{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Agentic Security Field Guide",
  "home_page_url": "https://readbeforerun.ai/",
  "feed_url": "https://readbeforerun.ai/feed.json",
  "description": "Find the right AI security tool for the job: curated AI agents, skills and MCP servers, each described with what it does, what it needs and what its code can touch.",
  "language": "en",
  "authors": [
    {
      "name": "Ilja Schlak",
      "url": "https://readbeforerun.ai/about/"
    }
  ],
  "items": [
    {
      "id": "https://readbeforerun.ai/catalog/cisco-mcp-scanner/#cisco-mcp-scanner-changed-0-2026-11-07",
      "url": "https://readbeforerun.ai/catalog/cisco-mcp-scanner/",
      "title": "Cisco MCP Scanner Plugin: value changed",
      "content_text": "changed: Tier listed → tried. Reason: First lab run published (runs/2026-11-07): the YARA-only CLI from the pinned commit, observed reach 2, beyond declared on network.",
      "date_published": "2026-11-07T00:00:00Z",
      "_field_guide": {
        "tier": "tried",
        "reach": "reach 3 · beyond declared (1)"
      }
    },
    {
      "id": "https://readbeforerun.ai/catalog/cisco-mcp-scanner/#cisco-mcp-scanner-tried-2026-11-07-2026-11-07",
      "url": "https://readbeforerun.ai/catalog/cisco-mcp-scanner/",
      "title": "Cisco MCP Scanner Plugin: lab run published",
      "content_text": "lab run 2026-11-07 published: Beyond declared on 1 of 6 rights: network (observed 2, declared 1), with blocked attempts to reach GitHub at start-up even in YARA-only mode. (reach 3 from code (privileged); lab: beyond declared on 1 of 6 rights: network)",
      "date_published": "2026-11-07T00:00:00Z",
      "_field_guide": {
        "tier": "tried",
        "reach": "reach 3 · beyond declared (1)"
      }
    },
    {
      "id": "https://readbeforerun.ai/catalog/crowdstrike-falcon-mcp/#crowdstrike-falcon-mcp-changed-0-2026-11-07",
      "url": "https://readbeforerun.ai/catalog/crowdstrike-falcon-mcp/",
      "title": "CrowdStrike Falcon MCP Server: value changed",
      "content_text": "changed: Tier listed → tried. Reason: First lab run published (runs/2026-11-07): falcon-mcp over stdio, read-only, detections module, against the lab's stub of the Falcon API; observed reach 3, beyond declared on secrets.",
      "date_published": "2026-11-07T00:00:00Z",
      "_field_guide": {
        "tier": "tried",
        "reach": "reach 3 · beyond declared (1)"
      }
    },
    {
      "id": "https://readbeforerun.ai/catalog/crowdstrike-falcon-mcp/#crowdstrike-falcon-mcp-tried-2026-11-07-2026-11-07",
      "url": "https://readbeforerun.ai/catalog/crowdstrike-falcon-mcp/",
      "title": "CrowdStrike Falcon MCP Server: lab run published",
      "content_text": "lab run 2026-11-07 published: Beyond declared on 1 of 6 rights: secrets (observed 3, declared 1), reading ~/.netrc on every API request. (reach 3 from code (privileged); lab: beyond declared on 1 of 6 rights: secrets)",
      "date_published": "2026-11-07T00:00:00Z",
      "_field_guide": {
        "tier": "tried",
        "reach": "reach 3 · beyond declared (1)"
      }
    },
    {
      "id": "https://readbeforerun.ai/catalog/gitguardian-ggmcp/#gitguardian-ggmcp-changed-0-2026-11-07",
      "url": "https://readbeforerun.ai/catalog/gitguardian-ggmcp/",
      "title": "GitGuardian MCP Server: value changed",
      "content_text": "changed: Tier listed → tried. Reason: First lab run published (runs/2026-11-07): gg-mcp-server over stdio with a PAT from the environment, against the lab's stub of the GitGuardian API; observed reach 2, within the declaration on every right.",
      "date_published": "2026-11-07T00:00:00Z",
      "_field_guide": {
        "tier": "tried",
        "reach": "reach 3 · as declared"
      }
    },
    {
      "id": "https://readbeforerun.ai/catalog/gitguardian-ggmcp/#gitguardian-ggmcp-tried-2026-11-07-2026-11-07",
      "url": "https://readbeforerun.ai/catalog/gitguardian-ggmcp/",
      "title": "GitGuardian MCP Server: lab run published",
      "content_text": "lab run 2026-11-07 published: Within declared on every right the lab could observe. (reach 3 from code (privileged); lab: as declared)",
      "date_published": "2026-11-07T00:00:00Z",
      "_field_guide": {
        "tier": "tried",
        "reach": "reach 3 · as declared"
      }
    },
    {
      "id": "https://readbeforerun.ai/catalog/accessitgroup-webapp-testing-checklist/#accessitgroup-webapp-testing-checklist-added-2026-10-21",
      "url": "https://readbeforerun.ai/catalog/accessitgroup-webapp-testing-checklist/",
      "title": "Webapp Testing Checklist: added",
      "content_text": "added (Skill)",
      "date_published": "2026-10-21T00:00:00Z",
      "_field_guide": {
        "tier": "listed",
        "reach": "reach 3 · not run yet"
      }
    },
    {
      "id": "https://readbeforerun.ai/catalog/andrewspearson-tenable-mcp-mssp/#andrewspearson-tenable-mcp-mssp-added-2026-10-21",
      "url": "https://readbeforerun.ai/catalog/andrewspearson-tenable-mcp-mssp/",
      "title": "Tenable MSSP Portal MCP Server: added",
      "content_text": "added (MCP server)",
      "date_published": "2026-10-21T00:00:00Z",
      "_field_guide": {
        "tier": "listed",
        "reach": "reach 3 · not run yet"
      }
    },
    {
      "id": "https://readbeforerun.ai/catalog/google-secops-mcp/#google-secops-mcp-added-2026-10-21",
      "url": "https://readbeforerun.ai/catalog/google-secops-mcp/",
      "title": "Google Security Operations MCP Server: added",
      "content_text": "added (MCP server)",
      "date_published": "2026-10-21T00:00:00Z",
      "_field_guide": {
        "tier": "listed",
        "reach": "reach 3 · not run yet"
      }
    },
    {
      "id": "https://readbeforerun.ai/catalog/hexstrike-ai/#hexstrike-ai-added-2026-10-21",
      "url": "https://readbeforerun.ai/catalog/hexstrike-ai/",
      "title": "HexStrike AI: added",
      "content_text": "added (MCP server)",
      "date_published": "2026-10-21T00:00:00Z",
      "_field_guide": {
        "tier": "listed",
        "reach": "reach 3 · not run yet"
      }
    },
    {
      "id": "https://readbeforerun.ai/catalog/kevinmhorvath-threat-intel-toolkit/#kevinmhorvath-threat-intel-toolkit-added-2026-10-21",
      "url": "https://readbeforerun.ai/catalog/kevinmhorvath-threat-intel-toolkit/",
      "title": "Threat Intel Toolkit: added",
      "content_text": "added (Plugin)",
      "date_published": "2026-10-21T00:00:00Z",
      "_field_guide": {
        "tier": "listed",
        "reach": "reach ≥2 · not run yet"
      }
    },
    {
      "id": "https://readbeforerun.ai/catalog/sentinelone-purple-mcp/#sentinelone-purple-mcp-added-2026-10-21",
      "url": "https://readbeforerun.ai/catalog/sentinelone-purple-mcp/",
      "title": "Purple AI MCP Server: added",
      "content_text": "added (MCP server)",
      "date_published": "2026-10-21T00:00:00Z",
      "_field_guide": {
        "tier": "listed",
        "reach": "reach 3 · not run yet"
      }
    },
    {
      "id": "https://readbeforerun.ai/catalog/sentinelone-s1-secops-mcp/#sentinelone-s1-secops-mcp-added-2026-10-21",
      "url": "https://readbeforerun.ai/catalog/sentinelone-s1-secops-mcp/",
      "title": "SentinelOne MCP Server (s1-secops-mcp): added",
      "content_text": "added (MCP server)",
      "date_published": "2026-10-21T00:00:00Z",
      "_field_guide": {
        "tier": "listed",
        "reach": "reach ≥2 · not run yet"
      }
    },
    {
      "id": "https://readbeforerun.ai/catalog/sentinelone-s1-secops-skills/#sentinelone-s1-secops-skills-added-2026-10-21",
      "url": "https://readbeforerun.ai/catalog/sentinelone-s1-secops-skills/",
      "title": "SentinelOne AI Analyst: Claude Skills: added",
      "content_text": "added (Plugin)",
      "date_published": "2026-10-21T00:00:00Z",
      "_field_guide": {
        "tier": "listed",
        "reach": "reach 3 · not run yet"
      }
    },
    {
      "id": "https://readbeforerun.ai/catalog/taherkaraki-tie-mcp-server/#taherkaraki-tie-mcp-server-added-2026-10-21",
      "url": "https://readbeforerun.ai/catalog/taherkaraki-tie-mcp-server/",
      "title": "Supercharged Tenable Identity Exposure MCP Server: added",
      "content_text": "added (MCP server)",
      "date_published": "2026-10-21T00:00:00Z",
      "_field_guide": {
        "tier": "listed",
        "reach": "reach 3 · not run yet"
      }
    },
    {
      "id": "https://readbeforerun.ai/catalog/tomabai-malware-analyst/#tomabai-malware-analyst-added-2026-10-21",
      "url": "https://readbeforerun.ai/catalog/tomabai-malware-analyst/",
      "title": "Malware Analyst: added",
      "content_text": "added (Skill)",
      "date_published": "2026-10-21T00:00:00Z",
      "_field_guide": {
        "tier": "listed",
        "reach": "reach ≥2 · not run yet"
      }
    },
    {
      "id": "https://readbeforerun.ai/catalog/cisco-mcp-scanner/#cisco-mcp-scanner-added-2026-10-19",
      "url": "https://readbeforerun.ai/catalog/cisco-mcp-scanner/",
      "title": "Cisco MCP Scanner Plugin: added",
      "content_text": "added (Plugin)",
      "date_published": "2026-10-19T00:00:00Z",
      "_field_guide": {
        "tier": "tried",
        "reach": "reach 3 · beyond declared (1)"
      }
    },
    {
      "id": "https://readbeforerun.ai/catalog/cloudflare-security-audit-skill/#cloudflare-security-audit-skill-added-2026-10-19",
      "url": "https://readbeforerun.ai/catalog/cloudflare-security-audit-skill/",
      "title": "Cloudflare Security Audit Skill: added",
      "content_text": "added (Skill)",
      "date_published": "2026-10-19T00:00:00Z",
      "_field_guide": {
        "tier": "listed",
        "reach": "reach 2 · not run yet"
      }
    },
    {
      "id": "https://readbeforerun.ai/catalog/crowdstrike-falcon-mcp/#crowdstrike-falcon-mcp-added-2026-10-19",
      "url": "https://readbeforerun.ai/catalog/crowdstrike-falcon-mcp/",
      "title": "CrowdStrike Falcon MCP Server: added",
      "content_text": "added (MCP server)",
      "date_published": "2026-10-19T00:00:00Z",
      "_field_guide": {
        "tier": "tried",
        "reach": "reach 3 · beyond declared (1)"
      }
    },
    {
      "id": "https://readbeforerun.ai/catalog/gitguardian-ggmcp/#gitguardian-ggmcp-added-2026-10-19",
      "url": "https://readbeforerun.ai/catalog/gitguardian-ggmcp/",
      "title": "GitGuardian MCP Server: added",
      "content_text": "added (MCP server)",
      "date_published": "2026-10-19T00:00:00Z",
      "_field_guide": {
        "tier": "tried",
        "reach": "reach 3 · as declared"
      }
    },
    {
      "id": "https://readbeforerun.ai/catalog/hackingbuddygpt/#hackingbuddygpt-added-2026-10-19",
      "url": "https://readbeforerun.ai/catalog/hackingbuddygpt/",
      "title": "hackingBuddyGPT: added",
      "content_text": "added (Agent)",
      "date_published": "2026-10-19T00:00:00Z",
      "_field_guide": {
        "tier": "listed",
        "reach": "reach 2 · not run yet"
      }
    },
    {
      "id": "https://readbeforerun.ai/catalog/keygraph-shannon/#keygraph-shannon-added-2026-10-19",
      "url": "https://readbeforerun.ai/catalog/keygraph-shannon/",
      "title": "Shannon: added",
      "content_text": "added (Agent)",
      "date_published": "2026-10-19T00:00:00Z",
      "_field_guide": {
        "tier": "listed",
        "reach": "reach 3 · not run yet"
      }
    },
    {
      "id": "https://readbeforerun.ai/catalog/mukul975-email-header-analysis/#mukul975-email-header-analysis-added-2026-10-19",
      "url": "https://readbeforerun.ai/catalog/mukul975-email-header-analysis/",
      "title": "Email Header Phishing Analysis: added",
      "content_text": "added (Skill)",
      "date_published": "2026-10-19T00:00:00Z",
      "_field_guide": {
        "tier": "listed",
        "reach": "reach 2 · not run yet"
      }
    },
    {
      "id": "https://readbeforerun.ai/catalog/trailofbits-agentic-actions-auditor/#trailofbits-agentic-actions-auditor-added-2026-10-19",
      "url": "https://readbeforerun.ai/catalog/trailofbits-agentic-actions-auditor/",
      "title": "Trail of Bits Agentic Actions Auditor: added",
      "content_text": "added (Plugin)",
      "date_published": "2026-10-19T00:00:00Z",
      "_field_guide": {
        "tier": "listed",
        "reach": "reach 2 · not run yet"
      }
    },
    {
      "id": "https://readbeforerun.ai/catalog/trailofbits-static-analysis/#trailofbits-static-analysis-added-2026-10-19",
      "url": "https://readbeforerun.ai/catalog/trailofbits-static-analysis/",
      "title": "Trail of Bits Static Analysis: added",
      "content_text": "added (Plugin)",
      "date_published": "2026-10-19T00:00:00Z",
      "_field_guide": {
        "tier": "listed",
        "reach": "reach ≥2 · not run yet"
      }
    },
    {
      "id": "https://readbeforerun.ai/catalog/usestrix-strix/#usestrix-strix-added-2026-10-19",
      "url": "https://readbeforerun.ai/catalog/usestrix-strix/",
      "title": "Strix: added",
      "content_text": "added (Agent)",
      "date_published": "2026-10-19T00:00:00Z",
      "_field_guide": {
        "tier": "listed",
        "reach": "reach 3 · not run yet"
      }
    },
    {
      "id": "https://readbeforerun.ai/fieldnotes/2026-10-16-example-recon-skill/",
      "url": "https://readbeforerun.ai/fieldnotes/2026-10-16-example-recon-skill/",
      "title": "[demo] Field Note #0: Example Recon Skill talks to a host it never mentions",
      "content_text": "Format demo: a recon skill pre-approves nmap and one host, then writes to the home directory and calls a third-party API.",
      "date_published": "2026-10-16T00:00:00Z"
    },
    {
      "id": "https://readbeforerun.ai/catalog/example-recon-skill/#example-recon-skill-tried-2026-10-10-2026-10-14",
      "url": "https://readbeforerun.ai/catalog/example-recon-skill/",
      "title": "[demo] Example Recon Skill: lab run published",
      "content_text": "lab run 2026-10-10 published: Beyond declared on 3 of 6 rights: files (wrote ~/recon-reports/, not declared), network (undeclared host api.example.net, blocked), execution (shell for nmap). (reach 2 from code (open); lab: beyond declared on 3 of 6 rights: files, network, execution)",
      "date_published": "2026-10-14T00:00:00Z",
      "_field_guide": {
        "tier": "tried",
        "reach": "reach 2 · beyond declared (3)"
      }
    },
    {
      "id": "https://readbeforerun.ai/catalog/example-siem-query/#example-siem-query-checked-2026-10-12",
      "url": "https://readbeforerun.ai/catalog/example-siem-query/",
      "title": "[demo] Example SIEM Query: re-checked",
      "content_text": "re-checked on the pinned commit, values unchanged (reach ≥1 from code (scoped, 1 right unknown); lab: not run yet)",
      "date_published": "2026-10-12T00:00:00Z",
      "_field_guide": {
        "tier": "listed",
        "reach": "reach ≥1 · not run yet"
      }
    },
    {
      "id": "https://readbeforerun.ai/catalog/example-vuln-mcp/#example-vuln-mcp-tried-2026-10-03-2026-10-07",
      "url": "https://readbeforerun.ai/catalog/example-vuln-mcp/",
      "title": "[demo] Example Vuln MCP: lab run published",
      "content_text": "lab run 2026-10-03 published: Beyond declared on 1 of 6 rights: network (undeclared host api.example.net, blocked). Nothing is declared, so each right is measured against its task scope. (reach ≥1 from code (scoped, 1 right unknown); lab: beyond declared on 1 of 6 rights: network)",
      "date_published": "2026-10-07T00:00:00Z",
      "_field_guide": {
        "tier": "tried",
        "reach": "reach ≥1 · beyond declared (1)"
      }
    },
    {
      "id": "https://readbeforerun.ai/catalog/example-siem-query/#example-siem-query-added-2026-10-01",
      "url": "https://readbeforerun.ai/catalog/example-siem-query/",
      "title": "[demo] Example SIEM Query: added",
      "content_text": "added (Skill)",
      "date_published": "2026-10-01T00:00:00Z",
      "_field_guide": {
        "tier": "listed",
        "reach": "reach ≥1 · not run yet"
      }
    },
    {
      "id": "https://readbeforerun.ai/catalog/example-vuln-mcp/#example-vuln-mcp-added-2026-09-30",
      "url": "https://readbeforerun.ai/catalog/example-vuln-mcp/",
      "title": "[demo] Example Vuln MCP: added",
      "content_text": "added (MCP server)",
      "date_published": "2026-09-30T00:00:00Z",
      "_field_guide": {
        "tier": "tried",
        "reach": "reach ≥1 · beyond declared (1)"
      }
    },
    {
      "id": "https://readbeforerun.ai/catalog/example-recon-skill/#example-recon-skill-added-2026-09-28",
      "url": "https://readbeforerun.ai/catalog/example-recon-skill/",
      "title": "[demo] Example Recon Skill: added",
      "content_text": "added (Skill)",
      "date_published": "2026-09-28T00:00:00Z",
      "_field_guide": {
        "tier": "tried",
        "reach": "reach 2 · beyond declared (3)"
      }
    }
  ]
}