Readiness Kit

The frame under the Agent Readiness Gate, in public: a command-line tool that runs an evaluation set against an AI agent and scores it on a held-out split, runs a starter attack pack mapped to the OWASP Top 10 for Agentic Applications, orchestrates the open agent scanners, emits a CycloneDX Agent Bill of Materials, computes a cost-per-task baseline from traces, and applies the eight-area readiness rubric to all of it. The engine (the full attack pack, the domain packs, the seed sets, the Evidence Report generator and the CI gate) ships in the licensed Gate.

Release: v0.1.0 · 22 October 2026. Apache-2.0. Python 3.10+.

pip install readiness-kit
rk demo

rk demo runs the whole pipeline on a bundled, deliberately weak support-ticket agent. It works offline, needs no model and no key, and prints a scorecard in about a second. Then rk init and point rk.yaml at your own agent: the ten-minute walkthrough.

What it does

Every command writes a JSON artefact into runs/ with the hashes and versions a published number must cite; rk score writes the scorecard as JSON and Markdown. The licensed Gate consumes these artefacts unchanged.

How an agent is wired in

One small contract (docs/FORMATS.md): the Kit sends {case_id, input, context, metadata} and reads {output, tool_calls, steps, usage}; only output is required. Five target types: python (a function in-process), http (an endpoint you control), openai-chat (any OpenAI-compatible chat endpoint with your system prompt), command (stdin to stdout), replay (a transcript). What an agent does not report, the Kit marks not observable. Silence is not upgraded to a pass.

Repository

A worked example of what the Gate produces from these artefacts, the Evidence Report on a fictional claims-triage agent, is at rainkernel.com/products/agent-readiness-gate/sample-report.

Principles

Frame open, engine licensed. The harness, the starter pack, the rubric, the BOM emitter, the cost baseline and the adapters are public; the full attack pack, the domain packs, the seed sets, the report generator and the CI gate are what a licence buys. Honest version numbers. v0.1 means v0.1, and no release is announced before it is tagged. Nothing moves behind a paywall. What ships in the open tier stays there. Upstream first. Where an open scanner should have a feature, we contribute it there before wrapping it here. The full note: docs/DESIGN.md.

Releases

• v0.1.0 · 22 October 2026 (planned for the 18th, four days late; the date is recorded, not rewritten). The frame above, with the benchmark on a public support-ticket set (docs/BENCHMARK.md) and the ten-minute walkthrough.
• Later releases are announced when they are tagged, here and in the Lab's log, and not before. CHANGELOG.md has the detail.

Developing

git clone https://github.com/rainkernel/readiness-kit && cd readiness-kit
pip install -e ".[dev]"
pytest -q && ruff check src tests examples

CONTRIBUTING.md has the rest: issues first, DCO sign-off, what belongs in the Kit and what belongs in the Gate. RELEASING.md is the release checklist.

Security

What the Kit itself does and does not do: no telemetry and no calls home (the only network traffic is to the target you configure and whatever the scanners you install make themselves); scanners run as subprocesses with explicit arguments and no shell; secrets are read from environment variables you name in rk.yaml, and a missing one stops the run before it starts; attack canaries sit on .invalid domains that cannot resolve. Run the attack pack against a staging agent with outbound tools stubbed: the cases are real attacks and your agent may act on them (docs/WALKTHROUGH.md).

Vulnerabilities in this tool: security@rainkernel.com or a private security advisory on this repository. We credit reporters. See SECURITY.md and rainkernel.com/.well-known/security.txt.

Licence

Apache-2.0. See LICENSE and NOTICE. © 2026 Rainkernel Technologies Private Limited.