Convex Deploy Guard

Before any command that touches a Convex deployment, this guard makes Claude identify which target it's hitting (dev, preview, or prod), announce it in one line, and only then act. Prod gets the strictest treatment: each prod action needs a fresh explicit yes in the current session, and the two prod MCP flags are kept separate so that "look at prod data" can't quietly turn into "mutate prod." It also supports a read-only session mode that holds for the whole conversation, and includes a useful diagnostic rule: if a deploy seemed to change nothing, the guard says to check which deployment got hit rather than re-deploy harder. The one thing to keep in mind is that it's a discipline layer, not a safety net. It works because Claude follows it, so it pairs best with the rest of your Convex tooling rather than replacing your own care around prod keys.

skills.sh installs: 41.2K
GitHub stars: 69
last updated: Oct 26, 2026

View on GitHub

Install

$ npx -y skills add convex/agent-skills --skill convex-deploy-guard --agent claude-code

Installs into .claude/skills of the current project.

Files

Deployment target guard

Deployments are not interchangeable, and most incidents start with a command aimed at the wrong one. Every Convex project has several (personal dev, preview, prod — often across multiple projects on one machine). This guard is the standing discipline: identify, announce, then act — and treat prod as consent-gated, per action, per session.