> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tolmo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Agents overview

> Tolmo's security agents test production, validate findings from your other tools, and recheck fixes. All agents use one findings model and one scope.

Tolmo has three security agents. Each agent has one job. The agents send findings to each other:

| Agent | Its job | When it runs |
| - | - | - |
| **Red team agent** | Pentests your apps. It attacks your authorized domains from the outside. It reports only the issues that it can exploit. | On its schedule, or on demand |
| **Blue team agent** | Verifies new findings from your other security tools. For each finding, it gives a proof of exploitation or a reasoned "not exploitable". | When a matching finding arrives, or on a schedule that you set |
| **Green team agent** | Rechecks exploited findings. It finds out if the issue is still present. | When you retest a finding that has a working exploit |

## How the agents work together

![Platform diagram. The production knowledge graph is the data plane. Mission Control is the control plane and receives production events such as deployments and code changes. Mission Control sends work to a group of agents. The agents read the knowledge graph and produce findings and threats.](https://mintcdn.com/tolmo/7vlOnd-Q0dNpaHkM/images/platform/overview.png?fit=max\&auto=format\&n=7vlOnd-Q0dNpaHkM\&q=85\&s=8509f3f20c7d3945deecea243e580056)

The Tolmo platform. Mission Control receives production events and sends work to the agents. The agents read the production knowledge graph and produce findings.

```mermaid theme={null}
flowchart LR
  R[Red proves an exploit] --> F[One finding]
  B[Blue proves a third-party alert] --> F
  F --> X[You fix it]
  X --> G[Green rechecks]
```

A finding is one record. This is true for all agents. For example, Blue can prove a Wiz alert, or Green can recheck a Red finding. In both cases, the runs attach to the same finding. You do not have to merge duplicate findings from different agents.

All agents also use the same scope. The scope contains the authorized domains, the test accounts, and the instructions. When you revoke a domain, the next run of each agent does not test it. See [Define scope](https://docs.tolmo.com/pentesting/scope.md).

A finding gets the validated status only after an agent reproduces it. The agent also keeps the request that worked.

## Configure the agents

These settings apply to all agents:

| Setting | What it controls |
| - | - |
| **Scope** | The hostnames that the agents can test. |
| **Credentials** | The test logins that the agents can use. |
| **Other instructions** | Notes that the agents read on each run. |
| **Allow state-changing requests** | Whether the agents can send `PUT`, `PATCH`, or `DELETE` requests. |
| **Notifications** | Where Tolmo announces new findings and agent activity. |

**Triggers** start the agents automatically. The triggers are the Red schedule and the rules that start Blue. To select triggers, see [Keep up with production changes](https://docs.tolmo.com/pentesting/production-changes.md).

## Monitor the agents

[Mission Control](https://docs.tolmo.com/agents/mission-control.md) shows the current work and the past work of your agents. [Notifications](https://docs.tolmo.com/agents/notifications.md) tell you in Slack or email when a finding needs attention.

## Use your own coding agent

After Tolmo proves a problem, your coding agent can write the fix. Install the Tolmo skill on Claude Code, Codex, or another compatible agent. Then the agent can read your findings and query your production. See [Use Tolmo from your coding agent](https://docs.tolmo.com/agents/coding-agents.md).

## Background assessments

Tolmo also runs background assessments on the [knowledge graph](https://docs.tolmo.com/knowledge-graph/overview.md). For example, an assessment classifies the data in a datastore. These assessments keep the graph current when production changes. You do not configure them. They do not touch your applications.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.