neon-postgres-agent-platforms — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited neon-postgres-agent-platforms (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Companion to **neon-postgres** (install that first). This skill covers fleet-scale control plane for the Neon Agent Program: dual-org layout, project transfer, per-tenant provisioning, compound checkpoints, consumption, and commercial terms.
For connection strings, drivers, ORMs, branching tutorials, Auth in apps, Data API, and MCP, use **neon-postgres** and Neon docs.
Use **neon-postgres** for general Neon usage. Use this skill when the question involves:
npx skills add neondatabase/agent-skills -s neon-postgresWith **neon-postgres** and this skill loaded, you have enough context for platform-level Neon work: dual-org layout, provisioning a project for a new tenant, compound checkpoints, org-wide consumption polling, and transfer/upgrade flows—without the user pasting long documentation.
Where runnable examples live: TypeScript samples run from this skill’s scripts/ directory (package.json, npm run …). The **references/** directory keeps markdown guides beside the runnable examples; MANAGEMENT_API_SAMPLES.md is the script catalog and env map. The human Quick start is the root README.
Non-obvious facts agents often get wrong:
revision + Neon snapshot/branch + secrets/env version + deploy URL + agent metadata. Do not equate "checkpoint" with "Neon branch" alone. See the compound checkpoints doc.
inside one org). Projects with GitHub or Vercel integrations in Neon cannot be transferred; the API returns 422 (Transfer projects).
operations to completion before reconnecting. Delete orphaned (old) branches to avoid storage cost.
GET /api/v2/consumption_history/v2/projects over legacy consumption endpoints. `GET /api/v2/consumption_history/account` is deprecated with a planned sunset of 2026-06-01; migrate to the v2 per-project endpoint (legacy consumption guide).
compute_unit_seconds,root_branch_bytes_month, child_branch_bytes_month, instant_restore_bytes_month, snapshot_storage_bytes_month, public_network_transfer_bytes, private_network_transfer_bytes, extra_branches_month (consumption metrics).
snapshot API + their own scheduler.
neon.com docs.
Partners run two Neon organizations:
| Org | Role |
|---|---|
| Sponsored free org | Free-tier end users (within program rules) |
| Paid org | Paying customers (metered per Agent Plan) |
Key points:
Agent Plan and neon.com/agents. Do not invent numbers.
quotas).
customer changes tier, then PATCH quotas to match the new tier.
Links: Agent Plan · AI Agents · Project transfer · AI Agent integration
Neon's published HIPAA program (workflows, agreements, configuration).
contact**.
Link: HIPAA on Neon
provision for (an end user, a customer app, or an agent workload) gets its own dedicated Neon project. That project is the isolation boundary for branches, databases, roles, and computes—not a shared Postgres cluster where you only partition by schema.
isolation between tenants, keep consumption limits and billing straightforward at project scale (aligned with Agent Plan metering elsewhere in this skill), and match how the Neon Management API and Console are structured** (project-scoped create, quota, and lifecycle calls).
previews) as branch- and snapshot-driven lifecycle inside that project—use Snapshots and database versioning and Sandbox and preview databases below for fleet orchestration, not a second project by default.
example how you host the builder or control plane) from each tenant's staging and production branches—avoid conflating "our production service" with "the tenant's production branch" in ledgers and automation.
development Neon assets across separate orgs for trust, keys, and billing boundaries; when that applies, read Isolation beyond branches (project and org edge cases)** next.
Link: AI Agent integration guide
Use project- or org-level splits when tenant scope or trust needs go beyond branch- and snapshot-first staging and production in Fleet shape. Embedded products may isolate an end customer's production versus development databases across separate Neon orgs, not only branches—tighter billing, org API keys, and console boundaries while you still manage branches within each org.
Project-level isolation (multiple projects per tenant or workload):
leak should not span unrelated workloads.
migration sandbox versus production data) when automation or ownership would otherwise collide in one Postgres.
host combined workloads.
Each extra project adds fleet surface area: more API keys, more consumption rows, more housekeeping, and higher operational cost—keep project-per-tenant as the default unless a boundary above clearly applies.
Org-level isolation (beyond sponsored free versus paid):
the commercial split (free-tier users versus paying customers). That pattern can stack with an embedded product split: for example prod org versus dev org per end customer so playground databases never share org scope with shipped production. Keep a clear internal map of which org owns which environment and tier.
contracting (enterprise “their org only”), reseller or MSP models, or geographic or legal separation—product defaults and limits belong on live docs; do not invent caps.
personal API key and project transfer, as in Gotchas—do not assume an org key can operate across orgs. Project-scoped keys are further limited to a single project (API keys).
Embedding hygiene:
consumption jobs) to least-privilege keys; do not reuse production keys in sandboxes at the wrong layer.
automation per org (typically one organization API key per org) and persist org_id with project_id / branch_id so jobs and restores target the correct side.
project_id, branch_id, org, checkpoint metadata)aligned with the isolation layer you chose so restores, transfers, and audits stay consistent.
For snapshot semantics, active-branch patterns, and restore tutorials, defer to **neon-postgres** and AI database versioning. Here, emphasize tenant fleets:
non-Neon state via compound checkpoints.
(old) branchesaccumulate. Automate cleanup and update stored IDs.
Confirm on Agent Plan docs.
Typical platform-level checkpoint triggers:
Links: AI database versioning · Backup and restore · Snapshots-as-checkpoints demo
Use this when a partner needs per-tenant preview or sandbox databases for generated apps. ("How do I create a branch?" for a single app goes to **neon-postgres**.)
project_id / branch_id per customer / agent run when spinningpreviews via the Management API.
garbage-collect idle previews.
suspend_timeout_seconds on preview computes reduces cost.compound checkpoints.
Link: AI Agent integration guide
Agent Plan and consumption metrics.
GET /api/v2/consumption_history/v2/projects for billing-aligned fields.Legacy endpoints differ. `GET /api/v2/consumption_history/account` is deprecated (sunset 2026-06-01); use v2 per-project metrics instead (legacy guide).
metrics query strings are exactly: compute_unit_seconds,root_branch_bytes_month, child_branch_bytes_month, instant_restore_bytes_month, snapshot_storage_bytes_month, public_network_transfer_bytes, private_network_transfer_bytes, extra_branches_month.
computes.
auth-users.ts meta fromscripts/ for a routing map (Neon Auth REST vs Postgres roles vs consumption APIs).
Links: Agent Plan · Consumption metrics · Consumption limits · Cost optimization · Plans
Agent Plan and AI Agent integration. Do not invent limits.
[email protected] with org ID(s), growth context, and timeline. Also flag in shared Slack if available.
studies, landing page features.
you're building.
Link: Agent Plan
issues.
escalations.
[email protected] with org ID(s), growth context, and timeline.
invoices are in the Neon Console under Billing.
Runnable Management API automation from neondatabase/neon-for-agent-platforms.
COMPOUND_CHECKPOINTS_FOR_AGENT_PLATFORMS.md
CHECKPOINT_ORCHESTRATION_PATTERN.md
All scripts use @neondatabase/api-client only. Shared utils.ts polls async operations. For SQL access from app code (drivers, pooling, ORMs), use **neon-postgres**.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.