Skip to main content
Use tolmo red-agent to operate the Red team agent from a terminal or a pipeline. It sends the same requests as the Red team agent page in the web app, so a change you make here shows up there. tolmo red is an alias. For what the agent does and how it tests, see How the Red team agent tests. Every subcommand accepts --org, --profile, and --json.
Starting a run and changing the schedule require an organization admin or an organization API key.

​
Check readiness

Readiness reports whether the agent has what it needs to run: A run also needs at least one domain with offensive testing enabled. To finish setup, see Define scope: domains and test accounts.

​
Start a run now

This starts the same whole-organization run as Start run in the web app. It tests every authorized domain. The output names the scan ID and the workflow ID of the new run. An on-demand run is in addition to the schedule. It does not replace or move the next scheduled run.

​
Set the schedule

The schedule keeps testing going as production changes. See Keep up with production changes for how to choose a cadence.
tolmo red-agent schedule without a subcommand is the same as schedule get. schedule set creates or replaces the schedule with these flags: pause stops scheduled runs without deleting the schedule. resume turns it back on. If Tolmo manages a testing campaign for your organization, you can pause it but not delete it.

​
Manage test accounts

Test accounts let the agent sign in and test what a signed-in user can reach. tolmo red-agent test-accounts is an alias for accounts.
Secrets never go on the command line. Pass them with --secret-file or --totp-seed-file (use - to read from stdin), or inside a --file JSON body. list and get never return a secret.

​
Account flags

create and update accept these flags. On update, a flag you do not pass leaves that field unchanged. create also accepts --file (-f): a JSON body in the API’s shape, or an array of bodies to create several accounts at once. update also accepts --clear-notes-private and --clear-domains.

​
List runs

Each JSON response contains items and total. Increase --offset to get the next pages. For the same history in the web app, see Mission Control and agent runs.

​
Blue Agent runs

The Blue team agent validates findings from your other security tools. List and inspect its runs with tolmo blue-agent:
blue-agent runs accepts the same filters as red-agent runs. It also accepts --scope for comma-separated target hostnames and --search for a run ID or workflow ID. The show identifier can be a scan ID, a RUN- prefix, or a workflow ID. The detail view shows the run’s execution stages. A completed run does not by itself mean a finding was confirmed. Review the result and the linked finding with tolmo findings. See Validate the findings you already have for what the Blue team agent does.