{"generated_at":"2026-08-25T03:28:32.072Z","profiles":{"runtime_labels":{"live":"Browser live","live_or_copy":"Live with copy fallback","copy_only":"Local copy only","config_only":"Config contract only","planned":"Reviewed starter contract","contract":"Contract only"},"auth_mode_labels":{"none":"No external auth","public":"Public access","pat":"Personal access token","bearer_token":"Bearer token","oauth":"OAuth delegated token","api_key":"API key","api_token":"API token","access_key":"Access key pair","aws_sigv4":"AWS SigV4 signing","webhook":"Webhook secret or URL"},"auth_mode_details":{"none":"No provider credential is required; the operator still chooses the exact page, file, or route input in the browser.","public":"The pack can rely on public or anonymously readable data, but the browser still needs a bounded repository, tenant, or document target.","pat":"A user-scoped personal access token must stay in browser storage and carry only the minimum read or write scope required for the selected task.","bearer_token":"A scoped bearer token must stay in browser storage and be sent only to the operator-configured gateway origin.","oauth":"The browser runtime needs an OAuth-capable flow and a delegated token with the provider scopes required for the selected source or route.","api_key":"The operator must paste a provider-issued API key into browser storage before the pack can call the provider API directly.","api_token":"The operator must supply a provider token or service token in browser storage before this pack can run.","access_key":"The pack needs provider access-key style credentials and should only be promoted when the browser flow can keep those values bounded and explicit.","aws_sigv4":"The browser runtime needs real AWS SigV4 request signing and short-lived credentials before the provider API can be called honestly from the browser.","webhook":"The destination system must expose a pre-approved webhook endpoint or secret-backed URL that the browser can post to directly."},"output_driver_auth_modes":{"draft-pr":["none"],"github-issue":["pat","oauth"],"slack":["webhook"],"email":["none"],"jira":["api_token"],"runbook":["none"],"server-runbook":["none"],"teams":["webhook"],"servicenow":["oauth"],"linear":["api_key"],"splunk-hec":["api_token"],"elastic-case":["api_key"],"pagerduty":["api_key"],"google-chat":["webhook"],"azure-devops":["pat","oauth"],"gitlab-issue":["pat","oauth"],"xsoar":["api_key"],"ibm-soar":["api_key"],"sentinel-playbook":["oauth"],"tines":["webhook"],"torq":["webhook"],"splunk-soar":["api_token"],"swimlane":["api_token"],"generic-webhook":["webhook"]},"runtime_requirements":{"live":"The browser workbench already has a direct BYO-token runtime path for this pack today.","live_or_copy":"The browser can try a direct write when the operator supplies the required config, and it still keeps a safe local copy or export fallback.","copy_only":"This pack intentionally stops at a local contract and never performs the external write for the operator.","config_only":"The contract shape is published for authoring and validation, but the browser runtime is not shipped.","planned":"This is a reviewed starter contract that still needs a verified browser-safe auth, API, and CORS story before promotion.","contract":"This entry is a reusable contract rather than a direct connector runtime."},"runtime_blockers":{"live":[],"live_or_copy":["Operator-owned credentials, webhook targets, or tenant metadata still need to be configured in the browser before a live call can run.","Provider cross-origin behavior and tenant policy still decide whether the direct browser path succeeds, so the local handoff fallback remains part of the design."],"copy_only":["No external write path exists by design, so a reviewer or downstream tool must copy, download, or relay the generated payload."],"config_only":["Only the configuration contract is published today; the browser runtime has not been implemented yet."],"planned":["The runtime path has not been promoted from starter contract to live browser flow yet.","Auth scope, request signing, pagination, throttling, and cross-origin behavior still need explicit verification for this provider."],"contract":["This pack shapes the workflow, but it is not itself a connector."]}},"counts":{"total_entries":56,"live":19,"live_or_copy":15,"copy_only":3,"planned":19,"config_only":0},"entries":[{"key":"input:page-context","kind":"input","label":"Current page context","category":"Local browser context","status":"native","runtime_support":"live","runtime_label":"Browser live","auth_modes":["none"],"description":"Sends the current page title, headings, and bounded body text to the model.","config_type":"page_context","requirements":["The browser workbench already has a direct BYO-token runtime path for this pack today.","No provider credential is required; the operator still chooses the exact page, file, or route input in the browser.","Runtime source: active_document."],"blockers":[]},{"key":"input:recipe-index","kind":"input","label":"SecurityRecipes search index","category":"Local browser context","status":"native","runtime_support":"live","runtime_label":"Browser live","auth_modes":["none"],"description":"Searches the generated recipe index and attaches the most relevant docs, prompts, and remediation pages.","config_type":"recipes_index","requirements":["The browser workbench already has a direct BYO-token runtime path for this pack today.","No provider credential is required; the operator still chooses the exact page, file, or route input in the browser.","Runtime source: /recipes-index.json."],"blockers":[]},{"key":"input:github-repository","kind":"input","label":"GitHub repository context","category":"Code and findings sources","status":"native","runtime_support":"live","runtime_label":"Browser live","auth_modes":["public","pat","oauth"],"description":"Pulls bounded public or authenticated GitHub repo metadata, manifest files, open issues, and pull requests.","config_type":"github_repository","requirements":["The browser workbench already has a direct BYO-token runtime path for this pack today.","The pack can rely on public or anonymously readable data, but the browser still needs a bounded repository, tenant, or document target.","A user-scoped personal access token must stay in browser storage and carry only the minimum read or write scope required for the selected task.","The browser runtime needs an OAuth-capable flow and a delegated token with the provider scopes required for the selected source or route."],"blockers":[]},{"key":"input:deps-dev-advisories","kind":"input","label":"deps.dev advisory context","category":"Code and findings sources","status":"native","runtime_support":"live","runtime_label":"Browser live","auth_modes":["public","pat","oauth"],"description":"Checks public GitHub Dependency Graph SBOM packages against deps.dev advisory metadata.","config_type":"deps_dev_lookup","requirements":["The browser workbench already has a direct BYO-token runtime path for this pack today.","The pack can rely on public or anonymously readable data, but the browser still needs a bounded repository, tenant, or document target.","A user-scoped personal access token must stay in browser storage and carry only the minimum read or write scope required for the selected task.","The browser runtime needs an OAuth-capable flow and a delegated token with the provider scopes required for the selected source or route."],"blockers":[]},{"key":"input:osv-vulnerability-api","kind":"input","label":"OSV.dev vulnerability context","category":"Code and findings sources","status":"native","runtime_support":"live","runtime_label":"Browser live","auth_modes":["public","pat","oauth"],"description":"Checks public GitHub Dependency Graph SBOM package URLs against OSV.dev vulnerability records without a token.","config_type":"osv_vulnerability_lookup","requirements":["The browser workbench already has a direct BYO-token runtime path for this pack today.","The pack can rely on public or anonymously readable data, but the browser still needs a bounded repository, tenant, or document target.","A user-scoped personal access token must stay in browser storage and carry only the minimum read or write scope required for the selected task.","The browser runtime needs an OAuth-capable flow and a delegated token with the provider scopes required for the selected source or route."],"blockers":[]},{"key":"input:mcp-http-gateway","kind":"input","label":"MCP HTTP gateway","category":"MCP and context gateways","status":"native","runtime_support":"live","runtime_label":"Browser live","auth_modes":["none","bearer_token","oauth"],"description":"Calls one configured read-only MCP tool through a CORS-enabled Streamable HTTP gateway endpoint and attaches bounded text context to chat or agent runs.","config_type":"mcp_http_gateway","requirements":["The browser workbench already has a direct BYO-token runtime path for this pack today.","No provider credential is required; the operator still chooses the exact page, file, or route input in the browser.","A scoped bearer token must stay in browser storage and be sent only to the operator-configured gateway origin.","The browser runtime needs an OAuth-capable flow and a delegated token with the provider scopes required for the selected source or route."],"blockers":[]},{"key":"input:gitlab-project-context","kind":"input","label":"GitLab project context","category":"Code and findings sources","status":"native","runtime_support":"live","runtime_label":"Browser live","auth_modes":["public","pat","oauth"],"description":"Pulls bounded GitLab project metadata, useful repository files, open issues, and open merge requests directly in the browser for GitLab-centered remediation work.","config_type":"gitlab_project_context","requirements":["The browser workbench already has a direct BYO-token runtime path for this pack today.","The pack can rely on public or anonymously readable data, but the browser still needs a bounded repository, tenant, or document target.","A user-scoped personal access token must stay in browser storage and carry only the minimum read or write scope required for the selected task.","The browser runtime needs an OAuth-capable flow and a delegated token with the provider scopes required for the selected source or route.","Provider endpoint: https://gitlab.com/api/v4."],"blockers":[]},{"key":"input:azure-devops-repository","kind":"input","label":"Azure DevOps repository context","category":"Code and findings sources","status":"native","runtime_support":"live","runtime_label":"Browser live","auth_modes":["oauth","pat"],"description":"Pulls bounded Azure DevOps repository metadata, useful repo files, active pull requests, and recent open work items directly in the browser for remediation planning.","config_type":"azure_devops_repository","requirements":["The browser workbench already has a direct BYO-token runtime path for this pack today.","The browser runtime needs an OAuth-capable flow and a delegated token with the provider scopes required for the selected source or route.","A user-scoped personal access token must stay in browser storage and carry only the minimum read or write scope required for the selected task.","Provider endpoint: https://dev.azure.com."],"blockers":[]},{"key":"input:sarif-manual-import","kind":"input","label":"SARIF upload","category":"Scanner findings","status":"native","runtime_support":"live","runtime_label":"Browser live","auth_modes":["none"],"description":"Uploads a local SARIF 2.1.0 file in the browser, normalizes the findings, and attaches a bounded summary to prompts and agent runs.","config_type":"sarif_bundle","requirements":["The browser workbench already has a direct BYO-token runtime path for this pack today.","No provider credential is required; the operator still chooses the exact page, file, or route input in the browser.","Runtime source: local_file.","Accepted formats: sarif-2.1.0-json."],"blockers":[]},{"key":"input:sbom-manual-import","kind":"input","label":"SBOM upload","category":"Scanner findings","status":"native","runtime_support":"live","runtime_label":"Browser live","auth_modes":["none"],"description":"Uploads a local CycloneDX or SPDX JSON SBOM in the browser and attaches a bounded package, dependency, and vulnerability summary to prompts.","config_type":"sbom_bundle","requirements":["The browser workbench already has a direct BYO-token runtime path for this pack today.","No provider credential is required; the operator still chooses the exact page, file, or route input in the browser.","Runtime source: local_file.","Accepted formats: cyclonedx-json, spdx-json."],"blockers":[]},{"key":"input:scanner-export-bundle","kind":"input","label":"Major scanner JSON exports","category":"Scanner findings","status":"native","runtime_support":"live","runtime_label":"Browser live","auth_modes":["none"],"description":"Uploads major scanner and findings-platform JSON exports in the browser, normalizes them into a bounded summary, and feeds the exposure queue plus downstream reports without any server-side secret handling.","config_type":"scanner_export_bundle","requirements":["The browser workbench already has a direct BYO-token runtime path for this pack today.","No provider credential is required; the operator still chooses the exact page, file, or route input in the browser.","Runtime source: local_file.","Accepted formats: aws-security-hub-asff, tenable-vulnerability-export, defectdojo-findings-json, generic-findings-array-json."],"blockers":[]},{"key":"input:wiz-findings-api","kind":"input","label":"Wiz findings API","category":"Scanner findings","status":"template","runtime_support":"planned","runtime_label":"Reviewed starter contract","auth_modes":["api_key","oauth"],"description":"Pre-populated browser-side config for pulling cloud and workload findings from Wiz when a customer enables direct API access.","config_type":"wiz_findings","requirements":["This is a reviewed starter contract that still needs a verified browser-safe auth, API, and CORS story before promotion.","The operator must paste a provider-issued API key into browser storage before the pack can call the provider API directly.","The browser runtime needs an OAuth-capable flow and a delegated token with the provider scopes required for the selected source or route.","Provider endpoint: https://api.us1.app.wiz.io/graphql."],"blockers":["The runtime path has not been promoted from starter contract to live browser flow yet.","Auth scope, request signing, pagination, throttling, and cross-origin behavior still need explicit verification for this provider."]},{"key":"input:snyk-issues-api","kind":"input","label":"Snyk issues API","category":"Scanner findings","status":"native","runtime_support":"live","runtime_label":"Browser live","auth_modes":["api_token"],"description":"Pulls a bounded first page of high-priority Snyk organization issues directly in the browser for scanner-aware triage and remediation planning.","config_type":"snyk_issues","requirements":["The browser workbench already has a direct BYO-token runtime path for this pack today.","The operator must supply a provider token or service token in browser storage before this pack can run.","Provider endpoint: https://api.snyk.io/rest."],"blockers":[]},{"key":"input:security-hub-api","kind":"input","label":"AWS Security Hub","category":"Scanner findings","status":"template","runtime_support":"planned","runtime_label":"Reviewed starter contract","auth_modes":["aws_sigv4"],"description":"Config profile for pulling ASFF findings into remediation reports and downstream workflow packs.","config_type":"aws_security_hub","requirements":["This is a reviewed starter contract that still needs a verified browser-safe auth, API, and CORS story before promotion.","The browser runtime needs real AWS SigV4 request signing and short-lived credentials before the provider API can be called honestly from the browser."],"blockers":["The runtime path has not been promoted from starter contract to live browser flow yet.","Auth scope, request signing, pagination, throttling, and cross-origin behavior still need explicit verification for this provider."]},{"key":"input:microsoft-defender-xdr-incidents","kind":"input","label":"Microsoft Defender XDR incidents","category":"Scanner findings","status":"native","runtime_support":"live","runtime_label":"Browser live","auth_modes":["oauth"],"description":"Pulls a bounded Microsoft Defender XDR incident sample directly in the browser with local severity and status filters for queueing, reporting, and remediation planning.","config_type":"microsoft_defender_xdr_incidents","requirements":["The browser workbench already has a direct BYO-token runtime path for this pack today.","The browser runtime needs an OAuth-capable flow and a delegated token with the provider scopes required for the selected source or route.","Provider endpoint: https://api.security.microsoft.com/api/incidents."],"blockers":[]},{"key":"input:microsoft-sentinel-incidents","kind":"input","label":"Microsoft Sentinel incidents","category":"Scanner findings","status":"native","runtime_support":"live","runtime_label":"Browser live","auth_modes":["oauth"],"description":"Pulls a bounded Microsoft Sentinel workspace incident sample directly in the browser with local severity and status filters for queueing, reporting, and remediation planning.","config_type":"microsoft_sentinel_incidents","requirements":["The browser workbench already has a direct BYO-token runtime path for this pack today.","The browser runtime needs an OAuth-capable flow and a delegated token with the provider scopes required for the selected source or route.","Provider endpoint: https://management.azure.com."],"blockers":[]},{"key":"input:gitlab-vulnerability-findings","kind":"input","label":"GitLab vulnerability findings","category":"Scanner findings","status":"native","runtime_support":"live","runtime_label":"Browser live","auth_modes":["pat","oauth"],"description":"Pulls a bounded first page of GitLab project vulnerability findings directly in the browser when AppSec findings and fix ownership live in the same GitLab namespace.","config_type":"gitlab_vulnerability_findings","requirements":["The browser workbench already has a direct BYO-token runtime path for this pack today.","A user-scoped personal access token must stay in browser storage and carry only the minimum read or write scope required for the selected task.","The browser runtime needs an OAuth-capable flow and a delegated token with the provider scopes required for the selected source or route.","Provider endpoint: https://gitlab.com/api/v4."],"blockers":[]},{"key":"input:crowdstrike-detections","kind":"input","label":"CrowdStrike detections","category":"Scanner findings","status":"template","runtime_support":"planned","runtime_label":"Reviewed starter contract","auth_modes":["oauth","api_key"],"description":"Starter config for bounded CrowdStrike Falcon detection intake into browser-side triage and response workflows.","config_type":"crowdstrike_detections","requirements":["This is a reviewed starter contract that still needs a verified browser-safe auth, API, and CORS story before promotion.","The browser runtime needs an OAuth-capable flow and a delegated token with the provider scopes required for the selected source or route.","The operator must paste a provider-issued API key into browser storage before the pack can call the provider API directly.","Provider endpoint: https://api.crowdstrike.com."],"blockers":["The runtime path has not been promoted from starter contract to live browser flow yet.","Auth scope, request signing, pagination, throttling, and cross-origin behavior still need explicit verification for this provider."]},{"key":"input:tenable-vulnerability-management","kind":"input","label":"Tenable vulnerability management","category":"Scanner findings","status":"template","runtime_support":"planned","runtime_label":"Reviewed starter contract","auth_modes":["api_key"],"description":"Starter config for exporting high-severity Tenable vulnerabilities into remediation and report workflows.","config_type":"tenable_vuln_export","requirements":["This is a reviewed starter contract that still needs a verified browser-safe auth, API, and CORS story before promotion.","The operator must paste a provider-issued API key into browser storage before the pack can call the provider API directly.","Provider endpoint: https://cloud.tenable.com."],"blockers":["The runtime path has not been promoted from starter contract to live browser flow yet.","Auth scope, request signing, pagination, throttling, and cross-origin behavior still need explicit verification for this provider."]},{"key":"input:defectdojo-findings","kind":"input","label":"DefectDojo findings","category":"Scanner findings","status":"template","runtime_support":"planned","runtime_label":"Reviewed starter contract","auth_modes":["api_token","oauth"],"description":"Starter config for pulling active high-severity DefectDojo findings with enough context for analyst routing and ticket creation.","config_type":"defectdojo_findings","requirements":["This is a reviewed starter contract that still needs a verified browser-safe auth, API, and CORS story before promotion.","The operator must supply a provider token or service token in browser storage before this pack can run.","The browser runtime needs an OAuth-capable flow and a delegated token with the provider scopes required for the selected source or route.","Provider endpoint: https://YOUR-DEFECTDOJO-HOST/api/v2."],"blockers":["The runtime path has not been promoted from starter contract to live browser flow yet.","Auth scope, request signing, pagination, throttling, and cross-origin behavior still need explicit verification for this provider."]},{"key":"input:prisma-cloud-alerts","kind":"input","label":"Prisma Cloud alerts","category":"Scanner findings","status":"template","runtime_support":"planned","runtime_label":"Reviewed starter contract","auth_modes":["access_key"],"description":"Starter config for Prisma Cloud alert intake across posture and runtime findings.","config_type":"prisma_cloud_alerts","requirements":["This is a reviewed starter contract that still needs a verified browser-safe auth, API, and CORS story before promotion.","The pack needs provider access-key style credentials and should only be promoted when the browser flow can keep those values bounded and explicit.","Provider endpoint: https://api.prismacloud.io."],"blockers":["The runtime path has not been promoted from starter contract to live browser flow yet.","Auth scope, request signing, pagination, throttling, and cross-origin behavior still need explicit verification for this provider."]},{"key":"input:google-cloud-scc-findings","kind":"input","label":"Google Cloud SCC findings","category":"Scanner findings","status":"template","runtime_support":"planned","runtime_label":"Reviewed starter contract","auth_modes":["oauth"],"description":"Starter config for Security Command Center findings when cloud exposures need browser-side triage and routing.","config_type":"google_cloud_scc_findings","requirements":["This is a reviewed starter contract that still needs a verified browser-safe auth, API, and CORS story before promotion.","The browser runtime needs an OAuth-capable flow and a delegated token with the provider scopes required for the selected source or route.","Provider endpoint: https://securitycenter.googleapis.com."],"blockers":["The runtime path has not been promoted from starter contract to live browser flow yet.","Auth scope, request signing, pagination, throttling, and cross-origin behavior still need explicit verification for this provider."]},{"key":"input:github-code-scanning-alerts","kind":"input","label":"GitHub code scanning alerts","category":"Scanner findings","status":"template","runtime_support":"planned","runtime_label":"Reviewed starter contract","auth_modes":["pat","oauth"],"description":"Starter config for pulling open high-severity GitHub code scanning alerts into browser-side triage and remediation planning.","config_type":"github_code_scanning_alerts","requirements":["This is a reviewed starter contract that still needs a verified browser-safe auth, API, and CORS story before promotion.","A user-scoped personal access token must stay in browser storage and carry only the minimum read or write scope required for the selected task.","The browser runtime needs an OAuth-capable flow and a delegated token with the provider scopes required for the selected source or route.","Provider endpoint: https://api.github.com."],"blockers":["The runtime path has not been promoted from starter contract to live browser flow yet.","Auth scope, request signing, pagination, throttling, and cross-origin behavior still need explicit verification for this provider."]},{"key":"input:semgrep-appsec-findings","kind":"input","label":"Semgrep AppSec findings","category":"Scanner findings","status":"template","runtime_support":"planned","runtime_label":"Reviewed starter contract","auth_modes":["api_token"],"description":"Starter config for bringing bounded Semgrep AppSec findings into browser-side reviewer queues and remediation handoffs.","config_type":"semgrep_appsec_findings","requirements":["This is a reviewed starter contract that still needs a verified browser-safe auth, API, and CORS story before promotion.","The operator must supply a provider token or service token in browser storage before this pack can run.","Provider endpoint: https://semgrep.dev/api/v1."],"blockers":["The runtime path has not been promoted from starter contract to live browser flow yet.","Auth scope, request signing, pagination, throttling, and cross-origin behavior still need explicit verification for this provider."]},{"key":"input:sonarqube-issues","kind":"input","label":"SonarQube security issues","category":"Scanner findings","status":"template","runtime_support":"planned","runtime_label":"Reviewed starter contract","auth_modes":["api_token"],"description":"Starter config for pulling open SonarQube vulnerabilities and security hotspots into a browser-local remediation queue.","config_type":"sonarqube_issues","requirements":["This is a reviewed starter contract that still needs a verified browser-safe auth, API, and CORS story before promotion.","The operator must supply a provider token or service token in browser storage before this pack can run.","Provider endpoint: https://YOUR-SONARQUBE-HOST/api."],"blockers":["The runtime path has not been promoted from starter contract to live browser flow yet.","Auth scope, request signing, pagination, throttling, and cross-origin behavior still need explicit verification for this provider."]},{"key":"input:checkmarx-one-findings","kind":"input","label":"Checkmarx One findings","category":"Scanner findings","status":"template","runtime_support":"planned","runtime_label":"Reviewed starter contract","auth_modes":["oauth","api_key"],"description":"Starter config for pulling high-severity Checkmarx One findings into browser-side triage and routed handoff workflows.","config_type":"checkmarx_one_findings","requirements":["This is a reviewed starter contract that still needs a verified browser-safe auth, API, and CORS story before promotion.","The browser runtime needs an OAuth-capable flow and a delegated token with the provider scopes required for the selected source or route.","The operator must paste a provider-issued API key into browser storage before the pack can call the provider API directly.","Provider endpoint: https://ast.checkmarx.net/api."],"blockers":["The runtime path has not been promoted from starter contract to live browser flow yet.","Auth scope, request signing, pagination, throttling, and cross-origin behavior still need explicit verification for this provider."]},{"key":"input:veracode-findings","kind":"input","label":"Veracode findings","category":"Scanner findings","status":"template","runtime_support":"planned","runtime_label":"Reviewed starter contract","auth_modes":["api_key"],"description":"Starter config for pulling actionable Veracode findings into a browser-local remediation and reporting workflow.","config_type":"veracode_findings","requirements":["This is a reviewed starter contract that still needs a verified browser-safe auth, API, and CORS story before promotion.","The operator must paste a provider-issued API key into browser storage before the pack can call the provider API directly.","Provider endpoint: https://api.veracode.com/appsec/v1."],"blockers":["The runtime path has not been promoted from starter contract to live browser flow yet.","Auth scope, request signing, pagination, throttling, and cross-origin behavior still need explicit verification for this provider."]},{"key":"input:aws-inspector-findings","kind":"input","label":"AWS Inspector findings","category":"Scanner findings","status":"template","runtime_support":"planned","runtime_label":"Reviewed starter contract","auth_modes":["aws_sigv4"],"description":"Starter config for pulling Amazon Inspector findings into browser-side prioritization, reporting, and downstream routing.","config_type":"aws_inspector_findings","requirements":["This is a reviewed starter contract that still needs a verified browser-safe auth, API, and CORS story before promotion.","The browser runtime needs real AWS SigV4 request signing and short-lived credentials before the provider API can be called honestly from the browser.","Provider endpoint: https://inspector2.us-east-1.amazonaws.com."],"blockers":["The runtime path has not been promoted from starter contract to live browser flow yet.","Auth scope, request signing, pagination, throttling, and cross-origin behavior still need explicit verification for this provider."]},{"key":"input:rapid7-insightvm-vulnerabilities","kind":"input","label":"Rapid7 InsightVM vulnerabilities","category":"Scanner findings","status":"template","runtime_support":"planned","runtime_label":"Reviewed starter contract","auth_modes":["api_key"],"description":"Starter config for pulling high-risk Rapid7 InsightVM vulnerabilities into browser-side triage and routing workflows.","config_type":"rapid7_insightvm_vulnerabilities","requirements":["This is a reviewed starter contract that still needs a verified browser-safe auth, API, and CORS story before promotion.","The operator must paste a provider-issued API key into browser storage before the pack can call the provider API directly.","Provider endpoint: https://console.insight.rapid7.com/api/3."],"blockers":["The runtime path has not been promoted from starter contract to live browser flow yet.","Auth scope, request signing, pagination, throttling, and cross-origin behavior still need explicit verification for this provider."]},{"key":"input:orca-security-alerts","kind":"input","label":"Orca Security alerts","category":"Scanner findings","status":"template","runtime_support":"planned","runtime_label":"Reviewed starter contract","auth_modes":["api_token"],"description":"Starter config for Orca alert intake when cloud exposure and workload findings need browser-side case and report handling.","config_type":"orca_security_alerts","requirements":["This is a reviewed starter contract that still needs a verified browser-safe auth, API, and CORS story before promotion.","The operator must supply a provider token or service token in browser storage before this pack can run.","Provider endpoint: https://api.orcasecurity.io."],"blockers":["The runtime path has not been promoted from starter contract to live browser flow yet.","Auth scope, request signing, pagination, throttling, and cross-origin behavior still need explicit verification for this provider."]},{"key":"input:lacework-alerts","kind":"input","label":"Lacework alerts","category":"Scanner findings","status":"template","runtime_support":"planned","runtime_label":"Reviewed starter contract","auth_modes":["api_key"],"description":"Starter config for pulling open high-severity Lacework alerts into browser-side remediation and escalation planning.","config_type":"lacework_alerts","requirements":["This is a reviewed starter contract that still needs a verified browser-safe auth, API, and CORS story before promotion.","The operator must paste a provider-issued API key into browser storage before the pack can call the provider API directly.","Provider endpoint: https://api.lacework.net."],"blockers":["The runtime path has not been promoted from starter contract to live browser flow yet.","Auth scope, request signing, pagination, throttling, and cross-origin behavior still need explicit verification for this provider."]},{"key":"input:confluence-knowledge","kind":"input","label":"Confluence runbook context","category":"Knowledge sources","status":"native","runtime_support":"live","runtime_label":"Browser live","auth_modes":["api_token","oauth"],"description":"Searches Confluence Cloud pages in the browser to bring internal runbooks, exception notes, and operational context into a scoped agent session.","config_type":"confluence_search","requirements":["The browser workbench already has a direct BYO-token runtime path for this pack today.","The operator must supply a provider token or service token in browser storage before this pack can run.","The browser runtime needs an OAuth-capable flow and a delegated token with the provider scopes required for the selected source or route.","Provider endpoint: https://YOUR-ATLASSIAN-SITE.atlassian.net/wiki."],"blockers":[]},{"key":"output:draft-pr-packet","kind":"output","label":"Draft PR packet","category":"Code handoff","status":"native","runtime_support":"copy_only","runtime_label":"Local copy only","auth_modes":["none"],"description":"Reviewer-ready markdown and metadata for a pull request without writing to the source host.","config_type":"draft_pr_packet","browser_delivery":true,"requirements":["No GitHub write required. Produces branch name, PR body, tests, rollback, and reviewer checklist.","This pack intentionally stops at a local contract and never performs the external write for the operator.","No provider credential is required; the operator still chooses the exact page, file, or route input in the browser.","Browser delivery is always operator-triggered; no server-side secret storage is introduced by this route."],"blockers":["No external write path exists by design, so a reviewer or downstream tool must copy, download, or relay the generated payload."]},{"key":"output:github-issue","kind":"output","label":"GitHub issue","category":"Ticketing","status":"native","runtime_support":"live","runtime_label":"Browser live","auth_modes":["pat","oauth"],"description":"Creates a GitHub issue with a normalized remediation or scan handoff body.","config_type":"github_issue","browser_delivery":true,"requirements":["Requires GitHub PAT or OAuth token with issues write access.","The browser workbench already has a direct BYO-token runtime path for this pack today.","A user-scoped personal access token must stay in browser storage and carry only the minimum read or write scope required for the selected task.","The browser runtime needs an OAuth-capable flow and a delegated token with the provider scopes required for the selected source or route.","Browser delivery is always operator-triggered; no server-side secret storage is introduced by this route."],"blockers":[]},{"key":"output:slack-webhook","kind":"output","label":"Slack webhook","category":"Collaboration","status":"native","runtime_support":"live","runtime_label":"Browser live","auth_modes":["webhook"],"description":"Posts the report or remediation handoff into a Slack channel using an incoming webhook.","config_type":"slack_webhook","browser_delivery":true,"requirements":["Requires an incoming Slack webhook URL.","The browser workbench already has a direct BYO-token runtime path for this pack today.","The destination system must expose a pre-approved webhook endpoint or secret-backed URL that the browser can post to directly.","Browser delivery is always operator-triggered; no server-side secret storage is introduced by this route."],"blockers":[]},{"key":"output:email-handoff","kind":"output","label":"Email handoff","category":"Collaboration","status":"native","runtime_support":"live_or_copy","runtime_label":"Live with copy fallback","auth_modes":["none"],"description":"Generates a browser mail draft or sends through a configured relay endpoint.","config_type":"email_handoff","browser_delivery":true,"requirements":["Uses a local mailto draft, or a configured CORS-enabled email relay URL.","The browser can try a direct write when the operator supplies the required config, and it still keeps a safe local copy or export fallback.","No provider credential is required; the operator still chooses the exact page, file, or route input in the browser.","Browser delivery is always operator-triggered; no server-side secret storage is introduced by this route."],"blockers":["Operator-owned credentials, webhook targets, or tenant metadata still need to be configured in the browser before a live call can run.","Provider cross-origin behavior and tenant policy still decide whether the direct browser path succeeds, so the local handoff fallback remains part of the design."]},{"key":"output:jira-ticket","kind":"output","label":"Jira ticket","category":"Ticketing","status":"native","runtime_support":"live","runtime_label":"Browser live","auth_modes":["api_token"],"description":"Creates a Jira task with a structured remediation or scan summary.","config_type":"jira_issue","browser_delivery":true,"requirements":["Requires Jira base URL, account email, API token, and project key.","The browser workbench already has a direct BYO-token runtime path for this pack today.","The operator must supply a provider token or service token in browser storage before this pack can run.","Browser delivery is always operator-triggered; no server-side secret storage is introduced by this route."],"blockers":[]},{"key":"output:runbook-receipt","kind":"output","label":"Runbook receipt","category":"Reports and evidence","status":"native","runtime_support":"copy_only","runtime_label":"Local copy only","auth_modes":["none"],"description":"Clipboard-friendly markdown for human execution with stop conditions and rollback.","config_type":"runbook_receipt","browser_delivery":true,"requirements":["No external auth required. Produces copyable steps and evidence.","This pack intentionally stops at a local contract and never performs the external write for the operator.","No provider credential is required; the operator still chooses the exact page, file, or route input in the browser.","Browser delivery is always operator-triggered; no server-side secret storage is introduced by this route."],"blockers":["No external write path exists by design, so a reviewer or downstream tool must copy, download, or relay the generated payload."]},{"key":"output:server-runbook","kind":"output","label":"Server runbook","category":"Reports and evidence","status":"native","runtime_support":"copy_only","runtime_label":"Local copy only","auth_modes":["none"],"description":"Operations-focused handoff for patching or validation during a maintenance window.","config_type":"server_runbook","browser_delivery":true,"requirements":["No automatic server changes. Produces commands for a human-run maintenance window.","This pack intentionally stops at a local contract and never performs the external write for the operator.","No provider credential is required; the operator still chooses the exact page, file, or route input in the browser.","Browser delivery is always operator-triggered; no server-side secret storage is introduced by this route."],"blockers":["No external write path exists by design, so a reviewer or downstream tool must copy, download, or relay the generated payload."]},{"key":"output:teams-workflow-webhook","kind":"output","label":"Microsoft Teams workflow webhook","category":"Collaboration","status":"native","runtime_support":"live_or_copy","runtime_label":"Live with copy fallback","auth_modes":["webhook"],"description":"Posts a browser-generated handoff to a Microsoft Teams channel or chat through a Workflows webhook.","config_type":"teams_workflows_webhook","browser_delivery":true,"requirements":["Requires a Teams Workflows webhook URL. Microsoft 365 connectors are nearing deprecation, so prefer a Workflows-owned webhook.","The browser can try a direct write when the operator supplies the required config, and it still keeps a safe local copy or export fallback.","The destination system must expose a pre-approved webhook endpoint or secret-backed URL that the browser can post to directly.","Browser delivery is always operator-triggered; no server-side secret storage is introduced by this route."],"blockers":["Operator-owned credentials, webhook targets, or tenant metadata still need to be configured in the browser before a live call can run.","Provider cross-origin behavior and tenant policy still decide whether the direct browser path succeeds, so the local handoff fallback remains part of the design."]},{"key":"output:servicenow-incident","kind":"output","label":"ServiceNow incident","category":"Ticketing","status":"native","runtime_support":"live_or_copy","runtime_label":"Live with copy fallback","auth_modes":["oauth"],"description":"Creates a ServiceNow incident or task record with a normalized remediation or scan summary.","config_type":"servicenow_incident","browser_delivery":true,"requirements":["Requires a ServiceNow instance URL, table name, and OAuth bearer token with create access to the target table.","The browser can try a direct write when the operator supplies the required config, and it still keeps a safe local copy or export fallback.","The browser runtime needs an OAuth-capable flow and a delegated token with the provider scopes required for the selected source or route.","Browser delivery is always operator-triggered; no server-side secret storage is introduced by this route."],"blockers":["Operator-owned credentials, webhook targets, or tenant metadata still need to be configured in the browser before a live call can run.","Provider cross-origin behavior and tenant policy still decide whether the direct browser path succeeds, so the local handoff fallback remains part of the design."]},{"key":"output:linear-issue","kind":"output","label":"Linear issue","category":"Ticketing","status":"native","runtime_support":"live_or_copy","runtime_label":"Live with copy fallback","auth_modes":["api_key"],"description":"Creates a Linear issue through the GraphQL API for security engineering or platform backlog handoff.","config_type":"linear_issue","browser_delivery":true,"requirements":["Requires a Linear personal API key and a target team ID.","The browser can try a direct write when the operator supplies the required config, and it still keeps a safe local copy or export fallback.","The operator must paste a provider-issued API key into browser storage before the pack can call the provider API directly.","Browser delivery is always operator-triggered; no server-side secret storage is introduced by this route."],"blockers":["Operator-owned credentials, webhook targets, or tenant metadata still need to be configured in the browser before a live call can run.","Provider cross-origin behavior and tenant policy still decide whether the direct browser path succeeds, so the local handoff fallback remains part of the design."]},{"key":"output:splunk-hec","kind":"output","label":"Splunk HEC event","category":"SIEM and analytics","status":"native","runtime_support":"live_or_copy","runtime_label":"Live with copy fallback","auth_modes":["api_token"],"description":"Posts the normalized report bundle directly to Splunk HTTP Event Collector for SIEM or analytics use.","config_type":"splunk_hec","browser_delivery":true,"requirements":["Requires a Splunk HEC URL and HEC token.","The browser can try a direct write when the operator supplies the required config, and it still keeps a safe local copy or export fallback.","The operator must supply a provider token or service token in browser storage before this pack can run.","Browser delivery is always operator-triggered; no server-side secret storage is introduced by this route."],"blockers":["Operator-owned credentials, webhook targets, or tenant metadata still need to be configured in the browser before a live call can run.","Provider cross-origin behavior and tenant policy still decide whether the direct browser path succeeds, so the local handoff fallback remains part of the design."]},{"key":"output:elastic-security-case","kind":"output","label":"Elastic Security case","category":"SIEM and analytics","status":"native","runtime_support":"live_or_copy","runtime_label":"Live with copy fallback","auth_modes":["api_key"],"description":"Creates an Elastic case with the generated remediation or scan summary.","config_type":"elastic_security_case","browser_delivery":true,"requirements":["Requires a Kibana base URL and Elastic API key with Cases write access.","The browser can try a direct write when the operator supplies the required config, and it still keeps a safe local copy or export fallback.","The operator must paste a provider-issued API key into browser storage before the pack can call the provider API directly.","Browser delivery is always operator-triggered; no server-side secret storage is introduced by this route."],"blockers":["Operator-owned credentials, webhook targets, or tenant metadata still need to be configured in the browser before a live call can run.","Provider cross-origin behavior and tenant policy still decide whether the direct browser path succeeds, so the local handoff fallback remains part of the design."]},{"key":"output:pagerduty-events-v2","kind":"output","label":"PagerDuty Events API v2","category":"Incident response","status":"native","runtime_support":"live_or_copy","runtime_label":"Live with copy fallback","auth_modes":["api_key"],"description":"Starter browser-side route for escalating a high-confidence incident or remediation brief into PagerDuty event orchestration.","config_type":"pagerduty_events_v2","browser_delivery":true,"requirements":["Requires a PagerDuty Events API v2 routing key or service integration configured for the target escalation path.","The browser can try a direct write when the operator supplies the required config, and it still keeps a safe local copy or export fallback.","The operator must paste a provider-issued API key into browser storage before the pack can call the provider API directly.","Browser delivery is always operator-triggered; no server-side secret storage is introduced by this route."],"blockers":["Operator-owned credentials, webhook targets, or tenant metadata still need to be configured in the browser before a live call can run.","Provider cross-origin behavior and tenant policy still decide whether the direct browser path succeeds, so the local handoff fallback remains part of the design."]},{"key":"output:google-chat-webhook","kind":"output","label":"Google Chat webhook","category":"Collaboration","status":"native","runtime_support":"live_or_copy","runtime_label":"Live with copy fallback","auth_modes":["webhook"],"description":"Starter browser-side route for posting a normalized remediation or incident brief into a Google Chat space.","config_type":"google_chat_webhook","browser_delivery":true,"requirements":["Requires a Google Chat incoming webhook URL for the destination space.","The browser can try a direct write when the operator supplies the required config, and it still keeps a safe local copy or export fallback.","The destination system must expose a pre-approved webhook endpoint or secret-backed URL that the browser can post to directly.","Browser delivery is always operator-triggered; no server-side secret storage is introduced by this route."],"blockers":["Operator-owned credentials, webhook targets, or tenant metadata still need to be configured in the browser before a live call can run.","Provider cross-origin behavior and tenant policy still decide whether the direct browser path succeeds, so the local handoff fallback remains part of the design."]},{"key":"output:azure-devops-work-item","kind":"output","label":"Azure DevOps work item","category":"Ticketing","status":"native","runtime_support":"live_or_copy","runtime_label":"Live with copy fallback","auth_modes":["pat","oauth"],"description":"Browser-side route for creating an Azure DevOps work item from a normalized remediation or scan handoff, with local preview fallback when direct delivery is blocked.","config_type":"azure_devops_work_item","browser_delivery":true,"requirements":["Requires an Azure DevOps organization, project, work item type, and a PAT or bearer token with Work Items write scope.","The browser can try a direct write when the operator supplies the required config, and it still keeps a safe local copy or export fallback.","A user-scoped personal access token must stay in browser storage and carry only the minimum read or write scope required for the selected task.","The browser runtime needs an OAuth-capable flow and a delegated token with the provider scopes required for the selected source or route.","Browser delivery is always operator-triggered; no server-side secret storage is introduced by this route."],"blockers":["Operator-owned credentials, webhook targets, or tenant metadata still need to be configured in the browser before a live call can run.","Provider cross-origin behavior and tenant policy still decide whether the direct browser path succeeds, so the local handoff fallback remains part of the design."]},{"key":"output:gitlab-issue","kind":"output","label":"GitLab issue","category":"Ticketing","status":"native","runtime_support":"live_or_copy","runtime_label":"Live with copy fallback","auth_modes":["pat","oauth"],"description":"Browser-side route for creating a GitLab issue with a normalized remediation or triage brief, with local preview fallback when direct delivery is blocked.","config_type":"gitlab_issue","browser_delivery":true,"requirements":["Requires a GitLab project path or ID plus a personal access token or bearer token. GitLab.com works out of the box; self-managed hosts need a browser-allowed API base URL.","The browser can try a direct write when the operator supplies the required config, and it still keeps a safe local copy or export fallback.","A user-scoped personal access token must stay in browser storage and carry only the minimum read or write scope required for the selected task.","The browser runtime needs an OAuth-capable flow and a delegated token with the provider scopes required for the selected source or route.","Browser delivery is always operator-triggered; no server-side secret storage is introduced by this route."],"blockers":["Operator-owned credentials, webhook targets, or tenant metadata still need to be configured in the browser before a live call can run.","Provider cross-origin behavior and tenant policy still decide whether the direct browser path succeeds, so the local handoff fallback remains part of the design."]},{"key":"output:cortex-xsoar-incident","kind":"output","label":"Cortex XSOAR incident","category":"SOAR and case management","status":"native","runtime_support":"live_or_copy","runtime_label":"Live with copy fallback","auth_modes":["api_key"],"description":"Browser-side route for creating a Cortex XSOAR incident from a reviewed SecurityRecipes packet, with incident-shaped payloads and local preview fallback when direct delivery is blocked.","config_type":"cortex_xsoar_incident","browser_delivery":true,"requirements":["Requires a Cortex XSOAR tenant URL or incident endpoint plus API key ID and API key with incident create access. Direct browser delivery still depends on tenant CORS and any mandatory incident fields.","The browser can try a direct write when the operator supplies the required config, and it still keeps a safe local copy or export fallback.","The operator must paste a provider-issued API key into browser storage before the pack can call the provider API directly.","Browser delivery is always operator-triggered; no server-side secret storage is introduced by this route."],"blockers":["Operator-owned credentials, webhook targets, or tenant metadata still need to be configured in the browser before a live call can run.","Provider cross-origin behavior and tenant policy still decide whether the direct browser path succeeds, so the local handoff fallback remains part of the design."]},{"key":"output:ibm-soar-incident","kind":"output","label":"IBM SOAR incident","category":"SOAR and case management","status":"template","runtime_support":"planned","runtime_label":"Reviewed starter contract","auth_modes":["api_key"],"description":"Starter browser-side route for creating an IBM SOAR incident from a structured SecurityRecipes packet.","config_type":"ibm_soar_incident","browser_delivery":true,"requirements":["Requires an IBM SOAR organization URL and API credentials with incident create access.","This is a reviewed starter contract that still needs a verified browser-safe auth, API, and CORS story before promotion.","The operator must paste a provider-issued API key into browser storage before the pack can call the provider API directly.","Browser delivery is always operator-triggered; no server-side secret storage is introduced by this route."],"blockers":["The runtime path has not been promoted from starter contract to live browser flow yet.","Auth scope, request signing, pagination, throttling, and cross-origin behavior still need explicit verification for this provider."]},{"key":"output:microsoft-sentinel-playbook","kind":"output","label":"Microsoft Sentinel playbook trigger","category":"SOAR and case management","status":"template","runtime_support":"planned","runtime_label":"Reviewed starter contract","auth_modes":["oauth"],"description":"Starter browser-side route for forwarding a reviewed packet into a Microsoft Sentinel incident playbook.","config_type":"microsoft_sentinel_playbook","browser_delivery":true,"requirements":["Requires Azure subscription and workspace identifiers plus an OAuth token permitted to run Sentinel playbooks.","This is a reviewed starter contract that still needs a verified browser-safe auth, API, and CORS story before promotion.","The browser runtime needs an OAuth-capable flow and a delegated token with the provider scopes required for the selected source or route.","Browser delivery is always operator-triggered; no server-side secret storage is introduced by this route."],"blockers":["The runtime path has not been promoted from starter contract to live browser flow yet.","Auth scope, request signing, pagination, throttling, and cross-origin behavior still need explicit verification for this provider."]},{"key":"output:tines-webhook","kind":"output","label":"Tines webhook","category":"SOAR and case management","status":"native","runtime_support":"live_or_copy","runtime_label":"Live with copy fallback","auth_modes":["webhook"],"description":"Browser-side route for forwarding a reviewed SecurityRecipes packet into a Tines story or event-driven workflow, with local preview fallback when direct delivery is blocked.","config_type":"tines_webhook","browser_delivery":true,"requirements":["Requires a Tines webhook or HTTP Request action endpoint approved for browser-triggered incident or remediation intake, with any optional auth header or custom headers configured in the browser.","The browser can try a direct write when the operator supplies the required config, and it still keeps a safe local copy or export fallback.","The destination system must expose a pre-approved webhook endpoint or secret-backed URL that the browser can post to directly.","Browser delivery is always operator-triggered; no server-side secret storage is introduced by this route."],"blockers":["Operator-owned credentials, webhook targets, or tenant metadata still need to be configured in the browser before a live call can run.","Provider cross-origin behavior and tenant policy still decide whether the direct browser path succeeds, so the local handoff fallback remains part of the design."]},{"key":"output:torq-webhook","kind":"output","label":"Torq workflow webhook","category":"SOAR and case management","status":"native","runtime_support":"live_or_copy","runtime_label":"Live with copy fallback","auth_modes":["webhook"],"description":"Browser-side route for sending a reviewed remediation or incident packet into a Torq automation workflow, with local preview fallback when direct delivery is blocked.","config_type":"torq_webhook","browser_delivery":true,"requirements":["Requires a Torq webhook or API-triggered workflow endpoint plus any auth header or secret material approved for browser-side use.","The browser can try a direct write when the operator supplies the required config, and it still keeps a safe local copy or export fallback.","The destination system must expose a pre-approved webhook endpoint or secret-backed URL that the browser can post to directly.","Browser delivery is always operator-triggered; no server-side secret storage is introduced by this route."],"blockers":["Operator-owned credentials, webhook targets, or tenant metadata still need to be configured in the browser before a live call can run.","Provider cross-origin behavior and tenant policy still decide whether the direct browser path succeeds, so the local handoff fallback remains part of the design."]},{"key":"output:splunk-soar-incident","kind":"output","label":"Splunk SOAR incident","category":"SOAR and case management","status":"native","runtime_support":"live_or_copy","runtime_label":"Live with copy fallback","auth_modes":["api_token"],"description":"Browser-side route for creating a Splunk SOAR container from a reviewed SecurityRecipes packet, with container-shaped payloads and local preview fallback when direct delivery is blocked.","config_type":"splunk_soar_container","browser_delivery":true,"requirements":["Requires a Splunk SOAR or Phantom tenant URL or /rest/container endpoint plus a ph-auth-token for an automation user with container create access. Direct browser delivery still depends on tenant CORS and label permissions.","The browser can try a direct write when the operator supplies the required config, and it still keeps a safe local copy or export fallback.","The operator must supply a provider token or service token in browser storage before this pack can run.","Browser delivery is always operator-triggered; no server-side secret storage is introduced by this route."],"blockers":["Operator-owned credentials, webhook targets, or tenant metadata still need to be configured in the browser before a live call can run.","Provider cross-origin behavior and tenant policy still decide whether the direct browser path succeeds, so the local handoff fallback remains part of the design."]},{"key":"output:swimlane-case","kind":"output","label":"Swimlane case","category":"SOAR and case management","status":"template","runtime_support":"planned","runtime_label":"Reviewed starter contract","auth_modes":["api_token"],"description":"Starter browser-side route for creating a Swimlane case or work item from a reviewed SecurityRecipes packet.","config_type":"swimlane_record","browser_delivery":true,"requirements":["Requires a Swimlane environment URL, app identifier, and API token with record create access for the target case app.","This is a reviewed starter contract that still needs a verified browser-safe auth, API, and CORS story before promotion.","The operator must supply a provider token or service token in browser storage before this pack can run.","Browser delivery is always operator-triggered; no server-side secret storage is introduced by this route."],"blockers":["The runtime path has not been promoted from starter contract to live browser flow yet.","Auth scope, request signing, pagination, throttling, and cross-origin behavior still need explicit verification for this provider."]},{"key":"output:generic-webhook","kind":"output","label":"Generic webhook","category":"Custom integrations","status":"native","runtime_support":"live_or_copy","runtime_label":"Live with copy fallback","auth_modes":["webhook"],"description":"Posts the full SecurityRecipes delivery envelope to a custom SOAR, queue, or workflow endpoint.","config_type":"generic_webhook","browser_delivery":true,"requirements":["Requires a browser-reachable webhook URL and any required headers or bearer token.","The browser can try a direct write when the operator supplies the required config, and it still keeps a safe local copy or export fallback.","The destination system must expose a pre-approved webhook endpoint or secret-backed URL that the browser can post to directly.","Browser delivery is always operator-triggered; no server-side secret storage is introduced by this route."],"blockers":["Operator-owned credentials, webhook targets, or tenant metadata still need to be configured in the browser before a live call can run.","Provider cross-origin behavior and tenant policy still decide whether the direct browser path succeeds, so the local handoff fallback remains part of the design."]}]}