·
Last changedVersion:
This version passed the hardening gate. Hardening applied 2 targeted changes and preserved all other text. Classified findings before hardening: 4. Classified findings closed: 0. Classified findings remaining: 4. Unclassified scanner findings remaining: 0. Review findings closed: 2. Review findings remaining: 18.
4
4
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
scripts/check_router_health.py | Sensitive Data & Secret Exposure | Data exfiltration | Medium | Open | |
SKILL.md | Tool & MCP Manipulation | MCP over-permissioning | Medium | Open | |
BENCHMARK.md | Sensitive Data & Secret Exposure | Agent snooping | Medium | Open | |
SKILL.md | Excessive Agency & Rogue Autonomy | — | Medium | Open |
4 findings
Make Dynamo routing feel easy by getting a baseline router mode running, enabling KV-aware routing when appropriate, and proving the endpoint works. Keep the user focused on exact commands and success signals, not router internals.
dynamo package importable (python3 -m dynamo.frontend --help works).kubectl configured with access to the target namespace and a deployed Dynamo recipe./v1/models returns at least one entry).Collect or infer:
round-robin, kv, least-loaded, device-aware-weighted, direct, or random/v1/models cannot discover itFor local bring-up with already registered workers:
For Kubernetes, inspect the selected recipe deploy.yaml and locate the
frontend service. If the recipe is not already deployed, use
dynamo-recipe-runner first.
For local frontend:
For Kubernetes, patch only the frontend service env:
If backend workers are not publishing KV cache events, set approximate mode instead of leaving the router waiting for events:
After port-forwarding the frontend service or starting local frontend, run:
This must verify /v1/models and, when a model is discoverable, one
/v1/chat/completions request.
When comparing round-robin vs KV routing:
If the endpoint is unhealthy or workers are missing, switch to
dynamo-troubleshoot.
| Script | Purpose | Arguments |
|---|---|---|
| Smoke-test |
|
Invoke via the agentskills.io run_script() protocol:
Local KV-routed frontend on port 8000, then smoke-test it:
Kubernetes-deployed frontend reachable via port-forward:
Equivalent through the agent protocol:
Return:
dynamo-benchmark for throughput/latency numbers.| Symptom | Likely cause | Next step |
|---|---|---|
| No worker registered with the frontend | Verify worker pods are Ready; confirm they connect to the same etcd/NATS |
Smoke chat request times out | Frontend up, workers not serving | Switch to |
KV mode hangs | Workers do not publish KV cache events | Set |
Connection refused on port-forward | Port-forward dropped or wrong service name | Re-run port-forward; verify the frontend service name matches the recipe |
See BENCHMARK.md for the NVCARPS-EVAL performance report (auto-generated by the NVSkills CI pipeline).
references/router-modes.md for the compact mode/env map.scripts/check_router_health.py for endpoint smoke tests.Get started with chainctlchainctl skill install public/nvidia/dynamo-router-starter:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/nvidia/skills/dynamo-router-starter:latest
Apache-2.0
BENCHMARK.md
HARDENING.md
LICENSE
SKILL.md
evals/evals.json
references/router-modes.md
scripts/check_router_health.py
skill-card.md
skill.oms.sig