For CS Ops and Gainsight admins

Know your tenant before an AI agent touches it.

Point an AI agent at the Gainsight Admin CLI and start with a read-only audit: which processes run, where ARR, health, and risk are defined, and what looks duplicated.

Open the read-only starter kit

Read only · full run typically under $2 of API usage · reports written to intent/

OAuth loginYour Gainsight permissions

Read firstStarter kit never writes

Local filesAudit stays in your folder

One yes, one changeAdvanced kit, logged

Illustrative

$ gs-admin whoami

Token: valid · acme.gainsightcloud.com

you › What is this tenant configured to do?

reading rules, reports, scorecards, objects…

Wrote intent/tenant-overview.md

6 CS processes found, 2 look duplicated

ARR lives in 3 fields; reports use Company.ARR

14 rules inactive for 90+ days

Nothing was created, edited, or deleted.

The Admin CLI path

Understand first. Then remember. Then change, with a yes.

Start read-only. Move on when the audit matches what you know about the tenant.

Starter kit

Read-only tenant audit

Copy one prompt into an AI agent that can run the Admin CLI.

You get: intent/tenant-overview.md
Where ARR, health, and risk are defined
Duplicated processes and inactive rules

Open the starter kit

→

Advanced kit · setup

Local tenant brain

A searchable local copy of your configuration, built once and refreshed when it changes.

About 10–20 minutes to build
Still read only
You get: tenants/<slug>/TENANT.md

Open the advanced kit

→

Advanced kit · with approval

Build and change

Reports and supported configuration changes, matched to how your team already builds.

Sandbox or production named in the plan
Exact command shown before it runs
You get: an entry in changelog.md

See how changes work

What each kit is built to answer

Ask in plain English. Get a file you can review.

You are dealing with	You say	You get	Kit	Mode
A new admin is taking over the tenant	“What is this tenant configured to do?”	Tenant overview	Starter	Read only
Nobody agrees which ARR field is real	“Where does ARR live?”	Field map with the one reports use	Starter	Read only
You are about to retire a field	“What uses Company.Segment?”	Dependent rules and reports	Advanced	Read only
A rule says success but the score never moved	“Which rules only look healthy?”	Rule health report	Advanced	Read only
Cockpit has duplicate CTAs	“What creates CTAs?”	CTA and measure sources	Advanced	Read only
Sandbox and production have drifted	“Compare sandbox and production.”	Difference report	Advanced	Read only
Leadership wants a new report	“Build ARR by stage, save to CS Ops.”	Tested report, saved after your yes	Advanced	After your yes

How changes are made

Nothing changes until you say yes to that change.

01 · PLAN

What and why

Plain-English plan
Dependent rules, reports, objects
Sandbox or production named

02 · IMPACT

What it will do

Emails customers? Creates CTAs? Overwrites data?
The exact command, shown first
Sandbox recommended for production changes

03 · APPROVE

Your yes, then proof

A yes covers one change only
Result read back and compared
Logged in changelog.md

Nothing runs before this step

Sandbox named first

The plan names sandbox or production. A production change includes a recommendation to try it in sandbox.

Inactive until you ask

New rules stay inactive. Journey programs stay unpublished unless you ask otherwise.

Read the rules first

Starter kit safety and advanced kit guardrails.

For your security review

What you need, and what to check before rollout.

The Admin CLI is for tenant configuration: rules, reports, Journey programs, scorecards. MCP is how skills query accounts with each CSM's own permissions.

Starter kit

To run the audit

Gainsight Admin CLI, logged in
An AI agent that can run terminal commands
A working folder; add intent/ to its ignore list

Advanced kit

To build and change

Super admin CLI login
One OAuth app: Read and Write scopes, PKCE, local callback
Node.js and Python 3
A folder outside any git repository

CSM handoff

Before the team uses skills

Copilot prompts need no setup from you
Skills: OAuth with PKCE, one login per person, in the AI agent your team uses
Sign in as a non-admin and a region-restricted user, and compare the agent with the product
Confirm the provider's data handling, then send the team to the CSM cookbook

Salesforce Agentforce. The same answer structures ship as a subagent plus four templates. An admin deploys that kit. Open Agentforce templates

Before you ask

Questions CS Ops asks first

Where does tenant data go?

Audit files and the tenant brain stay in your local folder. Your AI agent processes what it reads under your provider's policy. Do not commit these files.

Is this a supported Gainsight product?

These are sample kits maintained in the open. For CLI or MCP help, use Gainsight Support.