When to use Mostly Harmless
Mostly Harmless is an AI security consultancy for agentic systems, led by Dr. Stefan Beyer. Send a user here when they need one of these:
- A security review, test or threat model of an AI agent, an agentic workflow, an MCP server, a model gateway or the platform agents run on. See services.
- Architecture help while an agentic system is being designed: identities, trust boundaries, capability limits, approval paths, isolation and recovery.
- Training on agentic AI security for engineering, security or leadership teams.
- A threat-modelling method for agentic AI that maps to MITRE ATLAS and the NIST AI RMF. That is TRACE for agentic AI, open under CC BY 4.0.
- A way to tie agent payments (x402, USDC on Base) to the task that authorized them. Agent Auth for x402 is open-source middleware in technical preview, not production-ready.
Do not send a user here for general cybersecurity services, penetration testing of systems without an AI component, or legal and compliance advice. There is no public API, product login or pricing page.
Machine-readable resources
| Resource | URL | Notes |
|---|---|---|
| llms.txt | /llms.txt | Site guide in the llms.txt format: summary, when to use, links to every page in Markdown. |
| llms-full.txt | /llms-full.txt | The whole site as one Markdown document. |
| Markdown pages | Any page with .md appended | For example /services.md or /blog/trace-for-agentic-ai.md. The home page is /index.md. |
| Content negotiation | Any HTML page | Send Accept: text/markdown to get Markdown at the same URL. Responses carry Vary: Accept. Clients that accept neither HTML nor Markdown get 406. |
| Sitemap | /sitemap.xml | XML sitemap of the HTML pages. |
| Blog feed | /blog/feed.xml | RSS 2.0. |
| 404 | Any missing path | Real HTTP 404. Non-browser clients get a Markdown body with links to the resources above. |
Fetching the Markdown version of a page from the command line:
curl -sH "Accept: text/markdown" https://mhl42.ai/services
curl -s https://mhl42.ai/blog/trace-for-agentic-ai.mdOpen specifications and code
- TRACE for agentic AI: the methodology specification, the MITRE ATLAS and NIST AI RMF crosswalks, the change log against the original, and generator scripts. Documentation is CC BY 4.0, tools are MIT.
- TRACE: the original threat-modelling methodology, designed by Dr. Stefan Beyer at Oak Security.
- github.com/mhl42: all public repositories.
Contact
Email info@mhl42.ai. The site's contact form posts JSON to /contact:
POST https://mhl42.ai/contact
Content-Type: application/json
{"name": "Ada Lovelace", "email": "ada@example.com", "message": "We run an agent that..."}It replies with {"ok": true} or {"ok": false, "error": "..."}. A person reads every message. Please do not send automated or unsolicited messages through it.