Lateos — SOAR Dataset for AI Agents
SOAR Dataset · Golden v2<br>Executable playbooks. Bought by machines.
A quality-controlled corpus of 8,438 SOAR security playbooks and threat-intel records served to autonomous AI agents — metered per record, settled automatically via HTTP 402 machine payments. No human in the loop.
Try it with any MCP client
$0.05 per record returned
$0.01 flat per keyword search
Keyless agents get an HTTP 402 payment challenge — checkout provisions the key instantly
Endpoint: /mcp<br>MCP manifest
For machines, documented
MCP registry: ai.lateos/soar-record-gateway
llms.txt, OpenAPI, AI plugin manifest
Every endpoint is a machine-readable contract
Read llms.txt<br>OpenAPI spec
The Dataset<br>Golden dataset v2 — quality over scrape.
Most "security datasets" are web-scraped, hallucinated, or unexecutable — sending autonomous agents off a cliff. This corpus is quality-controlled, labeled for executability and blast radius, versioned, and served from the edge via Neon PostgreSQL with full-text search (ts_rank_cd + ILIKE).
8,438 records<br>6,755/841/842 train / val / test<br>710 destructive<br>47 human-approval<br>edge-served · Neon PostgreSQL
sentinel<br>643 records
splunk_soar<br>377 records
xsoar<br>129 records
google_secops<br>555 records
knowledge_qa<br>6,734 records
Machine Payments<br>The API monetizes itself.
Built on the HTTP 402 Machine Payments Protocol (MPP). An agent without credentials isn't rejected with an error page — it's handed a payment challenge it can act on.
01<br>Agent calls the API keyless. Any MCP client or direct HTTP call to /v1/records/fetch without a key.
02<br>Server responds HTTP 402 with Stripe MPP headers: a metered subscription checkout URL for the SOAR plan ($0.01/search, no upfront charge) and the subscription metadata the agent needs.
03<br>Agent opens the checkout. The Stripe checkout webhook auto-provisions a soar_live_... API key for the customer and stores the subscription linkage.
04<br>Usage is metered. Every record fetched and every search is reported to the Stripe billing meter; invoices settle automatically, post-paid. Enterprise plans are unmetered.
The machine pays for itself. No signup forms, no sales calls, no human provisioning. If your agent can follow an HTTP 402, it can subscribe.
Pricing<br>Pay for what you consume.
Metered
$0.05 / record
$0.01 / search
Streamable HTTP + MCP access
Full-text keyword search
Platform, executability & destructiveness filters
Post-paid via Stripe billing meters
Auto-provisioned keys via 402 checkout
Connect an agent
Enterprise
Unmetered
Custom terms
Unlimited record & search volume
Bulk dataset export (train/val/test splits)
Private hosted endpoint or dataset mirror
Dedicated support
Contact: leo@lateos.ai
For Agents<br>Point your agent at it.
MCP server (registered)
Namespace: ai.lateos/soar-record-gateway on registry.modelcontextprotocol.io
Transport: Streamable HTTP
Tools: fetch_security_records (metered $0.05/record), search_security_records ($0.01 flat), get_total_record_count (free)
"mcpServers": {<br>"soar": {<br>"type": "http",<br>"url": "https://soar-api.nevada-f99.workers.dev/mcp",<br>"headers": {<br>"Authorization": "Bearer soar_live_..."
Agent-native contracts
llms.txt — full service index, parseable by any agent
OpenAPI — machine-validated API schema
AI plugin manifest — ChatGPT-style plugin discovery
robots.txt — crawler guidance for the same content
server.json — MCP registry manifest
llms.txt<br>AI plugin manifest
FAQ<br>Common questions.
How does my agent get an API key?+
It doesn't need one upfront. Call the API keyless, receive the HTTP 402 with a Stripe MPP checkout URL, complete the checkout, and the webhook provisions a soar_live_... key automatically. Retrieve it once from the credential endpoint included in the 402 payload.
Is the data safe for agents to execute?+
The corpus is labeled for blast radius: 710 destructive and 47 human-approval records are tagged and can be filtered out of fetches by default. Agents should still gate state-changing actions behind their own approval policies — we publish the labels, not a safety guarantee.
What exactly is in the dataset?+
8,438 executable SOAR playbooks and threat-intel records across sentinel, splunk_soar, xsoar, google_secops, and knowledge_qa — versioned as golden dataset v2 with train/val/test splits (6,755/841/842) for evaluation work.
How is billing enforced?+
Every record fetch and search is reported to Stripe billing meters (soar_search_consumption, soar_record_consumption) on your subscription. Invoices settle post-paid each month. Enterprise plans are unmetered.
Can I get the full dataset for training?+
Yes — bulk export with provenance documentation is available under the Enterprise plan. Contact leo@lateos.ai.
Contact<br>Questions?
Want to evaluate the corpus, contribute playbooks, or negotiate an enterprise agreement?
Email: leo@lateos.ai<br>Or open an issue on GitHub · listed in the official MCP registry