What is, is one.

An agent skill that finds every drift between dev, staging and production, and ranks it by risk. It never prints a secret.

npx skills add senavoh/parmenides

Then ask your agent: “Is staging the same as prod?”

Parmenides as a Greek floor mosaic, eyes closed, unbothered
Parmenides of Elea, unbothered since 475 BC.

Works in the agent you already use.

A drift is a tile out of place.

8 tiles out of place in prod. 5 high risk, 3 medium.

Staging as it should be
Prod tap a tile out of place

Stripe webhook secret High

staging presentprod missing

Add it to the prod secret store, set to prod's own webhook signing secret.

1 of 8

    Already one: express, pg and stripe from one lockfile, production mode, the cookie and pool settings, the deploy script. Left out on purpose: the log level, the URL hosts and the replica count, listed in .parmenides.yml. This is a real, unedited run on a demo app with eight drifts planted. It found all eight. Read the full report

    Webhook secret present → missing Node 20 → 18 Postgres 16.4 → 15.8 Tests and migrations run → skipped CORS one origin → any Redis 7.4 → latest New checkout on → off Timeout 10s → 3s

    Secrets stay under the floor.

    He compares keys, not values. A secret only ever shows up as same, differs or missing. If a real secret is committed to the repo, he flags it without printing it.

    STRIPE_SECRET_KEYdiffers
    SESSION_SECRETdiffers
    DATABASE_URLhost differs
    STRIPE_WEBHOOK_SECRETmissing in prod

    Some cracks run through every floor.

    Staging and prod can agree and both be wrong. He lists those apart from the drift, under Wrong everywhere.

    The lockfile is ignored

    Both Dockerfiles copy only package.json and run npm install, so every build can resolve different dependencies. Nobody planted this one. It was a real mistake in the demo.

    Copy the lockfile and run npm ci --omit=dev.

    The env files are committed

    All three are in the repo. Every secret in them is a placeholder, so nothing leaked, and he says so without printing one. It's still a habit worth breaking.

    Move them to .env.*.example and ignore the real files.

    Questions.

    Will it change anything?

    No. It reads files and writes nothing unless you ask it to save the report as PARMENIDES.md. It never runs a deploy or touches a real environment.

    Where does it find my environments?

    In per-environment files like .env.production, config/staging.yml, docker-compose.prod.yml, values-prod.yaml or prod.tfvars. Or in branches, like staging against main.

    What about differences I want?

    List them in a .parmenides.yml and they stop counting as drift. A key that's missing still counts.

    Which agents does it work in?

    Claude Code, Codex, Cursor, Gemini CLI, OpenCode, and any agent that reads SKILL.md files. No API key, no account.

    Is it free?

    Yes. Open source under the MIT license. The only cost is your agent's own usage.

    Who was Parmenides?

    A Greek philosopher from Elea, born around 515 BC. His one surviving work is a poem, On Nature, where a goddess teaches him that what is, is one and unchanging.

    Make them one.

    Install the skill once, open a project, and ask. Nothing to host, no API key.

    Star it. It won't drift. Read a real report

    Ask your agent

    Install it once

    npx skills add senavoh/parmenides