diff --git a/README.md b/README.md
index 5fafd32..f237d28 100644
--- a/README.md
+++ b/README.md
@@ -11,4 +11,36 @@ Mostly Vibe coded scripts to assist with troubleshooting Riedel equipment
 - `mDNS-Scout.exe` - Windows based mDNS reader. Windows backend, webgui front end.
 
 ## RRCS Scripts
-Dig deeper in the folder for more info.
\ No newline at end of file
+Dig deeper in the folder for more info.
+
+## watch_remote_top
+
+SSHes into a Linux/embedded device (password auth, prompts for host/username/password), pulls a `top` snapshot every 10 minutes, and logs CPU/RAM usage locally — full raw snapshots plus a parsed CSV summary (CPU%, RAM used/total/free, top RAM-consuming process). Handles both standard Linux (`procps`) and BusyBox `top` output formats.
+
+**Requirements:** `pip install paramiko`
+
+**Usage:**
+```bash
+python3 watch_remote_top.py
+python3 watch_remote_top.py --once            # single snapshot, no loop
+python3 watch_remote_top.py --interval 5       # poll every 5 min instead of 10
+python3 watch_remote_top.py --log-dir ./logs   # default: ./TopLogs
+```
+
+**Output** (in `./TopLogs/` by default):
+- `top_full_snapshots.log` — full raw `top` output per poll
+- `cpu_ram_summary.csv` — parsed summary row per poll
+
+**Windows binary:** run `build_exe.bat` (requires `pip install pyinstaller paramiko`) to produce a standalone `watch_remote_top.exe` via PyInstaller — no Python install needed to run it afterward.
+
+**Running the compiled .exe:**
+
+The exe accepts the same flags as the Python script. Launch it from a terminal (cmd/PowerShell) to use them — double-clicking in Explorer runs it with defaults (10 min interval) since there's no way to pass arguments that way.
+
+```
+watch_remote_top.exe --interval 5
+watch_remote_top.exe --interval 15 --log-dir C:\Logs\TopLogs
+watch_remote_top.exe --once
+```
+
+> Note: on devices with heavy page caching (e.g. long-uptime embedded boxes), `Mem_Used` in the CSV will climb over time even with no real leak — BusyBox's `used` figure includes reclaimable page cache. Cross-check against the `cached` field in the raw log before assuming a leak.