Reach Inventory: five rules and a five-check script (free sample)
by PaperChaseWebb
From the Reach Inventory: five rules for the connectors your agents hold (a human owner, a job for every connector, leftover means removed, write access has an approver, unused access gets reviewed), and a read-only script that checks one reach list for them.
- Price
- Free
- Difficulty
- Beginner
- Setup
- 5 min
- Format
- .md file
reach-inventory-five-rules-and-checks-free-sample.md · 7 KB · direct download, no signup
What you end up with
In a few minutes you can see which of your agents' connectors have no job, no approver or no recent use.
What you get
- Five reach rules
- reach_mini.py: five read-only checks on one reach-lite.json
- One prompt for all four harnesses
- Worked example: 5 findings, then 0
Who it is for
Anyone who wants a quick look at what their agents can reach before adding more.
Works with
Solid chips: the agent is named in this listing's own tools list. Dashed chip: Plain Markdown, so it also pastes into other agents such as Grok Bot, Hermes, OpenClaw or Muse. We list those as compatible by format only, not as tested.
Tools needed
Cost to run: Free.
Time to result: About five minutes to a first result
Sample prompts, free to use
List every connector, MCP server and API key you can use, names only and never values. Write them to reach-lite.json with the job each serves, necessary, convenient or leftover, read or write, and the date each was last used where you can find it. Do not connect, remove or change anything. Run reach_mini.py reach-lite.json and show me the findings.
The rules and the script are in the file.
Free preview of the file
# Reach Inventory: five rules and a five-check script (free sample)
Version 1.0, 2026-10-29. By PaperChaseWebb. For owners whose agents hold connectors, in Grok Bot, Claude Code, Codex, Hermes or a mix, and who want one list of what those agents can reach. One Markdown file and one Python 3 script, standard library only. The script was tested on its worked example (5 findings, then 0) and on a missing file (exit 2). It was not run inside any agent harness or against real connected accounts.
Connectors pile up. One gets added for an afternoon's job and stays for a year. An automation bridge is connected once and from then on reaches every app behind it. Nobody remembers which grant does what, so nothing gets removed. These five rules cover the gaps that cost the most, and the script checks them in one small file.
## Install in one line
Save this page as FREE-SAMPLE.md, then:
```
python3 -c "import re;t=open('FREE-SAMPLE.md').read();open('reach_mini.py','w').write(re.search(r'~~~python\n(.*?)~~~',t,re.S).group(1))"
python3 reach_mini.py reach-lite.json
```
## Five rules
1. **The list has a human owner.** A person decides what stays and what goes. Not "TBD", and not the agent that holds the access.
2. **Every connector serves a named job.** If nobody can say what job it does, it goes on the removal list.
3. **Leftover means removed.** Access with no current job is switched off, not kept "just in case".
4. **Write access has an approver.** Anything that can send, post, booTest record
- Date
- Oct 29, 2026
- What was run
- reach_mini.py on the worked example, a fixed file and a missing file.
- Result
- 5 findings, then 0; exit 2 on a missing file.
- Not run
- The prompt inside a harness or on real accounts.
Copied from this item's dated test notes. What was not run stays in.
Worth knowing
- The sample checks one file against five rules. Scope granted against needed, bridges, removal proof, the three-legs check, owner approvals by hash and the fifteen checks are in the full pack.
- On 2026-10-29 reach_mini.py gave 5 findings on the worked example, then 0 on the fixed file, and exited 2 on a missing file. The prompt was not run inside a harness or on real accounts.
Questions
Does it change any access?
No. It reads one file and opens no network connection.
What is in the full pack?
The inventory folder with templates, reach.py that gates changes and records the owner's yes tied to a hash with one use and expiry, a one-page report, fifteen read-only checks with a seeded test inventory, a skill file, AGENTS.md snippet and Grok Bot rules block, ten prompts and a failure table. $19.
Details
Version 1.0 · Updated Oct 29, 2026 · Markdown version of this page
License: Personal and commercial use. Download terms
Related
Reach Inventory: every connector your agents hold, with a job, an owner and a way out
One row for every connector, MCP server, OAuth grant, API key and automation bridge your agents can use, each tied to a job and marked necessary, convenient or leftover. Scope granted is set against the scope the job needs, keys are named by where they live and never pasted, bridges list every app behind them, and leftover access is removed with a date and proof. Agents list and propose; removals, narrower scopes, rotations and new grants wait for your yes at your own terminal, tied to the sha256 of the inventory. Fifteen read-only checks run on the inventory.
Desk Authority Map: five rules and a five-check script (free sample)
From the Desk Authority Map: five rules for an agent fleet (every desk has a human owner, no desk checks its own work, nothing that cannot be undone is decided alone, money gets a dollar limit, some actions belong to the owner), and a read-only script that checks one map file for them.
Agent Readiness Self-Check: score one workflow before you hand it to an AI agent
A free self-check for agencies and small businesses. Name the decision, then score one workflow across eight areas (workflow mapped, data access, approval gates, owner per agent, handoffs, cost tracking, security and vetting, measurement) with an evidence rule, three gate rules and a skeptical pass, and read your band and the next steps it allows. v1.1 starts with the decision the score will change, scores unknowns as unknown, adds rules for conflicting facts and lookalike public records, ties every band to the next steps it allows with the Production Readiness Audit before go-live, makes owner approval concrete (prepared and approved status, a one-reply approval line, decisions the agent must leave open, a done test), adds agent files for Grok Bot, Claude Code, Codex and Hermes, a second worked example (missed call to booked job), a readiness folder with a fifteen-check read-only checker, a front door test with four questions to ask anyone selling you an agent install, and a plain note on how it was tested. Still free.