
For tasks started from a configured agent, MCP integrations are selected in the agent configuration (section 'Connect the tools it needs' of…
framing: The target page says the selection is saved with the agent and that integrations connected later must be added by editing the agent. The claim's "applies…; evidence: The cross-reference matches its target page. The section exists (configure.md L46, "## Connect the tools it needs") and says: "Expand the integrations selector beside **System prompt** and select the connected MCP services the agent…; source: repo:content/docs/ai/agents/configure.md#L46-L52
source: repo:content/docs/ai/agents/configure.md#L46-L52
framing: entailed-narrower — The target page says the selection is saved with the agent and that integrations connected later must be added by editing the agent. The claim's "applies across that agent's tasks" follows from this, but the page doesn't say it outright.
pass1 · url · medium confidence
#102 ➖ Not a claim
content/docs/ai/agents/integrations.md:64
- name: New Relic
framing: Regex false positive: the word 'New' is part of the proper noun 'New Relic'.; evidence: The regex matched the word "New" as a temporal marker, but "New Relic" is the name of a vendor (the observability company) in an integrations list entry. It says nothing about when anything happened, so there is no temporal assertion to…; source: content/docs/ai/agents/integrations.md L64 (claim text itself)
source: content/docs/ai/agents/integrations.md L64 (claim text itself)
framing: Regex false positive: the word 'New' is part of the proper noun 'New Relic'.
pass1 · temporal · high confidence
#302 ➖ Not a claim
content/docs/ai/neo/integrations/mcp/_index.md:104
### New Relic
evidence: The flagged text is just the section heading "### New Relic", which names the vendor New Relic. The regex caught the word "New", but the line makes no recency or other checkable assertion. The unreadable pulumi/marketing-web#252 isn't…; source: content/docs/ai/neo/integrations/mcp/_index.md L104
source: content/docs/ai/neo/integrations/mcp/_index.md L104
pass1 · temporal · high confidence
#317 ➖ Not a claim
static/logos/agents/atlassian.svg:1
<svg width="32" height="32" viewBox="0 0 32 32" fill="none" xmlns="http://www.w3.org/2000/svg">
framing: Regex picked up the SVG namespace URI as a URL. It's markup metadata, not a citation.; evidence: The string "http://www.w3.org/2000/svg" is the standard SVG XML namespace identifier in an xmlns attribute. It isn't a cited source or a link that makes a factual assertion, so there's nothing to check. The unreadable…; source: static/logos/agents/atlassian.svg:L1 (xmlns namespace attribute)
source: static/logos/agents/atlassian.svg:L1 (xmlns namespace attribute)
framing: Regex picked up the SVG namespace URI as a URL. It's markup metadata, not a citation.
pass3 · url · high confidence
#318 ➖ Not a claim
static/logos/agents/cloudflare.svg:1
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32" width="64" height="64"><path d="M8.16 23h21.177v-5.86l-4.023-2.307-.694-.3-16.46.113z"…
framing: The xmlns namespace identifier was matched by the regex as a source_hint, but it is not a citation.; evidence: This is raw SVG markup for a logo asset. The numbers are path coordinates, viewBox values and dimensions, and the w3.org URL is the standard SVG XML namespace, not a cited source. Nothing here can be checked as true or false.; source: static/logos/agents/cloudflare.svg:L1
source: static/logos/agents/cloudflare.svg:L1
framing: The xmlns namespace identifier was matched by the regex as a source_hint, but it is not a citation.
pass3 · numerical · high confidence
#319 ➖ Not a claim
static/logos/agents/dash0.svg:1
<svg role="img" width="128" height="128" viewBox="0 0 128 128" fill="none" xmlns="http://www.w3.org/2000/svg">
framing: xmlns namespace URI is an identifier, not a cited source; evidence: The "URL" is the standard SVG XML namespace identifier (xmlns="http://www.w3.org/2000/svg") on the root element of a logo file. It is markup boilerplate, not a citation or a factual assertion, so there is nothing to check. The unreadable…; source: static/logos/agents/dash0.svg:L1
source: static/logos/agents/dash0.svg:L1
framing: xmlns namespace URI is an identifier, not a cited source
pass3 · url · high confidence
#320 ➖ Not a claim
static/logos/agents/datadog-on-dark.svg:1
<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>Datadog</title><path fill="white" d="M19.57 17.04l-1.997-1.316-1.665…
evidence: This "claim" is SVG path markup for a Datadog logo asset. Its numbers are vector coordinates, and the xmlns URL is the standard SVG namespace identifier. Nothing in it is a factual assertion that could be checked or proven false.; source: static/logos/agents/datadog-on-dark.svg:L1 (asset markup; regex false positive on path coordinates and the xmlns namespace)
source: static/logos/agents/datadog-on-dark.svg:L1 (asset markup; regex false positive on path coordinates and the xmlns namespace)
pass3 · numerical · high confidence
#321 ➖ Not a claim
static/logos/agents/datadog.svg:1
<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>Datadog</title><path d="M19.57 17.04l-1.997-1.316-1.665 2.782-1.937-.567-1.706…
framing: The regex matched path coordinates and the SVG namespace URI. Neither one is a claim that can be checked.; evidence: This is the path data and XML namespace from an SVG logo file (looks like the Simple Icons Datadog glyph). The numbers are drawing coordinates, not a factual claim, and the xmlns URL is the standard SVG namespace identifier, not a citation.; source: static/logos/agents/datadog.svg:L1 (SVG asset markup)
source: static/logos/agents/datadog.svg:L1 (SVG asset markup)
framing: The regex matched path coordinates and the SVG namespace URI. Neither one is a claim that can be checked.
pass3 · numerical · high confidence
#322 ➖ Not a claim
static/logos/agents/honeycomb.svg:1
<svg width="51" height="48" viewBox="0 0 51 48" fill="none" xmlns="http://www.w3.org/2000/svg">
framing: xmlns namespace URI is an identifier, not a cited source; the unreadable pulumi/marketing-web#252 isn't needed to settle this.; evidence: The "URL" is the standard SVG XML namespace identifier (xmlns="http://www.w3.org/2000/svg") in a logo asset's root element. It is a namespace declaration, not a citation or a factual assertion, so there is nothing to fact-check.; source: static/logos/agents/honeycomb.svg:L1 (SVG namespace declaration)
source: static/logos/agents/honeycomb.svg:L1 (SVG namespace declaration)
framing: xmlns namespace URI is an identifier, not a cited source; the unreadable pulumi/marketing-web#252 isn't needed to settle this.
pass3 · url · high confidence
#323 ➖ Not a claim
static/logos/agents/linear-on-dark.svg:1
<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>Linear</title><path fill="white" d="M2.886 4.18A11.982 11.982 0 0 1 11.99…
framing: The regex extractor flagged path coordinates and the xmlns namespace URI as a numerical claim and a source. Neither one is an assertion.; evidence: This is raw SVG markup for a logo asset (the Linear icon). The numbers are path coordinates and the URL is the standard SVG XML namespace identifier, not a cited source. Nothing here can be checked as true or false.; source: static/logos/agents/linear-on-dark.svg:L1 (SVG markup; xmlns="http://www.w3.org/2000/svg" is a namespace URI)
source: static/logos/agents/linear-on-dark.svg:L1 (SVG markup; xmlns="http://www.w3.org/2000/svg" is a namespace URI)
framing: The regex extractor flagged path coordinates and the xmlns namespace URI as a numerical claim and a source. Neither one is an assertion.
pass3 · numerical · high confidence
#324 ➖ Not a claim
static/logos/agents/linear.svg:1
<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>Linear</title><path fill="currentColor" d="M2.886 4.18A11.982 11.982 0 0 1…
framing: The regex flagged numeric path data in an image file. http://www.w3.org/2000/svg is an XML namespace identifier, not a citation.; evidence: This line is the SVG markup for the Linear logo asset. The numbers are path coordinates and the viewBox size, not factual assertions. The "source" is just the standard SVG XML namespace (xmlns), not a cited reference.; source: static/logos/agents/linear.svg:L1
source: static/logos/agents/linear.svg:L1
framing: The regex flagged numeric path data in an image file. http://www.w3.org/2000/svg is an XML namespace identifier, not a citation.
pass3 · numerical · high confidence
#325 ➖ Not a claim
static/logos/agents/newrelic.svg:1
<svg role="img" viewBox="0 0 159.36 159.36" xmlns="http://www.w3.org/2000/svg">
framing: SVG namespace declaration, not a cited source; evidence: The "URL" is the standard SVG XML namespace identifier (xmlns="http://www.w3.org/2000/svg") in a logo file's root element. It's a namespace URI, not a citation or factual assertion, so there is nothing to fact-check.; source: static/logos/agents/newrelic.svg:L1
source: static/logos/agents/newrelic.svg:L1
framing: SVG namespace declaration, not a cited source
pass3 · url · high confidence
#326 ➖ Not a claim
static/logos/agents/pagerduty-on-dark.svg:1
<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>PagerDuty</title><path fill="white" d="M16.965 1.18C15.085.164 13.769 0 10.683…
framing: The xmlns 'http://www.w3.org/2000/svg' is an XML namespace identifier, not a cited source.; evidence: This line is SVG markup for a logo asset (the PagerDuty icon path data and the standard SVG namespace URI). The regex caught the path coordinates and the xmlns namespace, but neither is a factual or numerical assertion.; source: static/logos/agents/pagerduty-on-dark.svg:L1
source: static/logos/agents/pagerduty-on-dark.svg:L1
framing: The xmlns 'http://www.w3.org/2000/svg' is an XML namespace identifier, not a cited source.
pass3 · numerical · high confidence
#327 ➖ Not a claim
static/logos/agents/pagerduty.svg:1
<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>PagerDuty</title><path d="M16.965 1.18C15.085.164 13.769 0 10.683…
framing: The regex extractor matched digits in the SVG path coordinates and treated the XML namespace URI as a source hint.; evidence: This is SVG path data for a logo asset (the PagerDuty icon). The numbers are drawing coordinates, not a factual numerical claim. The xmlns URL is the standard SVG namespace identifier, not a cited source.; source: static/logos/agents/pagerduty.svg:L1
source: static/logos/agents/pagerduty.svg:L1
framing: The regex extractor matched digits in the SVG path coordinates and treated the XML namespace URI as a source hint.
pass3 · numerical · high confidence
#328 ➖ Not a claim
static/logos/agents/sentry-on-dark.svg:1
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 50 50"><path fill="white" d="M29,2.26a4.67,4.67,0,0,0-8,0L14.42,13.53A32.21,32.21,0,0,1,32.17,40.19H27.55A…
framing: The http://www.w3.org/2000/svg source hint is the standard SVG XML namespace identifier, not a citation.; evidence: This line is raw SVG markup for a logo asset: the xmlns namespace URI and the path coordinates. The regex matched those numbers, but none of them is a falsifiable numerical claim. The unreadable pulumi/marketing-web#252 isn't needed to…; source: static/logos/agents/sentry-on-dark.svg:L1
source: static/logos/agents/sentry-on-dark.svg:L1
framing: The http://www.w3.org/2000/svg source hint is the standard SVG XML namespace identifier, not a citation.
pass3 · numerical · high confidence
#329 ➖ Not a claim
static/logos/agents/sentry.svg:1
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 50 50"><path fill="#181225" d="M29,2.26a4.67,4.67,0,0,0-8,0L14.42,13.53A32.21,32.21,0,0,1,32.17,40.19H27.5…
framing: The source_hint is the standard SVG XML namespace identifier, not a citation.; evidence: This line is SVG markup for a logo asset: a namespace URI, viewBox values, and path coordinates. The regex picked up numbers from the path data and the xmlns namespace string. None of that is a falsifiable factual assertion.; source: static/logos/agents/sentry.svg:L1
source: static/logos/agents/sentry.svg:L1
framing: The source_hint is the standard SVG XML namespace identifier, not a citation.
pass3 · numerical · high confidence
#330 ➖ Not a claim
static/logos/agents/supabase-on-dark.svg:1
<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>Supabase</title><path fill="white" d="M11.9…
framing: The regex matched path coordinates and the xmlns namespace URI. Neither one is an assertion.; evidence: This line is SVG markup for a logo asset. The numbers are path coordinates, and http://www.w3.org/2000/svg is the standard SVG XML namespace, not a cited source. Nothing in it can be checked as true or false.; source: repo:static/logos/agents/supabase-on-dark.svg (L1, SVG path data; xmlns namespace URI)
source: repo:static/logos/agents/supabase-on-dark.svg (L1, SVG path data; xmlns namespace URI)
framing: The regex matched path coordinates and the xmlns namespace URI. Neither one is an assertion.
pass3 · numerical · high confidence
#331 ➖ Not a claim
static/logos/agents/supabase.svg:1
<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>Supabase</title><path d="M11.9 1.036c-.015-.986-1.26-1.41-1.874-.637L.764…
framing: The xmlns URI is a namespace identifier, not a citation.; evidence: This line is SVG path markup for a logo asset. A regex picked up the numbers in the viewBox and path coordinates and the xmlns namespace URI, but none of them is a factual assertion that can be checked. The xmlns value is just the…; source: static/logos/agents/supabase.svg:L1 (asset markup)
source: static/logos/agents/supabase.svg:L1 (asset markup)
framing: The xmlns URI is a namespace identifier, not a citation.
pass3 · numerical · high confidence
#332 ➖ Not a claim
static/logos/pkg/aws-on-dark.svg:1
<svg width="118" height="70" viewBox="0 0 118 70" fill="none" xmlns="http://www.w3.org/2000/svg">
evidence: The "URL" is the standard SVG XML namespace identifier (xmlns="http://www.w3.org/2000/svg") inside an SVG logo file's root element. It is markup boilerplate, not a cited source or a falsifiable assertion, so the unreadable…; source: static/logos/pkg/aws-on-dark.svg:L1 (SVG namespace declaration)
source: static/logos/pkg/aws-on-dark.svg:L1 (SVG namespace declaration)
pass3 · url · high confidence
#333 ➖ Not a claim
static/logos/tech/github-on-dark.svg:1
<svg width="100" height="98" viewBox="0 0 100 98" fill="none" xmlns="http://www.w3.org/2000/svg">
framing: The regex matched an XML namespace declaration, not a cited source.; evidence: The "URL" is the standard SVG XML namespace identifier (xmlns="http://www.w3.org/2000/svg") in an SVG logo file's root element. It is a namespace URI, not a citation or a falsifiable assertion, so nothing needs to be verified, and the…; source: static/logos/tech/github-on-dark.svg:L1
source: static/logos/tech/github-on-dark.svg:L1
framing: The regex matched an XML namespace declaration, not a cited source.
pass3 · url · high confidence
#20 🤷 Unverifiable
content/docs/ai/agents/_index.md:4
Pulumi Agents can be a pre-built agent or a custom-built agent, used to take on ongoing infrastructure responsibilities such as investigating incidents or…
evidence: The page says "Use a pre-built agent or build your own to take on ongoing infrastructure responsibilities, such as investigating incidents or maintaining dependencies." The only independent source I could check was…; source: repo:data/pulumi_editions.yaml (pulumi-agents entry); content/docs/ai/agents/_index.md L15 (the reviewed file, so it can't count as evidence); intuition: This is a hidden, unreleased Pulumi Cloud feature, so its details probably live in the private pulumi-service repo or…
source: repo:data/pulumi_editions.yaml (pulumi-agents entry); content/docs/ai/agents/_index.md L15 (the reviewed file, so it can't count as evidence)
pass1 · feature · low confidence
#21 🤷 Unverifiable
content/docs/ai/agents/_index.md:15
Pulumi Agents can be pre-built agents or custom-built agents that take on ongoing infrastructure responsibilities such as investigating incidents or…
framing: The claim is consistent with the sibling docs, but no independent product source was available.; evidence: I couldn't check this against product source. The claim agrees with the sibling page configure.md, whose table lists the pre-built agents "Incident investigation | Investigates outages..." and "Upgrade maintenance | Assesses provider and…; source: repo:content/docs/ai/agents/configure.md L25-33; repo:data/pulumi_editions.yaml L190-193; gh search code hit HTTP 429 (rate limit)
source: repo:content/docs/ai/agents/configure.md L25-33; repo:data/pulumi_editions.yaml L190-193; gh search code hit HTTP 429 (rate limit)
framing: The claim is consistent with the sibling docs, but no independent product source was available.
pass1 · feature · medium confidence
#24 🤷 Unverifiable
content/docs/ai/agents/_index.md:29
Custom Pulumi agents can be given runbooks and access to relevant logs, resources, and repositories.
evidence: The sibling docs page content/docs/ai/agents/custom.md agrees with the claim ("give the agent access to checkout logs, relevant cloud resources, and the repository containing its code and runbook"), but it is editorial same-site content…; source: repo:content/docs/ai/agents/custom.md L45-51; gh search code --owner pulumi "runbook agent" (HTTP 429)
source: repo:content/docs/ai/agents/custom.md L45-51; gh search code --owner pulumi "runbook agent" (HTTP 429)
pass1 · feature · medium confidence
#31 🤷 Unverifiable
content/docs/ai/agents/configure.md:15
Pulumi Agents pre-built agents include instructions for common infrastructure work, and users can edit those instructions and choose which tools and…
evidence: The only source I could find for this is the reviewed page itself ("Pre-built agents include instructions for common infrastructure work. You can edit those instructions and choose which tools and resources the agent can access."), and a…; source: repo:content/docs/ai/agents/configure.md (reviewed file, not independent); gh search code rate-limited; pulumi/marketing-web#252 unreadable
source: repo:content/docs/ai/agents/configure.md (reviewed file, not independent); gh search code rate-limited; pulumi/marketing-web#252 unreadable
pass1 · feature · low confidence
#32 🤷 Unverifiable
content/docs/ai/agents/configure.md:19
The Pulumi Agents setup flow requires connecting a version control provider and granting access to relevant repositories, while other tools can be connected…
framing: The link target is generic VCS integration docs. It doesn't address whether the Agents flow requires a VCS connection.; evidence: The linked /docs/integrations/version-control/ page lists VCS integration capabilities (PR previews, push-to-deploy, repository discovery) but says nothing about Pulumi Agents setup requiring a VCS connection. Product source for the…; source: repo:content/docs/integrations/version-control/_index.md; gh search code (HTTP 429)
source: repo:content/docs/integrations/version-control/_index.md; gh search code (HTTP 429)
framing: The link target is generic VCS integration docs. It doesn't address whether the Agents flow requires a VCS connection.
pass1 · url · low confidence
#33 🤷 Unverifiable
content/docs/ai/agents/configure.md:23
In the Pulumi Agents agent catalog, choosing an agent and selecting 'Set up agent' opens a form with the agent's name, description, instructions, and…
evidence: This describes Pulumi Cloud UI behavior: a "Set up agent" button in the agent catalog that opens a pre-filled form. The UI source is private, and the cited change pulumi/marketing-web#252 couldn't be read (the repository returned 404).…; source: gh search code --owner pulumi "Set up agent" (HTTP 429); repo:content/docs/ai/agents/configure.md L23 (reviewed file, not evidence)
source: gh search code --owner pulumi "Set up agent" (HTTP 429); repo:content/docs/ai/agents/configure.md L23 (reviewed file, not evidence)
pass1 · behavior · low confidence
#34 🤷 Unverifiable
content/docs/ai/agents/configure.md:25
The Pulumi Agents catalog includes six pre-built agents: Incident investigation, Deployment troubleshooting, Drift response, Upgrade maintenance, Security…
evidence: The only place I found the six-agent list (Incident investigation, Deployment troubleshooting, Drift response, Upgrade maintenance, Security remediation, Infrastructure migration) is the reviewed file itself (L25-32), and that can't…; source: repo:content/docs/ai/agents/configure.md L25-32 (claim's own file); gh search code --owner pulumi "Deployment troubleshooting agent" (HTTP 429); github.com/pulumi/marketing-web/pull/252 (unreadable)
source: repo:content/docs/ai/agents/configure.md L25-32 (claim's own file); gh search code --owner pulumi "Deployment troubleshooting agent" (HTTP 429); github.com/pulumi/marketing-web/pull/252 (unreadable)
pass1 · feature · low confidence
#35 🤷 Unverifiable
content/docs/ai/agents/configure.md:27
The Incident investigation pre-built agent investigates outages and service degradation, explains likely causes, and prepares fixes.
evidence: I couldn't confirm this catalog description from any independent source. The only other mention is a sibling docs page, which says "Pulumi provides agents for incident investigation, drift response, deployment troubleshooting". It names…; source: repo:content/docs/ai/agents/_index.md L23; gh search code (HTTP 429); pulumi/marketing-web#252 (unreadable)
source: repo:content/docs/ai/agents/_index.md L23; gh search code (HTTP 429); pulumi/marketing-web#252 (unreadable)
pass1 · feature · low confidence
#36 🤷 Unverifiable
content/docs/ai/agents/configure.md:28
The Deployment troubleshooting pre-built agent diagnoses failed Pulumi previews, updates, and deployments, including operations in external pipelines.
evidence: I couldn't find an independent source for what the pre-built agent covers. The sibling page content/docs/ai/agents/_index.md mentions "deployment troubleshooting" but not "external pipelines", and GitHub code search returned HTTP 429…; source: repo:content/docs/ai/agents/_index.md; gh search code --owner pulumi "Deployment troubleshooting external pipelines" (HTTP 429); intuition: The "including operations in external pipelines" scope is the specific part to check against the agent catalog…
source: repo:content/docs/ai/agents/_index.md; gh search code --owner pulumi "Deployment troubleshooting external pipelines" (HTTP 429)
pass1 · feature · low confidence
#37 🤷 Unverifiable
content/docs/ai/agents/configure.md:29
The Drift response pre-built agent compares drift with declared configuration and helps resolve the difference.
evidence: Only same-site docs mention the agent (_index.md L23: "Pulumi provides agents for incident investigation, drift response, deployment troubleshooting…"), and they don't describe what the Drift response agent does. The pre-built agent…; source: repo:content/docs/ai/agents/_index.md; gh search code --owner pulumi "Drift response" (HTTP 429)
source: repo:content/docs/ai/agents/_index.md; gh search code --owner pulumi "Drift response" (HTTP 429)
pass1 · feature · low confidence
#38 🤷 Unverifiable
content/docs/ai/agents/configure.md:30
The Upgrade maintenance pre-built agent assesses provider and infrastructure-component upgrades and prepares code changes.
evidence: The only place I found this description is the reviewed file itself (configure.md L30 table row), and that file can't count as evidence for its own claim. The pre-built agent catalog is defined in Pulumi Cloud product source, which I…; source: read_file content/docs/ai/agents/configure.md; gh search code --owner pulumi "Upgrade maintenance" (HTTP 429)
source: read_file content/docs/ai/agents/configure.md; gh search code --owner pulumi "Upgrade maintenance" (HTTP 429)
pass1 · feature · low confidence
#40 🤷 Unverifiable
content/docs/ai/agents/configure.md:40
The Pulumi Agents setup form has a 'System prompt' field where the agent's job, information to use, and expected result are described.
evidence: The 'System prompt' field label comes from the Pulumi Cloud console setup form, and that UI source isn't public. A GitHub code search was rate-limited (HTTP 429). The cited change, pulumi/marketing-web#252, returns 404 to these…; source: repo:content/docs/ai/agents/configure.md L40 (reviewed file only); gh search code rate-limited; pulumi/marketing-web#252 unreadable
source: repo:content/docs/ai/agents/configure.md L40 (reviewed file only); gh search code rate-limited; pulumi/marketing-web#252 unreadable
pass1 · api-surface · low confidence
#41 🤷 Unverifiable
content/docs/ai/agents/configure.md:44
In Pulumi Agents, saved agent instructions replace the organization's AI preference instructions rather than being added to them.
evidence: I couldn't find an independent source for this. The only other statement of it is a sibling page in this same PR (custom.md L47: "Saved agent instructions replace your organization's AI preference instructions"), and that can't serve as…; source: repo:content/docs/ai/agents/custom.md#L47; gh search code --owner pulumi "AI preference instructions" (HTTP 429); intuition: Replacing, rather than adding to, the org-level instructions is a notable behavior that a product engineer should…
source: repo:content/docs/ai/agents/custom.md#L47; gh search code --owner pulumi "AI preference instructions" (HTTP 429)
pass1 · behavior · low confidence
#42 🤷 Unverifiable
content/docs/ai/agents/configure.md:44
In Pulumi Agents, instructions guide the agent's work, while roles and credentials determine what it can access.
evidence: The only support is in Pulumi's own docs. The sibling page permissions.md says the same thing: "Selecting an integration or adding restrictions to the agent's instructions does not narrow those credentials" and "Approving an action does…; source: repo:content/docs/ai/agents/permissions.md L14-L38; pulumi/marketing-web#252 (unreadable); intuition: The claim fits a sensible least-privilege design and matches the sibling pages, so it is probably accurate. But it…
source: repo:content/docs/ai/agents/permissions.md L14-L38; pulumi/marketing-web#252 (unreadable)
pass1 · behavior · low confidence
#43 🤷 Unverifiable
content/docs/ai/agents/configure.md:48
The Pulumi Agents setup form has an integrations selector beside the 'System prompt' field for selecting connected MCP services.
evidence: The claim is about how the Pulumi Cloud Agents setup form is laid out: an integrations selector next to the 'System prompt' field. The Pulumi Cloud console source is private, so I couldn't check it. The only implementing change this PR…; source: repo:content/docs/ai/agents/configure.md L46-52 (reviewed file, read for context only; not used as evidence); github.com/pulumi/marketing-web/pull/252 (unreadable)
source: repo:content/docs/ai/agents/configure.md L46-52 (reviewed file, read for context only; not used as evidence); github.com/pulumi/marketing-web/pull/252 (unreadable)
pass1 · api-surface · low confidence
#44 🤷 Unverifiable
content/docs/ai/agents/configure.md:50
Creating a Pulumi Agents agent saves the selected MCP integrations; integrations connected later must be added by editing the agent and adding them to its…
evidence: I couldn't check this claim. It describes how the closed-source Pulumi Cloud Agents UI saves MCP integrations, and none of the public pulumi/* repos I can read contain that code. The PR's cited implementing change…; source: github.com/pulumi/marketing-web/pull/252 (unreadable); Pulumi Cloud service source is not public
source: github.com/pulumi/marketing-web/pull/252 (unreadable); Pulumi Cloud service source is not public
pass1 · behavior · low confidence
#45 🤷 Unverifiable
content/docs/ai/agents/configure.md:52
The Pulumi Agents setup form offers a 'Manage integrations' option for connecting a missing service, and an administrator can also connect it.
framing: The source_hint page covers setup requirements but says nothing about the UI button label or the administrator path.; evidence: The cited /docs/ai/agents/integrations/ page never mentions a "Manage integrations" option or administrators connecting services. The UI label comes from the private Pulumi Cloud console, and the cited implementing change…; source: repo:content/docs/ai/agents/integrations.md; gh search code --owner pulumi "Manage integrations" (HTTP 429)
source: repo:content/docs/ai/agents/integrations.md; gh search code --owner pulumi "Manage integrations" (HTTP 429)
framing: The source_hint page covers setup requirements but says nothing about the UI button label or the administrator path.
pass1 · api-surface · low confidence
#47 🤷 Unverifiable
content/docs/ai/agents/configure.md:56
In Pulumi Agents, documents can be referenced in the instructions by path or URL, but the agent also needs access to the repository or tool holding them; a…
evidence: The only source for this claim is the reviewed page itself (L56: "The agent also needs access to the repository or tool that holds them; a link alone does not grant access."), and that can't be used to verify itself. Pulumi Agents'…; source: repo:content/docs/ai/agents/configure.md L56; gh search code --owner pulumi "link alone does not grant" (HTTP 429); pulumi/marketing-web#252 (unreadable); intuition: This is plausible: access depends on the agent's role and its integrations, and the page says the same at L44. But it…
source: repo:content/docs/ai/agents/configure.md L56; gh search code --owner pulumi "link alone does not grant" (HTTP 429); pulumi/marketing-web#252 (unreadable)
pass1 · behavior · low confidence
#48 🤷 Unverifiable
content/docs/ai/agents/configure.md:62
The Pulumi Agents setup form has a 'Default mode' setting controlling when the agent asks for approval, and in 'Auto' mode actions do not require the user's…
framing: The Neo docs only back up the general Auto approval-mode behavior, not the Agents setup form's 'Default mode' field. The unreadable pulumi/marketing-web#252…; evidence: I couldn't check the 'Default mode' label on the Pulumi Agents setup form against product source. The console UI is closed-source, the cited pulumi/marketing-web#252 returns 404 to these credentials, and the sibling permissions.md page…; source: repo:content/docs/ai/neo/permissions/_index.md L73-86; repo:content/docs/ai/agents/permissions.md L38
source: repo:content/docs/ai/neo/permissions/_index.md L73-86; repo:content/docs/ai/agents/permissions.md L38
framing: The Neo docs only back up the general Auto approval-mode behavior, not the Agents setup form's 'Default mode' field. The unreadable pulumi/marketing-web#252 might settle the label.
pass1 · behavior · medium confidence
#50 🤷 Unverifiable
content/docs/ai/agents/configure.md:67
In Pulumi Agents, the Role can be set to 'Member' or a custom role, provided its permissions do not exceed the user's own.
framing: The cited /docs/ai/agents/permissions/ page talks about scoping the agent's role but says nothing about 'Member' or a rule that the role can't exceed the…; evidence: I couldn't find a readable source that confirms you can pick Member or a custom role only if its permissions don't exceed your own. The cited permissions page covers roles in general ("Select a role in the agent's **Role** field that…; source: repo:content/docs/ai/agents/permissions.md (L14-L44); gh search code/prs --owner pulumi (code search returned HTTP 429 rate limit; the PR search returned nothing)
source: repo:content/docs/ai/agents/permissions.md (L14-L44); gh search code/prs --owner pulumi (code search returned HTTP 429 rate limit; the PR search returned nothing)
framing: overclaim-broader — The cited /docs/ai/agents/permissions/ page talks about scoping the agent's role but says nothing about 'Member' or a rule that the role can't exceed the user's own permissions.
pass1 · url · low confidence
#51 🤷 Unverifiable
content/docs/ai/agents/configure.md:71
The Pulumi Agents setup form has a 'How do you want to invoke this agent?' question with options 'Manually' and 'Configure a trigger'; 'Manually' assigns…
evidence: I couldn't check the claim against any source other than the page under review. The UI strings ('How do you want to invoke this agent?', 'Manually', 'Configure a trigger') appear to come from the Pulumi Cloud frontend, which I believe is…; source: gh search code --owner pulumi "How do you want to invoke this agent" (HTTP 429); repo:content/docs/ai/agents/configure.md L71-74 (page under review, not evidence)
source: gh search code --owner pulumi "How do you want to invoke this agent" (HTTP 429); repo:content/docs/ai/agents/configure.md L71-74 (page under review, not evidence)
pass1 · api-surface · low confidence
#52 🤷 Unverifiable
content/docs/ai/agents/configure.md:74
In Pulumi Agents, 'Configure a trigger' starts tasks from Pulumi operations, external webhooks, or a recurring schedule, and selecting 'Continue' proceeds to…
evidence: The UI labels in the claim ("Configure a trigger", "Continue", the three trigger sources) come from the Pulumi Cloud console, and I couldn't read its source: GitHub code search returned HTTP 429, and the cited pulumi/marketing-web#252…; source: repo:content/docs/ai/agents/triggers.md L6,L15; gh search code "How do you want to invoke this agent" (HTTP 429)
source: repo:content/docs/ai/agents/triggers.md L6,L15; gh search code "How do you want to invoke this agent" (HTTP 429)
pass1 · feature · low confidence
#53 🤷 Unverifiable
content/docs/ai/agents/configure.md:76
The Pulumi Agents trigger step has a 'Trigger preset' choice, event filters or schedule settings, and an expandable 'Task instructions and context' section…
evidence: The claim describes Pulumi Cloud console UI labels: 'Trigger preset', 'Task instructions and context', 'Trigger name', 'Prompt' and 'Create agent'. That console code isn't public. The code search for "Trigger preset" hit HTTP 429 (rate…; source: gh search code --owner pulumi "Trigger preset" (HTTP 429); pulumi/marketing-web#252 unreadable
source: gh search code --owner pulumi "Trigger preset" (HTTP 429); pulumi/marketing-web#252 unreadable
pass1 · api-surface · low confidence
#55 🤷 Unverifiable
content/docs/ai/agents/configure.md:82
In Pulumi Agents, for a webhook trigger the connection steps are shown after saving the agent and must be finished.
evidence: This claim describes UI behavior in Pulumi Cloud's Agents product, which isn't open source. I couldn't find a public source that confirms it: code search returned HTTP 429 (rate-limited), and the cited…; source: gh search code --owner pulumi "webhook trigger agent connection steps" (HTTP 429); github.com/pulumi/marketing-web/pull/252 (unreadable)
source: gh search code --owner pulumi "webhook trigger agent connection steps" (HTTP 429); github.com/pulumi/marketing-web/pull/252 (unreadable)
pass1 · behavior · low confidence
#56 🤷 Unverifiable
content/docs/ai/agents/configure.md:84
The Pulumi Agents agent page has a 'Describe the task for this agent' field for entering an assignment.
evidence: The field label 'Describe the task for this agent' is a Pulumi Cloud console UI string. That UI source is private, the cited pulumi/marketing-web#252 can't be read here, and the GitHub code search returned HTTP 429 (rate limited). Only…; source: gh search code --owner pulumi "Describe the task for this agent" (HTTP 429); repo:content/docs/ai/agents/configure.md L84
source: gh search code --owner pulumi "Describe the task for this agent" (HTTP 429); repo:content/docs/ai/agents/configure.md L84
pass1 · api-surface · low confidence
#58 🤷 Unverifiable
content/docs/ai/agents/configure.md:90
The Pulumi Agents agent page has an 'Edit' control for changing an existing agent.
evidence: The claimed "Edit" button on the agent page is part of the Pulumi Cloud UI, and that UI code is not in any public repo I could read. The code search was rate-limited (HTTP 429). The cited pulumi/marketing-web#252 can't be read (404), and…; source: gh search code --owner pulumi (HTTP 429); repo:content/docs/ai/agents/configure.md L88-90
source: gh search code --owner pulumi (HTTP 429); repo:content/docs/ai/agents/configure.md L88-90
pass1 · api-surface · low confidence
#62 🤷 Unverifiable
content/docs/ai/agents/create-and-manage/_index.md:15
In Pulumi Agents, teammates can assign tasks to an agent without repeating the agent's setup.
evidence: The sibling doc content/docs/ai/agents/tasks.md agrees with the claim ("The task uses the agent's saved configuration."), but it is same-site editorial content, not ground truth. Pulumi Agents is implemented in private Pulumi Cloud…; source: repo:content/docs/ai/agents/tasks.md; gh search code --owner pulumi "Pulumi Agents saved instructions" (HTTP 429)
source: repo:content/docs/ai/agents/tasks.md; gh search code --owner pulumi "Pulumi Agents saved instructions" (HTTP 429)
pass1 · behavior · low confidence
#63 🤷 Unverifiable
content/docs/ai/agents/create-and-manage/_index.md:15
In Pulumi Agents, you can start with a pre-built agent or write your own custom instructions for an agent.
framing: Only the custom-instructions half is backed by public sources. The pre-built-agent half needs a check against Pulumi Cloud product source.; evidence: (escalated from pass1) Pulumi's generated REST API schema shows Custom Agent definitions with editable instructions: "Optional Custom Agent definition id to run this task as" (a "preview capability, gated per organization"). I found no…; source: https://www.pulumi.com/docs/reference/cloud-rest-api/schema/createagenttaskrequest/; WebSearch ran query "Pulumi Agents pre-built agent custom instructions"
source: https://www.pulumi.com/docs/reference/cloud-rest-api/schema/createagenttaskrequest/; WebSearch ran query "Pulumi Agents pre-built agent custom instructions"
framing: Only the custom-instructions half is backed by public sources. The pre-built-agent half needs a check against Pulumi Cloud product source.
pass3 · feature · low confidence
#64 🤷 Unverifiable
content/docs/ai/agents/create-and-manage/_index.md:15
Pulumi Agents supports starting with a pre-built agent or writing your own custom instructions for an agent.
evidence: I couldn't find an independent source to check this against. The reviewed page itself says "Start with a pre-built agent or write your own instructions", but a page can't verify its own claim. The linked custom-agent page…; source: repo:content/docs/ai/agents/create-and-manage/_index.md (the reviewed page, not used as evidence); gh search code --owner pulumi "pre-built agent" (HTTP 429); intuition: The page links to /docs/ai/agents/custom/, but no content/docs/ai/agents/custom/_index.md exists in the repo. The…
source: repo:content/docs/ai/agents/create-and-manage/_index.md (the reviewed page, not used as evidence); gh search code --owner pulumi "pre-built agent" (HTTP 429)
pass1 · feature · low confidence
#68 🤷 Unverifiable
content/docs/ai/agents/create-and-manage/_index.md:33
Pulumi agents can be edited, paused, or deleted.
evidence: The sibling page content/docs/ai/agents/manage.md agrees ("Edit, pause, or delete an agent"), and it describes Edit, Pause/Resume, and Delete buttons. But it is a same-site docs page, probably added in this same PR, so it can't…; source: repo:content/docs/ai/agents/manage.md L15-33; gh search code --owner pulumi "pause agent" (HTTP 429)
source: repo:content/docs/ai/agents/manage.md L15-33; gh search code --owner pulumi "pause agent" (HTTP 429)
pass1 · feature · low confidence
#71 🤷 Unverifiable
content/docs/ai/agents/custom.md:10
The menu parent identifier 'ai-agents-create-manage' exists in the ai menu.
evidence: custom.md sets `parent: ai-agents-create-manage`, but I couldn't find any page that defines that identifier. The agents section index defines `identifier: ai-agents` (its parent is `ai-concepts`), `data/docs_menu_sections.yml` has no…; source: repo:content/docs/ai/agents/_index.md; repo:data/docs_menu_sections.yml; gh search code "ai-agents-create-manage" (HTTP 429); intuition: No section page found defining 'ai-agents-create-manage'. If none exists in the PR, the menu entry would be orphaned…
source: repo:content/docs/ai/agents/_index.md; repo:data/docs_menu_sections.yml; gh search code "ai-agents-create-manage" (HTTP 429)
pass1 · cross-reference · low confidence
#72 🤷 Unverifiable
content/docs/ai/agents/custom.md:19
When creating a custom Pulumi agent, the creation form includes a Name field and a Description field.
evidence: The custom-agent creation form is part of the Pulumi Cloud console UI, which is closed source, and the cited github.com/pulumi/marketing-web/pull/252 can't be read (it returns 404). The sibling page configure.md agrees with the claim…; source: repo:content/docs/ai/agents/configure.md L23; github.com/pulumi/marketing-web/pull/252 (unreadable)
source: repo:content/docs/ai/agents/configure.md L23; github.com/pulumi/marketing-web/pull/252 (unreadable)
pass1 · api-surface · low confidence
#73 🤷 Unverifiable
content/docs/ai/agents/custom.md:19
In the Pulumi Agents catalog, there is an option labeled 'Create your own from scratch' used to create a custom agent.
evidence: I couldn't check the 'Create your own from scratch' catalog label against any independent source. The label belongs to the Pulumi Cloud console UI, which lives in a private repo. Both GitHub code searches I tried came back HTTP 429…; source: gh search code --owner pulumi "Create your own from scratch" (HTTP 429); repo:content/docs/ai/agents/custom.md L19
source: gh search code --owner pulumi "Create your own from scratch" (HTTP 429); repo:content/docs/ai/agents/custom.md L19
pass1 · feature · low confidence
#74 🤷 Unverifiable
content/docs/ai/agents/custom.md:26
A Pulumi agent's saved instructions apply every time the agent runs, while assignment-specific details such as the repository or stack to check belong in the…
evidence: I couldn't check this against product source. The custom-agent behavior lives in Pulumi Cloud's private service code, GitHub code search returned HTTP 429, and the cited marketing-web#252 can't be read. A sibling page agrees with the…; source: repo:content/docs/ai/agents/configure.md (L40-44, L76); gh search code (HTTP 429); intuition: Most of the sentence is advice on what goes in the instructions versus the task. Only "applies every time the agent…
source: repo:content/docs/ai/agents/configure.md (L40-44, L76); gh search code (HTTP 429)
pass1 · behavior · low confidence
#75 🤷 Unverifiable
content/docs/ai/agents/custom.md:28
The Pulumi Agents custom agent creation form has a field labeled 'System prompt' where the agent's instructions are entered.
evidence: I couldn't confirm the 'System prompt' field label from any source I could read. The form is part of Pulumi Cloud's private UI. My code search was rate-limited (HTTP 429), and the cited github.com/pulumi/marketing-web/pull/252 returns…; source: gh search code --owner pulumi "\"System prompt\" agent" (HTTP 429); github.com/pulumi/marketing-web/pull/252 (unreadable)
source: gh search code --owner pulumi "\"System prompt\" agent" (HTTP 429); github.com/pulumi/marketing-web/pull/252 (unreadable)
pass1 · api-surface · low confidence
#76 🤷 Unverifiable
content/docs/ai/agents/custom.md:40
A Pulumi custom agent can read a repository's contribution instructions and open a pull request, and can be instructed not to merge or deploy.
evidence: (escalated from pass1) The public docs cover only Neo, not the new Pulumi custom agents. They say Neo reads per-repository AGENTS.md ("Neo reads AGENTS.md files when it enters a repository") and opens PRs, but no public page describes…; source: WebSearch ran query "Pulumi Neo custom agent pull request instructions"; https://www.pulumi.com/docs/ai/concepts/neo/instructions/ (Neo only, not custom agents); intuition: This describes Pulumi's own product (the new Agents feature in pulumi/docs#22287), so only product source can settle…
source: WebSearch ran query "Pulumi Neo custom agent pull request instructions"; https://www.pulumi.com/docs/ai/concepts/neo/instructions/ (Neo only, not custom agents)
pass3 · feature · low confidence
#77 🤷 Unverifiable
content/docs/ai/agents/custom.md:45
A Pulumi custom agent needs access to any repository or tool referenced in its instructions; including a path or URL in the instructions does not grant access.
evidence: The sibling page agrees: configure.md L56 says "The agent also needs access to the repository or tool that holds them; a link alone does not grant access." L44 says "roles and credentials determine what it can access." Another docs page…; source: repo:content/docs/ai/agents/configure.md L44-L56; github.com/pulumi/marketing-web/pull/252 (unreadable, 404); intuition: Plausible and matches the sibling page: access comes from roles and integrations, not from links in a prompt. It just…
source: repo:content/docs/ai/agents/configure.md L44-L56; github.com/pulumi/marketing-web/pull/252 (unreadable, 404)
pass1 · behavior · low confidence
#78 🤷 Unverifiable
content/docs/ai/agents/custom.md:47
In Pulumi Agents, saved agent instructions replace (rather than add to) the organization's AI preference instructions.
evidence: Pulumi Agents runtime behavior lives in the closed-source Pulumi Cloud service. The only other mention I found is a sibling docs page (configure.md L44: "Saved agent instructions replace the organization's AI preference instructions.")…; source: repo:content/docs/ai/agents/configure.md L44; gh search code (HTTP 429); pulumi/marketing-web#252 unreadable; intuition: Replace-versus-merge with org-level AI preferences is a behavior that's easy to get wrong. Confirm it with the Pulumi…
source: repo:content/docs/ai/agents/configure.md L44; gh search code (HTTP 429); pulumi/marketing-web#252 unreadable
pass1 · behavior · low confidence
#114 🤷 Unverifiable
content/docs/ai/agents/integrations/aws.md:13
The AWS connection setup in Pulumi Agents is the same for Neo and for agents the user configures.
evidence: I couldn't check this. The only source for the claim is the page under review, which says "The setup is the same for Neo and agents you configure." The page can't confirm its own claim. The behavior belongs to closed-source Pulumi Cloud…; source: repo:content/docs/ai/agents/integrations/aws.md (reviewed file, not independent); github.com/pulumi/marketing-web/pull/252 (unreadable)
source: repo:content/docs/ai/agents/integrations/aws.md (reviewed file, not independent); github.com/pulumi/marketing-web/pull/252 (unreadable)
pass1 · behavior · low confidence
#115 🤷 Unverifiable
content/docs/ai/agents/integrations/aws.md:13
Pulumi Agents can connect an AWS account so an agent can inspect resources through the AWS CLI.
evidence: The only support I found is inside this PR: the reviewed page and the `agent-cli-connection` partial, which describes "Agent settings > Integrations > CLI tools". That content can't verify itself. Both GitHub code searches I tried failed…; source: repo:layouts/partials/docs/agent-cli-connection.md; gh search code (HTTP 429); pulumi/marketing-web#252 (404 to the review's credentials)
source: repo:layouts/partials/docs/agent-cli-connection.md; gh search code (HTTP 429); pulumi/marketing-web#252 (404 to the review's credentials)
pass1 · feature · low confidence
#117 🤷 Unverifiable
content/docs/ai/agents/integrations/aws.md:17
Checking versioning on an S3 bucket via `s3:GetBucketVersioning` does not require access to the bucket's objects or permission to change versioning.
framing: The source has no passage about permission isolation. The claim's "does not require" is an inference from how IAM works (a separate action…; evidence: The cited page loaded (200) but never says that GetBucketVersioning works without object access or without permission to change versioning. It says only "Returns the versioning state of a bucket. To retrieve the versioning state of a…; source: https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketVersioning.html; intuition: The claim is likely true as an IAM principle, but the cited page adds a condition the doc line leaves out: "you must…
source: https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketVersioning.html
framing: The source has no passage about permission isolation. The claim's "does not require" is an inference from how IAM works (a separate action: s3:GetBucketVersioning, not s3:GetObject or s3:PutBucketVersioning). The API reference does not…
pass2 · url · medium confidence
#122 🤷 Unverifiable
content/docs/ai/agents/integrations/aws.md:31
Connecting the AWS environment to Pulumi Agents is performed by an organization administrator.
evidence: The page says "As an organization administrator:" and then includes the agent-cli-connection partial, which only lists UI steps ("Open your organization's **Agent settings** > **Integrations** > **CLI tools**"). Nothing I could read says…; source: repo:layouts/partials/docs/agent-cli-connection.md; repo:content/docs/ai/agents/permissions.md; gh search code (HTTP 429); intuition: Requiring an admin is plausible for org-level integration settings, but the exact permission (e.g.…
source: repo:layouts/partials/docs/agent-cli-connection.md; repo:content/docs/ai/agents/permissions.md; gh search code (HTTP 429)
pass1 · behavior · low confidence
#123 🤷 Unverifiable
content/docs/ai/agents/integrations/aws.md:35
A Pulumi Agents AWS connection can be given a name such as `production-aws-investigation` and notes that include the AWS account ID.
evidence: The example name `production-aws-investigation` is just the author's illustration. The real claim is that a connection has Name and Notes fields. The only support is the repo's own docs partial: "Enter a **Name** and select the **ESC…; source: repo:layouts/partials/docs/agent-cli-connection.md; gh search code --owner pulumi "Notes (optional)" (HTTP 429); intuition: The claim is plausible and matches the shared connection-steps partial. A check against the Pulumi Cloud UI source…
source: repo:layouts/partials/docs/agent-cli-connection.md; gh search code --owner pulumi "Notes (optional)" (HTTP 429)
pass1 · feature · low confidence
#124 🤷 Unverifiable
content/docs/ai/agents/integrations/azure.md:13
The Azure integration in Pulumi Agents lets an agent use the Azure CLI with credentials supplied from Pulumi ESC.
evidence: The only support I could find is in the repo's own docs. The reviewed page says "Connect Azure so an agent can use the Azure CLI with credentials from Pulumi ESC," and the shared partial describes "Agent settings > Integrations > CLI…; source: repo:content/docs/ai/agents/integrations/azure.md; repo:layouts/partials/docs/agent-cli-connection.md; gh search code (HTTP 429); github.com/pulumi/marketing-web/pull/252 (unreadable, 404); intuition: The claim is plausible and matches the shared CLI-connection partial, but the Agents integrations UI is closed-source…
source: repo:content/docs/ai/agents/integrations/azure.md; repo:layouts/partials/docs/agent-cli-connection.md; gh search code (HTTP 429); github.com/pulumi/marketing-web/pull/252 (unreadable, 404)
pass1 · feature · low confidence
#126 🤷 Unverifiable
content/docs/ai/agents/integrations/azure.md:21
The Pulumi Agents Azure CLI integration expects an ESC environment that supplies the environment variables AZURE_CLIENT_ID, AZURE_CLIENT_SECRET…
framing: The linked ESC page defines the environmentVariables mechanism. It does not say which variables the Agents Azure integration needs, so it supports the link…; evidence: The cited anchor resolves: outputs.md has "## environmentVariables", which says the property "contains values that should be exported as environment variables". That page is about ESC in general and says nothing about which variables the…; source: repo:content/docs/esc/concepts/outputs.md#L29-L31; gh search code (HTTP 429); pulumi/marketing-web#252 unreadable
source: repo:content/docs/esc/concepts/outputs.md#L29-L31; gh search code (HTTP 429); pulumi/marketing-web#252 unreadable
framing: shifted — The linked ESC page defines the environmentVariables mechanism. It does not say which variables the Agents Azure integration needs, so it supports the link target but not the claim itself.
pass1 · url · low confidence
#127 🤷 Unverifiable
content/docs/ai/agents/integrations/azure.md:25
The Azure CLI service principal sign-in uses the `AZURE_CLIENT_ID` environment variable, set to the service principal's application ID, for the Pulumi Agents…
evidence: The reviewed page lists "`AZURE_CLIENT_ID` | The service principal's application ID" as an ESC variable for the Pulumi Agents Azure CLI integration. Using AZURE_CLIENT_ID for the application (client) ID is the standard Azure convention.…; source: repo:content/docs/ai/agents/integrations/azure.md; repo:layouts/shortcodes/agent-cli-connection.html; gh search code --owner pulumi agent-cli-connection (HTTP 429); intuition: Plausible: the variable name matches the standard Azure SDK/CLI service principal convention, and the doc says it is…
source: repo:content/docs/ai/agents/integrations/azure.md; repo:layouts/shortcodes/agent-cli-connection.html; gh search code --owner pulumi agent-cli-connection (HTTP 429)
pass1 · api-surface · low confidence
#135 🤷 Unverifiable
content/docs/ai/agents/integrations/datadog.md:5
The Pulumi Agents Datadog integration authenticates using a Datadog API key and an application key (the application key belonging to a service account).
evidence: The only support is the reviewed page itself ("uses a Datadog API key and application key"; "Enter Datadog site, API Key, and App Key"), and that can't count as evidence for its own claim. The Neo integration code lives in the private…; source: repo:content/docs/ai/agents/integrations/datadog.md (reviewed file, circular); gh search code --owner pulumi (HTTP 429); pulumi/marketing-web#252 unreadable; intuition: Datadog's MCP server does use API and application keys, so this is plausible. The service-account part is advice, and…
source: repo:content/docs/ai/agents/integrations/datadog.md (reviewed file, circular); gh search code --owner pulumi (HTTP 429); pulumi/marketing-web#252 unreadable
pass1 · behavior · low confidence
#136 🤷 Unverifiable
content/docs/ai/agents/integrations/datadog.md:13
In Pulumi Agents, Neo and agents the user configures share the organization's Datadog connection.
evidence: The only support I found is in other Pulumi docs pages. configure.md says agents pick from "the connected MCP services" and that setup goes through org-level Neo Settings > Integrations, which fits a shared org connection. But same-site…; source: repo:content/docs/ai/agents/configure.md L48-54; gh search code (HTTP 429)
source: repo:content/docs/ai/agents/configure.md L48-54; gh search code (HTTP 429)
pass1 · behavior · low confidence
#140 🤷 Unverifiable
content/docs/ai/agents/integrations/datadog.md:24
Datadog sites are identified as us1, us3, us5, eu1, ap1, or ap2 (the list of Datadog site identifiers supported by the Pulumi integration).
evidence: (escalated from pass3) The doc line says "Identify your Datadog site: `us1`, `us3`, `us5`, `eu1`, `ap1`, or `ap2`." I couldn't confirm that this is the list the Pulumi Cloud integration accepts. The site options live in Pulumi Cloud's…; source: read_file content/docs/ai/agents/integrations/datadog.md; gh search code --owner pulumi (HTTP 429); pulumi/marketing-web#252 can't be read (404); intuition: Datadog's public site list also has US1-FED (gov). Check whether the integration really leaves it out, or whether the…
source: read_file content/docs/ai/agents/integrations/datadog.md; gh search code --owner pulumi (HTTP 429); pulumi/marketing-web#252 can't be read (404)
pass1 · entity-spec · low confidence
#141 🤷 Unverifiable
content/docs/ai/agents/integrations/datadog.md:26
Datadog's MCP server setup documentation at https://docs.datadoghq.com/mcp_server/setup/#api-and-application-keys describes the API and application key…
framing: No readable source passage, so I couldn't run the framing check. The link is live (200), so this isn't a dead citation.; evidence: The cited URL returned HTTP 200, but the pre-fetched body is still compressed binary data (it looks gzip-encoded and was never decoded). It has no readable text, so I couldn't find or quote a passage about API and application keys.; source: https://docs.datadoghq.com/mcp_server/setup/#api-and-application-keys
source: https://docs.datadoghq.com/mcp_server/setup/#api-and-application-keys
framing: No readable source passage, so I couldn't run the framing check. The link is live (200), so this isn't a dead citation.
pass2 · attribution · low confidence
#142 🤷 Unverifiable
content/docs/ai/agents/integrations/datadog.md:30
Connecting Datadog in Pulumi Cloud requires the Pulumi Cloud organization administrator role.
evidence: The only source for the admin-role requirement is the reviewed page ("As a Pulumi Cloud organization administrator:"), and that can't count as evidence for itself. GitHub code search returned HTTP 429 (rate limited), and no sibling…; source: repo:content/docs/ai/agents/integrations/datadog.md (reviewed file only); gh search code --owner pulumi (HTTP 429)
source: repo:content/docs/ai/agents/integrations/datadog.md (reviewed file only); gh search code --owner pulumi (HTTP 429)
pass1 · behavior · low confidence
#143 🤷 Unverifiable
content/docs/ai/agents/integrations/datadog.md:32
Pulumi Cloud has Neo Settings with an Integrations tab containing an 'MCP servers' section where integrations are configured.
evidence: The Pulumi Cloud console UI path (Neo Settings > Integrations > MCP servers) is closed-source and can't be checked from readable pulumi/* repos. GitHub code search hit rate limits (HTTP 429). The only source the PR cites…; source: repo:content/docs/ai/agents/integrations/datadog.md (reviewed file, not evidence); gh search code (HTTP 429); pulumi/marketing-web#252 (unreadable)
source: repo:content/docs/ai/agents/integrations/datadog.md (reviewed file, not evidence); gh search code (HTTP 429); pulumi/marketing-web#252 (unreadable)
pass1 · feature · low confidence
#144 🤷 Unverifiable
content/docs/ai/agents/integrations/datadog.md:34
The Pulumi Cloud Datadog integration form asks for three fields: **Datadog site**, **API Key**, and **App Key**, and is submitted with **Save**.
evidence: The Pulumi Cloud Neo MCP-server Datadog authorize form is in private Pulumi Cloud UI source, and I couldn't read it. The cited github.com/pulumi/marketing-web/pull/252 couldn't be read either (it returned 404). The code search I tried…; source: gh search code --owner pulumi "Datadog site App Key MCP" (HTTP 429); github.com/pulumi/marketing-web/pull/252 (unreadable)
source: gh search code --owner pulumi "Datadog site App Key MCP" (HTTP 429); github.com/pulumi/marketing-web/pull/252 (unreadable)
pass1 · behavior · low confidence
#146 🤷 Unverifiable
content/docs/ai/agents/integrations/google-cloud.md:13
A Pulumi Agents agent can use the `gcloud` CLI with Google Cloud credentials supplied from a Pulumi ESC environment.
evidence: The ESC half checks out: the gcp-login provider docs show how to supply gcloud credentials, e.g. "CLOUDSDK_AUTH_ACCESS_TOKEN: ${gcp.login.accessToken}". I found no readable product source showing that Pulumi Agents offers a Google…; source: repo:content/docs/esc/providers/login/gcp-login.md L42-61; repo:layouts/partials/docs/agent-cli-connection.md; pulumi/marketing-web#252 (unreadable)
source: repo:content/docs/esc/providers/login/gcp-login.md L42-61; repo:layouts/partials/docs/agent-cli-connection.md; pulumi/marketing-web#252 (unreadable)
pass1 · feature · medium confidence
#151 🤷 Unverifiable
content/docs/ai/agents/integrations/google-cloud.md:27
Connecting an ESC environment to Pulumi Agents as a Google Cloud connection is done by an organization administrator.
evidence: The only statement of this is the reviewed page itself ("As an organization administrator:"), and that page can't serve as evidence for its own claim. The permissions page and the agent-cli-connection shortcode don't say which role is…; source: repo:content/docs/ai/agents/permissions.md; repo:layouts/shortcodes/agent-cli-connection.html
source: repo:content/docs/ai/agents/permissions.md; repo:layouts/shortcodes/agent-cli-connection.html
pass1 · behavior · low confidence
#155 🤷 Unverifiable
content/docs/ai/agents/manage.md:19
In Pulumi Agents, selecting Edit on an agent's page, updating its settings, and selecting Save changes saves the agent's configuration.
evidence: The Edit → Save changes flow is Pulumi Cloud console UI, and that console is closed source. The only source given is the cited pulumi/marketing-web#252, which returned 404 and can't be read. My one GitHub code search was rate-limited…; source: repo:content/docs/ai/agents/manage.md (reviewed file, not evidence); gh search code --owner pulumi "\"Save changes\" agent" (HTTP 429)
source: repo:content/docs/ai/agents/manage.md (reviewed file, not evidence); gh search code --owner pulumi "\"Save changes\" agent" (HTTP 429)
pass1 · behavior · low confidence
#156 🤷 Unverifiable
content/docs/ai/agents/manage.md:21
In Pulumi Agents, the agent's instructions, role, approval settings, and MCP integrations cannot be overridden in an individual task.
evidence: The only source for this is the reviewed page itself (L21: "These settings cannot be overridden in an individual task."), and citing that would be circular. The Pulumi Agents service code isn't public, GitHub code search returned HTTP…; source: repo:content/docs/ai/agents/manage.md L21; gh search code --owner pulumi (HTTP 429)
source: repo:content/docs/ai/agents/manage.md L21; gh search code --owner pulumi (HTTP 429)
pass1 · behavior · low confidence
#157 🤷 Unverifiable
content/docs/ai/agents/manage.md:25
In Pulumi Agents, a running task can be cancelled by opening the task and selecting Cancel, which is the stop icon beside the message box.
evidence: I couldn't check this claim. It describes the Pulumi Cloud task page (a "Cancel" control shown as a stop icon beside the message box), and that UI code is not in any public pulumi/* repo. The only other source is the cited…; source: repo:content/docs/ai/agents/manage.md (reviewed file only); gh search code attempts returned HTTP 429; github.com/pulumi/marketing-web/pull/252 unreadable (404)
source: repo:content/docs/ai/agents/manage.md (reviewed file only); gh search code attempts returned HTTP 429; github.com/pulumi/marketing-web/pull/252 unreadable (404)
pass1 · api-surface · low confidence
#158 🤷 Unverifiable
content/docs/ai/agents/manage.md:27
In Pulumi Agents, scheduled runs and events skipped while an agent is paused are not replayed after resuming.
evidence: The only place this appears is the reviewed page (L27: "Scheduled runs and events skipped while paused are not replayed."), so it can't count as evidence. Pulumi Agents pause/resume behavior is part of the private Pulumi Cloud service.…; source: repo:content/docs/ai/agents/manage.md (reviewed file only); gh search code --owner pulumi returned HTTP 429; pulumi/marketing-web#252 unreadable
source: repo:content/docs/ai/agents/manage.md (reviewed file only); gh search code --owner pulumi returned HTTP 429; pulumi/marketing-web#252 unreadable
pass1 · behavior · low confidence
#159 🤷 Unverifiable
content/docs/ai/agents/manage.md:31
In Pulumi Agents, Pulumi blocks deletion of an agent while an automation still references it.
evidence: I couldn't check this. Blocking agent deletion is Pulumi Cloud service behavior, and that source code is private. The only implementing change cited is pulumi/marketing-web#252, which returns 404 and can't be read. GitHub code search was…; source: repo:content/docs/ai/agents/manage.md L31 (reviewed file, not evidence); gh search code (HTTP 429); pulumi/marketing-web#252 (unreadable)
source: repo:content/docs/ai/agents/manage.md L31 (reviewed file, not evidence); gh search code (HTTP 429); pulumi/marketing-web#252 (unreadable)
pass1 · behavior · low confidence
#160 🤷 Unverifiable
content/docs/ai/agents/manage.md:33
In Pulumi Agents, deleting an agent does not cancel work already executing; each running task must be cancelled by opening it and selecting Cancel.
evidence: This is a Pulumi Cloud (Agents) behavior claim, and the service source isn't public. The only other source the PR cites is pulumi/marketing-web#252, which returned 404 and couldn't be read. The reviewed page's L33 matches the pause…; source: repo:content/docs/ai/agents/manage.md (L25, L33); gh search code --owner pulumi (rate-limited HTTP 429); pulumi/marketing-web#252 unreadable
source: repo:content/docs/ai/agents/manage.md (L25, L33); gh search code --owner pulumi (rate-limited HTTP 429); pulumi/marketing-web#252 unreadable
pass1 · behavior · low confidence
#161 🤷 Unverifiable
content/docs/ai/agents/manage.md:37
In Pulumi Agents, resuming an agent does not resume its paused automations.
evidence: I couldn't check this independently. The only text I found is the reviewed page itself (L37: "Resuming an agent does not resume its paused automations."), and a page can't verify its own claim. The Pulumi Cloud agent and automation…; source: repo:content/docs/ai/agents/manage.md (L23-37); gh search code --owner pulumi "resume agent automations" (HTTP 429)
source: repo:content/docs/ai/agents/manage.md (L23-37); gh search code --owner pulumi "resume agent automations" (HTTP 429)
pass1 · behavior · low confidence
#163 🤷 Unverifiable
content/docs/ai/agents/manage.md:40
In the Pulumi Agents automation form for a schedule, the Runs setting has an option 'On a schedule' and the form has a Frequency setting.
evidence: The labels 'On a schedule' and 'Frequency' belong to the Pulumi Cloud automation form, whose UI source isn't in any repo I can read. GitHub code search returned HTTP 429 (rate-limited), and the cited pulumi/marketing-web#252 is…; source: repo:content/docs/ai/agents/manage.md L40-42 (context only); gh search code --owner pulumi "On a schedule" Frequency (HTTP 429)
source: repo:content/docs/ai/agents/manage.md L40-42 (context only); gh search code --owner pulumi "On a schedule" Frequency (HTTP 429)
pass1 · api-surface · low confidence
#165 🤷 Unverifiable
content/docs/ai/agents/manage.md:48
In Pulumi Agents, the agent's role grants access to Pulumi Cloud resources, including any ESC environment that supplies credentials.
framing: Only same-site sibling pages corroborate the claim; they aren't independent product source.; evidence: Sibling docs agree with this: permissions.md says "assign a Pulumi Cloud role to control access to stacks and ESC environments" and "If an integration uses Pulumi ESC, the agent also needs permission to open the environment. Its Pulumi…; source: repo:content/docs/ai/agents/permissions.md L14, L26, L34
source: repo:content/docs/ai/agents/permissions.md L14, L26, L34
framing: Only same-site sibling pages corroborate the claim; they aren't independent product source.
pass1 · behavior · low confidence
#170 🤷 Unverifiable
content/docs/ai/agents/permissions.md:14
For Pulumi Agents that a team creates, assigning a Pulumi Cloud role controls the agent's access to stacks and Pulumi ESC environments.
evidence: The only support I found is in sibling docs. configure.md says "Select a Pulumi Cloud role whose grants cover the agent's responsibility" and "The agent's role must allow it to open each connection's ESC environment." Pulumi pages can't…; source: repo:content/docs/ai/agents/configure.md L54-L67; gh search code (HTTP 429)
source: repo:content/docs/ai/agents/configure.md L54-L67; gh search code (HTTP 429)
pass1 · behavior · low confidence
#171 🤷 Unverifiable
content/docs/ai/agents/permissions.md:14
When a Pulumi Agents integration uses Pulumi ESC, the credentials supplied by the environment control access to the connected tool.
evidence: The only place this claim appears is the reviewed page itself ("Its Pulumi Cloud role controls that access; the credentials supplied by the environment control access to the connected tool"). No integration guides exist in the repo…; source: repo:content/docs/ai/agents/permissions.md (reviewed file, not independent); gh search code attempt (HTTP 429); intuition: This is plausible because it's how ESC-injected credentials normally work, but it comes from a private service and…
source: repo:content/docs/ai/agents/permissions.md (reviewed file, not independent); gh search code attempt (HTTP 429)
pass1 · behavior · low confidence
#173 🤷 Unverifiable
content/docs/ai/agents/permissions.md:18
If a Pulumi Agents integration requires a personal token, the agent uses the token owner's permissions and identity.
evidence: I couldn't find an independent product source for how Pulumi Agents handle a personal token. Code search returned HTTP 429 (rate limited), the integration guides aren't in the repo, and the cited github.com/pulumi/marketing-web/pull/252…; source: repo:content/docs/ai/agents/permissions.md (reviewed file only); gh search code rate-limited; github.com/pulumi/marketing-web/pull/252 unreadable; intuition: Close to true by definition: a personal access token acts as its owner, so this is low risk.
source: repo:content/docs/ai/agents/permissions.md (reviewed file only); gh search code rate-limited; github.com/pulumi/marketing-web/pull/252 unreadable
pass1 · behavior · low confidence
#177 🤷 Unverifiable
content/docs/ai/agents/permissions.md:26
The Pulumi Agents configuration has a **Role** field in which a Pulumi Cloud role can be selected for the agent, granting access to relevant stacks and ESC…
evidence: (escalated from pass1) Web searches found nothing about a Role field in the Pulumi Agents configuration. The closest match is the Deployments "Pulumi Cloud role" dropdown, which is a different feature: "pick a role from the Pulumi Cloud…; source: WebSearch ran query "Pulumi Agents configure agent Role Pulumi Cloud role stacks ESC environments docs/ai/agents"; top results didn't address the claim
source: WebSearch ran query "Pulumi Agents configure agent Role Pulumi Cloud role stacks ESC environments docs/ai/agents"; top results didn't address the claim
pass3 · api-surface · low confidence
#178 🤷 Unverifiable
content/docs/ai/agents/permissions.md:32
In Pulumi Agents, selecting an integration or adding restrictions to the agent's instructions does not narrow the integration's credentials.
evidence: The only place I found this statement is the reviewed page itself: "Selecting an integration or adding restrictions to the agent's instructions does not narrow those credentials." That page can't verify its own claim. Pulumi Agents is…; source: repo:content/docs/ai/agents/permissions.md L32 (reviewed file, context only); gh search code --owner pulumi "does not narrow" (HTTP 429); intuition: This is a general security caveat and is almost certainly true: prompt instructions can't change a third-party…
source: repo:content/docs/ai/agents/permissions.md L32 (reviewed file, context only); gh search code --owner pulumi "does not narrow" (HTTP 429)
pass1 · behavior · low confidence
#179 🤷 Unverifiable
content/docs/ai/agents/permissions.md:34
When a Pulumi Agents integration uses Pulumi ESC, the agent needs permission to open the ESC environment, which is controlled by the agent's Pulumi Cloud role.
evidence: I couldn't check this against product source. Pulumi Agents' role and ESC access logic is in private service code, and my code search was rate-limited (HTTP 429). The only support is a sibling page, content/docs/ai/agents/configure.md…; source: repo:content/docs/ai/agents/configure.md (L54); gh search code --owner pulumi "agent role environment:open" (HTTP 429); intuition: Sounds right: it matches the sibling configure page and how ESC's environment-open permission works. But no product…
source: repo:content/docs/ai/agents/configure.md (L54); gh search code --owner pulumi "agent role environment:open" (HTTP 429)
pass1 · behavior · low confidence
#181 🤷 Unverifiable
content/docs/ai/agents/permissions.md:38
Pulumi Agents have a **Default mode** setting that controls when the agent asks for approval.
evidence: I couldn't find an independent source for a Pulumi Agents "Default mode" approval setting. The sibling page content/docs/ai/neo/permissions.md doesn't exist in this repo, and both GitHub code searches failed with HTTP 429 (rate limited).…; source: read_file content/docs/ai/agents/permissions.md L38 (the file under review, so it can't confirm itself); gh search code --owner pulumi "\"Default mode\" agent approval" (HTTP 429); unreadable pulumi/marketing-web#252
source: read_file content/docs/ai/agents/permissions.md L38 (the file under review, so it can't confirm itself); gh search code --owner pulumi "\"Default mode\" agent approval" (HTTP 429); unreadable pulumi/marketing-web#252
pass1 · api-surface · low confidence
#182 🤷 Unverifiable
content/docs/ai/agents/permissions.md:38
Approving an action in Pulumi Agents does not grant permissions beyond the agent's role and connected credentials.
evidence: I couldn't check this independently. The claim describes how approvals work in the closed-source Pulumi Cloud agents service. The only places it appears are the reviewed page itself and the cited pulumi/marketing-web#252, which returns…; source: repo:content/docs/ai/agents/permissions.md (reviewed file, cannot self-verify); gh search code --owner pulumi "approval does not grant" (HTTP 429); pulumi/marketing-web#252 unreadable; intuition: This is plausible as a security design statement, but no public product source backs it. A Pulumi Cloud engineer…
source: repo:content/docs/ai/agents/permissions.md (reviewed file, cannot self-verify); gh search code --owner pulumi "approval does not grant" (HTTP 429); pulumi/marketing-web#252 unreadable
pass1 · behavior · low confidence
#185 🤷 Unverifiable
content/docs/ai/agents/permissions.md:44
For a Pulumi Agent with an assigned role, a teammate must hold that role directly or through a team, or have the `organization:update` permission, to start a…
framing: The claim points readers to /docs/administration/concepts/rbac/roles/, but that page has nothing on agent role assignment or this task-start rule.; evidence: The cited Roles page (content/docs/administration/concepts/rbac/roles.md) never mentions agents, so it says nothing about the rule that a teammate needs the agent's role (directly or through a team) or `organization:update` to start a…; source: repo:content/docs/administration/concepts/rbac/roles.md (grep 'agent' returned no matches); gh search code --owner pulumi "agent role organization:update" (HTTP 429)
source: repo:content/docs/administration/concepts/rbac/roles.md (grep 'agent' returned no matches); gh search code --owner pulumi "agent role organization:update" (HTTP 429)
framing: overclaim-broader — The claim points readers to /docs/administration/concepts/rbac/roles/, but that page has nothing on agent role assignment or this task-start rule.
pass1 · url · low confidence
#186 🤷 Unverifiable
content/docs/ai/agents/permissions.md:46
For Pulumi Agents tasks started by an organization-owned automation, the `agent_automations:update` permission grants access to reply and approve actions.
evidence: The only place the `agent_automations:update` scope, or its reply/approve rights on automation-started tasks, turns up is the reviewed file itself (L46). The RBAC roles page doesn't mention agent_automations or agent_task scopes, and…; source: repo:content/docs/administration/concepts/rbac/roles.md (no match); gh search code --owner pulumi "agent_automations:update" (HTTP 429); pulumi/marketing-web#252 (unreadable)
source: repo:content/docs/administration/concepts/rbac/roles.md (no match); gh search code --owner pulumi "agent_automations:update" (HTTP 429); pulumi/marketing-web#252 (unreadable)
pass1 · api-surface · low confidence
#187 🤷 Unverifiable
content/docs/ai/agents/permissions.md:48
A personal schedule running a shared agent does not grant other teammates access to the tasks that schedule creates.
evidence: I couldn't find a source I can read that settles this. The claim describes how Pulumi Cloud's private service grants access to agent tasks created by personal schedules. The only place it's stated is the reviewed page (L48), and that…; source: repo:content/docs/ai/agents/permissions.md L48 (reviewed file, not evidence); gh search code --owner pulumi "agent_automations:read" (HTTP 429)
source: repo:content/docs/ai/agents/permissions.md L48 (reviewed file, not evidence); gh search code --owner pulumi "agent_automations:read" (HTTP 429)
pass1 · behavior · low confidence
#190 🤷 Unverifiable
content/docs/ai/agents/reference.md:16
Access to the preview `agentDefinitionId` field of the task-creation API must be enabled for your Pulumi organization before it can be used.
evidence: The only statement of this gating is the reviewed page itself (L20: "Access to this preview field must be enabled for your organization."), and that page can't count as evidence for its own claim. The org-level enablement of…; source: repo:content/docs/ai/agents/reference.md (reviewed file, L20); gh search code --owner pulumi agentDefinitionId (HTTP 429); pulumi/marketing-web#252 (unreadable)
source: repo:content/docs/ai/agents/reference.md (reviewed file, L20); gh search code --owner pulumi agentDefinitionId (HTTP 429); pulumi/marketing-web#252 (unreadable)
pass1 · behavior · low confidence
#192 🤷 Unverifiable
content/docs/ai/agents/reference.md:20
Access to the preview `agentDefinitionId` field must be enabled for your organization before it can be used.
evidence: The reviewed page (L20) says "Access to this preview field must be enabled for your organization," but I found no independent source for this. GitHub code search for `agentDefinitionId` failed with HTTP 429 (rate-limited) twice, the Neo…; source: gh search code --owner pulumi agentDefinitionId (HTTP 429); repo:content/docs/ai/agents/reference.md L20; intuition: Gating a preview field per organization is plausible, but it's backend behavior that only Pulumi Cloud service source…
source: gh search code --owner pulumi agentDefinitionId (HTTP 429); repo:content/docs/ai/agents/reference.md L20
pass1 · behavior · low confidence
#193 🤷 Unverifiable
content/docs/ai/agents/tasks.md:15
Each Pulumi Agent task contains the agent's work and results, and users and teammates can reply in the task to answer questions, add context, or ask for…
framing: The link target covers automated task triggers, but the claim covers task contents and replies, which the target page doesn't address.; evidence: The linked /docs/ai/agents/triggers/ page exists and supports the sentence next to the link ("Configure an agent to start tasks automatically when a Pulumi operation completes, an external tool sends a webhook, or a schedule runs"). It…; source: repo:content/docs/ai/agents/triggers.md; repo:content/docs/ai/agents/tasks.md L15,L37
source: repo:content/docs/ai/agents/triggers.md; repo:content/docs/ai/agents/tasks.md L15,L37
framing: shifted — The link target covers automated task triggers, but the claim covers task contents and replies, which the target page doesn't address.
pass1 · url · low confidence
#195 🤷 Unverifiable
content/docs/ai/agents/tasks.md:21
The Pulumi Cloud agent page has an input field labeled "Describe the task for this agent" where users enter their request to start a task.
evidence: The input label "Describe the task for this agent" is Pulumi Cloud UI text, and that frontend source isn't public. A code search of the pulumi org was rate-limited (HTTP 429), and I found no sibling docs that contain the label. The cited…; source: gh search code --owner pulumi "Describe the task for this agent" (HTTP 429); read_file content/docs/ai/agents/index.md (not found)
source: gh search code --owner pulumi "Describe the task for this agent" (HTTP 429); read_file content/docs/ai/agents/index.md (not found)
pass1 · api-surface · low confidence
#203 🤷 Unverifiable
content/docs/ai/agents/triggers.md:6
Pulumi Agents can be configured to start agent tasks automatically when a Pulumi operation completes, when an external tool sends a webhook, or on a…
evidence: (escalated from pass1) Partial support only: the Pulumi Cloud REST API AgentTask schema lists a task `source` value "schedule — Schedule: Task created by a scheduled automation" and a `sourceAutomationID` field. But its enum ('console'…; source: https://www.pulumi.com/docs/reference/cloud-rest-api/schema/agenttask/; WebSearch ran query "Pulumi Agents triggers webhook schedule deployment completes agent tasks"; intuition: The AgentTask source enum has no 'webhook' or 'operation' value. The webhook and operation-completion triggers may be…
source: https://www.pulumi.com/docs/reference/cloud-rest-api/schema/agenttask/; WebSearch ran query "Pulumi Agents triggers webhook schedule deployment completes agent tasks"
pass3 · feature · low confidence
#207 🤷 Unverifiable
content/docs/ai/agents/triggers.md:25
For Pulumi Agents automations, instructions written in the assignment (prompt) do not filter incoming events; trigger settings select which events start tasks.
evidence: The only place this shows up is the reviewed page itself: "Use trigger settings to select which events start tasks. Instructions in the assignment do not filter incoming events." The page can't verify its own claim. Pulumi Cloud's…; source: repo:content/docs/ai/agents/triggers.md (reviewed file, circular); gh search code --owner pulumi "Follow-up batch window" (HTTP 429)
source: repo:content/docs/ai/agents/triggers.md (reviewed file, circular); gh search code --owner pulumi "Follow-up batch window" (HTTP 429)
pass1 · behavior · low confidence
#208 🤷 Unverifiable
content/docs/ai/agents/triggers.md:29
In Pulumi Cloud, creating a Pulumi-operation trigger involves opening Automations, selecting 'Set up trigger', entering a Name, setting Runs to 'When a…
evidence: I couldn't check these Pulumi Cloud UI labels ('Set up trigger', 'When a Pulumi operation completes', 'Create automation'). The UI code is closed-source, and both code searches failed with HTTP 429 rate limits. The only cited…; source: gh search code --owner pulumi "When a Pulumi operation completes" (HTTP 429); gh search code --owner pulumi "Set up trigger" (HTTP 429); github.com/pulumi/marketing-web/pull/252 (unreadable); intuition: The same page starts the Schedule section with 'New automation' → 'Start with a blank automation' but starts the…
source: gh search code --owner pulumi "When a Pulumi operation completes" (HTTP 429); gh search code --owner pulumi "Set up trigger" (HTTP 429); github.com/pulumi/marketing-web/pull/252 (unreadable)
pass1 · api-surface · low confidence
#209 🤷 Unverifiable
content/docs/ai/agents/triggers.md:38
For Pulumi-operation triggers on Pulumi agents, matching stacks are added to the task context automatically.
evidence: I couldn't check this claim. The behavior lives in Pulumi Cloud's private service code, and none of the readable public sources describe it. The only text that says it is the reviewed page itself (L38: "Matching stacks are added to the…; source: repo:content/docs/ai/agents/triggers.md; gh search code --owner pulumi (HTTP 429)
source: repo:content/docs/ai/agents/triggers.md; gh search code --owner pulumi (HTTP 429)
pass1 · behavior · low confidence
#210 🤷 Unverifiable
content/docs/ai/agents/triggers.md:40
For a Pulumi-operation trigger, the first matching event starts an agent task, and later matching events join that task while its batch window is open.
evidence: The batching behavior for Pulumi Cloud agent automation triggers is closed-source service behavior. The only cited implementing change, pulumi/marketing-web#252, can't be read (404), and both GitHub code searches I tried were…; source: repo:content/docs/ai/agents/triggers.md L40 (reviewed file, not evidence); gh search code --owner pulumi "followUpBatchWindow" (HTTP 429); pulumi/marketing-web#252 (unreadable)
source: repo:content/docs/ai/agents/triggers.md L40 (reviewed file, not evidence); gh search code --owner pulumi "followUpBatchWindow" (HTTP 429); pulumi/marketing-web#252 (unreadable)
pass1 · behavior · low confidence
#211 🤷 Unverifiable
content/docs/ai/agents/triggers.md:40
For a Pulumi-operation trigger, events that arrive while the agent is working are combined and delivered when the agent can accept more input.
evidence: This describes how the closed-source Pulumi Cloud agent-trigger service works, and I couldn't find any public pulumi/* source to check it against. The only other reference is the cited pulumi/marketing-web#252, which this review can't…; source: repo:content/docs/ai/agents/triggers.md L40; gh search code --owner pulumi (rate-limited HTTP 429); pulumi/marketing-web#252 unreadable
source: repo:content/docs/ai/agents/triggers.md L40; gh search code --owner pulumi (rate-limited HTTP 429); pulumi/marketing-web#252 unreadable
pass1 · behavior · low confidence
#212 🤷 Unverifiable
content/docs/ai/agents/triggers.md:42
The 'Follow-up batch window (seconds)' setting sets how long the batch stays open after the most recent event, capped at one hour after the first event.
framing: The claim describes Pulumi Cloud product behavior, but the source that implements it isn't public, and the cited marketing-web#252 couldn't be read.; evidence: I couldn't check this claim. The only text I found that states the batch-window behavior is the reviewed file itself (L42: "sets how long the batch stays open after the most recent event, up to one hour after the first event"), so it…; source: repo:content/docs/ai/agents/triggers.md#L40-L42; gh search code --owner pulumi "batch window" (HTTP 429); gh search code --owner pulumi "followUpBatchWindow" (HTTP 429)
source: repo:content/docs/ai/agents/triggers.md#L40-L42; gh search code --owner pulumi "batch window" (HTTP 429); gh search code --owner pulumi "followUpBatchWindow" (HTTP 429)
framing: The claim describes Pulumi Cloud product behavior, but the source that implements it isn't public, and the cited marketing-web#252 couldn't be read.
pass1 · behavior · low confidence
#213 🤷 Unverifiable
content/docs/ai/agents/triggers.md:46
In Pulumi Cloud, the webhook trigger is set up by opening Automations, selecting 'Set up trigger', setting Runs to 'When a webhook event arrives', choosing a…
evidence: The claim describes Pulumi Cloud console UI labels ("Set up trigger", "When a webhook event arrives", "Generic webhook"/"PagerDuty" presets, "Webhook URL", "Required header"). Those labels live in private Pulumi Cloud service/UI source…; source: gh search code --owner pulumi "When a webhook event arrives" (HTTP 429); repo:content/docs/ai/agents/triggers.md L46-54 (reviewed file, not evidence); pulumi/marketing-web#252 (unreadable)
source: gh search code --owner pulumi "When a webhook event arrives" (HTTP 429); repo:content/docs/ai/agents/triggers.md L46-54 (reviewed file, not evidence); pulumi/marketing-web#252 (unreadable)
pass1 · api-surface · low confidence
#214 🤷 Unverifiable
content/docs/ai/agents/triggers.md:53
After creating a webhook automation, the setup panel shows a Webhook URL and a Required header; the sender must include the header `X-Pulumi-Trigger-Secret`…
evidence: I couldn't find an independent source for the `X-Pulumi-Trigger-Secret` header name or the setup panel's "Webhook URL" and "Required header" fields. Pulumi Cloud's service code is private, both GitHub code searches failed with HTTP 429…; source: gh search code --owner pulumi "X-Pulumi-Trigger-Secret" (HTTP 429); repo:content/docs/ai/agents/triggers.md L53-54 (reviewed file, not evidence)
source: gh search code --owner pulumi "X-Pulumi-Trigger-Secret" (HTTP 429); repo:content/docs/ai/agents/triggers.md L53-54 (reviewed file, not evidence)
pass1 · api-surface · low confidence
#215 🤷 Unverifiable
content/docs/ai/agents/triggers.md:56
The Pulumi webhook trigger secret is shown only once, and if lost it can be rotated from the automation details page.
evidence: I couldn't check this. The behaviour (the trigger secret is shown once and can be rotated from the automation details page) is Pulumi Cloud UI behaviour, and that code isn't public. A gh code search for X-Pulumi-Trigger-Secret hit a rate…; source: repo:content/docs/ai/agents/triggers.md L56; gh search code --owner pulumi "X-Pulumi-Trigger-Secret" (HTTP 429); pulumi/marketing-web#252 (unreadable)
source: repo:content/docs/ai/agents/triggers.md L56; gh search code --owner pulumi "X-Pulumi-Trigger-Secret" (HTTP 429); pulumi/marketing-web#252 (unreadable)
pass1 · behavior · low confidence
#217 🤷 Unverifiable
content/docs/ai/agents/triggers.md:62
With the PagerDuty preset for Pulumi agent webhook triggers, the setup panel guides event subscription configuration, and if signature verification is…
evidence: The doc (L62-64) describes the Pulumi Cloud UI: a "PagerDuty signing secret" field that is separate from the X-Pulumi-Trigger-Secret header. That UI lives in closed-source Pulumi Cloud code, and the cited implementing change…; source: repo:content/docs/ai/agents/triggers.md L60-64; gh search code --owner pulumi "PagerDuty signing secret" (HTTP 429); github.com/pulumi/marketing-web/pull/252 (unreadable)
source: repo:content/docs/ai/agents/triggers.md L60-64; gh search code --owner pulumi "PagerDuty signing secret" (HTTP 429); github.com/pulumi/marketing-web/pull/252 (unreadable)
pass1 · behavior · low confidence
#218 🤷 Unverifiable
content/docs/ai/agents/triggers.md:68
In Pulumi Cloud, a scheduled automation is created by opening Automations, selecting 'New automation' then 'Start with a blank automation', setting Runs to…
evidence: These UI labels come from the Pulumi Cloud console, whose source is private, and the cited change (pulumi/marketing-web#252) returned 404, so it can't be read. A sibling page partly backs up the flow: "Open **Neo Tasks**, then the…; source: repo:content/docs/ai/neo/automations/_index.md L33; repo:content/docs/ai/agents/triggers.md L29,L46,L68; github.com/pulumi/marketing-web/pull/252 (unreadable); intuition: On the same page, operation and webhook automations start from "Set up trigger" but the schedule one starts from "New…
source: repo:content/docs/ai/neo/automations/_index.md L33; repo:content/docs/ai/agents/triggers.md L29,L46,L68; github.com/pulumi/marketing-web/pull/252 (unreadable)
pass1 · api-surface · low confidence
#219 🤷 Unverifiable
content/docs/ai/agents/triggers.md:77
Each task started by a scheduled automation uses the agent's saved instructions and access settings.
evidence: The claim is about how Pulumi Cloud Agents behave at runtime: scheduled tasks use the agent's saved instructions and access settings. That backend is closed source, and none of the public pulumi/* repos I can read describe it. The only…; source: repo:content/docs/ai/agents/triggers.md (context only); github.com/pulumi/marketing-web/pull/252 (unreadable)
source: repo:content/docs/ai/agents/triggers.md (context only); github.com/pulumi/marketing-web/pull/252 (unreadable)
pass1 · behavior · low confidence
#221 🤷 Unverifiable
content/docs/ai/agents/triggers.md:83
Disabling an automation or pausing an agent does not stop work already in progress; the running task must be canceled separately.
framing: Matches sibling page manage.md; only product source can confirm how disabling an automation affects running tasks.; evidence: The sibling page manage.md L25 says the same thing: "Pausing does not cancel work already executing. To cancel it, open the running task and select Cancel". But it's another editorial page, so it doesn't count as independent proof. The…; source: repo:content/docs/ai/agents/manage.md L23-33; pulumi/marketing-web#252 (unreadable)
source: repo:content/docs/ai/agents/manage.md L23-33; pulumi/marketing-web#252 (unreadable)
framing: Matches sibling page manage.md; only product source can confirm how disabling an automation affects running tasks.
pass1 · behavior · medium confidence
#224 🤷 Unverifiable
content/docs/ai/cli-for-agents/index.md:40
By default, resource changes are recorded in Pulumi state and support state tracking, drift detection, and policy enforcement. The `--stateless` flag opts…
evidence: (escalated from pass1) This claim is about how Pulumi's own CLI behaves: direct resource operations are recorded in state by default, and a `--stateless` flag opts out. Web search can't read Pulumi product source. The cited…; source: Not searched; this is a Pulumi product/CLI behavior claim that needs pulumi/pulumi source (pulumi/marketing-web#252 unreadable)
source: Not searched; this is a Pulumi product/CLI behavior claim that needs pulumi/pulumi source (pulumi/marketing-web#252 unreadable)
pass3 · url · low confidence
#227 🤷 Unverifiable
content/docs/ai/coding-agents/_index.md:14
The page /docs/ai/mcp-server/ exists and covers client configuration, authentication, and supported tools for the Pulumi MCP server.
evidence: I couldn't find a /docs/ai/mcp-server page in pulumi/docs. The `content/docs/ai` directory on master holds only _index.md, concepts, get-started, guides, integrations (cli-integrations.md, external-mcp-servers.md, slack) and reference.…; source: gh api repos/pulumi/docs/contents/content/docs/ai; gh api repos/pulumi/docs/contents/content/docs/ai/integrations; read_file content/docs/ai/mcp-server/_index.md (absent); intuition: Target page not found in pulumi/docs master; the link may break unless marketing-web#252 or an alias provides…
source: gh api repos/pulumi/docs/contents/content/docs/ai; gh api repos/pulumi/docs/contents/content/docs/ai/integrations; read_file content/docs/ai/mcp-server/_index.md (absent)
pass1 · url · low confidence
#228 🤷 Unverifiable
content/docs/ai/coding-agents/_index.md:18
The page /docs/ai/skills/ exists and lists the available Pulumi Agent Skills and installation instructions.
evidence: I couldn't find a /docs/ai/skills/ page anywhere I could read. There is no content/docs/ai/skills/_index.md or skills.md in the local tree, and pulumi/docs content/docs/ai on the default branch has only _index.md, concepts, get-started…; source: read_file content/docs/ai/skills/_index.md (missing); gh api repos/pulumi/docs/contents/content/docs/ai; unreadable pulumi/marketing-web#252; intuition: The link target doesn't exist in pulumi/docs. If marketing-web#252 doesn't ship /docs/ai/skills/, this link will be…
source: read_file content/docs/ai/skills/_index.md (missing); gh api repos/pulumi/docs/contents/content/docs/ai; unreadable pulumi/marketing-web#252
pass1 · url · low confidence
#229 🤷 Unverifiable
content/docs/ai/coding-agents/_index.md:26
The page /docs/ai/cli-for-agents/ exists and describes CLI features for agents such as structured JSON output and direct resource operations.
evidence: There's no page for /docs/ai/cli-for-agents/ in this repo. Neither content/docs/ai/cli-for-agents/_index.md nor cli-for-agents.md exists locally, and pulumi/docs master's content/docs/ai/ has no cli-for-agents entry. The sibling links…; source: gh api repos/pulumi/docs/contents/content/docs/ai; read_file content/docs/ai/cli-for-agents/_index.md (missing); intuition: The link target may not exist yet. If marketing-web#252 doesn't add /docs/ai/cli-for-agents/, this is a broken link.
source: gh api repos/pulumi/docs/contents/content/docs/ai; read_file content/docs/ai/cli-for-agents/_index.md (missing)
pass1 · url · low confidence
#230 🤷 Unverifiable
content/docs/ai/coding-agents/handoff.md:14
The docs page /docs/ai/skills/ has a 'delegation plugin' section (anchor #delegation-plugin) describing how to install the Pulumi delegation plugin/skill.
evidence: I couldn't find a /docs/ai/skills/ page with a #delegation-plugin anchor anywhere I could read. There is no content/docs/ai/skills.md or skills/_index.md in this repo, and pulumi/docs content/docs/ai only lists _index.md, concepts…; source: read_file content/docs/ai/skills.md (not found); gh api repos/pulumi/docs/contents/content/docs/ai; intuition: The link target may be broken: /docs/ai/skills/ doesn't exist in pulumi/docs as far as I can see, so check it…
source: read_file content/docs/ai/skills.md (not found); gh api repos/pulumi/docs/contents/content/docs/ai
pass1 · url · low confidence
#232 🤷 Unverifiable
content/docs/ai/neo/_index.md:5
Neo is the pre-built personal agent in Pulumi Agents; each user gets one with Pulumi Agents.
evidence: I couldn't find an independent source that describes Neo as "the pre-built personal agent" in a Pulumi Agents product. The only page that says so is the reviewed page. data/pulumi_editions.yaml lists `pulumi-agents` (min_edition: pro…; source: repo:data/pulumi_editions.yaml (lines 190-196); pulumi/marketing-web#252 unreadable (404); intuition: The editions data puts Neo at Essentials but Pulumi Agents at Pro, so "each user gets Neo with Pulumi Agents" may not…
source: repo:data/pulumi_editions.yaml (lines 190-196); pulumi/marketing-web#252 unreadable (404)
pass1 · feature · low confidence
#247 🤷 Unverifiable
content/docs/ai/neo/integrations/cli/_index.md:16
When an agent uses a CLI integration, it calls the CLI against credentials managed in Pulumi ESC, scoped to exactly the permissions the user chooses.
framing: The linked page only defines Pulumi ESC. It doesn't cover how Neo uses CLI credentials or the claim that permissions are "scoped to exactly the permissions…; evidence: I couldn't verify how Neo uses the CLI. The /docs/esc/ link works and points to the right page: content/docs/esc/_index.md describes "Pulumi ESC (Environments, Secrets, and Configuration) provides centralized secrets management". But…; source: repo:content/docs/esc/_index.md; repo:content/docs/ai/neo/integrations/cli/_index.md (reviewed file, not used as evidence); intuition: "Scoped to exactly the permissions you choose" is marketing wording. The scope actually comes from whatever…
source: repo:content/docs/esc/_index.md; repo:content/docs/ai/neo/integrations/cli/_index.md (reviewed file, not used as evidence)
framing: shifted — The linked page only defines Pulumi ESC. It doesn't cover how Neo uses CLI credentials or the claim that permissions are "scoped to exactly the permissions you choose".
pass1 · url · medium confidence
#248 🤷 Unverifiable
content/docs/ai/neo/integrations/cli/_index.md:22
A CLI integration requires an ESC environment that emits the environment variables the CLI expects (for example, `AWS_ACCESS_KEY_ID` for the AWS CLI).
evidence: I couldn't check this against an independent source. The Neo CLI-integration backend lives in closed-source Pulumi Cloud, my one GitHub code search hit a rate limit (HTTP 429), and the cited github.com/pulumi/marketing-web/pull/252 can't…; source: read_file content/docs/ai/neo/integrations/cli/_index.md (reviewed file only); gh search code --owner pulumi "CLOUDSDK_AUTH_ACCESS_TOKEN neo" → HTTP 429; intuition: Looks plausible and matches the page's own supported-CLIs table, but the claim is about Pulumi Cloud behavior that…
source: read_file content/docs/ai/neo/integrations/cli/_index.md (reviewed file only); gh search code --owner pulumi "CLOUDSDK_AUTH_ACCESS_TOKEN neo" → HTTP 429
pass1 · behavior · low confidence
#249 🤷 Unverifiable
content/docs/ai/neo/integrations/cli/_index.md:24
An agent refers to a CLI connection by the name the user gave it (for example `production-aws`) when it decides which connection to use.
evidence: I couldn't find an independent source for how Neo agents pick a CLI connection. The behavior lives in the closed-source Pulumi Cloud/Neo backend. The only other source is the cited github.com/pulumi/marketing-web/pull/252, which this…; source: repo:content/docs/ai/neo/integrations/cli/_index.md L24; layouts/shortcodes/agent-cli-connection.html; gh search code (HTTP 429)
source: repo:content/docs/ai/neo/integrations/cli/_index.md L24; layouts/shortcodes/agent-cli-connection.html; gh search code (HTTP 429)
pass1 · behavior · low confidence
#250 🤷 Unverifiable
content/docs/ai/neo/integrations/cli/_index.md:26
When an agent decides to use a CLI integration, it runs the equivalent of `pulumi env run <orgLogin>/<escProject>/<escEnvironment> -- <cli> <args>`.
evidence: I couldn't confirm this. The claim describes how Neo's agent runtime calls a CLI through ESC, and that code isn't in any public pulumi/* repo I could reach. The only source is the reviewed page itself ("runs the equivalent of: pulumi env…; source: repo:content/docs/ai/neo/integrations/cli/_index.md (reviewed file only); gh search code --owner pulumi "env run escProject escEnvironment" → HTTP 429; intuition: The wording "equivalent of" hedges this as a model of what happens, not the literal call. `pulumi env run…
source: repo:content/docs/ai/neo/integrations/cli/_index.md (reviewed file only); gh search code --owner pulumi "env run escProject escEnvironment" → HTTP 429
pass1 · behavior · low confidence
#252 🤷 Unverifiable
content/docs/ai/neo/integrations/cli/_index.md:38
The `aws` CLI integration requires the environment variables `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`, with optional `AWS_SESSION_TOKEN` (temporary…
evidence: The only source for the Neo CLI integration's required and optional env vars is the reviewed page itself (L38 table), and that page can't verify its own claim. The product definition probably lives in private Pulumi service code. GitHub…; source: gh search code --owner pulumi "CLOUDSDK_AUTH_ACCESS_TOKEN AZURE_CLIENT_SECRET" (HTTP 429); repo:content/docs/ai/neo/integrations/cli/_index.md L36-41 (reviewed file, not evidence); intuition: Plausible because it matches the standard AWS CLI env vars. Note that the AWS CLI reads AWS_REGION or…
source: gh search code --owner pulumi "CLOUDSDK_AUTH_ACCESS_TOKEN AZURE_CLIENT_SECRET" (HTTP 429); repo:content/docs/ai/neo/integrations/cli/_index.md L36-41 (reviewed file, not evidence)
pass1 · api-surface · low confidence
#260 🤷 Unverifiable
content/docs/ai/neo/integrations/cli/_index.md:60
Using a CLI connection requires permission to open the backing ESC environment; for a team-configured agent access is granted through the agent's Pulumi…
evidence: This describes how Pulumi Cloud (closed source) checks permissions for agent CLI connections: whether a team-configured agent's role or the Neo user must be able to open the ESC environment. I couldn't find any independent source in this…; source: repo:content/docs/ai/neo/integrations/cli/_index.md (reviewed file, not evidence); gh search code --owner pulumi (HTTP 429)
source: repo:content/docs/ai/neo/integrations/cli/_index.md (reviewed file, not evidence); gh search code --owner pulumi (HTTP 429)
pass1 · behavior · low confidence
#261 🤷 Unverifiable
content/docs/ai/neo/integrations/cli/_index.md:60
Using a CLI connection requires permission to open the backing ESC environment.
evidence: I couldn't find an independent source that settles this. The only support is the reviewed page itself (L60: "using it requires permission to open that environment"; it says the same thing again at L85 and L113), and that can't verify its…; source: repo:content/docs/ai/neo/integrations/cli/_index.md (L60, L85, L113); gh search code attempt (HTTP 429); intuition: This fits how ESC already works: `pulumi env run` needs open permission on the environment. So the claim is…
source: repo:content/docs/ai/neo/integrations/cli/_index.md (L60, L85, L113); gh search code attempt (HTTP 429)
pass1 · behavior · low confidence
#262 🤷 Unverifiable
content/docs/ai/neo/integrations/cli/_index.md:62
For an agent a team configures, access to the CLI connection's ESC environment is granted through the agent's Pulumi Cloud role.
framing: The sibling docs page agrees with the claim, but agreement between Pulumi pages doesn't verify it. Confirming it needs Pulumi Cloud service source, which is…; evidence: The sibling page content/docs/ai/agents/permissions.md says the same thing: "If an integration uses Pulumi ESC, the agent also needs permission to open the environment. Its Pulumi Cloud role controls that access". But that is an…; source: repo:content/docs/ai/agents/permissions.md L34; gh search code --owner pulumi "agent role ESC environment CLI integration" (no results); pulumi/marketing-web#252 unreadable
source: repo:content/docs/ai/agents/permissions.md L34; gh search code --owner pulumi "agent role ESC environment CLI integration" (no results); pulumi/marketing-web#252 unreadable
framing: The sibling docs page agrees with the claim, but agreement between Pulumi pages doesn't verify it. Confirming it needs Pulumi Cloud service source, which is private.
pass1 · behavior · medium confidence
#265 🤷 Unverifiable
content/docs/ai/neo/integrations/cli/_index.md:77
Multiple instances of the same CLI can be connected, each pointing at a separate ESC environment, and an agent can use multiple connections in the same task…
evidence: I couldn't find any readable product source for this. Neo's CLI integration behavior (more than one connection per CLI type, and an agent using several connections in one task) seems to live in private Pulumi Cloud service code. A gh…; source: gh search code --owner pulumi "staging-aws production-aws" (no results); repo:content/docs/ai/neo/integrations/cli/_index.md L77 (reviewed file, not evidence); pulumi/marketing-web#252 unreadable
source: gh search code --owner pulumi "staging-aws production-aws" (no results); repo:content/docs/ai/neo/integrations/cli/_index.md L77 (reviewed file, not evidence); pulumi/marketing-web#252 unreadable
pass1 · behavior · low confidence
#266 🤷 Unverifiable
content/docs/ai/neo/integrations/cli/_index.md:81
For an agent a team has configured, connected CLI integrations are available without a selection step.
evidence: Pulumi Cloud's agent task UI isn't in any public pulumi/* source I could read, and the cited implementing change (pulumi/marketing-web#252) is unreadable (404). The only statement of this behavior is the reviewed page itself (L81, L89…; source: repo:content/docs/ai/neo/integrations/cli/_index.md (reviewed file only); github.com/pulumi/marketing-web/pull/252 unreadable
source: repo:content/docs/ai/neo/integrations/cli/_index.md (reviewed file only); github.com/pulumi/marketing-web/pull/252 unreadable
pass1 · behavior · low confidence
#267 🤷 Unverifiable
content/docs/ai/neo/integrations/cli/_index.md:85
The agent needs permission to open the connection's ESC environment, and the AWS credentials must allow listing buckets and reading their versioning settings.
evidence: I couldn't confirm the ESC-open permission requirement against product source: GitHub code search returned HTTP 429 (rate limited), and the cited implementing change, pulumi/marketing-web#252, can't be read with the review's credentials.…; source: repo:content/docs/ai/neo/integrations/cli/_index.md L60-L65, L113; gh search code (HTTP 429)
source: repo:content/docs/ai/neo/integrations/cli/_index.md L60-L65, L113; gh search code (HTTP 429)
pass1 · behavior · low confidence
#268 🤷 Unverifiable
content/docs/ai/neo/integrations/cli/_index.md:89
Neo provides a per-task CLI selector, and tasks for agents your team configures do not have this selector.
evidence: I couldn't check this claim. It describes how the Pulumi Cloud task composer UI behaves (a per-task "CLI integrations" submenu for Neo that agents your team configures don't get), and that UI is closed source. The only place the claim is…; source: repo:content/docs/ai/neo/integrations/cli/_index.md (reviewed file, not independent); gh search code --owner pulumi "CLI integrations connected" (HTTP 429)
source: repo:content/docs/ai/neo/integrations/cli/_index.md (reviewed file, not independent); gh search code --owner pulumi "CLI integrations connected" (HTTP 429)
pass1 · feature · low confidence
#269 🤷 Unverifiable
content/docs/ai/neo/integrations/cli/_index.md:91
By default a Neo task inherits all CLI integrations the organization has connected, and the task composer has a **CLI integrations** submenu where individual…
evidence: This describes the Pulumi Cloud Neo task composer UI (a "CLI integrations" submenu, plus org-level integrations being inherited by default), and that code lives in private service repos. No sibling Neo integrations doc mentions…; source: read_file content/docs/ai/neo/integrations/_index.md (no match for inherit|composer|toggle); gh search code --owner pulumi "CLI integrations" (HTTP 429)
source: read_file content/docs/ai/neo/integrations/_index.md (no match for inherit|composer|toggle); gh search code --owner pulumi "CLI integrations" (HTTP 429)
pass1 · behavior · low confidence
#270 🤷 Unverifiable
content/docs/ai/neo/integrations/cli/_index.md:99
A CLI integration is removed in Neo Settings > Integrations > CLI tools by selecting **Manage integration** and then **Disconnect integration**.
evidence: The labels in this UI path (Neo Settings > Integrations > CLI tools > Manage integration > Disconnect integration) come from the private Pulumi Cloud console. The sibling integrations index doesn't mention them, and GitHub code search…; source: repo:content/docs/ai/neo/integrations/_index.md; gh search code --owner pulumi "Disconnect integration" (HTTP 429)
source: repo:content/docs/ai/neo/integrations/_index.md; gh search code --owner pulumi "Disconnect integration" (HTTP 429)
pass1 · behavior · low confidence
#271 🤷 Unverifiable
content/docs/ai/neo/integrations/cli/_index.md:101
Disconnecting a CLI integration removes the connection's reference to the ESC environment without modifying or deleting the ESC environment itself.
evidence: The only statement of this behavior I found is in the page under review (L101: "Removes the connection's reference to the ESC environment. **It does not modify or delete the ESC environment itself.**"), so it can't verify itself. A code…; source: read_file content/docs/ai/neo/integrations/cli/_index.md; gh search code --owner pulumi "cli integration disconnect esc" (no results); github.com/pulumi/marketing-web/pull/252 (unreadable, 404); intuition: Plausible design (a connection holds only a reference), but only the Pulumi Cloud backend team can confirm it.
source: read_file content/docs/ai/neo/integrations/cli/_index.md; gh search code --owner pulumi "cli integration disconnect esc" (no results); github.com/pulumi/marketing-web/pull/252 (unreadable, 404)
pass1 · behavior · low confidence
#272 🤷 Unverifiable
content/docs/ai/neo/integrations/cli/_index.md:102
Tasks that are already running lose access to a disconnected CLI integration the next time the agent tries to use it.
evidence: I couldn't check this. How Neo/Pulumi Cloud handles a CLI integration that is disconnected while tasks are running is service-side behavior in closed-source code. GitHub code search returned HTTP 429 (rate limited). The cited change…; source: repo:content/docs/ai/neo/integrations/cli/_index.md L97-103; gh search code --owner pulumi "neo CLI integration disconnect" (HTTP 429); pulumi/marketing-web#252 unreadable (404); intuition: Revoking access lazily on next use is plausible, but whether the service re-checks the connection on each use or…
source: repo:content/docs/ai/neo/integrations/cli/_index.md L97-103; gh search code --owner pulumi "neo CLI integration disconnect" (HTTP 429); pulumi/marketing-web#252 unreadable (404)
pass1 · behavior · low confidence
#273 🤷 Unverifiable
content/docs/ai/neo/integrations/cli/_index.md:107
Connect and disconnect events for CLI integrations are written to the organization's audit log, attributed to the acting user, and record the CLI, connection…
evidence: The audit-logging behavior belongs to the Pulumi Cloud service, whose source I can't read. A code search of the pulumi org returned no matches, and the follow-up search hit the GitHub rate limit (HTTP 429). The cited change…; source: gh search code --owner pulumi "cli integration audit log neo" (no results); gh search code "AgentIntegration audit" (HTTP 429)
source: gh search code --owner pulumi "cli integration audit log neo" (no results); gh search code "AgentIntegration audit" (HTTP 429)
pass1 · behavior · low confidence
#274 🤷 Unverifiable
content/docs/ai/neo/integrations/cli/_index.md:109
Individual CLI invocations made by an agent during a task are visible in the task transcript alongside its other tool calls.
evidence: No readable source confirms that CLI invocations show up in the Neo task transcript. The Neo tasks docs don't mention transcripts or how tool calls are displayed, and Neo's backend code isn't public. GitHub code search returned HTTP 429…; source: repo:content/docs/ai/neo/tasks/_index.md; gh search code (HTTP 429); pulumi/marketing-web#252 (unreadable)
source: repo:content/docs/ai/neo/tasks/_index.md; gh search code (HTTP 429); pulumi/marketing-web#252 (unreadable)
pass1 · behavior · low confidence
#275 🤷 Unverifiable
content/docs/ai/neo/integrations/cli/_index.md:113
ESC access errors for a CLI integration are resolved by checking the configured agent's role, or for Neo the acting user's permissions, since the relevant…
evidence: I couldn't check this against an independent source. The only text that states the rule is the page under review (L60-63: "For an agent your team configures, grant access through the agent's Pulumi Cloud role. For Neo, the user running…; source: repo:content/docs/ai/neo/integrations/cli/_index.md L60-63, L113; gh search code (HTTP 429); intuition: The claim matches the page's own setup section (L60-63), but I could only confirm that the page agrees with itself…
source: repo:content/docs/ai/neo/integrations/cli/_index.md L60-63, L113; gh search code (HTTP 429)
pass1 · behavior · low confidence
#276 🤷 Unverifiable
content/docs/ai/neo/integrations/cli/_index.md:115
For Neo, per-task selection can be used to limit a task to specific CLI connections, and access to ESC environments can be limited through the agent's role…
evidence: The claim matches the reviewed page itself (L60-63: "For an agent your team configures, grant access through the agent's Pulumi Cloud role. For Neo, the user running the task needs access."; L89: "Neo provides a per-task CLI selector.")…; source: repo:content/docs/ai/neo/integrations/cli/_index.md L60-93 (internal consistency only); gh search code attempts returned HTTP 429; intuition: Consistent with the page's own setup and per-task sections; no sign it's wrong, but the product behavior is only…
source: repo:content/docs/ai/neo/integrations/cli/_index.md L60-93 (internal consistency only); gh search code attempts returned HTTP 429
pass1 · behavior · low confidence
#278 🤷 Unverifiable
content/docs/ai/neo/integrations/mcp/_index.md:16
For Pulumi Agents' MCP integrations, an organization administrator connects each external provider with credentials stored in Pulumi Cloud.
framing: Wrong target: the source defines the MCP protocol in general, while the claim is about how Pulumi's MCP integrations handle admin setup and credential storage.; evidence: The cited page loaded (HTTP 200), but it is only the MCP protocol home page ("What is the Model Context Protocol (MCP)?"). It says nothing about Pulumi Agents, organization administrators, or credentials stored in Pulumi Cloud. The link…; source: https://modelcontextprotocol.io/
source: https://modelcontextprotocol.io/
framing: shifted — Wrong target: the source defines the MCP protocol in general, while the claim is about how Pulumi's MCP integrations handle admin setup and credential storage.
pass2 · url · low confidence
#280 🤷 Unverifiable
content/docs/ai/neo/integrations/mcp/_index.md:21
Pulumi Agents' supported external MCP integrations are Atlassian (Jira and Confluence), Cloudflare, Dash0, Datadog, Honeycomb, Linear, New Relic, PagerDuty…
evidence: The list of supported MCP integrations is set by Pulumi Cloud, which is closed source. Code searches of the public pulumi org found nothing for these providers. The cited change pulumi/marketing-web#252 couldn't be read (404). The only…; source: gh search code --owner pulumi "Dash0 Honeycomb PagerDuty Supabase" (no results); pulumi/marketing-web#252 unreadable
source: gh search code --owner pulumi "Dash0 Honeycomb PagerDuty Supabase" (no results); pulumi/marketing-web#252 unreadable
pass1 · feature · low confidence
#281 🤷 Unverifiable
content/docs/ai/neo/integrations/mcp/_index.md:25
To enable an MCP integration in Pulumi Cloud, navigate to Neo Settings, select Integrations, open MCP servers, find the provider under Available, select…
evidence: The navigation path (Neo Settings > Integrations > MCP servers > Available > Authorize > Save) describes the Pulumi Cloud console UI, which isn't in any public pulumi/* source I could search. The sibling page…; source: repo:content/docs/ai/agents/integrations/datadog.md; gh search code --owner pulumi "Neo Settings Integrations MCP servers Authorize" (no results)
source: repo:content/docs/ai/agents/integrations/datadog.md; gh search code --owner pulumi "Neo Settings Integrations MCP servers Authorize" (no results)
pass1 · behavior · low confidence
#282 🤷 Unverifiable
content/docs/ai/neo/integrations/mcp/_index.md:27
Available tools for an external MCP integration depend on the credentials and authentication method the service supports.
evidence: The claim describes how Pulumi Cloud's Neo MCP integration backend behaves, and that code is closed-source. The only support is the reviewed page itself (e.g., the New Relic section: "Tools that require OAuth are unavailable through this…; source: repo:content/docs/ai/neo/integrations/mcp/_index.md (context only); github.com/pulumi/marketing-web/pull/252 (unreadable); intuition: Broad, hard-to-falsify generalization; plausible (an API-key-only setup can't reach OAuth-only tools), but the…
source: repo:content/docs/ai/neo/integrations/mcp/_index.md (context only); github.com/pulumi/marketing-web/pull/252 (unreadable)
pass1 · behavior · low confidence
#283 🤷 Unverifiable
content/docs/ai/neo/integrations/mcp/_index.md:31
When a task needs an integration, Pulumi Cloud decrypts the credentials at task time, constructs the authentication headers, and connects to the service on…
evidence: This describes how Pulumi Cloud's Neo service handles integration credentials internally: it decrypts them at task time, builds the auth headers, and connects for the agent. That service code isn't public, and the GitHub code search was…; source: gh search code --owner pulumi "neo integration credentials decrypt mcp" (HTTP 429)
source: gh search code --owner pulumi "neo integration credentials decrypt mcp" (HTTP 429)
pass1 · behavior · low confidence
#284 🤷 Unverifiable
content/docs/ai/neo/integrations/mcp/_index.md:31
MCP integration credentials are never exposed to the language model and are never embedded in task state.
evidence: The claim is about how Pulumi Cloud's Neo backend handles credentials internally. That code is closed-source and not in any public pulumi/* repo. The only independent support could be the cited github.com/pulumi/marketing-web/pull/252…; source: repo:content/docs/ai/neo/integrations/mcp/_index.md L31 (reviewed file, not evidence); gh search code --owner pulumi (rate-limited, HTTP 429); intuition: Absolute security guarantees ("never exposed", "never embedded") should be signed off by the Neo service team.
source: repo:content/docs/ai/neo/integrations/mcp/_index.md L31 (reviewed file, not evidence); gh search code --owner pulumi (rate-limited, HTTP 429)
pass1 · behavior · low confidence
#285 🤷 Unverifiable
content/docs/ai/neo/integrations/mcp/_index.md:35
To remove an MCP integration, navigate to Neo Settings, select Integrations, open MCP servers, find the integration, select Manage integration, then…
evidence: This is a Pulumi Cloud UI path, and the UI source isn't public. I couldn't read the cited pulumi/marketing-web#252 either. A sibling page uses the same steps: "navigate to **Neo Settings**, **Integrations**, **CLI tools**, find the…; source: gh search code --owner pulumi "Disconnect integration" (only hit: pulumi/docs:content/docs/ai/integrations/cli-integrations.md)
source: gh search code --owner pulumi "Disconnect integration" (only hit: pulumi/docs:content/docs/ai/integrations/cli-integrations.md)
pass1 · behavior · low confidence
#286 🤷 Unverifiable
content/docs/ai/neo/integrations/mcp/_index.md:37
Disabling an MCP integration deletes its stored credentials and immediately prevents any new tasks from using it.
evidence: This describes how the private Pulumi Cloud/Neo backend handles disconnecting an integration: credentials are deleted and new tasks lose access immediately. I couldn't find any public pulumi/* source to confirm or refute it. The only…; source: repo:content/docs/ai/neo/integrations/mcp/_index.md L33-37 (context only); pulumi/marketing-web#252 unreadable; intuition: Two guarantees in one sentence ("deletes credentials" and "immediately prevents"), both about backend behavior that…
source: repo:content/docs/ai/neo/integrations/mcp/_index.md L33-37 (context only); pulumi/marketing-web#252 unreadable
pass1 · behavior · low confidence
#288 🤷 Unverifiable
content/docs/ai/neo/integrations/mcp/_index.md:43
Neo tasks inherit all MCP integrations enabled by the organization, and integrations can be turned off in the task composer before starting a task, applying…
evidence: The only support is the reviewed page itself (L43: "Neo tasks inherit all integrations enabled by the organization... This selection applies only to that task."), and a page can't verify its own claim. The Pulumi Cloud console code that…; source: repo:content/docs/ai/neo/integrations/mcp/_index.md L39-43; gh search issues --owner pulumi "neo MCP integrations per-task toggle" (no results); pulumi/marketing-web#252 unreadable (404)
source: repo:content/docs/ai/neo/integrations/mcp/_index.md L39-43; gh search issues --owner pulumi "neo MCP integrations per-task toggle" (no results); pulumi/marketing-web#252 unreadable (404)
pass1 · behavior · low confidence
#289 🤷 Unverifiable
content/docs/ai/neo/integrations/mcp/_index.md:47
To replace expired credentials for an MCP integration, disconnect the integration and then authorize it again with new credentials.
evidence: The only support is the reviewed page itself (L35 describes "Manage integration, then Disconnect integration" and L47 says to re-authorize). Neo MCP integration behavior lives in Pulumi Cloud source, which isn't public. GitHub code…; source: repo:content/docs/ai/neo/integrations/mcp/_index.md L35-47; gh search code --owner pulumi "Disconnect integration" (HTTP 429); intuition: Many integration UIs let you edit or rotate credentials in place. If the "Manage integration" dialog has an update…
source: repo:content/docs/ai/neo/integrations/mcp/_index.md L35-47; gh search code --owner pulumi "Disconnect integration" (HTTP 429)
pass1 · behavior · low confidence
#290 🤷 Unverifiable
content/docs/ai/neo/integrations/mcp/_index.md:49
A failure to retrieve or decrypt stored credentials can prevent a task from starting or continuing, while some other connection failures leave other tools…
evidence: This describes how Neo's MCP integration runtime handles errors, which lives in Pulumi Cloud's closed-source service. No public pulumi/* source I can read covers it, and the cited implementing change (pulumi/marketing-web#252) returned…; source: repo:content/docs/ai/neo/integrations/mcp/_index.md (L45-49); github.com/pulumi/marketing-web/pull/252 (unreadable, 404)
source: repo:content/docs/ai/neo/integrations/mcp/_index.md (L45-49); github.com/pulumi/marketing-web/pull/252 (unreadable, 404)
pass1 · behavior · low confidence
#292 🤷 Unverifiable
content/docs/ai/neo/integrations/mcp/_index.md:55
Atlassian Rovo MCP setup: in admin.atlassian.com open Rovo MCP and enable API token authentication; open Directory then Service Accounts; create a service…
framing: The source_hint is a placeholder site URL in the docs, not a citation for the procedure. Atlassian's Rovo MCP admin docs would be the right source to check.; evidence: The cited URL is a placeholder example (yoursite.atlassian.net), not a source for the setup steps. It returned HTTP 202 with an empty body, so nothing on it confirms the admin.atlassian.com Rovo MCP, service account, or API credential…; source: https://yoursite.atlassian.net
source: https://yoursite.atlassian.net
framing: The source_hint is a placeholder site URL in the docs, not a citation for the procedure. Atlassian's Rovo MCP admin docs would be the right source to check.
pass2 · url · low confidence
#294 🤷 Unverifiable
content/docs/ai/neo/integrations/mcp/_index.md:70
Dash0 MCP integration setup: in Dash0 Settings > Endpoints copy the MCP endpoint URL; under Settings > Auth Tokens create an organization auth token with…
evidence: (escalated from pass1) Dash0's hub backs the endpoint step: "find it under Settings → Endpoints in Dash0." The token permission does not line up: Dash0's MCP README says to create a token "with All permissions on the Dataset(s)," and the…; source: https://www.dash0.com/hub/integrations/int_dash0_mcp/overview; https://github.com/dash0hq/mcp-dash0; intuition: "Reading permissions" on an organization token may not match Dash0's dataset-scoped token model (the README says All… (WebSearch dispatched but verification did not converge within the turn budget)
source: https://www.dash0.com/hub/integrations/int_dash0_mcp/overview; https://github.com/dash0hq/mcp-dash0
pass3 · api-surface · low confidence
#295 🤷 Unverifiable
content/docs/ai/neo/integrations/mcp/_index.md:74
Dash0 uses regional endpoints, and Dash0's auth token documentation at https://www.dash0.com/docs/dash0/miscellaneous/glossary/auth-tokens explains scoping a…
framing: The page exists and its title matches "auth token documentation". The fetched body doesn't include the passage about permission scoping, so no framing…; evidence: The cited URL returns HTTP 200 and is a live Dash0 docs page titled "Auth Tokens · Dash0" ("Settings / Auth Tokens"). The fetched body was cut off in the site navigation, so it shows no text about scoping a token's permissions or about…; source: https://www.dash0.com/docs/dash0/miscellaneous/glossary/auth-tokens
source: https://www.dash0.com/docs/dash0/miscellaneous/glossary/auth-tokens
framing: The page exists and its title matches "auth token documentation". The fetched body doesn't include the passage about permission scoping, so no framing comparison was possible.
pass2 · url · low confidence
#303 🤷 Unverifiable
content/docs/ai/neo/integrations/mcp/_index.md:106
New Relic MCP integration setup: an administrator enables New Relic MCP Server > API Keys in Feature Control Manager and grants MCP read access to an…
framing: New Relic docs cover the FCM toggle, API Keys sub-toggle, MCP read role and User API Key steps; the Pulumi-side form fields are not covered by any external…; evidence: (escalated from pass1) New Relic's own docs back up the setup steps on their side. Under Feature Control there is a "New Relic MCP Server" toggle, and "API Keys: Required for API key connections, including automated scripts." Access…; source: https://docs.newrelic.com/docs/agentic-ai/mcp/overview/ ; https://docs.newrelic.com/docs/agentic-ai/mcp/troubleshoot/ ; https://www.oodle.ai/guides/mcp/new-relic (WebSearch dispatched but verification did not converge within the turn budget)
source: https://docs.newrelic.com/docs/agentic-ai/mcp/overview/ ; https://docs.newrelic.com/docs/agentic-ai/mcp/troubleshoot/ ; https://www.oodle.ai/guides/mcp/new-relic
framing: entailed-narrower — New Relic docs cover the FCM toggle, API Keys sub-toggle, MCP read role and User API Key steps; the Pulumi-side form fields are not covered by any external source.
pass3 · api-surface · medium confidence
#304 🤷 Unverifiable
content/docs/ai/neo/integrations/mcp/_index.md:108
1. In the New Relic integration, enter your account's **Region** (`us`, `eu`, or `jp`) and the **User API Key**.
framing: The external fact (New Relic has US/EU/JP regions) is confirmed. The Pulumi Neo integration UI fields still need checking against product source.; evidence: (escalated from pass1) The New Relic side checks out: New Relic's docs say "The New Relic global data hosting structure consists of three regions: the US region (default), EU region, and JP region," and the JP region went GA in 2026.…; source: https://docs.newrelic.com/docs/accounts/accounts-billing/account-setup/choose-your-data-center/; intuition: New Relic's hosted MCP server only lists US and EU endpoints in third-party writeups (mcp.newrelic.com… (WebSearch dispatched but verification did not converge within the turn budget)
source: https://docs.newrelic.com/docs/accounts/accounts-billing/account-setup/choose-your-data-center/
framing: The external fact (New Relic has US/EU/JP regions) is confirmed. The Pulumi Neo integration UI fields still need checking against product source.
pass3 · temporal · medium confidence
#305 🤷 Unverifiable
content/docs/ai/neo/integrations/mcp/_index.md:110
The New Relic API key uses the automation account's permissions, and tools that require OAuth are unavailable through this API-key integration, per New Relic…
framing: Couldn't run the framing check: the source text was not in the truncated body.; evidence: The cited page returned HTTP 200, but the pre-fetched body cuts off inside inline CSS and KaTeX font data. None of the authentication-options text is visible, so I can't quote anything about API-key permissions or which tools need OAuth.; source: https://docs.newrelic.com/docs/agentic-ai/mcp/overview/#authentication-options
source: https://docs.newrelic.com/docs/agentic-ai/mcp/overview/#authentication-options
framing: Couldn't run the framing check: the source text was not in the truncated body.
pass2 · attribution · low confidence
#308 🤷 Unverifiable
content/docs/ai/neo/integrations/mcp/_index.md:125
For Sentry, create an internal integration under Settings > Custom Integrations, grant Read access to Organization, Project, Team, and Issue & Event, and…
framing: The Sentry setup steps are confirmed. The list of required scopes and the field labels are Pulumi Neo product details, so web search can't settle them.; evidence: (escalated from pass1) Sentry's own docs confirm the navigation: "Click 'Custom Integrations' in the left side panel to create a new internal integration and org-level auth token." These are real Sentry permission categories, and…; source: https://docs.sentry.io/api/guides/create-auth-token; WebSearch ran query "Sentry internal integration Settings Custom Integrations token permissions"
source: https://docs.sentry.io/api/guides/create-auth-token; WebSearch ran query "Sentry internal integration Settings Custom Integrations token permissions"
framing: The Sentry setup steps are confirmed. The list of required scopes and the field labels are Pulumi Neo product details, so web search can't settle them.
pass3 · api-surface · medium confidence
#309 🤷 Unverifiable
content/docs/ai/neo/integrations/mcp/_index.md:129
The Sentry MCP integration connects to Sentry SaaS only.
evidence: The page says "This integration connects to Sentry SaaS." I couldn't find independent product source to confirm it: GitHub code search for the Sentry MCP endpoint was rate-limited (HTTP 429). The integration config probably lives in…; source: gh search code --owner pulumi "mcp.sentry.dev" (HTTP 429); repo:content/docs/ai/neo/integrations/mcp/_index.md L129; intuition: The claim adds "only" but the page just says "connects to Sentry SaaS", so self-hosted Sentry support isn't…
source: gh search code --owner pulumi "mcp.sentry.dev" (HTTP 429); repo:content/docs/ai/neo/integrations/mcp/_index.md L129
pass1 · feature · low confidence
#298 ❌ Contradicted
content/docs/ai/neo/integrations/mcp/_index.md:87
The Honeycomb Key ID and Key Secret cannot be viewed again after they are first shown.
framing: Claim treats both Key ID and Key Secret as shown only once; vendor docs limit that to the Secret. Settled from Honeycomb docs; the unreadable…; evidence: (escalated from pass1) Honeycomb's docs say only the Secret is one-time; the Key ID can be viewed again: "Your Key ID is always available after creation, but your Secret is not." The claim gets the Secret right but is wrong to say the…; source: https://docs.honeycomb.io/configure/teams/manage-api-keys
source: https://docs.honeycomb.io/configure/teams/manage-api-keys
framing: Claim treats both Key ID and Key Secret as shown only once; vendor docs limit that to the Secret. Settled from Honeycomb docs; the unreadable pulumi/marketing-web#252 was not needed.
pass3 · behavior · high confidence
#334 🚩 Flagged
content/docs/ai/agents/_index.md:47
or [assign work to an existing agent](/docs/ai/agents/tasks/)
readthrough: self-redundancy
source: readthrough pre-step
preflight · readthrough-self-redundancy · high confidence
#335 🚩 Flagged
content/docs/ai/agents/integrations.md:98
Select MCP integrations in the [agent's configuration]
readthrough: prerequisite-inversion
source: readthrough pre-step
preflight · readthrough-prerequisite-inversion · high confidence
#336 🚩 Flagged
content/docs/ai/agents/integrations/datadog.md:17
Give the service account **MCP Read** (`mcp_read`) and the resource-level permissions for the data the agent needs. Limit its application key
readthrough: prerequisite-inversion
source: readthrough pre-step
preflight · readthrough-prerequisite-inversion · high confidence
#337 🚩 Flagged
content/docs/ai/agents/permissions.md:44
The default **Agent Read Only** role does not need to be assigned to teammates.
readthrough: prerequisite-inversion
source: readthrough pre-step
preflight · readthrough-prerequisite-inversion · high confidence
#338 🚩 Flagged
content/docs/ai/agents/reference.md:16
## Run a task with an organization-created agent
readthrough: orphaned-structure
source: readthrough pre-step
preflight · readthrough-orphaned-structure · high confidence

Findings

IDBucketFile:linesStatusDisposition
F4 ⚠️ Reviewer check content/docs/ai/agents/integrations/datadog.md:17-22 open —
"Prepare Datadog access" grants permissions to the service account before "Create the credentials" step 1 creates that account. A reader can still finish, since the account can be created first and permissioned afterward. Confirm the order is acceptable, or ask the author to move account creation ahead of the permissions paragraph.
F24 ⚠️ Reviewer check content/docs/ai/agents/custom.md:47 open —
Only the PR's own permissions page backs the claim that roles and credentials, not instructions, enforce an agent's access limits. If it's wrong, readers will over-trust prompt restrictions. Confirm with someone who knows the product, or accept the author's answer to F7.
F26 ⚠️ Reviewer check content/docs/ai/agents/integrations.md:78 open —
Only sibling pages in this PR support the claim that Neo and configured agents share the same integration connections. That affects how admins reason about credential blast radius. Confirm it with someone who knows the product.
F28 ⚠️ Reviewer check content/docs/ai/agents/tasks.md:33 open —
The rule that Slack channel membership alone grants no access to an agent's tasks rests only on the Slack integration page. It's a security-relevant statement, so confirm it with someone who knows the product.
F1 🚨 Outstanding content/docs/ai/neo/integrations/mcp/_index.md resolved fixed
The Honeycomb step says the Key ID and the Key Secret are both shown only once, but Honeycomb shows only the Key Secret once. Limit the warning to the secret. — ✅ fixed in 958d731
F16 ❓ Author answer content/docs/ai/neo/integrations/mcp/_index.md resolved fixed
*"Atlassian Rovo MCP setup: in admin.atlassian.com open Rovo MCP and enable API token…"* — verdict: unverifiable. Nothing public describes this product behavior. Confirm it matches the shipped product (details below). — ✅ fixed in 958d731; the rewritten Atlassian steps now match Atlassian's MCP-settings and service-account token docs, which the page cites
F7 ❓ Author answer (multiple files) conceded not-applicable — conceded: CamSoper confirmed that PR author kramhuber owns Pulumi Agents and is the SME, and that the claims this group lists match the shipped product.
121 claims about Pulumi's own behavior, unchecked because the review can't read `github.com/pulumi/marketing-web/pull/252` — verdict: unverifiable — concede: CamSoper confirmed that PR author kramhuber owns Pulumi Agents and is the SME, and that the claims this group lists match the shipped product.
121 claims asked about together
  • content/docs/ai/agents/_index.md:4 Pulumi Agents can be a pre-built agent or a custom-built agent, used to take on ongoing infrastructure responsibilities such as investigating incidents or…
  • content/docs/ai/agents/_index.md:15 Pulumi Agents can be pre-built agents or custom-built agents that take on ongoing infrastructure responsibilities such as investigating incidents or…
  • content/docs/ai/agents/_index.md:29 Custom Pulumi agents can be given runbooks and access to relevant logs, resources, and repositories.
  • content/docs/ai/agents/configure.md:15 Pulumi Agents pre-built agents include instructions for common infrastructure work, and users can edit those instructions and choose which tools and…
  • content/docs/ai/agents/configure.md:19 The Pulumi Agents setup flow requires connecting a version control provider and granting access to relevant repositories, while other tools can be connected…
  • content/docs/ai/agents/configure.md:23 In the Pulumi Agents agent catalog, choosing an agent and selecting 'Set up agent' opens a form with the agent's name, description, instructions, and…
  • content/docs/ai/agents/configure.md:25-32 The Pulumi Agents catalog includes six pre-built agents: Incident investigation, Deployment troubleshooting, Drift response, Upgrade maintenance, Security…
  • content/docs/ai/agents/configure.md:27 The Incident investigation pre-built agent investigates outages and service degradation, explains likely causes, and prepares fixes.
  • content/docs/ai/agents/configure.md:28 The Deployment troubleshooting pre-built agent diagnoses failed Pulumi previews, updates, and deployments, including operations in external pipelines.
  • content/docs/ai/agents/configure.md:29 The Drift response pre-built agent compares drift with declared configuration and helps resolve the difference.
  • content/docs/ai/agents/configure.md:30 The Upgrade maintenance pre-built agent assesses provider and infrastructure-component upgrades and prepares code changes.
  • content/docs/ai/agents/configure.md:40 The Pulumi Agents setup form has a 'System prompt' field where the agent's job, information to use, and expected result are described.
  • content/docs/ai/agents/configure.md:44 In Pulumi Agents, saved agent instructions replace the organization's AI preference instructions rather than being added to them.
  • content/docs/ai/agents/configure.md:44 In Pulumi Agents, instructions guide the agent's work, while roles and credentials determine what it can access.
  • content/docs/ai/agents/configure.md:48 The Pulumi Agents setup form has an integrations selector beside the 'System prompt' field for selecting connected MCP services.
  • content/docs/ai/agents/configure.md:50 Creating a Pulumi Agents agent saves the selected MCP integrations; integrations connected later must be added by editing the agent and adding them to its…
  • content/docs/ai/agents/configure.md:52 The Pulumi Agents setup form offers a 'Manage integrations' option for connecting a missing service, and an administrator can also connect it.
  • content/docs/ai/agents/configure.md:56 In Pulumi Agents, documents can be referenced in the instructions by path or URL, but the agent also needs access to the repository or tool holding them; a…
  • content/docs/ai/agents/configure.md:62-63 The Pulumi Agents setup form has a 'Default mode' setting controlling when the agent asks for approval, and in 'Auto' mode actions do not require the user's…
  • content/docs/ai/agents/configure.md:67 In Pulumi Agents, the Role can be set to 'Member' or a custom role, provided its permissions do not exceed the user's own.
  • content/docs/ai/agents/configure.md:71-74 The Pulumi Agents setup form has a 'How do you want to invoke this agent?' question with options 'Manually' and 'Configure a trigger'; 'Manually' assigns…
  • content/docs/ai/agents/configure.md:74 In Pulumi Agents, 'Configure a trigger' starts tasks from Pulumi operations, external webhooks, or a recurring schedule, and selecting 'Continue' proceeds to…
  • content/docs/ai/agents/configure.md:76 The Pulumi Agents trigger step has a 'Trigger preset' choice, event filters or schedule settings, and an expandable 'Task instructions and context' section…
  • content/docs/ai/agents/configure.md:82 In Pulumi Agents, for a webhook trigger the connection steps are shown after saving the agent and must be finished.
  • content/docs/ai/agents/configure.md:84 The Pulumi Agents agent page has a 'Describe the task for this agent' field for entering an assignment.
  • content/docs/ai/agents/configure.md:90 The Pulumi Agents agent page has an 'Edit' control for changing an existing agent.
  • content/docs/ai/agents/create-and-manage/_index.md:15 In Pulumi Agents, teammates can assign tasks to an agent without repeating the agent's setup.
  • content/docs/ai/agents/create-and-manage/_index.md:15 Pulumi Agents supports starting with a pre-built agent or writing your own custom instructions for an agent.
  • content/docs/ai/agents/create-and-manage/_index.md:33 Pulumi agents can be edited, paused, or deleted.
  • content/docs/ai/agents/custom.md:10 The menu parent identifier 'ai-agents-create-manage' exists in the ai menu.
  • content/docs/ai/agents/custom.md:19-22 When creating a custom Pulumi agent, the creation form includes a Name field and a Description field.
  • content/docs/ai/agents/custom.md:19 In the Pulumi Agents catalog, there is an option labeled 'Create your own from scratch' used to create a custom agent.
  • content/docs/ai/agents/custom.md:26 A Pulumi agent's saved instructions apply every time the agent runs, while assignment-specific details such as the repository or stack to check belong in the…
  • content/docs/ai/agents/custom.md:28 The Pulumi Agents custom agent creation form has a field labeled 'System prompt' where the agent's instructions are entered.
  • content/docs/ai/agents/custom.md:45 A Pulumi custom agent needs access to any repository or tool referenced in its instructions; including a path or URL in the instructions does not grant access.
  • content/docs/ai/agents/custom.md:47 In Pulumi Agents, saved agent instructions replace (rather than add to) the organization's AI preference instructions.
  • content/docs/ai/agents/integrations/aws.md:13 The AWS connection setup in Pulumi Agents is the same for Neo and for agents the user configures.
  • content/docs/ai/agents/integrations/aws.md:13 Pulumi Agents can connect an AWS account so an agent can inspect resources through the AWS CLI.
  • content/docs/ai/agents/integrations/aws.md:31-33 Connecting the AWS environment to Pulumi Agents is performed by an organization administrator.
  • content/docs/ai/agents/integrations/aws.md:35 A Pulumi Agents AWS connection can be given a name such as `production-aws-investigation` and notes that include the AWS account ID.
  • content/docs/ai/agents/integrations/azure.md:13 The Azure integration in Pulumi Agents lets an agent use the Azure CLI with credentials supplied from Pulumi ESC.
  • content/docs/ai/agents/integrations/azure.md:21 The Pulumi Agents Azure CLI integration expects an ESC environment that supplies the environment variables AZURE_CLIENT_ID, AZURE_CLIENT_SECRET…
  • content/docs/ai/agents/integrations/azure.md:25-28 The Azure CLI service principal sign-in uses the `AZURE_CLIENT_ID` environment variable, set to the service principal's application ID, for the Pulumi Agents…
  • content/docs/ai/agents/integrations/datadog.md:5 The Pulumi Agents Datadog integration authenticates using a Datadog API key and an application key (the application key belonging to a service account).
  • content/docs/ai/agents/integrations/datadog.md:13 In Pulumi Agents, Neo and agents the user configures share the organization's Datadog connection.
  • content/docs/ai/agents/integrations/datadog.md:24 Datadog sites are identified as us1, us3, us5, eu1, ap1, or ap2 (the list of Datadog site identifiers supported by the Pulumi integration).
  • content/docs/ai/agents/integrations/datadog.md:30 Connecting Datadog in Pulumi Cloud requires the Pulumi Cloud organization administrator role.
  • content/docs/ai/agents/integrations/datadog.md:32-33 Pulumi Cloud has Neo Settings with an Integrations tab containing an 'MCP servers' section where integrations are configured.
  • content/docs/ai/agents/integrations/datadog.md:34 The Pulumi Cloud Datadog integration form asks for three fields: **Datadog site**, **API Key**, and **App Key**, and is submitted with **Save**.
  • content/docs/ai/agents/integrations/google-cloud.md:13 A Pulumi Agents agent can use the `gcloud` CLI with Google Cloud credentials supplied from a Pulumi ESC environment.
  • content/docs/ai/agents/integrations/google-cloud.md:27-29 Connecting an ESC environment to Pulumi Agents as a Google Cloud connection is done by an organization administrator.
  • content/docs/ai/agents/manage.md:19 In Pulumi Agents, selecting Edit on an agent's page, updating its settings, and selecting Save changes saves the agent's configuration.
  • content/docs/ai/agents/manage.md:21 In Pulumi Agents, the agent's instructions, role, approval settings, and MCP integrations cannot be overridden in an individual task.
  • content/docs/ai/agents/manage.md:25 In Pulumi Agents, a running task can be cancelled by opening the task and selecting Cancel, which is the stop icon beside the message box.
  • content/docs/ai/agents/manage.md:27 In Pulumi Agents, scheduled runs and events skipped while an agent is paused are not replayed after resuming.
  • content/docs/ai/agents/manage.md:31 In Pulumi Agents, Pulumi blocks deletion of an agent while an automation still references it.
  • content/docs/ai/agents/manage.md:33 In Pulumi Agents, deleting an agent does not cancel work already executing; each running task must be cancelled by opening it and selecting Cancel.
  • content/docs/ai/agents/manage.md:37 In Pulumi Agents, resuming an agent does not resume its paused automations.
  • content/docs/ai/agents/manage.md:40-42 In the Pulumi Agents automation form for a schedule, the Runs setting has an option 'On a schedule' and the form has a Frequency setting.
  • content/docs/ai/agents/manage.md:48-49 In Pulumi Agents, the agent's role grants access to Pulumi Cloud resources, including any ESC environment that supplies credentials.
  • content/docs/ai/agents/permissions.md:14 For Pulumi Agents that a team creates, assigning a Pulumi Cloud role controls the agent's access to stacks and Pulumi ESC environments.
  • content/docs/ai/agents/permissions.md:14 When a Pulumi Agents integration uses Pulumi ESC, the credentials supplied by the environment control access to the connected tool.
  • content/docs/ai/agents/permissions.md:18 If a Pulumi Agents integration requires a personal token, the agent uses the token owner's permissions and identity.
  • content/docs/ai/agents/permissions.md:32 In Pulumi Agents, selecting an integration or adding restrictions to the agent's instructions does not narrow the integration's credentials.
  • content/docs/ai/agents/permissions.md:34 When a Pulumi Agents integration uses Pulumi ESC, the agent needs permission to open the ESC environment, which is controlled by the agent's Pulumi Cloud role.
  • content/docs/ai/agents/permissions.md:38 Pulumi Agents have a **Default mode** setting that controls when the agent asks for approval.
  • content/docs/ai/agents/permissions.md:38 Approving an action in Pulumi Agents does not grant permissions beyond the agent's role and connected credentials.
  • content/docs/ai/agents/permissions.md:44 For a Pulumi Agent with an assigned role, a teammate must hold that role directly or through a team, or have the `organization:update` permission, to start a…
  • content/docs/ai/agents/permissions.md:46 For Pulumi Agents tasks started by an organization-owned automation, the `agent_automations:update` permission grants access to reply and approve actions.
  • content/docs/ai/agents/permissions.md:48 A personal schedule running a shared agent does not grant other teammates access to the tasks that schedule creates.
  • content/docs/ai/agents/reference.md:16 Access to the preview `agentDefinitionId` field of the task-creation API must be enabled for your Pulumi organization before it can be used.
  • content/docs/ai/agents/reference.md:20 Access to the preview `agentDefinitionId` field must be enabled for your organization before it can be used.
  • content/docs/ai/agents/tasks.md:15 Each Pulumi Agent task contains the agent's work and results, and users and teammates can reply in the task to answer questions, add context, or ask for…
  • content/docs/ai/agents/tasks.md:21 The Pulumi Cloud agent page has an input field labeled "Describe the task for this agent" where users enter their request to start a task.
  • content/docs/ai/agents/triggers.md:25 For Pulumi Agents automations, instructions written in the assignment (prompt) do not filter incoming events; trigger settings select which events start tasks.
  • content/docs/ai/agents/triggers.md:29-36 In Pulumi Cloud, creating a Pulumi-operation trigger involves opening Automations, selecting 'Set up trigger', entering a Name, setting Runs to 'When a…
  • content/docs/ai/agents/triggers.md:38 For Pulumi-operation triggers on Pulumi agents, matching stacks are added to the task context automatically.
  • content/docs/ai/agents/triggers.md:40 For a Pulumi-operation trigger, the first matching event starts an agent task, and later matching events join that task while its batch window is open.
  • content/docs/ai/agents/triggers.md:40 For a Pulumi-operation trigger, events that arrive while the agent is working are combined and delivered when the agent can accept more input.
  • content/docs/ai/agents/triggers.md:42 The 'Follow-up batch window (seconds)' setting sets how long the batch stays open after the most recent event, capped at one hour after the first event.
  • content/docs/ai/agents/triggers.md:46-54 In Pulumi Cloud, the webhook trigger is set up by opening Automations, selecting 'Set up trigger', setting Runs to 'When a webhook event arrives', choosing a…
  • content/docs/ai/agents/triggers.md:53-54 After creating a webhook automation, the setup panel shows a Webhook URL and a Required header; the sender must include the header `X-Pulumi-Trigger-Secret`…
  • content/docs/ai/agents/triggers.md:56 The Pulumi webhook trigger secret is shown only once, and if lost it can be rotated from the automation details page.
  • content/docs/ai/agents/triggers.md:62-64 With the PagerDuty preset for Pulumi agent webhook triggers, the setup panel guides event subscription configuration, and if signature verification is…
  • content/docs/ai/agents/triggers.md:68-75 In Pulumi Cloud, a scheduled automation is created by opening Automations, selecting 'New automation' then 'Start with a blank automation', setting Runs to…
  • content/docs/ai/agents/triggers.md:77 Each task started by a scheduled automation uses the agent's saved instructions and access settings.
  • content/docs/ai/agents/triggers.md:83 Disabling an automation or pausing an agent does not stop work already in progress; the running task must be canceled separately.
  • content/docs/ai/coding-agents/_index.md:14 The page /docs/ai/mcp-server/ exists and covers client configuration, authentication, and supported tools for the Pulumi MCP server.
  • content/docs/ai/coding-agents/_index.md:18 The page /docs/ai/skills/ exists and lists the available Pulumi Agent Skills and installation instructions.
  • content/docs/ai/coding-agents/_index.md:26 The page /docs/ai/cli-for-agents/ exists and describes CLI features for agents such as structured JSON output and direct resource operations.
  • content/docs/ai/coding-agents/handoff.md:14 The docs page /docs/ai/skills/ has a 'delegation plugin' section (anchor #delegation-plugin) describing how to install the Pulumi delegation plugin/skill.
  • content/docs/ai/neo/_index.md:5 Neo is the pre-built personal agent in Pulumi Agents; each user gets one with Pulumi Agents.
  • content/docs/ai/neo/integrations/cli/_index.md:16 When an agent uses a CLI integration, it calls the CLI against credentials managed in Pulumi ESC, scoped to exactly the permissions the user chooses.
  • content/docs/ai/neo/integrations/cli/_index.md:22-23 A CLI integration requires an ESC environment that emits the environment variables the CLI expects (for example, `AWS_ACCESS_KEY_ID` for the AWS CLI).
  • content/docs/ai/neo/integrations/cli/_index.md:24 An agent refers to a CLI connection by the name the user gave it (for example `production-aws`) when it decides which connection to use.
  • content/docs/ai/neo/integrations/cli/_index.md:26-30 When an agent decides to use a CLI integration, it runs the equivalent of `pulumi env run <orgLogin>/<escProject>/<escEnvironment> -- <cli> <args>`.
  • content/docs/ai/neo/integrations/cli/_index.md:38-41 The `aws` CLI integration requires the environment variables `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`, with optional `AWS_SESSION_TOKEN` (temporary…
  • content/docs/ai/neo/integrations/cli/_index.md:60 Using a CLI connection requires permission to open the backing ESC environment; for a team-configured agent access is granted through the agent's Pulumi…
  • content/docs/ai/neo/integrations/cli/_index.md:60 Using a CLI connection requires permission to open the backing ESC environment.
  • content/docs/ai/neo/integrations/cli/_index.md:62-63 For an agent a team configures, access to the CLI connection's ESC environment is granted through the agent's Pulumi Cloud role.
  • content/docs/ai/neo/integrations/cli/_index.md:77 Multiple instances of the same CLI can be connected, each pointing at a separate ESC environment, and an agent can use multiple connections in the same task…
  • content/docs/ai/neo/integrations/cli/_index.md:81 For an agent a team has configured, connected CLI integrations are available without a selection step.
  • content/docs/ai/neo/integrations/cli/_index.md:85 The agent needs permission to open the connection's ESC environment, and the AWS credentials must allow listing buckets and reading their versioning settings.
  • content/docs/ai/neo/integrations/cli/_index.md:89 Neo provides a per-task CLI selector, and tasks for agents your team configures do not have this selector.
  • content/docs/ai/neo/integrations/cli/_index.md:91 By default a Neo task inherits all CLI integrations the organization has connected, and the task composer has a **CLI integrations** submenu where individual…
  • content/docs/ai/neo/integrations/cli/_index.md:101 Disconnecting a CLI integration removes the connection's reference to the ESC environment without modifying or deleting the ESC environment itself.
  • content/docs/ai/neo/integrations/cli/_index.md:102-103 Tasks that are already running lose access to a disconnected CLI integration the next time the agent tries to use it.
  • content/docs/ai/neo/integrations/cli/_index.md:109 Individual CLI invocations made by an agent during a task are visible in the task transcript alongside its other tool calls.
  • content/docs/ai/neo/integrations/cli/_index.md:113 ESC access errors for a CLI integration are resolved by checking the configured agent's role, or for Neo the acting user's permissions, since the relevant…
  • content/docs/ai/neo/integrations/cli/_index.md:115 For Neo, per-task selection can be used to limit a task to specific CLI connections, and access to ESC environments can be limited through the agent's role…
  • content/docs/ai/neo/integrations/mcp/_index.md:21 Pulumi Agents' supported external MCP integrations are Atlassian (Jira and Confluence), Cloudflare, Dash0, Datadog, Honeycomb, Linear, New Relic, PagerDuty…
  • content/docs/ai/neo/integrations/mcp/_index.md:25 To enable an MCP integration in Pulumi Cloud, navigate to Neo Settings, select Integrations, open MCP servers, find the provider under Available, select…
  • content/docs/ai/neo/integrations/mcp/_index.md:27 Available tools for an external MCP integration depend on the credentials and authentication method the service supports.
  • content/docs/ai/neo/integrations/mcp/_index.md:31 When a task needs an integration, Pulumi Cloud decrypts the credentials at task time, constructs the authentication headers, and connects to the service on…
  • content/docs/ai/neo/integrations/mcp/_index.md:31 MCP integration credentials are never exposed to the language model and are never embedded in task state.
  • content/docs/ai/neo/integrations/mcp/_index.md:35 To remove an MCP integration, navigate to Neo Settings, select Integrations, open MCP servers, find the integration, select Manage integration, then…
  • content/docs/ai/neo/integrations/mcp/_index.md:37 Disabling an MCP integration deletes its stored credentials and immediately prevents any new tasks from using it.
  • content/docs/ai/neo/integrations/mcp/_index.md:43 Neo tasks inherit all MCP integrations enabled by the organization, and integrations can be turned off in the task composer before starting a task, applying…
  • content/docs/ai/neo/integrations/mcp/_index.md:47 To replace expired credentials for an MCP integration, disconnect the integration and then authorize it again with new credentials.
  • content/docs/ai/neo/integrations/mcp/_index.md:49 A failure to retrieve or decrypt stored credentials can prevent a task from starting or continuing, while some other connection failures leave other tools…
  • content/docs/ai/neo/integrations/mcp/_index.md:129 The Sentry MCP integration connects to Sentry SaaS only.
F8 ❓ Author answer content/docs/ai/agents/create-and-manage/_index.md conceded not-applicable — conceded: CamSoper confirmed that PR author kramhuber owns Pulumi Agents and is the SME, and that this behavior matches the shipped feature.
*"In Pulumi Agents, you can start with a pre-built agent or write your own custom…"* — verdict: unverifiable. Nothing public describes this product behavior. Confirm it matches the shipped product (details below). — concede: CamSoper confirmed that PR author kramhuber owns Pulumi Agents and is the SME, and that this behavior matches the shipped feature.
F9 ❓ Author answer content/docs/ai/agents/custom.md conceded not-applicable — conceded: CamSoper confirmed that PR author kramhuber owns Pulumi Agents and is the SME, and that this behavior matches the shipped feature.
*"A Pulumi custom agent can read a repository's contribution instructions and open a pull…"* — verdict: unverifiable. Nothing public describes this product behavior. Confirm it matches the shipped product (details below). — concede: CamSoper confirmed that PR author kramhuber owns Pulumi Agents and is the SME, and that this behavior matches the shipped feature.
F12 ❓ Author answer content/docs/ai/agents/permissions.md conceded not-applicable — conceded: CamSoper confirmed that PR author kramhuber owns Pulumi Agents and is the SME, and that this behavior matches the shipped feature.
*"The Pulumi Agents configuration has a **Role** field in which a Pulumi Cloud role can…"* — verdict: unverifiable. Nothing public describes this product behavior. Confirm it matches the shipped product (details below). — concede: CamSoper confirmed that PR author kramhuber owns Pulumi Agents and is the SME, and that this behavior matches the shipped feature.
F13 ❓ Author answer content/docs/ai/agents/triggers.md conceded not-applicable — conceded: CamSoper confirmed that PR author kramhuber owns Pulumi Agents and is the SME, and that this behavior matches the shipped feature.
*"Pulumi Agents can be configured to start agent tasks automatically when a Pulumi…"* — verdict: unverifiable. Nothing public describes this product behavior. Confirm it matches the shipped product (details below). — concede: CamSoper confirmed that PR author kramhuber owns Pulumi Agents and is the SME, and that this behavior matches the shipped feature.
F14 ❓ Author answer content/docs/ai/cli-for-agents/index.md conceded not-applicable — conceded: CamSoper confirmed that PR author kramhuber owns Pulumi Agents and is the SME, and that this behavior matches the shipped feature.
*"By default, resource changes are recorded in Pulumi state and support state tracking…"* — verdict: unverifiable. Nothing public describes this product behavior. Confirm it matches the shipped product (details below). — concede: CamSoper confirmed that PR author kramhuber owns Pulumi Agents and is the SME, and that this behavior matches the shipped feature.
F15 ❓ Author answer content/docs/ai/neo/integrations/mcp/_index.md conceded not-applicable — conceded: CamSoper confirmed that PR author kramhuber owns Pulumi Agents and is the SME, and that this behavior matches the shipped feature.
*"For Pulumi Agents' MCP integrations, an organization administrator connects each…"* — verdict: unverifiable. Nothing public describes this product behavior. Confirm it matches the shipped product (details below). — concede: CamSoper confirmed that PR author kramhuber owns Pulumi Agents and is the SME, and that this behavior matches the shipped feature.
F17 ❓ Author answer content/docs/ai/neo/integrations/mcp/_index.md conceded not-applicable — conceded: CamSoper confirmed that PR author kramhuber owns Pulumi Agents and is the SME, and that this integration setup matches the shipped feature.
*"Dash0 MCP integration setup: in Dash0 Settings > Endpoints copy the MCP endpoint URL…"* — verdict: unverifiable. Nothing public describes this product behavior. Confirm it matches the shipped product (details below). — concede: CamSoper confirmed that PR author kramhuber owns Pulumi Agents and is the SME, and that this integration setup matches the shipped feature.
F18 ❓ Author answer content/docs/ai/neo/integrations/mcp/_index.md conceded not-applicable — conceded: CamSoper confirmed that PR author kramhuber owns Pulumi Agents and is the SME, and that this integration setup matches the shipped feature.
*"Dash0 uses regional endpoints, and Dash0's auth token documentation at…"* — verdict: unverifiable. Nothing public describes this product behavior. Confirm it matches the shipped product (details below). — concede: CamSoper confirmed that PR author kramhuber owns Pulumi Agents and is the SME, and that this integration setup matches the shipped feature.
F19 ❓ Author answer content/docs/ai/neo/integrations/mcp/_index.md conceded not-applicable — conceded: CamSoper confirmed that PR author kramhuber owns Pulumi Agents and is the SME, and that this integration setup matches the shipped feature.
*"New Relic MCP integration setup: an administrator enables New Relic MCP Server > API…"* — verdict: unverifiable. Nothing public describes this product behavior. Confirm it matches the shipped product (details below). — concede: CamSoper confirmed that PR author kramhuber owns Pulumi Agents and is the SME, and that this integration setup matches the shipped feature.
F20 ❓ Author answer content/docs/ai/neo/integrations/mcp/_index.md conceded not-applicable — conceded: CamSoper confirmed that PR author kramhuber owns Pulumi Agents and is the SME, and that this integration setup matches the shipped feature.
*"1. In the New Relic integration, enter your account's **Region** (`us`, `eu`, or `jp`)…"* — verdict: unverifiable. Nothing public describes this product behavior. Confirm it matches the shipped product (details below). — concede: CamSoper confirmed that PR author kramhuber owns Pulumi Agents and is the SME, and that this integration setup matches the shipped feature.
F21 ❓ Author answer content/docs/ai/neo/integrations/mcp/_index.md conceded not-applicable — conceded: CamSoper confirmed that PR author kramhuber owns Pulumi Agents and is the SME, and that this integration setup matches the shipped feature.
*"The New Relic API key uses the automation account's permissions, and tools that require…"* — verdict: unverifiable. Nothing public describes this product behavior. Confirm it matches the shipped product (details below). — concede: CamSoper confirmed that PR author kramhuber owns Pulumi Agents and is the SME, and that this integration setup matches the shipped feature.
F22 ❓ Author answer content/docs/ai/neo/integrations/mcp/_index.md conceded not-applicable — conceded: CamSoper confirmed that PR author kramhuber owns Pulumi Agents and is the SME, and that this integration setup matches the shipped feature.
*"For Sentry, create an internal integration under Settings > Custom Integrations, grant…"* — verdict: unverifiable. Nothing public describes this product behavior. Confirm it matches the shipped product (details below). — concede: CamSoper confirmed that PR author kramhuber owns Pulumi Agents and is the SME, and that this integration setup matches the shipped feature.
F30 💡 Preexisting content/docs/ai/neo/integrations/cli/_index.md:99 open —
Unverifiable claim on a line this PR doesn't change: A CLI integration is removed in Neo Settings > Integrations > CLI tools by selecting **Manage integration** and then **Disconnect integration**.
F31 💡 Preexisting content/docs/ai/neo/integrations/cli/_index.md:107 open —
Unverifiable claim on a line this PR doesn't change: Connect and disconnect events for CLI integrations are written to the organization's audit log, attributed to the acting user, and record the CLI, connection…

Editorial stances

Superlative, ranking, or comparative language the diff adds. No verdict — a page's own framing isn't fact-checkable — listed so a reviewer can confirm each is a stance the docs should take.

Investigation log

cross-sibling-reads
0 of 8 siblings
external-claim-verification
175 of 333 claims verified (138 unverifiable, 1 contradicted) · 4 specialists (numerical, cross-reference, capability, framing); 0 cross-specialist corroborations · routed: 0 inline, 280 Pass 1, 7 Pass 2 (verified 1, contradicted 0, unverifiable 6), 46 Pass 3 (verified 19, contradicted 1, unverifiable 26).
cited-claim-spot-checks
7 of 7 cited claims fetched and compared
frontmatter-sweep
ran on body + meta_desc
temporal-trigger-sweep
ran (recency words present in diff; spot-check in-review)
code-execution
not run (no `static/programs/` change)
code-examples-checks
ran (3 specialists: structural, existence, body-code-coverage); 0 findings
editorial-balance-pass
not run (not under content/blog/)

Triaged

History

  1. 2026-10-22T22:24:15Z 7fbea27

    initial review (pending publication)

  2. 2026-10-23T18:03:43Z 6de586eee6

    Re-verified 6de586e: F1 Honeycomb wording and F16 Atlassian steps fixed in 958d731; other questions still open

  3. 2026-10-23T18:18:33Z 6de586eee6

    Maintainer confirmed all open ❓ product-behavior claims via the PR author (feature owner/SME); conceded.