ReadBeforeRunAgentic Security Field GuideOpen the catalog

A curated catalog · every value read from code

Choose AI security tools with evidence.

AI agents, skills and MCP servers for offensive, defensive and agent security. Each entry says what the tool does, what it needs, who maintains it and what its code can touch, with a line of code behind every value.

Browse by task

No scores, no sponsors, no tool is called safe. Every page works without JavaScript.

Fictional example · how to read a cardreach 3 · privileged
231?02FilesNetworkExecutionSecretsPersistenceApproval
Example toolRestrict first

A made-up entry that shows every element of a card. A real card carries the tool's own one-line summary here.

Can tunnel or exfiltrate · write outside the project · run with broad pre-approvals · Secrets: no evidence

by its author · last push, date checked and commit on every real card

  1. Reach word. The highest level the code reaches, 0 to 3, and its word.
  2. Plate. Six rights, one spoke each; the rings are the levels from the centre out.
  3. Points. Each carries its digit: amber is 2, red is 3, dashed means the code showed no evidence.
  4. Chip. The run advice when a verdict exists, else “Code shows”. No tool is ever called safe.
  5. “Can” line. The worst findings as verbs; the full table with evidence lines sits on the entry page.
  6. Values are read from the tool's code and shown with their source. 0 never means safe.

A tool's author says one thing. Its code shows another. A run in the lab shows a third. The Field Guide prints all three, side by side.

  • Author says
    1talks only to declared hosts

    README.md#L563 the documented use is a penetration test against a target the user names

  • Code shows
    3can tunnel or exfiltrate

    hexstrike_server.py#L17289 the API server listens on all interfaces without authentication, which exposes its command execution to the network
    hexstrike_server.py#L99 HEXSTRIKE_HOST is read into API_HOST but used only for the startup banner (L198), not for binding

  • Run showed
    ·not run yet

    Declarations are often incomplete and scanners can be bypassed, so we run each tool once and compare. This one has not run yet.

The Network right of HexStrike AI, read three ways. Every entry has six such rows.

Recently tried

The whole catalog

Three cards, always the three most recently checked. The catalog page lists every tool as a row with the same plate as a thumbnail.

Every entry · how it runs

See how a tool runs before you run it.

Drawn from the code at build time: which part runs where, what it listens on, where data goes, and which lines say so.

  • Three zones: your AI client, your machine, outside your machine.
  • Solid lines are the default flow, dashed lines run only if you turn them on.
  • Every part links to the line that says so; the record of the entry adds what the reading does not cover.

Your AI client

Parts that live inside the AI client: skill instructions, client configuration.

Your machine

Programs and files on the machine where you run the tool.

Outside your machine

Remote services: vendor APIs, model providers, targets, telemetry endpoints. Data sent here leaves your machine.

How HexStrike AI runs, drawn from its code. On a phone the zones stack. The entry

Across the catalog

How far the code reaches, right by right.

Every reviewed tool counted once per right. The bars keep their shape as the catalog grows; the digits are the counts today.

0 contained1 scoped2 open3 privileged? no evidence

Files16121
Network2756
Execution25121
Secrets4102?4
Persistence2396
Approval541?10

0 never means safe. The numbers behind the catalog

  • 1 of 20

    tools say nothing about what they may access: no files, hosts, commands or secrets are named anywhere.

    Show them
  • 12 of 20

    tools contain code that can read stored passwords or tokens, change your machine permanently, or use admin rights.

    Show them
  • 2 of 3

    tools we ran did more than their description says.

    Show them

What are you trying to do?

The eight tasks with the most tools, then the full list. The counts update with every build.

How a tool is read

  1. Read what the author says. README, manifest, client configuration: which files, hosts, commands and secrets are named.
  2. Read what the code can do. Six rights, levels 0 to 3, every level tied to a file and a line. Method reach-v0.1.
  3. Run it once in the lab and compare. 3 tools have run so far; for every other tool the column stays empty until it does.

The full method

Cite and verify

Ilja Schlak. "HexStrike AI". Agentic Security Field Guide, checked 2026-10-21, method reach-v0.1. https://readbeforerun.ai/catalog/hexstrike-ai/

Every entry has a JSON twin, the whole catalog ships as catalog.json and llms.txt, and each value names the commit it was read at.

Installs field-guide-search: ask your agent “which tool for X with reach ≤ 1”.

Claude Code

/plugin marketplace add https://readbeforerun.ai/marketplace.json
/plugin install field-guide-search@field-guide

Claude Code 2.1.224 or later. The plugin comes as a zip from this site, pinned by its SHA-256; the pin changes with every catalog update, so run /plugin marketplace update field-guide before a later install or update.

skills CLI

npx skills add https://readbeforerun.ai --skill field-guide-search

The skills CLI (vercel-labs/skills, fetched from npm) reads this site's agent-skills index.

Or download the skill as a zip and unpack it into a folder named field-guide-search inside your agent's skills folder (for Claude Code ~/.claude/skills/field-guide-search/): field-guide-search-skill.zip

  1. you › which tool for alert triage with reach ≤ 1?
  2. agent › Example SIEM Query: reach ≥1 · not run yet (one right unknown). Declared: files 0, approval 1.
  3. agent › Zero is not safe; it means none found in the code. Entry page: /catalog/example-siem-query/

The example answer uses a demo entry.

Latest field note

Start with your task.

Open the catalogRead the method