How long does the integration take?

Change one base URL in an OpenAI-compatible client, or install the Python or TypeScript SDK; the quickstart routes a first request in a few minutes.

Will this lock us into another vendor?

No. The router is Apache-2.0 open source, your provider keys stay yours, and the API is OpenAI-compatible, so leaving is a change of base URL.

What happens when a provider fails?

The router falls back to the next model your policy allows and records the fallback in the trace, so an outage costs a retry, not an incident.

cis-tomcat9-v120-7.4 - Skill

Name: cis-tomcat9-v120-7.4
Author: urtir

Imported from urtir/SiagaSiber (.siaga/skill/CIS_benchmarks/Server_Software/Apache_Tomcat/CIS_Apache_Tomcat_9_Benchmark_v1.2.0/cis-tomcat9-v120-7.4/SKILL.md). Install upstream with npx skills add urtir/SiagaSiber --skill cis-tomcat9-v120-7.4. Copyright stays with the author.

7.4 Ensure directory in context.xml is a secure location (Manual)

Description

The directory attribute tells Tomcat where to store logs. It is recommended that the location referenced by the directory attribute be secured.

Rationale

Securing the log location will help ensure the integrity and confidentiality of web application activity.

Audit Procedure

Review the permissions of the directory specified by the directory attribute to ensure the permissions are o-rwx and owned by tomcat_admin:tomcat:

# grep directory context.xml
# ls -ld <log_location>

Remediation

Perform the following:

Add the following statement into the $CATALINA_BASE/webapps/<app_name>/META-INF/context.xml file if it does not already exist.

<Valve className="org.apache.catalina.valves.AccessLogValve"
directory="$CATALINA_HOME/logs/"
prefix="access_log" fileDateFormat="yyyy-MM-dd.HH" suffix=".log"
pattern="%h %t %H cookie:%{SESSIONID}c request:%{SESSIONID}r %m %U %s
%q %r"
/>

Set the location pointed to by the directory attribute to be owned by tomcat_admin:tomcat with permissions of o-rwx.

# chown tomcat_admin:tomcat $CATALINA_HOME/logs
# chmod o-rwx $CATALINA_HOME/logs

Default Value

Does not exist by default

CIS Controls

Controls Version	Control	IG 1	IG 2	IG 3
v8	3.3 Configure Data Access Control ListsConfigure data access control lists based on a user's need to know. Apply data access control lists, also known as access permissions, to local and remote file systems, databases, and applications.	●	●	●
v7	14.6 Protect Information through Access Control ListsProtect all information stored on systems with file system, network share, claims, application, or database specific access control lists. These controls will enforce the principle that only authorized individuals should have access to the information based on their need to access the information as a part of their responsibilities.	●	●	●

Profile

Level 1

Install cis-tomcat9-v120-7.4 and it becomes one more candidate the router can pick - when it fits.

A listing is a routing target with a manifest: what it does, which domains it covers, what it costs and who publishes it. Once installed it sits beside your own models and tools, is scored like any other candidate for each request, and shows up in the trace when it wins. Ratings come from workspaces that installed it, one per account.

{ "ocm": "1", "id": "urtir-siagasiber-cis-tomcat9-v120-7-4", "kind": "skill", "name": "cis-tomcat9-v120-7.4", "description": "Ensure directory in context.xml is a secure location (Manual)", "publisher": "urtir", "version": "1.0.0", "capabilities": { "domains": [ "observability" ], "tags": [ "skill-md", "cis", "tomcat", "linux", "java", "logging", "log-files", "github" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Ensure directory in context.xml is a secure location (Manual)" ], "primary": false, "metadata": { "source": { "provider": "github", "repository": "https://github.com/urtir/SiagaSiber", "path": ".siaga/skill/CIS_benchmarks/Server_Software/Apache_Tomcat/CIS_Apache_Tomcat_9_Benchmark_v1.2.0/cis-tomcat9-v120-7.4/SKILL.md", "ref": "d1a447c79bcaffe6589ba07750d28d2376b1e45c", "url": "https://github.com/urtir/SiagaSiber/blob/d1a447c79bcaffe6589ba07750d28d2376b1e45c/.siaga/skill/CIS_benchmarks/Server_Software/Apache_Tomcat/CIS_Apache_Tomcat_9_Benchmark_v1.2.0/cis-tomcat9-v120-7.4/SKILL.md", "key": "urtir/SiagaSiber/.siaga/skill/CIS_benchmarks/Server_Software/Apache_Tomcat/CIS_Apache_Tomcat_9_Benchmark_v1.2.0/cis-tomcat9-v120-7.4/SKILL.md" } }, "instructions": "# 7.4 Ensure directory in context.xml is a secure location (Manual)\n\n## Description\n\nThe `directory` attribute tells Tomcat where to store logs. It is recommended that the location referenced by the `directory` attribute be secured.\n\n## Rationale\n\nSecuring the log location will help ensure the integrity and confidentiality of web application activity.\n\n## Audit Procedure\n\nReview the permissions of the directory specified by the `directory` attribute to ensure the permissions are `o-rwx` and owned by `tomcat_admin:tomcat`:\n\n```\n# grep directory context.xml\n# ls -ld <log_location>\n```\n\n## Remedi", "cost": { "context_tokens": 764 } }

cis-tomcat9-v120-7.4

About

7.4 Ensure directory in context.xml is a secure location (Manual)

Description

Rationale

Audit Procedure

Remediation

Default Value

CIS Controls

Profile

Install cis-tomcat9-v120-7.4 and it becomes one more candidate the router can pick - when it fits.

What it costs to adopt - in engineering time.

One base URL

No vendor lock-in

Failover built in

Use it

Manifest

Reviews