What are we working on?
Ask a question, create an output, or build an app that works with your tools and data.
Get Started
Build a cyber threat intelligence dashboard
Monitor attack vectors, fraud attempts, and security posture in real time
App
Monitor attack vectors, fraud attempts, and security posture in real time
Draft an edge infrastructure migration runbook
Generate a runbook grounded in your architecture standards and change procedures
Document
Generate a runbook grounded in your architecture standards and change procedures
Build a Q3 platform engineering review deck
Pull data from Jira and Confluence into slides
Slide Deck
Pull data from Jira and Confluence into slides
Connect to our fraud detection engine and build a real-time threat intelligence dashboard showing attack vectors, blocked requests, fraud attempt rates, and security posture across payment services.
AI
I'll need access to your fraud detection and security telemetry. Let me request that through a Gatekeeper.
🔒 Gatekeeper: Fraud Detection Engine
Requesting read-only access to threat telemetry, fraud scores, WAF block logs, and security posture metrics. The Gatekeeper holds the credential and logs every query.
Requesting read-only access to threat telemetry, fraud scores, WAF block logs, and security posture metrics. The Gatekeeper holds the credential and logs every query.
Approved.
AI
Access granted. Pulling security telemetry now.
Executed code
const threats = await env.FRAUD_ENGINE.getThreatTelemetry({
services: "all-payment",
include: ["vectors", "blocks", "fraud_rate", "posture"]
});
const activeAlerts = threats.incidents.filter(
i => i.severity === "critical" || i.severity === "high"
);
app.render(ThreatDashboard, { threats, activeAlerts });
AI
Cyber Threat Intelligence Dashboard is live. Connected via Gatekeeper -- read-only, every query logged.
I see 3 active alerts requiring attention, including a credential stuffing campaign targeting the checkout API. Want me to set up PagerDuty escalation if the block rate drops below 99%?
I see 3 active alerts requiring attention, including a credential stuffing campaign targeting the checkout API. Want me to set up PagerDuty escalation if the block rate drops below 99%?
+
Draft an updated Edge Infrastructure Migration Runbook for our CDN and edge services. Base it on our current architecture principles and change management procedures.
AI
I'll pull from your company's context library to ground this in PayPal's standards.
📚 Context Library: Architecture & Infrastructure
Loading PayPal's architecture principles (v4.1), network architecture docs, edge PoP inventory, and change management procedures. These are curated by your platform team and read-only to the agent.
Loading PayPal's architecture principles (v4.1), network architecture docs, edge PoP inventory, and change management procedures. These are curated by your platform team and read-only to the agent.
AI
Context loaded. I've identified 4 key areas to address in the runbook:
1. DNS cutover sequencing for 12 edge PoPs
2. Origin shield migration with zero-downtime traffic shifting
3. TLS certificate rotation and pinning updates
4. Rollback procedures with automated health checks
I'll structure the runbook around these phases.
1. DNS cutover sequencing for 12 edge PoPs
2. Origin shield migration with zero-downtime traffic shifting
3. TLS certificate rotation and pinning updates
4. Rollback procedures with automated health checks
I'll structure the runbook around these phases.
AI
Edge Services Migration Runbook v2.0 draft is ready. Structured per PayPal's change management framework with phase gates and automated pre-checks.
You can edit directly, export to Google Docs, or share for review. The document stays connected to the context library -- if architecture standards change, I can flag sections that need updating.
You can edit directly, export to Google Docs, or share for review. The document stays connected to the context library -- if architecture standards change, I can flag sections that need updating.
+
Build a Q3 platform engineering review deck summarizing our infrastructure changes, migration status, and upcoming initiatives. Pull data from Jira and Confluence.
AI
I'll need access to your project tracking and wiki.
🔒 Gatekeeper: Jira (read-only)
Requesting access to the PLATFORM and NETWORK projects. Read epics, status, and completion data only.
Requesting access to the PLATFORM and NETWORK projects. Read epics, status, and completion data only.
🔒 Gatekeeper: Confluence (read-only)
Requesting access to the Architecture Decisions space. Read pages only.
Requesting access to the Architecture Decisions space. Read pages only.
Both approved.
AI
Executed code
const epics = await env.JIRA.getEpics({
projects: ["PLATFORM", "NETWORK"],
quarter: "Q3-2026"
});
const adrs = await env.CONFLUENCE.getPages({
space: "architecture-decisions",
since: "2026-07-01"
});
deck.generate(QuarterlyReview, { epics, adrs });
AI
Q3 Platform Engineering Review deck is ready -- 4 slides from live Jira and Confluence data.
You can regenerate anytime to pick up changes, or edit individual slides. Export to Google Slides or PDF when ready to present.
You can regenerate anytime to pick up changes, or edit individual slides. Export to Google Slides or PDF when ready to present.
+
Gadget
Code
Connections
Cyber Threat Intelligence Dashboard
99.6%
WAF Block Rate
3
Active Threats
2.3M
Blocked Requests Today
97
Security Posture Score
Active Alerts
🔴 Credential Stuffing -- Checkout API -- 14K attempts/hr from rotating proxies. Bot management rules engaged, 99.8% blocked.
🔴 API Abuse -- /v2/payments endpoint -- Anomalous request pattern from 3 merchant accounts. Rate limiting applied, under investigation.
⚠️ TLS Certificate Expiry -- Edge PoP SJC-02 cert expires in 72 hours. Auto-renewal triggered, pending validation.
Threat Severity by Service
Payment Processing
97%
Secure
Checkout API
82%
Elevated
Identity & Auth
95%
Secure
Merchant Portal
91%
Secure
Edge CDN
88%
Secure
Fraud Detection
74%
Monitor
Developer APIs
63%
At Risk
Page
Source
Connections
Edge Services Migration Runbook v2.0
PayPal -- Edge Services Migration Runbook
1. Purpose
This runbook defines the end-to-end procedure for migrating PayPal's edge infrastructure services -- including CDN, DNS, origin shields, and TLS termination -- to the next-generation architecture. It applies to all production edge PoPs and is aligned with PayPal's change management framework and architecture principles.
2. Scope
- All 12 production edge PoPs (US, EU, APAC regions)
- DNS authoritative and recursive resolvers
- Origin shield and load balancer configurations
- TLS certificate and pinning infrastructure [NEW]
- DDoS mitigation and WAF rule propagation
3. Migration Phases
| Phase | Description | Duration | Gate |
|---|---|---|---|
| 1. Pre-flight | Validate configs, run dependency checks, snapshot current state | 2 days | All checks green |
| 2. DNS Cutover | Migrate DNS records PoP-by-PoP with 5-min TTL, monitor resolution | 4 days | 100% resolution accuracy |
| 3. Origin Shield | Deploy new origin shield config, shift traffic 10% → 50% → 100% | 3 days | P99 latency < 200ms |
| 4. TLS Rotation | Rotate certificates, update pinning, validate OCSP stapling | 2 days | Zero handshake errors |
| 5. Validation | Full synthetic monitoring, load testing, security scan | 3 days | SLA compliance confirmed |
Change Advisory Board (CAB) Requirement: All Phase 2 and Phase 3 activities require a CAB-approved change ticket with rollback plan attached. Emergency rollback can be initiated by any on-call SRE.
4. Rollback Procedures
| Trigger | Action | RTO |
|---|---|---|
| DNS resolution failure > 0.1% | Revert DNS records, flush resolver caches | < 5 min |
| Origin latency P99 > 500ms | Shift traffic back to previous origin shield | < 2 min |
| TLS handshake error rate > 0.01% | Restore previous certificates, disable pinning update | < 10 min |
| WAF false positive spike | Rollback WAF ruleset to previous version | < 3 min |
Slides
Source
Connections
Q3 Platform Engineering Review
Integrations
Connect external services to PayPal OS. Gatekeepers govern access, scope permissions, and log every action.
Gatekeepers
Google Workspace
Gmail, Docs, Sheets, Slides, Calendar, Drive
Slack
Send messages, read channels, manage workflows
Jira
Projects, epics, issues, sprints, and boards
Confluence
Read and write wiki pages, search spaces
GitHub
Access repositories, create PRs, manage issues and actions
PagerDuty
On-call schedules, incident alerts, and escalation policies
Splunk / SIEM
Security events, alerts, monitoring, and correlation data
ServiceNow
IT tickets, change requests, CMDB, and incident management
Snowflake
Data warehouse, analytics, cross-department reporting
Grafana
Dashboards, observability, metrics, and alerting
Workday
Employee data, org charts, payroll, time off, benefits
Datadog
APM, infrastructure monitoring, log management, and tracing
MCP Servers
Remote MCP servers available to all workspaces.
Fraud Detection Engine
https://fraud.mcp.paypal.internal/mcp
Auto
Payment Processing API
https://payments.mcp.paypal.internal/mcp
Needs auth
Network Topology Service
https://network.mcp.paypal.internal/mcp
Auto
Edge CDN Management
https://edge.mcp.paypal.internal/mcp
Needs auth
Cloudflare API
https://mcp.cloudflare.com/mcp
Auto
Context
Curated reference documents that ground your agent in PayPal's knowledge. Published centrally, read-only to all agents and workspaces.
company-strategy-fy2027.md
PayPal's strategic priorities, digital payments vision, annual objectives, and key results by business unit
security-standards.md
Payment security policies, PCI-DSS v4.0.1 requirements, fraud prevention controls, and cryptographic standards
architecture-principles.md
Platform architecture standards, microservices guidelines, decision criteria, and technology radar
api-design-guidelines.md
REST/GraphQL API conventions, versioning policy, rate limiting, and developer experience standards
compliance-framework.md
PSD2, GDPR, SOX, BSA/AML regulatory requirements, control mappings, and audit procedures
infrastructure-inventory.md
System catalog with ownership, SLAs, dependency mappings, and change advisory contacts
developer-standards.md
Coding standards, CI/CD pipeline requirements, testing coverage thresholds, and release procedures
risk-management-playbook.md
Fraud detection models, risk scoring methodology, AML procedures, and transaction monitoring thresholds
network-architecture.md
Network topology, edge PoP inventory, DNS architecture, traffic engineering policies, and peering agreements
incident-management.md
Incident response procedures, war room protocols, post-mortem templates, and escalation paths
Skills
| Name | Description | Group | Source |
|---|---|---|---|
| meeting-prep | Scan calendar, gather context from connected systems, and generate briefing docs | General | PayPal |
| weekly-report | Compile team activity summaries from Jira, Slack, email, and calendar data | General | PayPal |
| threat-assessment | Analyze threat intelligence feeds, correlate attack patterns, and generate risk briefings | Security | PayPal |
| fraud-detection-tuning | Review fraud model performance, suggest threshold adjustments, and generate tuning reports | Security | PayPal |
| compliance-audit | Gather PCI-DSS/PSD2 compliance evidence, map controls, and generate audit packages | Security | PayPal |
| incident-response | Draft or update incident response policies grounded in PayPal security standards and NIST | Security | PayPal |
| vulnerability-triage | Prioritize CVEs against PayPal's asset inventory, assign owners, and track remediation SLAs | Security | PayPal |
| architecture-review | Build quarterly architecture review decks from Jira and Confluence data | Engineering | PayPal |
| api-catalog | Discover, document, and visualize internal API endpoints with ownership and health | Engineering | PayPal |
| service-health | Generate service reliability reports from monitoring data, SLO tracking, and incident history | Engineering | PayPal |
| deployment-runbook | Create step-by-step deployment guides with pre-checks, rollback procedures, and verification | Engineering | PayPal |
| cloud-migration | Plan and track cloud migration workloads, dependency mapping, and cutover checklists | Infrastructure | PayPal |
| capacity-planning | Forecast compute, storage, and network capacity needs based on traffic trends and growth | Infrastructure | PayPal |
| edge-optimization | Analyze edge PoP performance, cache hit ratios, and latency distribution for optimization | Infrastructure | PayPal |
| cost-optimization | Cloud and infrastructure spend analysis, trend visualization, and optimization recommendations | Infrastructure | PayPal |
| change-impact | Analyze change impact across systems, map dependencies, and identify affected teams | Engineering | PayPal |