Builds AI agents on the Convex agent component: threads, messages, tools that call queries and mutations, streaming, RAG with vector search, and workflows for multi step jobs. Use when adding a chat assistant, tool calling agent, or retrieval feature to a Convex app.

Deep security review of a Convex app: authorization model, data access paths per table, HTTP action exposure, rate limiting, file storage access, scheduled function trust, and a written findings report. Use before launch, after an incident, or when the user asks for a full audit rather than a quick check.

Ten minute security pass over a Convex backend: public functions that should be internal, missing auth checks, unvalidated args, IDs from the client trusted without ownership checks, secrets in code. Use before merging a pull request, after adding new public functions, or when the user says 'quick security check'.

Reflection first problem solving for Convex projects: root cause before code, two candidate fixes, a 98 percent confidence bar, and changes limited to the files the request needs. Use before implementing any fix or feature, when a bug report comes in, when a previous fix did not work, or when the request is vague.

Ends every agent turn with a clear "What I need from you" section listing concrete actions the user must take, or says "Nothing needed from you right now", and logs every ask by id and session in prds/what-i-need-from-you.md. Use on every turn, especially when blocked on the user, when the next step needs a login, dashboard, key rotation, decision, file, or approval, or when finishing a task, audit, or fix.