{"slug": "executable-soar-playbook-dataset-ai-agents-pay-per-record-via-http-402", "title": "Executable SOAR playbook dataset – AI agents pay per record via HTTP 402", "summary": "Lateos AI released a quality-controlled corpus of 8,438 SOAR security playbooks and threat-intel records, served to autonomous AI agents via an HTTP 402 Machine Payments Protocol that meters usage at $0.05 per record and $0.01 per keyword search, with no human in the loop. The dataset, versioned as golden dataset v2 with train/val/test splits (6,755/841/842), is labeled for executability and blast radius, including 710 destructive and 47 human-approval records, and is accessible via MCP at ai.lateos/soar-record-gateway.", "body_md": "A quality-controlled corpus of 8,438 SOAR security playbooks and threat-intel records served to autonomous AI agents — metered per record, settled automatically via HTTP 402 machine payments. No human in the loop.\n\n**$0.05** per record returned\n\n**$0.01** flat per keyword search\n\nKeyless agents get an HTTP 402 payment challenge — checkout provisions the key instantly\n\n**MCP registry:** ai.lateos/soar-record-gateway\n\n**llms.txt, OpenAPI,** AI plugin manifest\n\nEvery endpoint is a machine-readable contract\n\nMost \"security datasets\" are web-scraped, hallucinated, or unexecutable — sending autonomous agents off a cliff. This corpus is quality-controlled, labeled for executability and blast radius, versioned, and served from the edge via Neon PostgreSQL with full-text search (**ts_rank_cd** + ILIKE).\n\nBuilt on the HTTP 402 Machine Payments Protocol (MPP). An agent without credentials isn't rejected with an error page — it's handed a **payment challenge** it can act on.\n\n**Agent calls the API keyless.** Any MCP client or direct HTTP call to /v1/records/fetch without a key.\n\n**Server responds HTTP 402** with Stripe MPP headers: a metered subscription checkout URL for the SOAR plan ($0.01/search, no upfront charge) and the subscription metadata the agent needs.\n\n**Agent opens the checkout.** The Stripe checkout webhook auto-provisions a **soar_live_...** API key for the customer and stores the subscription linkage.\n\n**Usage is metered.** Every record fetched and every search is reported to the Stripe billing meter; invoices settle automatically, post-paid. Enterprise plans are unmetered.\n\n**The machine pays for itself.** No signup forms, no sales calls, no human provisioning. If your agent can follow an HTTP 402, it can subscribe.\n\n$0.05 / record\n\n$0.01 / search\n\nUnmetered\n\nCustom terms\n\n**Namespace:** ai.lateos/soar-record-gateway on registry.modelcontextprotocol.io\n\n**Transport:** Streamable HTTP\n\n**Tools:** fetch_security_records (metered $0.05/record), search_security_records ($0.01 flat), get_total_record_count (free)\n\n```\n{\n  \"mcpServers\": {\n    \"soar\": {\n      \"type\": \"http\",\n      \"url\": \"https://soar-api.nevada-f99.workers.dev/mcp\",\n      \"headers\": {\n        \"Authorization\": \"Bearer soar_live_...\"\n      }\n    }\n  }\n}\n```\n\n**llms.txt** — full service index, parseable by any agent\n\n**OpenAPI** — machine-validated API schema\n\n**AI plugin manifest** — ChatGPT-style plugin discovery\n\n**robots.txt** — crawler guidance for the same content\n\n**server.json** — MCP registry manifest\n\nIt doesn't need one upfront. Call the API keyless, receive the HTTP 402 with a Stripe MPP checkout URL, complete the checkout, and the webhook provisions a soar_live_... key automatically. Retrieve it once from the credential endpoint included in the 402 payload.\n\nThe corpus is labeled for blast radius: 710 destructive and 47 human-approval records are tagged and can be filtered out of fetches by default. Agents should still gate state-changing actions behind their own approval policies — we publish the labels, not a safety guarantee.\n\n8,438 executable SOAR playbooks and threat-intel records across sentinel, splunk_soar, xsoar, google_secops, and knowledge_qa — versioned as golden dataset v2 with train/val/test splits (6,755/841/842) for evaluation work.\n\nEvery record fetch and search is reported to Stripe billing meters (soar_search_consumption, soar_record_consumption) on your subscription. Invoices settle post-paid each month. Enterprise plans are unmetered.\n\nYes — bulk export with provenance documentation is available under the Enterprise plan. Contact leo@lateos.ai.\n\nWant to evaluate the corpus, contribute playbooks, or negotiate an enterprise agreement?\n\nOr open an issue on [GitHub](https://github.com/lateos-ai/website) · listed in the [official MCP registry](https://registry.modelcontextprotocol.io)", "url": "https://wpnews.pro/news/executable-soar-playbook-dataset-ai-agents-pay-per-record-via-http-402", "canonical_source": "https://lateos.ai/soar/", "published_at": "2026-08-14 03:59:26+00:00", "updated_at": "2026-08-14 04:14:37.708895+00:00", "lang": "en", "topics": ["ai-agents", "ai-infrastructure", "ai-products"], "entities": ["Lateos AI", "Stripe", "Neon PostgreSQL", "MCP", "HTTP 402", "SOAR"], "alternates": {"html": "https://wpnews.pro/news/executable-soar-playbook-dataset-ai-agents-pay-per-record-via-http-402", "markdown": "https://wpnews.pro/news/executable-soar-playbook-dataset-ai-agents-pay-per-record-via-http-402.md", "text": "https://wpnews.pro/news/executable-soar-playbook-dataset-ai-agents-pay-per-record-via-http-402.txt", "jsonld": "https://wpnews.pro/news/executable-soar-playbook-dataset-ai-agents-pay-per-record-via-http-402.jsonld"}}