Best Backend and DevOps Skills: Databases, Auth, Cloud, IaC

Backend and DevOps skills are the vendor-published SKILL.md collections that teach a coding agent one platform’s current API: Supabase, Neon, Prisma, Firebase and Convex for data; Clerk and Better Auth for authentication; Cloudflare, AWS, Azure and Google Cloud for deployment; HashiCorp Terraform for infrastructure as code; Stripe for payments. The qualifier: a skill teaches the API, while the matching MCP server touches live resources.

This page is for developers and tech leads who build services with Claude Code, Codex or Cursor. The situation it fixes: the agent adds auth with a middleware pattern two major versions old, wraps <html> in a provider the SDK now wants inside <body>, and writes a migration against a table name it guessed. The model was trained before the SDK changed. A vendor skill replaces that memory with the vendor’s current instructions, and a read-only MCP connection replaces guessing with the live schema.

What you’ll learn

• A shortlist of the 13 official backend and DevOps collections, with the first skill to install from each and the MCP server that pairs with it
• Install commands for Claude Code, Codex and Cursor, checked against the installed CLIs, and the measured context cost of each plugin
• A worked example: Clerk authentication in a Next.js app, with the prompt, the expected output and a machine check
• A new-service workflow (auth, database and deploy) that ends in evidence a reviewer can check without reading every line
• The traps that install the wrong thing, and how to recover when a skill misleads the agent

Checked for this page

Install commands were run on Claude Code 2.1.285, codex-cli 0.157.1, skills 1.7.0 and the Clerk CLI (clerk 3.4.0). Plugin contents and token costs come from claude plugin details on Claude Code 2.1.285. Repository facts come from the September 2026 vendor-skills research, read on 2026-09-26. Cursor had no binary in the writing environment, so Cursor lines follow the vendors’ READMEs and were not tested.

Which backend skills should you install for your stack?

Install the collection for each platform you actually run, and nothing else. Every collection below is published by the vendor itself.

Layer	Collection (repository)	Start with	Pair with this MCP server	GitHub stars, 2026-09-26
Database	Supabase (supabase/agent-skills)	supabase, supabase-postgres-best-practices	Supabase MCP, read_only=true	2,655
Database	Neon (neondatabase/agent-skills)	neon-postgres, neon-postgres-branches	Neon MCP, bundled in the neon-postgres plugin	91
Database	Prisma (prisma/skills)	prisma-postgres-setup, prisma-cli, prisma-upgrade-v7	a database server from database MCP servers	60
Database	Firebase (firebase/agent-skills)	firebase-basics, firebase-security-rules-auditor	Firebase MCP, bundled in the firebase plugin	454
Database	Convex (get-convex/agent-skills)	convex router, convex-auth, convex-migrate (skills CLI names; auth and migrate in the Claude Code plugin)	Convex MCP, bundled in the convex plugin	62
Auth	Clerk (clerk/skills)	clerk-setup, clerk-nextjs-patterns, clerk-testing	Clerk remote MCP, via clerk mcp install	79
Auth	Better Auth (better-auth/skills)	better-auth-best-practices, better-auth-security-best-practices	none; the skills are enough	221
Cloud	Cloudflare (cloudflare/skills)	wrangler, workers-best-practices, durable-objects	Cloudflare Code Mode MCP, bundled	2,913
Cloud	AWS (aws/agent-toolkit-for-aws)	the aws-core plugin (IaC, serverless, IAM)	AWS MCP Server, bundled	2,726
Cloud	Azure (microsoft/azure-skills)	the azure plugin (azure-prepare, azure-deploy)	Azure MCP Server, bundled	1,500
Cloud	Google Cloud (google/skills)	cloud-run-basics, google-cloud-recipe-auth	Developer Knowledge MCP, in the google-cloud-developer plugin	20,398
IaC	HashiCorp (hashicorp/agent-skills)	terraform-style-guide, terraform-test, refactor-module	Terraform MCP Server, added separately; see infrastructure MCP	875 (read 2026-09-24)
Payments	Stripe (stripe/ai)	stripe-best-practices, upgrade-stripe	Stripe MCP, bundled; test mode only	1,833

How popular are these, and why stars only? Stars were read from GitHub on 2026-09-26. They measure attention on a repository, not use of one skill: google/skills covers all of Google Cloud, while a focused collection such as Clerk’s has 79. The Claude plugin directory adds first-party install counts for two of them on the same date: supabase@claude-plugins-official (the community-repo plugin, not the supabase-agent-skills one this page installs) at 118,617 installs and stripe at 61,066. The skills.sh install counts quoted elsewhere could not be read directly for this page, so they are left out; check the live count on skills.sh before you cite one.

For the rest of the vendor catalogue (mobile, observability, CMS, AI APIs), see official skills from technology makers. Frontend frameworks live in the best frontend skills.

How do you install backend skills in Claude Code, Codex and Cursor?

There are two routes. The skills CLI (npx skills) installs SKILL.md folders for every agent you name and works everywhere. A plugin bundles the skills with the vendor’s MCP server and sometimes hooks, and it updates as one unit. Use a plugin when your agent has one for the vendor; use the skills CLI for everything else, and for Cursor unless the vendor ships a Cursor plugin.

Claude Code

# Plugins bundle skills + MCP. Add the vendor marketplace, then install.
claude plugin marketplace add clerk/skills
claude plugin install core@clerk-skills           # also: frameworks@clerk-skills, features@clerk-skills

claude plugin marketplace add neondatabase/agent-skills
claude plugin install neon-postgres@neon

claude plugin marketplace add cloudflare/skills
claude plugin install cloudflare@cloudflare

claude plugin marketplace add hashicorp/agent-skills
claude plugin install terraform@hashicorp        # also: packer@hashicorp

# Marketplace names differ from repository names; these three appear in the cost table below:
claude plugin marketplace add supabase/agent-skills      # then: claude plugin install supabase@supabase-agent-skills
claude plugin marketplace add better-auth/skills         # then: claude plugin install auth-skills@better-auth-agent-skills
claude plugin marketplace add firebase/agent-skills      # then: claude plugin install firebase@firebase

# Anthropic's official directory carries Stripe, Convex, AWS and Azure:
claude plugin install stripe@claude-plugins-official
claude plugin install aws-core@claude-plugins-official

If a …@claude-plugins-official install says the plugin is not found, run claude plugin marketplace add anthropics/claude-plugins-official first; a fresh headless install may have no marketplaces configured. The part after @ is the marketplace name, not the repository: run claude plugin marketplace list to see which names your machine has (checked on Claude Code 2.1.285).

Codex

# Third-party marketplaces: add, then install (listed by `codex plugin list` on 0.157.1)
codex plugin marketplace add cloudflare/skills
codex plugin add cloudflare@cloudflare

codex plugin marketplace add clerk/skills
codex plugin add clerk-skills@clerk

codex plugin marketplace add aws/agent-toolkit-for-aws
codex plugin add aws-core@agent-toolkit-for-aws

# Vendors without a tested Codex marketplace: use the skills CLI
npx skills add neondatabase/agent-skills -a codex -y

Codex’s own openai-curated marketplace (listed as openai-api-curated by codex plugin marketplace list on 0.157.1) lists Stripe, Supabase and others, but those installs could not be tested signed-out; check them in /plugins in a signed-in Codex.

Cursor

# The skills CLI writes project skills to .agents/skills/ for Cursor
npx skills add clerk/skills --skill clerk-setup clerk-nextjs-patterns clerk-testing -a cursor -y
npx skills add supabase/agent-skills -a cursor -y

Neon and Stripe document Cursor plugins in their READMEs (/add-plugin neon-postgres, /add-plugin stripe in Agent chat), and cloudflare/skills ships a Cursor plugin manifest (.cursor-plugin/plugin.json) for the same cloudflare plugin. None of these were tested here.

With skills 1.7.0, the CLI installs one canonical copy of each skill in .agents/skills/, which Codex and Cursor read directly, and symlinks it into agent-specific directories such as .claude/skills/ for -a claude-code. Repeat -a to target several agents in one run. Commit both .agents/skills/ and .claude/skills/, because committing only the symlinks leaves them dangling; pass --copy to get real folders instead of symlinks, for example when teammates check out on Windows. Commit the skills-lock.json the CLI writes too, so every teammate and CI run gets the same revision. Installing and managing skills covers pinning and updates in depth.

How much context does each backend plugin cost?

Every installed skill puts its name and description into every session; the body loads only when the skill fires. claude plugin details <plugin> prints both numbers. Measured on Claude Code 2.1.285:

Plugin	Skills	Always-on cost	Bundles an MCP server?
auth-skills@better-auth-agent-skills	2	~229 tokens	no
supabase@supabase-agent-skills	1	~339 tokens	yes
core@clerk-skills	5	~726 tokens	no
cloudflare@cloudflare	14	~1,037 tokens	yes
firebase@firebase	13	~1,968 tokens	yes
neon-postgres@neon	8	~2,116 tokens	yes
terraform@hashicorp	16	~2,155 tokens	no
stripe@claude-plugins-official	12	~2,240 tokens	yes
convex@claude-plugins-official	18	~2,466 tokens	yes
azure@claude-plugins-official	28	~6,263 tokens	yes
aws-core@claude-plugins-official	25	~7,056 tokens	yes

MCP tool schemas are not in these numbers; run /context in a session to see them. The two cloud plugins cost more than the other nine combined, so install them only in repositories that deploy to that cloud. Reducing MCP token cost covers the server side.

Example: add Clerk authentication to a Next.js app

This is the smallest end-to-end use of a backend skill. Clerk’s clerk-setup skill (version 2.6.0 at the time of writing) drives the Clerk CLI rather than hand-writing files, and it forbids the agent from reading your environment files.

1. Install the skills in the Next.js repository with the tab for your tool above. For this example you need clerk-setup, clerk-nextjs-patterns and clerk-testing: the core, frameworks and features plugins in Claude Code, clerk-skills@clerk in Codex, or the three named skills through the skills CLI.

2. Ask for the change with the acceptance criteria in the prompt.

   Copy-paste prompt: Clerk auth in a Next.js app

   Use the clerk-setup skill to add Clerk authentication to this Next.js App Router app.
   - Use accountless development keys; do not log in to Clerk and do not read or print any .env file.
   - Put sign-in, sign-up and the user button into the existing header in app/layout.tsx.
   - Protect everything under /dashboard with Clerk middleware, following clerk-nextjs-patterns.
   - Server code must `await auth()`; CLERK_SECRET_KEY must never reach client code.
   - When done, run `npx -y clerk@latest doctor --json`, the type check and the linter, and paste the results.
   - Then use clerk-testing to add one Playwright test: a signed-out visit to /dashboard redirects to sign-in.
   Stop and ask before touching any existing auth code.

3. Confirm the plan. The skill shows a two-item checklist and waits for a yes. It then runs npx -y clerk@latest init --no-skills, which detects Next.js, installs @clerk/nextjs, configures the provider, middleware and auth routes, and writes temporary development keys to the environment file it names.

4. Check what you should see. The CLI prints which env file it wrote and how to claim the application. clerk doctor --json reports its checks, the type check and linter pass, and the new Playwright test goes red if /dashboard is reachable signed-out. In the browser, the header shows Sign in and Sign up, and the user button after you sign up.

The claimable accountless application is for development only. Before production, a person runs npx -y clerk@latest auth login to claim it and npx -y clerk@latest deploy to configure the production instance; the skill tells the agent not to do either unasked.

Workflow: stand up a new service with auth, database and deploy skills

A new service is where backend skills pay off most, because every layer has a current API the model may not know. This workflow pairs one skill set and one MCP server per layer: Clerk for auth, Neon for Postgres, Cloudflare for deployment. Swap in Supabase, Better Auth or AWS; the shape stays the same.

1. Plan with the skills loaded, before code. Install the three collections and connect the MCP servers as read-only as each vendor allows (commands and limits below). Ask for a plan, not code:

   Copy-paste prompt: plan a new service across auth, database and deploy

   We are building an invoices service: Next.js on Cloudflare Workers, Clerk auth with organizations, Neon Postgres.
   Using the clerk, neon-postgres and cloudflare skills (read them first), write docs/plan-invoices.md with:
   1. the Clerk setup steps and which routes are protected,
   2. the schema for invoices and line_items, with the migration file names,
   3. the Worker bindings and wrangler config changes,
   4. acceptance criteria as testable statements, one per line, each naming the test that proves it.
   Use the Neon MCP server read-only to check existing schemas. Do not create branches, apply migrations or deploy.

   A tech lead approves the plan and its acceptance criteria. That approval is the sign-off that replaces line-by-line review later; see writing acceptance criteria an agent can be checked against.

2. Build on a disposable database branch. The read-only Neon MCP connection cannot create branches, so this one step uses the Neon CLI with a project-scoped API key. Ask the agent to run npx -y neonctl branches create --project-id PROJECT_ID --name invoices (or call the Neon API, as the neon-postgres-branches skill shows), apply the migrations there, and run the test suite against the branch connection string from npx -y neonctl connection-string invoices --project-id PROJECT_ID. The main branch is never touched until CI applies the migration after merge; database development with agents covers migration gates.

3. Verify with machines, not by reading.

   Copy-paste prompt: verify the new service before review

   Verify the invoices service against docs/plan-invoices.md. For each acceptance criterion, run the test that proves it and record pass/fail with the command output.
   Also run: npx -y clerk@latest doctor --json, the type check, the linter, and
   npx wrangler deploy --dry-run --outdir=/tmp/invoices-dry.
   Read the Neon branch schema through MCP and diff it against the migration files.
   Write the results to docs/evidence-invoices.md. Do not fix anything in this pass; list failures.

   wrangler deploy --dry-run builds the Worker and uploads nothing. The evidence file is what the reviewer reads; the evidence bundle gives a template.

4. Review the risky surface, then ship through CI. A human reviews three things only: middleware and route protection, the migration, and the wrangler bindings. Everything else is covered by the evidence. Deployment happens in CI from the default branch, never from the agent’s session, so the agent’s Cloudflare connection needs only read access: grant only read permissions on the OAuth consent screen, or pass a read-only Cloudflare API token as the bearer.

5. Watch it after release. Ask the agent to read the last hour of Worker errors through the Cloudflare observability MCP server (https://observability.mcp.cloudflare.com/mcp), or through the Code Mode server’s API access, and compare them with the pre-release baseline. Cloudflare MCP covers adding the observability server. Roll back with wrangler rollback if the error rate rises.

Connect the matching MCP servers. These are the servers the workflow uses:

Claude Code

npx -y clerk@latest mcp install --client claude
claude mcp add --transport http neon-ro "https://mcp.neon.tech/mcp?readonly=true"
# Cloudflare MCP comes with cloudflare@cloudflare.

The neon-postgres and cloudflare plugins wire their servers without a read-only setting (https://mcp.neon.tech/mcp and https://mcp.cloudflare.com/mcp), so both can write if the account allows it. Turn off the plugin’s own Neon server in /mcp and use neon-ro; limit Cloudflare through its OAuth permissions or a read-only API token.

Codex

npx -y clerk@latest mcp install --client codex
codex mcp add neon --url "https://mcp.neon.tech/mcp?readonly=true"   # URL parameter from Neon's README
codex mcp login neon
# Cloudflare MCP comes with cloudflare@cloudflare.

Cursor

npx -y clerk@latest mcp install --client cursor

Add Neon with the URL https://mcp.neon.tech/mcp?readonly=true and Cloudflare with a read-only token, using the JSON in database MCP servers and Cloudflare MCP.

clerk mcp install registers Clerk’s remote MCP server; its --client flag accepts claude, codex, cursor and others (Clerk CLI 3.4.0). For Supabase, use https://mcp.supabase.com/mcp?project_ref=PROJECT_REF&read_only=true, where PROJECT_REF is the project’s reference ID. For AWS, Azure and Google Cloud, see cloud platform MCP servers.

What each collection teaches, and where it trips you up

Databases

• Supabase: supabase covers Database, Auth, Edge Functions, Realtime, Storage, Cron and Queues; supabase-postgres-best-practices covers indexes and row-level security. Trap: supabase@claude-plugins-official comes from a different repository (supabase-community/supabase-plugin) than the skills repository’s own supabase@supabase-agent-skills.
• Neon: eight skills, including branching, Neon Auth (managed Better Auth) and an egress optimizer (“Why is my Neon bill so high?”). Trap: the agent-platforms skill in Neon’s README lives in neondatabase/neon-for-agent-platforms, so this repository does not install it.
• Prisma: nine skills, from prisma-cli to prisma-upgrade-v7. Install with npx skills add prisma/skills --skill prisma-cli prisma-upgrade-v7. Trap: the README omits prisma-postgres-setup; run --list to see the real set.
• Firebase: 13 skills, among them firestore-rules-creation and firebase-security-rules-auditor. Trap: the README says firebase/skills, which redirects; record firebase/agent-skills.
• Convex: a convex router plus convex-* skills. Traps: the README still names convex-setup-auth, convex-migration-helper and convex-performance-audit, none of which exist (use convex-auth and convex-migrate, which the Claude Code plugin names auth and migrate); and the convex-add step fetches a capability catalogue from a *.convex.site URL at run time, so its behaviour can change without a skill update.

Authentication

• Clerk: 20 skills covering setup, the CLI, per-framework patterns, organizations, billing, webhooks, testing and mobile. Trap: the README only documents a manual clone for Claude Code; the plugin route above works and was tested.
• Better Auth: six skills (better-auth-best-practices, better-auth-security-best-practices, create-auth, email-and-password, organizations, two-factor). Trap: the Claude Code plugin auth-skills ships only two of them; use npx skills add better-auth/skills for the full set.

Cloud

• Cloudflare: 14 skills for Workers, Wrangler, D1, KV, R2, Durable Objects, the Agents SDK and Next.js on Workers. The plugin wires the Code Mode MCP server. Trap: that server is not read-only, so it can change your account as far as its OAuth grant or token allows; see Cloudflare MCP for the server itself.
• AWS: the Agent Toolkit’s aws-core plugin (25 skills: CDK, CloudFormation, serverless, IAM, cost) over the managed AWS MCP Server. Trap: aws/agent-toolkit-for-aws and the older awslabs/agent-plugins (which adds deploy-on-aws) are two different repositories with different plugins; pick one per repository.
• Azure: the azure plugin (28 skills plus the Azure MCP Server). Trap: microsoft/skills holds 175 SDK skills that npx skills add microsoft/skills does not list without --full-depth, and Microsoft warns that loading all of them “causes context rot”.
• Google Cloud: google/skills covers GKE, Cloud Run, AlloyDB, BigQuery and auth recipes. npx skills add google/skills --skill cloud-run-basics google-cloud-recipe-auth; for plugins, claude plugin marketplace add google/skills, then claude plugin install google-cloud-developer@google-plugins.

Infrastructure as code

• HashiCorp: 16 Terraform skills (style guide, terraform test, module refactoring, imports, Stacks, policy, provider development) in the terraform plugin, plus 4 Packer image-builder skills in packer. npx skills add hashicorp/agent-skills lists them. Trap: the terraform@hashicorp plugin bundles no MCP server, and the separate terraform plugin in claude-plugins-official pins the old hashicorp/terraform-mcp-server:0.4.0 image; add the current server yourself, as infrastructure MCP shows.

Payments

• Stripe: 12 skills in the Claude Code plugin, including stripe-best-practices (Checkout Sessions versus PaymentIntents, Connect, webhooks) and upgrade-stripe. Stripe also documents npx skills add https://docs.stripe.com, which does not auto-update; run npx skills update -y. Trap: the bundled MCP server can move money, so connect it only to test mode or a restricted key.

Backend skill traps, as of 2026-09-26

• npx skills add openai/skills installs a deprecated catalogue. Codex plugins now come from openai/plugins (the openai-curated marketplace).
• supabase/skills, prisma/agent-skills, clerk/agent-skills, cloudflare/agent-skills and aws/skills do not exist. Use the repository names in the table above.
• stripe/agent-toolkit resolves to the repository now called stripe/ai; record the canonical name.
• --skill matches the skill’s frontmatter name, not its folder name. Run npx skills add OWNER/REPO --list before you pin names.
• @azure/mcp@latest is a 3.0 beta on npm; pin @azure/mcp@2.0.5 if you add the Azure server by hand.

When backend skills mislead the agent

The agent writes code for the wrong SDK generation. Skills describe the current SDK, and your project may pin an older one. Clerk’s skill checks installed versions and keeps a Core 2 project on Core 2, but most skills do not. Recovery: put the pinned versions in AGENTS.md or CLAUDE.md and add “match the versions in package.json; do not upgrade” to the prompt.

A Node.js API ends up in a Worker. With Cloudflare skills next to generic backend habits, the agent can import modules the Workers runtime lacks. Recovery: wrangler deploy --dry-run fails the build, so run it in the verify step and name the runtime in the task.

An MCP server writes to production. A skill tells the agent what to do; an MCP server with write access lets it. Recovery: keep database servers on read_only=true or ?readonly=true, keep Stripe in test mode, and let CI apply migrations and deploy. If a write already happened, restore from the database provider’s point-in-time recovery or a Neon branch reset, and rotate the token the server used.

A skill changed under you. npx skills update pulls the newest revision, and Convex’s router fetches content at run time. Recovery: commit skills-lock.json, review skill diffs like dependency upgrades, and follow skill supply-chain security before you install a new collection.

The context fills before the work starts. AWS and Azure together add over 13,000 always-on tokens. Recovery: install cloud plugins per repository, not globally, and disable the ones this repository does not deploy to with claude plugin disable.

Two skills give conflicting advice. Supabase Auth and Clerk both claim “add authentication”. Recovery: install one auth collection per repository and name the skill in the prompt.

Where to go next with backend skills

Database MCP servers Read-only connections to Postgres, Supabase, Neon and MongoDB, and CI-applied migrations.

Cloud platform MCP servers AWS, Azure, Google Cloud and Vercel servers, with least-privilege setup.

Installing and managing skills Pin, share and update one skill set across Claude Code, Codex and Cursor.

Skill supply-chain security What to check before a third-party skill runs in your repository.