Skip to main content
Tolmo’s agents find and prove the issues that are exploitable. Your coding agent writes the fix. You can connect the two in two ways:
  • The fix prompt. You copy one finding into a coding agent. This needs no setup. See Fix a finding.
  • The Tolmo skill. The skill teaches your coding agent the Tolmo CLI. The agent can then find findings, query the knowledge graph, and clone the affected repository.

​
Install the skill

The Tolmo skill is a Markdown command reference for compatible coding agents. It gives the CLI syntax for infrastructure queries, findings review, repository access, and connected services. The agent runs commands with your Tolmo credentials and permissions.
  1. Install the CLI and sign in.
  2. Install the skill and check it:
The installer writes the CLI reference and the finding-format guide to these files:
  • ~/.claude/skills/tolmo/SKILL.md
  • ~/.agents/skills/tolmo/SKILL.md
  • ~/.claude/skills/tolmo-finding-format/SKILL.md
  • ~/.agents/skills/tolmo-finding-format/SKILL.md
Claude Code reads ~/.claude/skills. Codex and other agents that follow the shared convention read ~/.agents/skills. Homebrew installs only the CLI binary. After a Homebrew install, run tolmo skill install.

​
What each skill does

​
What to ask your agent

After you install the skill, ask your agent in plain language. The agent selects the commands. For example:
  • “List my open critical and high findings and group them by repository.”
  • “Open the finding about the password reset endpoint, read the evidence, and fix it in this repo. Then tell me how to verify the fix.”
  • “Which of my findings touch this repository?”
  • “What new hosts did Tolmo see this week, and do any of them have open findings?”
  • “Clone the repository that serves api.example.com and find where POST /api/auth/reset-password is handled.”
Your agent reads data with your permissions. If you let it, your agent can also change the status of a finding. For example, it can set the status to In review after it opens a PR.
The skill tells your agent to use --intent on each graph query. Your audit log then records the purpose of each query. See SQL and Cypher.

​
Fix-and-retest workflow

The full workflow from a coding agent is:
  1. You tell your agent to fix a finding. The agent reads the evidence with tolmo findings get <id>. Or, you paste the fix prompt.
  2. The agent proposes the smallest change that closes the issue. Then it opens a PR.
  3. You move the finding to In review. You add the PR link.
  4. After the fix ships, you retest the finding. Green replays the original exploit. It confirms that the exploit no longer works.

​
Update the skill

After you update the CLI, install the bundled skill again:
tolmo skill status shows the installation state for each supported directory.