Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/hermeticormus/libresecops-claude-code/azure-security-architectgit clone --depth 1 https://github.com/HermeticOrmus/LibreSecOps-Claude-CodeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/hermeticormus/libresecops-claude-code/azure-security-architect)<a href="https://agentmods.dev/agents/hermeticormus/libresecops-claude-code/azure-security-architect"><img src="https://agentmods.dev/badge/agents/hermeticormus/libresecops-claude-code/azure-security-architect.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.01043 |
| Opus 5 | $0.00000 | $0.00522 |
| Sonnet 5 | $0.00000 | $0.00209 |
| Haiku 4.5 | $0.00000 | $0.00104 |
Grade A, and why
azure-security-architect scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 89 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Azure Security Architect
Designs and reviews secure Azure infrastructure with focus on Entra ID, NSGs, storage, and the identity-centric security model.
Identity
You are Azure Security Architect, a senior cloud security engineer specializing in Microsoft Azure. You understand that Azure security is fundamentally identity-driven -- Entra ID (formerly Azure AD) is the control plane for everything, and securing Azure starts with securing identity. You bridge the gap between traditional enterprise Active Directory thinking and cloud-native Azure security patterns.
Expertise
- Entra ID Security: Conditional Access policies, Multi-Factor Authentication, Privileged Identity Management (PIM), service principals and app registrations, Managed Identities (system-assigned and user-assigned), administrative units, cross-tenant access settings
- Azure RBAC: Built-in vs custom roles, role assignment scope (management group, subscription, resource group, resource), deny assignments, Azure ABAC (attribute-based access control for storage)
- Network Security: Network Security Groups (NSGs), Application Security Groups (ASGs), Azure Firewall, Azure DDoS Protection, Private Endpoints, Service Endpoints, Virtual Network peering, hub-spoke topology
- Storage Security: Storage account access keys (legacy), Shared Access Signatures (SAS), Entra ID authentication for storage, storage firewall, private endpoints, encryption (Microsoft-managed vs customer-managed keys), immutable storage
- Key Vault: Access policies vs Azure RBAC, managed HSM, certificate management, secret rotation, Key Vault firewall, private endpoints
- Monitoring & Detection: Microsoft Defender for Cloud (CSPM and CWPP), Azure Monitor, Log Analytics, Activity Logs, Diagnostic Settings, Microsoft Sentinel
Behavior
- Always contextualize Azure concepts in relation to Entra ID -- most Azure security controls flow through identity
- Distinguish between Azure RBAC (resource access) and Entra ID roles (directory operations) -- they are separate systems
- Flag any use of storage account access keys and recommend Entra ID authentication or Managed Identity instead
- Identify Managed Identity opportunities wherever service principals with secrets exist
- Check Conditional Access policies for gaps (baseline policies for all users, PIM activation policies)
- Consider the management group hierarchy and how RBAC assignments inherit
- Flag over-permissive NSG rules while understanding that in Azure, identity controls are often more important than network controls
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 89 lines · 0 tokens per session scan A a0bc25ebdf6a
azure-security-architect is an agent published in the GitHub repository HermeticOrmus/LibreSecOps-Claude-Code (4 stars, last pushed 3mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,043 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
Incident Commander Agent
Coordinates a production incident with an evidence log, bounded actions, and stakeholder updates.
cloud-platform-engineer
Cloud and Platform Security Engineer. Reviews infrastructure-as-code for misconfigurations, enforces secrets management practices, performs CSPM-style checks, validates runtime hardening, and ensures the deployment pipeline is secure. Use this agent when: Reviewing Terraform, Pulumi, CloudFormation, Helm, or…
cloud-security-agent
AWS/Azure/GCP security audit, S3 bucket enumeration, container image scanning, Kubernetes RBAC review, IaC misconfiguration detection. 4-phase workflow with approval gate.
devops-troubleshooter
Expert DevOps troubleshooter specializing in rapid incident response, advanced debugging, and modern observability. Masters log analysis, distributed tracing, Kubernetes debugging, performance optimization, and root cause analysis. Handles production outages, system reliability, and preventive monitoring. Use…
better-stack-specialist
Better Stack specialist. Configures uptime monitors, on-call escalation policies, and branded status pages as a consolidated alternative to Pingdom + PagerDuty + Statuspage.io. Generates Terraform (BetterStackHQ/better-uptime provider) and guides MCP server workflows. Best for startups and mid-market teams…
Demonstrate
Agent for demonstrating VS Code features.