> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt
> Use this file to discover all available pages before exploring further.

# First Prompts by Role

> Find your role, copy a prompt, and get a real result from your own cloud environment in about 10 minutes.

By the end of this tutorial you will have run one role-specific prompt against your live environment and refined it with follow-ups. Allow **\~10 minutes**.

<Info>
  **What you'll need:** a workspace with at least one cloud connection — agents can't return real results without one. If you haven't set that up, complete the [quickstart](/quickstart) first.
</Info>

## The syntax

Talk to agents in plain language. The full pattern is:

```text theme={null}
@agent #tool your request
```

* **`@agent`** — who does the work: `@alex` (cloud), `@oliver` (security), `@tony` (database), `@kai` (Kubernetes), `@anna` (coordination).
* **`#tool`** *(optional)* — the output you want: `#dashboard`, `#report`, `#recommend`, `#alert`, `#chart`, `#kb`.
* **Your request** — what you need, in your own words. Add any context inline.

See the [CloudThinker Language reference](/guide/language) for the full syntax.

<Steps>
  <Step title="Open a chat">
    Sign in at [app.cloudthinker.io](https://app.cloudthinker.io) and click **New chat** in the left sidebar.

    **Success state:** an empty conversation panel opens and typing `@` shows the agent picker.
  </Step>

  <Step title="Run your role's quick win">
    Pick the tab that matches your role, paste the quick win, then try the follow-ups once you see the shape of the output.

    <Tabs>
      <Tab title="Cloud / DevOps">
        **Goal:** Stop paying for cloud you don't use. See where waste lives in under a minute.

        **You need:** [AWS](/guide/connections/aws), [Azure](/guide/connections/azure), or [GCP](/guide/connections/gcp) connection. Agent: [@alex](/guide/agents/alex).

        **Quick win — find idle and oversized resources:**

        ```text theme={null}
        @alex find EC2 instances with <20% CPU utilization over the last 30 days, plus any unattached EBS volumes and unused Elastic IPs
        ```

        Alex queries the cloud APIs, joins with utilization metrics, and returns a ranked list with projected monthly savings.

        **Follow up:**

        ```text theme={null}
        @alex #recommend right-sizing for the top 5 by waste
        @alex #dashboard cost trend by service for this quarter
        @alex draft a reserved-instance plan for the stable workloads above
        ```
      </Tab>

      <Tab title="Security">
        **Goal:** Find the highest-risk misconfigurations before an auditor or attacker does.

        **You need:** AWS, Azure, or GCP connection. Agent: [@oliver](/guide/agents/oliver).

        **Quick win — surface public exposure on sensitive ports:**

        ```text theme={null}
        @oliver list security groups with 0.0.0.0/0 access on database, SSH, or RDP ports across all regions
        ```

        Oliver returns the offending rules with resource owner, region, and severity ranking.

        **Follow up:**

        ```text theme={null}
        @oliver #report SOC 2 compliance status with prioritized remediation
        @oliver audit IAM policies for privilege-escalation paths
        @oliver check for IMDSv1 instances or unencrypted EBS volumes
        ```
      </Tab>

      <Tab title="Database">
        **Goal:** Find the queries that are actually hurting you, not the ones you assume are slow.

        **You need:** [PostgreSQL](/guide/connections/postgresql) or [MySQL](/guide/connections/mysql) connection. Agent: [@tony](/guide/agents/tony).

        **Quick win — slowest queries in the last 24 hours:**

        ```text theme={null}
        @tony show the top 10 queries by total time over the last 24 hours on production PostgreSQL, with execution count and P95 latency
        ```

        Tony pulls from `pg_stat_statements` (or the equivalent), ranks by impact, and shows where the cost is concentrated.

        **Follow up:**

        ```text theme={null}
        @tony #recommend indexes for the top 3 queries above
        @tony explain why query #2 isn't using the existing index
        @tony #dashboard query latency P95 trends by endpoint
        ```
      </Tab>

      <Tab title="Kubernetes">
        **Goal:** See where pods are oversized, undersized, or imbalanced — before the next OOMKill or budget review.

        **You need:** [Kubernetes connection](/guide/connections/kubernetes). Agent: [@kai](/guide/agents/kai).

        **Quick win — pod resource waste across the cluster:**

        ```text theme={null}
        @kai analyze pod resource usage vs requests across all namespaces, surface the largest over- and under-provisioned workloads
        ```

        Kai joins requests/limits with actual usage and ranks the deltas by node-cost impact.

        **Follow up:**

        ```text theme={null}
        @kai #recommend HPA policies for the variable workloads above
        @kai find nodes with <30% utilization for consolidation
        @kai check for pods without resource limits or liveness probes
        ```
      </Tab>

      <Tab title="SRE / On-call">
        **Goal:** Cut the time from alert to root cause. Get a structured investigation, not raw logs.

        **You need:** [Pulse](/guide/pulse/overview) configured, plus the connections for the systems you operate. Agent: [@anna](/guide/agents/anna) to coordinate.

        **Quick win — investigate an active alert:**

        ```text theme={null}
        @anna investigate the current incident: pull related metrics, recent deploys, and topology, then propose the top 3 likely causes ranked by evidence
        ```

        Anna delegates to the relevant specialists, gathers evidence in parallel, and returns a hypothesis ladder you can act on.

        **Follow up:**

        ```text theme={null}
        @anna #report draft a postmortem from this conversation
        @anna pull the matching runbook and walk through the approval gates
        @anna check whether this pattern matches any past incident in memory
        ```
      </Tab>

      <Tab title="Eng Leader">
        **Goal:** Get a coordinated view across cost, security, performance, and reliability without scheduling four meetings.

        **You need:** Connections in place for the domains you want covered. Agent: [@anna](/guide/agents/anna).

        **Quick win — multi-agent quarterly review:**

        ```text theme={null}
        @anna coordinate a quarterly infrastructure review:
        - @alex top cost optimization opportunities and savings
        - @oliver security posture and compliance gaps
        - @tony database performance hotspots
        - @kai Kubernetes utilization and risk
        Consolidate into an executive summary with prioritized actions.
        ```

        Anna delegates, collects, deduplicates, and returns a single executive brief instead of four tabs.

        **Follow up:**

        ```text theme={null}
        @anna #report quarterly business review in slide-deck format
        @anna track the open actions from last quarter — what shipped, what slipped
        @anna draft a roadmap that aligns cost reduction with reliability work
        ```
      </Tab>
    </Tabs>

    **Success state:** the agent replies within \~30 seconds naming resources, queries, or rules you recognize from your own environment — not generic best practices.
  </Step>

  <Step title="Refine the conversation">
    Agents keep conversation context, so build on the result instead of starting over:

    * **Be specific upfront.** "EC2 costs in us-east-1 for the last 30 days" beats "show me costs".
    * **Refine, don't restart.** "Drill into RDS for the items above" works.
    * **Combine tools.** Use `#dashboard` first to see the shape, then `#recommend` for the action on the same topic.
    * **Let [Anna](/guide/agents/anna) coordinate.** For anything that touches more than one domain, start with `@anna` and name the specialists.

    **Success state:** a follow-up prompt returns an answer that references items from earlier in the conversation without you repeating them.
  </Step>
</Steps>

## You're done when…

* [x] Your role's quick win returned results naming resources or queries you recognize
* [x] At least one follow-up prompt built on the first answer without restating it
* [x] You can predict what shape of output `#dashboard`, `#report`, and `#recommend` will produce

## Next steps

Every prompt you just ran is one pass of the Detect → Analyze → Resolve → Validate loop described in [How CloudThinker works](/#how-cloudthinker-works) — the modules below run that loop continuously. Set up your first module:

<CardGroup cols={2}>
  <Card title="Code Review" icon="code-pull-request" href="/guide/code-review/setup">
    Connect a repository and get review comments from @cloudthinker-ai on the next pull request.
  </Card>

  <Card title="CostOps" icon="dollar-sign" href="/guide/infrastructure/cloudkeepers">
    Turn on CloudKeepers to monitor spend continuously and surface savings as findings.
  </Card>

  <Card title="Incident response" icon="triangle-exclamation" href="/guide/pulse/setup">
    Route alerts into Pulse so agents investigate before you open a terminal.
  </Card>

  <Card title="Skills" icon="wand-magic-sparkles" href="/guide/skills/custom-skills">
    Teach agents your team's procedures so they run them your way.
  </Card>
</CardGroup>