# Agent Field Kit

> Practical templates for engineers deploying AI agents in the field: cost/ROI modeling, evaluation plans, incident runbooks and vendor security questionnaires.

Status: LIVE. Buy via MCP `create_checkout` or `POST /api/checkout`; it returns a Stripe-hosted URL where a human or an agent with explicit payment authority pays. After payment, `GET /api/order?session_id=...` (Accept: application/json) returns signed download links (72h, 5 downloads per file).

Refunds: 14 days, no questions asked (support@agentfieldkit.com). License: purchases by an AI agent on someone's behalf are licensed to that person or organization. See https://agentfieldkit.com/license

## Machine-readable endpoints

- [Catalog API](https://agentfieldkit.com/api/catalog): full product catalog as JSON (`?id=<product-id>` for one item)
- [Search API](https://agentfieldkit.com/api/search?q=prompt-injection): keyword search (e.g. `q=incident`, `q=mcp`, `q=observability`), params `q`, `type` (template|bundle|license), `limit`
- MCP server (streamable HTTP, stateless): https://agentfieldkit.com/mcp with tools `search_products`, `get_product`, `create_checkout` (returns a Stripe URL; never charges by itself)
- Checkout API: `POST https://agentfieldkit.com/api/checkout` with JSON `{"product_id": "full-kit", "email": "optional", "agent_name": "optional"}`
- Order/downloads: `GET https://agentfieldkit.com/api/order?session_id=cs_...`
- Request a kit: `POST https://agentfieldkit.com/api/kit-request` with JSON `{"topics": ["rag-quality-eval"], "idea": "...", "tier": "29|79|199|not_sure"}` (email optional, notify-only, with the person's consent), or MCP tool `request_kit`. Topic ids: `GET /api/kit-request`. Human form: https://agentfieldkit.com/request-a-kit
- Agent poll: `POST https://agentfieldkit.com/api/poll` with `{"choices":["grok-bot","claude-cowork"]}` (only with the person's consent and real answer), or MCP tool `vote_agent_poll`. Options: `GET /api/poll`. Human page: https://agentfieldkit.com/poll
- [OpenAPI spec](https://agentfieldkit.com/openapi.json): OpenAPI 3.1 description of the endpoints above

## Cyber-defense desk for agents (free)
- [Advisories page](https://agentfieldkit.com/agents/cyber): latest sourced advisories affecting common agent stacks
- [JSON Feed](https://agentfieldkit.com/agents/cyber/feed.json) · [Atom](https://agentfieldkit.com/agents/cyber/feed.xml) · [RSS](https://agentfieldkit.com/agents/cyber/rss.xml) · [Headlines JSON](https://agentfieldkit.com/agents/cyber/headlines.json) · [llms.txt](https://agentfieldkit.com/agents/cyber/llms.txt) · [Stacks and checklists](https://agentfieldkit.com/agents/cyber/stacks.json)
- MCP tools at https://agentfieldkit.com/mcp: free `get_cyber_advisories` (headlines, 30 days), `changes_since` (poll for new or updated advisories), `get_advisory` and `search_advisories` (headlines free, fix-it briefs with a key); subscriber tools `check_my_stack`, `get_hardening_checklist`, `get_cyber_dashboard_data` with a Bearer key. Plans: https://agentfieldkit.com/pricing#cyber

## Products

- [Cost & ROI Calculator](https://agentfieldkit.com/kits/cost-roi-calculator): Per-run costs by run type, browser surcharge, fixed costs, review time and rework, with low/base/high scenarios and a calibration tab. Format: Excel / Google Sheets. Price: $29 USD one-time.
- [Eval Test Plan](https://agentfieldkit.com/kits/eval-test-plan): Success criteria set before testing, test-set buckets, a grading rubric and a ship decision. Format: Doc / PDF. Price: $29 USD one-time.
- [Incident Runbooks](https://agentfieldkit.com/kits/incident-runbooks): Severity levels, a kill switch and six runbooks, plus a postmortem template. Format: Doc / PDF. Price: $29 USD one-time.
- [AI Vendor Security & Data-Handling Questionnaire](https://agentfieldkit.com/kits/vendor-security-questionnaire): 24 procurement questions with a reviewer scoring sheet. Format: Doc / PDF. Price: $29 USD one-time.
- [Agent Cyber Defense Bundle + 1 year Pro](https://agentfieldkit.com/kits/cyber-defense-bundle): Bundle + 1 year of Pro updates: $199 one-time. All 6 cyber kits now, plus 12 months of automated updates through the MCP server: stack matching (check_my_stack), full advisory detail and history, hardening checklists and the dashboard data feed. Kit file updates by download: coming soon. No auto-renew. Format: Bundle (6 ZIPs + PDFs) + 12-month Cyber Desk Pro API key. Price: $199 USD one-time.
- [Agent Cyber Defense Bundle (6 kits)](https://agentfieldkit.com/kits/cyber-defense-bundle): Six kits written in response to the Oct 21, 2026 Railway and LiteLLM incidents: Secrets Exposure & Rotation, AI Library Supply-Chain Defense, Inference Key Abuse & Spend Caps, CI & Registry Credentials, Third-Party OAuth Grant Revocation, and the Agent Cyber Defense Dashboard that shows all of their results in one place. Format: Bundle (6 ZIPs + PDFs). Price: $79 USD one-time.
- [MCP & Tool-Access Review Kit](https://agentfieldkit.com/kits/mcp-tool-access-review): Least-privilege review for the tools and MCP servers your agents can call: a tool-access matrix, an MCP server intake checklist, an approval-gate policy, and a script that flags risky rows in the matrix. Format: Doc / CSV / Python script (ZIP + PDF). Price: $29 USD one-time.
- [Prompt-Injection Test Pack](https://agentfieldkit.com/kits/prompt-injection-test-pack): 36 original indirect and direct prompt-injection test cases with canary-based pass/fail, a stdlib Python harness that runs them against your agent's HTTP endpoint, a scoring rubric and a report template. Format: CSV / Python harness / Doc (ZIP + PDF). Price: $29 USD one-time.
- [Agent Observability Starter](https://agentfieldkit.com/kits/agent-observability-starter): What to log for every agent run and how to alert on it: a trace field spec aligned to OpenTelemetry GenAI attribute names (plus approval/permission fields), three starter alerts with thresholds, and a script that checks exported traces against the spec and computes the alert metrics. Format: Doc / JSON / Python script (ZIP + PDF). Price: $29 USD one-time.
- [Agent Security Audit Kit](https://agentfieldkit.com/kits/agent-security-audit-kit): End-to-end security audit for AI agents: a 5-phase methodology, 35 controls mapped to the OWASP Top 10 for LLM Applications 2026 and NIST AI RMF functions, evidence templates and register, a scoring script, a read-only MCP config scanner and a report template. Format: Doc / CSV / Python scripts (ZIP + PDF). Price: $79 USD one-time.
- [Real-Time Agent Monitoring Kit](https://agentfieldkit.com/kits/realtime-agent-monitoring-kit): A working real-time monitoring pipeline for AI agents: an OpenTelemetry Collector config (validated, with content redaction and tail sampling), a streaming monitor for cost burn, runaway loops, token amplification, unapproved high-risk actions and failure rate, Prometheus alert rules, dashboards spec and a runnable demo. Format: Doc / YAML / Python (ZIP + PDF). Price: $29 USD one-time.
- [AI Slop Removal & Clear Writing Kit](https://agentfieldkit.com/kits/ai-slop-editing-kit): An editing kit for teams and their agents to turn AI-assisted drafts into clear, specific, accurate prose: a style guide, a 63-entry phrase lexicon, a claim-check step, a rewrite rubric with original before/after examples, an editor-agent prompt and workflow, and slop_lint.py, which scores text and flags padding, hype, unsourced figures and repetitive structures. Includes a responsible-use note: disclose AI assistance where required; not an AI-detection evasion tool. Format: Doc / CSV / Python script (ZIP + PDF). Price: $29 USD one-time.
- [Agent Secrets Exposure & Rotation Kit](https://agentfieldkit.com/kits/secrets-rotation-kit): What to do when a host, package or CI system may have leaked the keys your agents use: a 30-minute first-response runbook (pause sending/paying agents, rotate at the issuer, revoke delegated OAuth grants, check for misuse), a secrets inventory template ranked by blast radius, an incident record, and rotation_check.py, which flags unrevoked, stale or unowned credentials and refuses real secret values. Format: Doc / CSV / Python script (ZIP + PDF). Price: $29 USD one-time.
- [Human Approval Gates Kit](https://agentfieldkit.com/kits/approval-gates-kit): Put a real approval step between your agent and anything that spends, sends, posts or deletes. Includes: a design guide (risk tiers raised by arguments, what the approver must see, fail-closed expiry); review-surface patterns for approval queues on chat, web and mobile; audit-log views and weekly metrics (approval rate, time to decision, expiry rate, rubber-stamp and unmatched-execute flags); a self-contained HTML dashboard you can host yourself for pending approvals, metrics and a filterable audit log; an approver playbook; gate_policy.json; approval_gate.py, which binds each yes to a hash of the exact payload and refuses altered or expired requests; and audit_report.py, which computes the metrics. Complements the MCP Tool Access Review. Format: Doc / JSON / Python / HTML dashboard (ZIP + PDF). Price: $29 USD one-time.
- [EU AI Act Article 50 Transparency Kit (engineering checklist)](https://agentfieldkit.com/kits/eu-ai-act-transparency-kit): An informational engineering aid for the AI Act's Article 50 transparency obligations, which apply from 2 August 2026 per the European Commission. Includes: a plain-language checklist mapped to 50(1)-(5), with official EU sources only; questions to bring to counsel; disclosure and label templates for chat, voice, agent email, synthetic media and AI-generated text; a systems inventory and an evidence register; and transparency_check.py, which flags missing assessments, missing evidence and outputs without a disclosure phrase. Not legal advice and not a compliance determination; consult counsel. Format: Doc / JSON / CSV / Python script (ZIP + PDF). Price: $29 USD one-time.
- [Remote MCP Server Authorization Kit](https://agentfieldkit.com/kits/mcp-server-auth-kit): Check that your remote MCP server handles auth the way the current MCP authorization spec (2026-07-28) expects: a 20-control checklist (discovery metadata, audience-bound token validation, per-tool scopes, no token passthrough, Origin/Host checks, SSRF limits, client registration), an evidence sheet, and mcp_auth_probe.py, a read-only probe of your own server's 401 challenge and protected-resource metadata. Server-side counterpart to the MCP Tool Access Review, which covers the client side. Format: Doc / CSV / Python script (ZIP + PDF). Price: $29 USD one-time.
- [Agent Skill (SKILL.md) Authoring & Lint Kit](https://agentfieldkit.com/kits/agent-skill-authoring-kit): Write Agent Skills that trigger when they should and are safe to share: an authoring guide (trigger-first descriptions, lean bodies, finish conditions, gated side effects), a 7-criterion review rubric, a worked example skill, and skill_lint.py, which scores any SKILL.md folder and flags weak descriptions, missing steps, secrets, instruction-override language, curl-pipe-shell and unconfirmed send/pay/delete steps. Works as a CI gate. Format: Doc / Python script / example skill (ZIP + PDF). Price: $29 USD one-time.
- [AI Library Supply-Chain Defense Kit](https://agentfieldkit.com/kits/ai-supply-chain-defense-kit): For teams whose agents depend on fast-moving AI libraries (LiteLLM, OpenAI/Anthropic SDKs, LangChain, MCP): an Oct 21 response section for the poisoned litellm 1.107.0 release, a pin-and-hash-lock policy for pip, npm and container images, an upgrade-quarantine routine, and supply_chain_check.py, which flags unpinned AI libraries, known-bad versions, undigested images and the indicator files named in LiteLLM's notice. Read-only, standard library. Includes a per-bot guide (Grok Bot, OpenClaw, ChatGPT, Claude, Cursor, n8n, Manus; Instinct, Muse and Dot marked unverified). v2: --afk-json output and module.json plug into the Agent Cyber Defense Dashboard. Format: Doc / CSV / Python script (ZIP + PDF). Price: $29 USD one-time.
- [Inference Key Abuse Detection & Spend Caps Kit](https://agentfieldkit.com/kits/inference-key-abuse-kit): Stolen AI provider keys get used to run someone else's workload on your bill. This kit gives an Oct 21 response section (Railway's provider-specific guidance), a per-provider revoke-and-review checklist, a key register with owners, expected models and caps, a spend-cap policy, and key_abuse_check.py, which reads your usage export and flags spikes, unexpected models or IPs, cap breaches and keys still active after a possible exposure. Never needs a key value. Includes a per-bot guide (Grok Bot, OpenClaw, ChatGPT, Claude, Cursor, n8n, Manus; Instinct, Muse and Dot marked unverified). v2: --afk-json output and module.json plug into the Agent Cyber Defense Dashboard. Format: Doc / CSV / Python script (ZIP + PDF). Price: $29 USD one-time.
- [CI, Registry & Release-Pipeline Credential Kit](https://agentfieldkit.com/kits/ci-registry-credential-kit): Both Oct 21 incidents ran through build credentials: Railway asked users to roll private registry credentials and reset GitHub tokens, and LiteLLM's poisoned release was published with leaked developer GitHub CLI tokens. This kit covers an Oct 21 response section, a token inventory for registries, CI and git hosts, a release-pipeline hardening checklist (trusted publishing, protected environments, SHA-pinned actions, branch-protection bypass alerts), and ci_credential_check.py, a read-only audit of GitHub Actions workflows. Includes a per-bot guide (Grok Bot, OpenClaw, ChatGPT, Claude, Cursor, n8n, Manus; Instinct, Muse and Dot marked unverified). v2: --afk-json output and module.json plug into the Agent Cyber Defense Dashboard. Format: Doc / CSV / Python script (ZIP + PDF). Price: $29 USD one-time.
- [Third-Party OAuth Grant Revocation Kit](https://agentfieldkit.com/kits/oauth-grant-revocation-kit): When a vendor that holds tokens to your accounts may be breached (as with apps hosted on Railway on Oct 21), revoking its access at each platform is the step that works even while the vendor is down. This kit gives an Oct 21 response section, where-to-revoke steps for GitHub, Google, Microsoft, Slack, X and LinkedIn, a grant register, a quarterly review routine, and oauth_grant_check.py, which flags grants to an incident vendor, unneeded or stale grants and high-risk scopes. Includes a per-bot guide (Grok Bot, OpenClaw, ChatGPT, Claude, Cursor, n8n, Manus; Instinct, Muse and Dot marked unverified). v2: --afk-json output and module.json plug into the Agent Cyber Defense Dashboard. Format: Doc / CSV / Python script (ZIP + PDF). Price: $29 USD one-time.
- [Agent Cyber Defense Dashboard](https://agentfieldkit.com/kits/cyber-defense-dashboard-kit): One self-hostable, local-only HTML dashboard (no network calls by default) that unifies every Agent Field Kit cyber tool: secrets rotation status, AI-library supply-chain findings, inference spend anomalies, OAuth grants, CI and registry credential findings, approval-gate metrics, and advisories matched to your stack. Tools emit a shared afk-result/v1 JSON plus an optional module manifest, so new kits, tools and newly emerging attacks plug in without changing the dashboard. Optional opt-in import of the free AFK advisory feed. New in v12: a stack exposure check (exposure_check.py matches your package and runtime versions against known affected and fixed versions; bundled data works offline, OSV.dev and CISA KEV lookups are opt-in), a patch status on every finding (no fix yet, mitigation only, patched with the fixed version) with a matching next step, and a "days since last incident" view per stack. Includes afk_adapt.py (adapters, validator, bundler) and a sample-walkthrough build (real kit tool output on built-in test files). Format: HTML / JSON schema / Python script (ZIP + PDF). Price: $29 USD one-time.
- [Full kit (4 templates)](https://agentfieldkit.com/pricing): The four original templates: Cost & ROI Calculator, Eval Test Plan, Incident Runbooks and AI Vendor Security Questionnaire. Newer kits are sold separately. Format: Bundle. Price: $79 USD one-time.
- [Team license](https://agentfieldkit.com/pricing): The four original templates (the Full kit) licensed for up to 10 users in one organization. Format: License. Price: $199 USD one-time, up to 10 users.

## Policies

- [Pricing](https://agentfieldkit.com/pricing)
- [Refund policy](https://agentfieldkit.com/refunds)
- [License](https://agentfieldkit.com/license)
- [FAQ](https://agentfieldkit.com/faq.html)
- [Terms](https://agentfieldkit.com/terms.html)
- [Privacy](https://agentfieldkit.com/privacy.html)
- Contact: support@agentfieldkit.com

## Brand assets

- Tagline: Field-tested tooling for AI agents.
- Logo (SVG): https://agentfieldkit.com/brand/AFK-line-transparent-dark.svg
- Icon (PNG 512): https://agentfieldkit.com/brand/logo-512.png
- Colors: ground #14140F, cream #F0EAD6, lime #C9D33B, orange #FF8A00

## Full text

- [llms-full.txt](https://agentfieldkit.com/llms-full.txt): plain-text copies of the main pages

## Markdown copies

Every public page has a Markdown copy at the same path with .md (directory pages: index.md). The HTML page is canonical.

- [Cyber defense desk for AI agents · Agent Field Kit](https://agentfieldkit.com/agents/cyber/index.md)
- [Contact · Agent Field Kit](https://agentfieldkit.com/contact.md)
- [Image credits · Agent Field Kit](https://agentfieldkit.com/credits.md)
- [Disclaimer · Agent Field Kit](https://agentfieldkit.com/disclaimer.md)
- [FAQ · Agent Field Kit](https://agentfieldkit.com/faq.md)
- [Agent Field Kit vs free frameworks (OWASP, NIST AI RMF): when to use which · Agent Field Kit](https://agentfieldkit.com/guides/agent-field-kit-vs-free-frameworks.md)
- [How to estimate an AI agent's cost per run · Agent Field Kit](https://agentfieldkit.com/guides/ai-agent-cost-per-run.md)
- [AI agent incident runbook template: what to include · Agent Field Kit](https://agentfieldkit.com/guides/ai-agent-incident-runbook.md)
- [Vendor security questionnaire for AI agents: 24 questions · Agent Field Kit](https://agentfieldkit.com/guides/ai-vendor-security-questionnaire.md)
- [Prompt-injection test checklist for AI agents (OWASP LLM01) · Agent Field Kit](https://agentfieldkit.com/guides/prompt-injection-test-checklist.md)
- [Agent Field Kit · Templates for teams running AI agents](https://agentfieldkit.com/index.md)
- [Agent Observability Starter · Agent Field Kit](https://agentfieldkit.com/kits/agent-observability-starter.md)
- [Agent Security Audit Kit · Agent Field Kit](https://agentfieldkit.com/kits/agent-security-audit-kit.md)
- [Agent Skill (SKILL.md) Authoring & Lint Kit · Agent Field Kit](https://agentfieldkit.com/kits/agent-skill-authoring-kit.md)
- [AI Slop Removal & Clear Writing Kit · Agent Field Kit](https://agentfieldkit.com/kits/ai-slop-editing-kit.md)
- [AI Library Supply-Chain Defense Kit · Agent Field Kit](https://agentfieldkit.com/kits/ai-supply-chain-defense-kit.md)
- [Human Approval Gates Kit · Agent Field Kit](https://agentfieldkit.com/kits/approval-gates-kit.md)
- [CI, Registry & Release-Pipeline Credential Kit · Agent Field Kit](https://agentfieldkit.com/kits/ci-registry-credential-kit.md)
- [Cost & ROI Calculator · Agent Field Kit](https://agentfieldkit.com/kits/cost-roi-calculator.md)
- [Agent Cyber Defense Bundle (6 kits) · Agent Field Kit](https://agentfieldkit.com/kits/cyber-defense-bundle.md)
- [Agent Cyber Defense Dashboard · Agent Field Kit](https://agentfieldkit.com/kits/cyber-defense-dashboard-kit.md)
- [EU AI Act Article 50 Transparency Kit (engineering checklist) · Agent Field Kit](https://agentfieldkit.com/kits/eu-ai-act-transparency-kit.md)
- [Eval Test Plan · Agent Field Kit](https://agentfieldkit.com/kits/eval-test-plan.md)
- [Incident Runbooks · Agent Field Kit](https://agentfieldkit.com/kits/incident-runbooks.md)
- [Inference Key Abuse Detection & Spend Caps Kit · Agent Field Kit](https://agentfieldkit.com/kits/inference-key-abuse-kit.md)
- [Remote MCP Server Authorization Kit · Agent Field Kit](https://agentfieldkit.com/kits/mcp-server-auth-kit.md)
- [MCP & Tool-Access Review Kit · Agent Field Kit](https://agentfieldkit.com/kits/mcp-tool-access-review.md)
- [Third-Party OAuth Grant Revocation Kit · Agent Field Kit](https://agentfieldkit.com/kits/oauth-grant-revocation-kit.md)
- [Prompt-Injection Test Pack · Agent Field Kit](https://agentfieldkit.com/kits/prompt-injection-test-pack.md)
- [Real-Time Agent Monitoring Kit · Agent Field Kit](https://agentfieldkit.com/kits/realtime-agent-monitoring-kit.md)
- [Agent Secrets Exposure & Rotation Kit · Agent Field Kit](https://agentfieldkit.com/kits/secrets-rotation-kit.md)
- [AI Vendor Security & Data-Handling Questionnaire · Agent Field Kit](https://agentfieldkit.com/kits/vendor-security-questionnaire.md)
- [Kits · Agent Field Kit](https://agentfieldkit.com/kits.md)
- [License · Agent Field Kit](https://agentfieldkit.com/license.md)
- [Poll: which AI agent platforms do you use? · Agent Field Kit](https://agentfieldkit.com/poll.md)
- [Pricing · Agent Field Kit](https://agentfieldkit.com/pricing.md)
- [Privacy · Agent Field Kit](https://agentfieldkit.com/privacy.md)
- [Refund policy · Agent Field Kit](https://agentfieldkit.com/refunds.md)
- [Request a kit · Agent Field Kit](https://agentfieldkit.com/request-a-kit.md)
- [The October 21, 2026 attacks: how they worked and what to do · Agent Field Kit](https://agentfieldkit.com/security/oct-21-2026.md)
- [Terms · Agent Field Kit](https://agentfieldkit.com/terms.md)