Research lab

Research is the lab. Assessment is the service.

These public methods and experiments show how LeftOut Security studies agent authority, trust boundaries, and constrained tool access. They inform the work, but they are not client services, certifications, or proof that a deployment is secure.

Research method · Non-commercial

CLAWLINE

CLAWLINE is a research and internal-methodology reference that informs evidence, reach, blast-radius, and decision analysis. It is not a client service, public engagement route, certification, approved control, endorsement, or security guarantee.

  • Evidence states and explicit uncertainty
  • Agent identities, data, memory, tools, and actions
  • Abuse paths, negative space, and business consequence
  • Framework crosswalks without checklist-driven judgment
Read the Assessment Method
Experimental · Active development

Tentaclaw

Tentaclaw is experimental work on a local-only MCP server that mediates authorized access from an MCP-compatible client to the Poppy API over outbound HTTPS.

  • Local MCP client → local stdio process → Tentaclaw → Poppy API
  • Explicit board and chat selection
  • Separated secret storage and non-secret policy
  • No hosted LeftOut service and no public remote control plane
Status boundary: Tentaclaw is not a LeftOut assessment, implementation offer, approved security control, certification, or guarantee. Public release and production-readiness claims must come from its own release documentation.

Current project status: Tentaclaw remains release-candidate software with external acceptance gates pending. See its authoritative release documentation for the current version, evidence, and release decision.

Why list these here

Hands-on research without turning findings into product sales.

Research and open-source experiments sharpen the assessment method, but they do not change the independence boundary.

LeftOut Security does not require clients to adopt CLAWLINE-branded tooling or Tentaclaw, and it does not treat use of either project as evidence that a system is secure.

Need an independent assessment?

Start with the system and the decision—not a product pitch.

Describe what the agent can do, what it can reach, and why the security decision matters now.

Request a Consultation