RSS and Atom feeds

Certified Certified by Atlantic Agentic Labs on 7 November 2026, against RSS 2.0; Atom 1.0 (RFC 4287); expires 7 May 2027.

Reads a publisher’s RSS 2.0 or Atom 1.0 feed: a regulator’s notices, a standards body’s updates, a vendor’s security advisories, a news desk. Each item becomes one document in the knowledge base, kept with its link and the hash of exactly what the publisher served.

At a glance

Collector	RSS and Atom feeds, version 1.0.1
Reads	Any publisher: RSS 2.0 and Atom 1.0 feeds (the vendor's documentation)
Family	Web
Kind	Feed
Ways to connect	None (no credential)
Scopes	Read:
Read only	Yes
Vendor's API can move money	No
Personal data	None
Hosts it may contact	Only the hosts on your deployment's allow-list (*: the host is the one you give it)
Vendor API versions	RSS 2.0, Atom 1.0 (RFC 4287)
Lowest engine version	0.45.0

What it reads

• The feed at the address you give, and nothing it links to.
• For each item: its title, its summary or content (with markup removed), its link, its identifier (guid or Atom id) and its date (pubDate, Atom updated or published).
• Only items newer than the last one read. The first read takes everything the feed currently lists.

It does not follow links, download attachments or read pages behind a sign-in.

How to connect

1. In LightHouse, open Connectors and choose RSS and Atom feeds.
2. Paste the feed’s address. It must start with https://.
3. Add the feed’s host to the source’s allowed hosts (LightHouse fills in the host of the address you pasted). If the publisher redirects to another host, add that host too, or the read stops at the redirect.
4. Choose a label for what the feed contains (for example regulation or internal) and how often to read it. Nothing reads on a schedule until you choose one.

No credential is needed: a feed that requires a sign-in is not supported by this collector.

Permissions

None. The collector sends only GET requests, with no credentials, to the hosts you allow. Its read-only test proves it on every change.

Limits

• One feed per source. Add a source per feed.
• Items without an identifier or a link are skipped.
• Dates are read as RFC 822 (RSS pubDate) or ISO 8601 (Atom) and compared in UTC. An item whose date cannot be read is offered on every read; unchanged items are not rewritten, so this costs a fetch, not duplicates.
• An item with no summary or content (some publishers list titles and links only) is kept with its title and link and an empty body.
• Requests are paced (one second apart by default) and back off when the publisher asks (Retry-After).
• Plain http:// feeds are refused.

Data handling

• Feeds are public by nature; the collector expects no personal data. If a feed carries some (a named author, for example), it is kept as the publisher wrote it and labelled like the rest of the item.
• The raw bytes of each response are cached in your deployment, named by their SHA-256, so any passage can be traced to what was served.
• Nothing leaves your deployment: the collector runs inside it, and only the counts of items read reach LightHouse.
• XML is parsed with defusedxml, which refuses entity expansion and external entities.

Troubleshooting

What you see	What it means	What to do
HostNotAllowed	The feed, or a redirect, is on a host not in the source’s allowed hosts	Add the host, if you trust it
non-https	The address or a redirect uses plain http://	Ask the publisher for an https feed
EntitiesForbidden	The feed uses XML entities, which are refused	Report it to the publisher; it cannot be read safely
HTTPStatusError 404	The feed has moved	Update the address
Read succeeded, 0 written	Nothing newer than the last read	Nothing to do

Certification

Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See How collectors are certified.

Date	Collector	Engine	Vendor API	Method	Expires
7 November 2026	1.0.1	0.45.0	RSS 2.0; Atom 1.0 (RFC 4287)	Vendor's sandbox (a real run)	7 May 2027
6 November 2026	1.0.0	0.45.0	RSS 2.0; Atom 1.0 (RFC 4287)	Fixtures only: built, not certified	Not applicable

Security posture

From the collector’s last scan on the default branch. What each line means, and what blocks a release: Security posture.

Last scanned	10 November 2026
Critical findings	0
High findings	0
Medium findings	0
Low findings	0
Info findings	0
Release blocked	No
Network allow-list check	Pass
Read-only behavioural test	Pass
SBOM (CycloneDX)	Produced
Dependency licences	Pass
Scanners	bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only