---
name: redis
description: >-
  Inspect Cleo ElastiCache (Valkey/Redis) caches through a local read-only proxy.
  Use when the user asks to look at, list, or check Redis/Valkey/cache keys,
  TTLs, sizes, or key counts for a service in dev or prod.
user-invocable: true
argument-hint: '[service and question about cache contents]'
---
# redis

`~/Projects/redis-proxy/redis-proxy` finds the cluster, reads its AUTH token from SSM, and listens on `127.0.0.1` with no auth. TLS and AUTH happen upstream, so never handle a token or use `rediss://`. Only read commands are forwarded; anything else returns `-ERR redis-proxy: <CMD> blocked (read-only)`.

```sh
~/Projects/redis-proxy/redis-proxy list --env dev|prod
~/Projects/redis-proxy/redis-proxy up <name> --env dev|prod [--port 16379] [--primary]   # run with run_in_background
valkey-cli -p 16379 <command>
```

Wait for `listening on 127.0.0.1:<port>` in the background output before connecting. Stop the proxy when done. If it reports no SSO session, ask the user to run the `! aws sso login --profile <profile>` command it prints.

## PII/PHI rules (org policy: never put PII/PHI into Claude)

- Prefer `SCAN ... COUNT`, `TYPE`, `TTL`, `STRLEN`, `MEMORY USAGE`, `DBSIZE`, `INFO keyspace` over reading values. Avoid `KEYS`.
- Key names can contain emails or IDs. Don't repeat a key that looks like an email in output; refer to "the key".
- In prod, don't `GET`/`HGETALL`/`LRANGE` etc. on keys that look like sessions, users, messages, or profiles unless the user explicitly asks, and then summarize shape (field names, sizes) rather than pasting values.
- Never read or print the SSM token.

## Notes

- The proxy uses the reader endpoint by default; `--primary` switches. Dev can pass `--allow-writes`; prod refuses it.
- Default port is 16379. Pass `--port` to run several proxies side by side.
- Logs show blocked command names only.