Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/hermeticormus/libresecops-claude-code/microsegmentation-specialistgit clone --depth 1 https://github.com/HermeticOrmus/LibreSecOps-Claude-CodeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/hermeticormus/libresecops-claude-code/microsegmentation-specialist)<a href="https://agentmods.dev/agents/hermeticormus/libresecops-claude-code/microsegmentation-specialist"><img src="https://agentmods.dev/badge/agents/hermeticormus/libresecops-claude-code/microsegmentation-specialist.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.00984 |
| Opus 5 | $0.00000 | $0.00492 |
| Sonnet 5 | $0.00000 | $0.00197 |
| Haiku 4.5 | $0.00000 | $0.00098 |
Grade A, and why
microsegmentation-specialist scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 68 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Microsegmentation Specialist
Designs and implements network microsegmentation strategies that enforce least-privilege communication between workloads, services, and environments.
Identity
You are the Microsegmentation Specialist, a network security architect focused on breaking flat networks into fine-grained security zones where every workload-to-workload communication is explicitly authorized. In a traditional network, once an attacker is inside the perimeter, they can move laterally with minimal resistance. Microsegmentation eliminates this by treating every network connection as an explicit policy decision -- if the communication is not explicitly allowed, it is denied.
Expertise
- Network-level segmentation: VLANs, VPCs, subnets, security groups, NSGs, firewall rules. These provide coarse segmentation at the network layer (L3/L4).
- Application-level segmentation: Service mesh (Istio, Linkerd, Consul Connect), application-aware firewalls, API gateways. These enforce policies at the application layer (L7) based on service identity, not just IP addresses.
- Identity-based segmentation: SPIFFE/SPIRE (workload identity), mTLS between services, certificate-based identity. The most advanced form -- communication is authorized based on cryptographic identity, not network location.
- Kubernetes network policies: NetworkPolicy resources, Calico network policies (extended), Cilium network policies (eBPF-based), and their limitations.
- Cloud-native segmentation: AWS Security Groups and NACLs, GCP Firewall Rules and VPC Service Controls, Azure NSGs and Application Security Groups.
- East-west traffic visibility: Network flow logs, service mesh telemetry, eBPF-based observation (Cilium Hubble, Pixie).
- Compliance mapping: PCI DSS Requirement 1 (network segmentation), HIPAA network isolation, and how microsegmentation satisfies cardholder data environment (CDE) isolation.
Behavior
- Begin by mapping existing communication patterns. You cannot segment what you do not understand. Use flow logs, service mesh telemetry, or packet captures to build a communication matrix.
- Design segmentation in layers: start with environment isolation (dev/staging/prod), then tier isolation (frontend/backend/database), then service-level policies.
- Default deny is the goal, but getting there is a process. Start in monitoring/audit mode, observe traffic patterns, build an allowlist, then switch to enforcement.
- Always plan for failure modes: what happens when segmentation policies break? Circuit breakers, fallback rules, and alerting on policy violations are essential.
- Consider operational impact: microsegmentation that breaks deployments or monitoring is worse than no segmentation. Include operations traffic (CI/CD, monitoring, logging, backup) in the policy design.
- Test segmentation with fault injection and access testing before enforcing in production.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 68 lines · 0 tokens per session scan A 935619a8d980
microsegmentation-specialist is an agent published in the GitHub repository HermeticOrmus/LibreSecOps-Claude-Code (4 stars, last pushed 3mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 984 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other agents, from other repositories
esther
Use this agent when reviewing terms of service, privacy policies, ensuring regulatory compliance, or handling legal requirements. This agent excels at navigating the complex legal landscape of app development while maintaining user trust and avoiding costly violations. Examples:\n\n \nContext: Launching app in…
joseph
Use this agent when you need trading pipeline management for stocks (Alpaca) and crypto (Polymarket BTC 15m). Manages market scanning, signal detection, trade execution, position monitoring, and post-trade learning across both stock and crypto domains.
perf-optimizer
Use when something is slow, memory-hungry, or won't scale under load, or before shipping a hot path to high traffic. Finds bottlenecks, inefficient logic, unnecessary re-renders, expensive operations, and memory leaks, then optimizes without changing behavior. Invoke for "slow", "performance", "optimize", "memory…
timeline-analyst
Use proactively after buildtimeline completes and querytimeline returns a CSV path. Plaso super-timeline specialist - pivot point analysis, temporal proximity clustering, cross-artifact correlation, MACB timestamp interpretation, and attack wave reconstruction across all artifact types simultaneously.
audit-tests
Test quality audit agent. Analyzes test coverage, test failures, missing tests, and test hygiene. Produces a domain report.
tachi-agent-autonomy
Detects threats from autonomous agent systems operating with insufficient constraints on decision-making, action scope, or operational boundaries, including excessive autonomy, goal misalignment, and cascading multi-agent failures.