# Recipes cookbook > Copy-ready prompts and commands for the Core agents and every pack, each with what it really does: Atlas, Forge, Sentinel, Nexus, Shadow, Zecher, SEO, Shield, Dev Studio, Atelier and the CLI. Canonical: https://bmad-plus.rochetta.fr/docs/guides/recipes-cookbook/ Language: en BMAD+ version: 0.23.1 Documentation reviewed: 2026-10-19 Author: Laurent Rochetta License: MIT BMAD+ documentation › [Guides](https://bmad-plus.rochetta.fr/docs/guides/) › Recipes cookbook Each recipe is a prompt you can paste into your AI tool (or a command for your terminal) and a description of what it does according to the files that define the agent. Replace the project details with your own. Results are stated only as far as the repository defines them; anything that depends on your model or your tool is said to depend on it. Prompts that name a person, a site or a company are examples: use only targets you are allowed to analyse. ## Core agents ### Atlas: research a market Atlas has two roles, Analyst and Product Manager. Words such as "analyze", "market" or "benchmark" switch it to the Analyst role; it announces the switch and you can answer "skip". On activation Atlas greets you and shows its capability menu, then waits: give the request below or the menu code `MR`. **In your AI assistant** ```text Atlas, analyze the market for AI note-taking apps. Identify the main segments, three direct competitors and two indirect alternatives, what each charges, and where a new entrant could differ. Separate what you know from what you assume, and name the sources you used. ``` **What you should get** A market and competitive analysis from the Analyst role (capability MR). Its content depends on the model and the web access of your tool; the prompt asks for sources and assumptions, so treat any claim without a source as unverified. ### Forge: propose an architecture Use once a PRD or a brief exists. Keywords such as "architecture", "API" or "schema", or a change touching more than five files, switch Forge to its Architect role. **In your AI assistant** ```text Forge, propose an architecture for the app described in _bmad-output/discovery/prd.md. Give the stack with the reason for each choice, the main components and their boundaries, the data model, the riskiest assumption and how to test it first. Keep alternatives you rejected and why. ``` **What you should get** An architecture document (capability CA), written under `_bmad-output/`; the skill chooses the file name, so read the path it reports. In autopilot it is the input of the `architecture` checkpoint, where you approve it before any story is planned. ### Sentinel: review the UX and accessibility of a screen Sentinel’s UX Reviewer role. If the Design pack is installed, Atelier’s rules govern visual design and accessibility and Sentinel hands those over. **In your AI assistant** ```text Sentinel, review the UX of the dashboard in src/pages/dashboard. Check keyboard navigation, focus visibility, colour contrast, empty and error states, and what happens on a 360 px wide screen. List findings by severity with the file and the element, and say which checks you could only inspect and not run. ``` **What you should get** A UX review from Sentinel’s UX Reviewer role, with findings ranked by severity. Whether a check was run or only read from the code depends on what your tool can execute; the report should say which. ### Nexus: turn a plan into epics and stories Nexus in its Scrum Master role. Use after the architecture is approved. **In your AI assistant** ```text Nexus, create epics and stories for the MVP from the PRD and the architecture. Each story needs acceptance criteria I can check, its dependencies and the files it is likely to touch, so that independent stories can run in parallel later. Order them and mark the first story to build. ``` **What you should get** Story files (capability ES) under `_bmad-output/`; the skill chooses the folder, so read the paths it reports. A sprint plan (SP) follows only if you ask for one. The file lists per story are what the Parallel Supervisor later uses to decide which stories do not collide. ## Specialist packs ### Shadow: a due-diligence check with a recorded legal basis OSINT pack, governed. A named person or a personal-data operation needs a recorded purpose, legal basis, retention and erasure path first (the Phase minus 1 gate). Company or market research is not affected. At least one provider API key must be set. **In your AI assistant** ```text Shadow, run a due-diligence check on the supplier Acme Ltd and its director. Purpose: supplier onboarding for a contract signing next month. Legal basis: legitimate interest, Article 6(1)(f), with the balancing test written down. Retention: 12 months. Erasure requests go to privacy@example.com. Record this before you search, keep the budget under 0.50 dollars unless I agree, and grade every fact A to D. ``` **What you should get** The lawful-basis record is made first. The dossier opens with the notice "AI-generated OSINT output - may contain errors; not legal advice" and each fact carries a confidence grade (A three sources or more, B two, C one, D unverified). According to the agent file, reports are saved under `{output_folder}/osint-reports/`; the investigation skill may use its own folders, so read the path it reports. Without a stated purpose and legal basis, the agent declines the named-person operation and offers non-personal alternatives. Profiling personality needs a separate GDPR Article 9(2) condition. ### Zecher: index the projects on your machine Memory pack. The scan is interactive: nothing is indexed before you confirm each project. The CLI equivalent is `npx bmad-plus scan ~/dev --depth 4`. **In your AI assistant** ```text Zecher, scan the projects in ~/dev. Skip node_modules, vendor and build folders. Show me a table with the project name, detected stack, status (active, paused or archived by last modification) and whether BMAD+ is installed, then let me confirm, edit, skip or install for each one before you write the index. ``` **What you should get** A table of discovered projects with a status from their last modification (active under 30 days, paused 30 to 180, archived beyond), a per-project choice, and then one YAML card per confirmed project under `~/.bmad-plus/brain/projects/` plus a human-readable `projects-index.md`. Then a report of how many were indexed, new and updated. ### Backup Manager: a timestamped archive and a rotation Backup pack. The agent adapts the commands to your operating system (PowerShell or Bash) and asks for confirmation before deleting any backup. **In your AI assistant** ```text /backup before I refactor the billing module, then show me the archive name and its size. ``` **What you should get** A ZIP named `_backup_.zip` in a `backups/` folder of the project, leaving out, at the project root only, `node_modules`, `.git`, `vendor`, `backups/`, `__pycache__` and `*.backup_*` (a `node_modules` folder deeper in the tree is archived). The PowerShell form prints the size; the Bash form prints only the file name. Follow with `/backup-list` to list archives, `/backup-restore` to unpack one into a new `restore_/` folder (your files are not overwritten), and `/backup-clean` to keep only the last N (5 by default) after asking you. ### Animated Website Creator: a scroll-driven page from a video Animated pack. Needs FFmpeg and FFprobe (with the `libwebp` encoder), an MP4, and Python 3 only for the local preview. The pack ships no extraction script: the agent extracts the frames with two ffmpeg commands. **In your AI assistant** ```text Turn product-demo.mp4 into an Apple-style scroll-driven website. Analyse the video with ffprobe first and show me the duration, resolution, frame rate and the number of frames you recommend. Wait for my confirmation before extracting frames. Then plan the six overlay sections (hero, vision, details, grid, context, call to action) and ask me for their content. ``` **What you should get** A video analysis table, then a recommended frame count by duration (0 to 5 s: 60 to 90 frames and 400vh; 5 to 15 s: 100 to 150 and 650vh; 15 to 30 s: 150 to 200 and 800vh; beyond 30 s: capped at 200 and 900vh). After confirmation, WebP frames for desktop (1920x1080) and mobile (960x540) with a manifest, within a payload budget of 10 MB for desktop and 5 MB for mobile, then a single HTML file with the design system built in. By default the page uses system fonts and makes no outside request; the agent asks first, and Google Fonts are used only if you explicitly ask for them, after a warning that every visitor’s browser would then contact Google. ### SEO: a technical inspection of one site SEO pack, Scout agent (Inspector role). Only the URL you give and its internal links are fetched, public addresses only. Without a usable Python environment (opt-in with `install --provision-python`), the agent works in prompts-only mode and marks unverified categories instead of computing a score. **In your AI assistant** ```text SEO Scout, run the technical inspection (the /seo technical routine) on https://staging.example.com before we launch. Report crawlability, indexability, security, URL structure and mobile findings by severity, and say which categories you could not verify. ``` **What you should get** The technical phase only: crawlability, indexability, security, URL structure, mobile, Core Web Vitals, structured data detection, JavaScript rendering and IndexNow, with findings in severity buckets. The SEO skill defines these sub-commands, which you can ask for in a sentence (they are names the skill understands, not slash commands registered in your tool): `/seo full ` (all six phases), `/seo quick ` (phases 1 to 4), `/seo content`, `/seo schema`, `/seo images`, `/seo hreflang`, `/seo pagespeed`, `/seo plan `, `/seo fix`, `/seo history`, `/seo compare`, `/seo competitor ` and `/seo api `. ### SEO: how ready is a site for AI search? SEO pack, Judge agent (GEO Analyst role). It reads what crawlers can access; it does not query any AI service. **In your AI assistant** ```text SEO Judge, check how ready the blog at https://example.com/blog is for AI search (the /seo geo routine): crawler access for GPTBot, ClaudeBot and PerplexityBot, llms.txt, and which passages an AI answer could cite. Mark anything you could not verify instead of scoring it. ``` **What you should get** An analysis of crawler access (GPTBot, ClaudeBot, PerplexityBot), the presence and quality of `llms.txt`, how citable the content blocks are (the playbook looks at blocks of roughly 134 to 167 words) and an AI Readiness Score, but only when every input was verified; otherwise the affected parts are marked `unverified` and no overall score is given. ## Compliance and engineering packs ### Shield: audit a SaaS against GDPR Shield pack. The orchestrator routes by the words you use to the right specialist (here `gdpr-agent`, which has seven workflows). Every report is marked AI-generated and "not legal advice". **In your AI assistant** ```text Shield, ask the GDPR specialist (gdpr-agent) to review the code and the data flows of my SaaS in this repository: which personal data is collected, where it is stored and sent, the legal basis you can infer, retention, data-subject rights and processors. List gaps by severity with the file that shows each one, and say what you could not determine from the code alone. ``` **What you should get** A structured audit from the GDPR specialist (code and system audit, with data-flow and PII review among its workflows), ending with the "not legal advice" marking. The findings are a prompt for your DPO or counsel, not a certification. Related workflows: `dpia-sentinel` (impact assessment), `breach-sentinel` (Articles 33 and 34, the 72-hour notification), `legitimate-interest`, `privacy-notice-gen` and `cookie-policy-gen`. ### Shield: compare two frameworks in one report When a request involves several frameworks, the orchestrator lists the relevant ones with a confidence level, routes to each specialist, maps the controls across frameworks and writes one consolidated report. **In your AI assistant** ```text Shield, do a gap analysis of ISO 27001 against NIST CSF 2.0 for our company. Use the ISO 27001 specialist and the NIST CSF specialist, map the controls between the two frameworks, and give me one consolidated report: where we are covered once for both, where only one is covered, and what to do first. State your assumptions about our scope. ``` **What you should get** A consolidated report built from the shared audit-report template, with a cross-framework mapping and prioritised actions, marked AI-generated and "not legal advice". The depth of each specialist’s analysis depends on what you give it about your organisation. ### Shield: write a data protection impact assessment The `dpia-sentinel` workflow follows GDPR Article 35 in seven steps, from the threshold assessment to prior consultation, with a section on AI-specific considerations. **In your AI assistant** ```text Shield, run a DPIA for our recommendation engine, which scores users from their browsing history. Start with the threshold assessment. Ask me for the missing facts about nature, scope, context and purpose of the processing instead of inventing them, then produce the document with its numbered sections and leave the DPO opinion and the sign-off for the people who must give them. ``` **What you should get** A DPIA document with nine numbered sections: project information, threshold assessment, processing description, necessity and proportionality, risks to data subjects, mitigation measures, DPO opinion, conclusion and sign-off. Sections 7 (DPO opinion) and 9 (sign-off) are for people to complete. ### Shield: an assurance case whose evidence is a check that ran Shield pack with the BMAD+ CLI. The case file lives at `_bmad/assurance/.yaml`; the ledger `runs.jsonl` records each check run. Set `BMAD_PLUS_ASSURANCE_KEY` (at least 32 characters) to sign records with an HMAC. **In your AI assistant** ```text Shield, build an assurance case for release 1.4 with bmad-plus assurance init _bmad/assurance/release-1-4.yaml. Declare claims such as "dependencies have no high-severity advisory" and "the access-control tests pass", each backed by a command I already have in the repository. Run bmad-plus assurance run for the checks, then bmad-plus assurance verify, and report which claims are supported or unsupported and, for each unsupported one, whether its check is missing, failed or stale. Do not mark a claim supported unless its check ran. ``` **What you should get** A case file started from the Shield template, a hash-chained ledger of the commands that ran (only commands listed in your own case file run, and only on an explicit `assurance run`), and a verdict: `verify` exits 0 when the claims are supported and 1 otherwise. A supported claim means a named check passed; it is not a certification. ### Dev Studio: Miriam writes a product brief Dev Studio pack: six personas (Miriam, Huldah, Yosef, Rachel, Bezalel, Oholiab) and 38 Markdown workflows that your assistant executes. The CLI only prepares read-only context. **In your AI assistant** ```text Miriam, use product-brief to define a feedback inbox for field technicians who work offline most of the day. Keep the first scope to what works without a connection. ``` **What you should get** A report at `_bmad-output/dev-studio/product-brief.md` (the default location for a workflow report is `_bmad-output/dev-studio/.md`) stating the product problem, the audience and the first useful scope. To see exactly what the workflow will be given, run `npx bmad-plus studio prepare product-brief --request "Define a feedback inbox that works offline" --json`: it resolves the configuration, loads the shipped instructions, records their hashes and proposes the report path, without running or writing anything. ### Dev Studio: Oholiab reproduces a failure The `investigate` workflow of the engineer persona produces hypotheses, reproduction evidence and a next action. List the workflows with `npx bmad-plus studio list --json`. **In your AI assistant** ```text Oholiab, use investigate to reproduce the failing import described in docs/issue.md. State your hypotheses first, reproduce the failure with a command I can re-run, show its real output, and stop at the next action without changing the code. ``` **What you should get** A report with the hypotheses, the reproduction command and its real output, and a proposed next action. The workflow is Markdown instructions: whether the command can actually run depends on the permissions of your tool, and a failure to run it is reported, not hidden. ## Design and the command line ### Atelier: audit an existing interface Design pack, Reviewer role. The audit follows the `design-review` skill; the report labels each finding as `tool` (a command ran and its output is quoted) or `inspection` (read against the checklist). A review changes nothing. **In your AI assistant** ```text /design review src/ ``` **What you should get** A report at `_bmad-output/design/review.md` with findings ranked from accessibility blockers down, each labelled `tool` or `inspection`. A number appears only under `tool`; a check the skill expects that could not run is listed under "not run", never estimated. Other commands: `/design read`, `/design build `, `/design redesign` and `/design tokens`. ### Bootstrap an existing project with autoconfig A terminal command, not a chat prompt. It analyses the project, recommends packs, installs them and ends with suggested next prompts. **In your AI assistant** ```text npx bmad-plus autoconfig --yes ``` **What you should get** The detected stack and structure with a project health percentage, then the packs it recommends: always Core and Memory; Dev Studio when the project has no `docs/` or more than five top-level folders; Shield when it finds CI/CD or Docker; SEO for Next.js, Nuxt, Angular, React, Vue.js or Svelte. It installs them (with `--yes`, without asking) and prints a few recommended first prompts, such as asking Sentinel to set up a test framework when none exists. In a real run on a bare project it ended with "Autoconfig complete!". ### Check an installation in a script A terminal command for CI or a pre-flight check. `doctor` is read-only, never contacts npm, and exits 1 on any error. **In your AI assistant** ```text npx bmad-plus doctor --json ``` **What you should get** A JSON report with `schemaVersion`, `status` (`ok` on a healthy installation), the installed and CLI versions, the ownership inventory (`complete` with the number of tracked files), each pack with its required resources, the integrations, the runtimes and the individual checks. Add `--verify-python` to run the provisioned Python interpreter of a pack in isolation and confirm that its modules import. **See also** - [Your first hour with BMAD+](https://bmad-plus.rochetta.fr/docs/guides/first-hour/) - [All the packs](https://bmad-plus.rochetta.fr/docs/packs/packs-overview/) - [The agent roster](https://bmad-plus.rochetta.fr/docs/agents/agents-roster/) - [The command-line reference](https://bmad-plus.rochetta.fr/docs/reference/cli-overview/) - [Swarms of sub-agents](https://bmad-plus.rochetta.fr/docs/concepts/swarm/) - [Code review and human acceptance](https://bmad-plus.rochetta.fr/docs/concepts/code-review-and-acceptance/) [BMAD+ documentation](https://bmad-plus.rochetta.fr/docs/) · [Guides](https://bmad-plus.rochetta.fr/docs/guides/) [Source on GitHub](https://github.com/lrochetta/BMAD-PLUS)