> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tolmo.com/llms.txt
> Use this file to discover all available pages before exploring further.
# How Tolmo works
> Tolmo watches production through your connected accounts, tests your authorized domains, proves which issues are exploitable, and retests your fixes.
Tolmo operates one loop: watch, test, prove, fix, and retest. Each feature in these docs belongs to one step of this loop. **Mission Control** shows the full loop in one view.
The Tolmo platform. Mission Control receives production events and sends work to the agents. The agents read the production knowledge graph and produce findings.
```mermaid theme={null}
flowchart LR
W[Watch
knowledge graph] --> T[Test
Red and Blue agents]
T --> P[Prove
live re-exploit]
P --> F[Fix
fix prompt, ticket, PR]
F --> R[Retest
Green agent, on demand]
R --> W
```
## Mission Control: the loop in one view
Mission Control is the place where you monitor Tolmo. It shows three things:
* **The changes in production.** Each new finding, security alert, code event, CI event, or cloud resource change appears as an event when it occurs.
* **The agents that act on each change.** Each event shows the agents that examine it, and if they are done.
* **The result of each run.** **Agent Runs** keeps the history of all Red, Blue, and Green runs, with the trigger, the status, and the result.
Mission Control. The histogram shows production events over time. Each row shows one event, the agents that work on it, and its findings.
Use the findings list to decide what to fix. Use Mission Control to see what changed in production and what your agents did about it.
> [card] [Mission Control and agent runs](https://docs.tolmo.com/agents/mission-control.md)
>
> Filter the activity feed, examine a run, and read run history from the CLI.
## Watch
You connect your cloud, code, observability, and security accounts. Tolmo crawls these accounts and builds the [production knowledge graph](https://docs.tolmo.com/knowledge-graph/overview.md).
The graph shows your assets and the connections between them. Your assets include:
* Domains and hosts
* Applications and HTTP endpoints
* Datastores and cloud resources
The graph records when Tolmo first saw each asset and when Tolmo last saw it. Tolmo uses these records to find new hosts, endpoints, and resources. Each change appears as an event in Mission Control.
## Test
The **Red team agent** tests your authorized domains the way an outside attacker does. An authorized domain is a domain that has offensive testing enabled. Tolmo starts a Red run on your daily or weekly schedule. You can also start a run at any time.
Each Red run reads the current graph. Thus, the next run tests all new hosts and endpoints under an authorized domain.
The **Blue team agent** examines findings from your other security tools, for example Wiz or Snyk. When a finding arrives, Blue tries to exploit it. Blue examines only the findings that match your severity and origin rules.
Each Red and Blue run appears in Mission Control while it runs, and stays in **Agent Runs** after it ends.
[Keep up with production changes](https://docs.tolmo.com/pentesting/production-changes.md) shows which agent reacts to each type of change, and how quickly.
## Prove
A verifier exploits each issue again against the live target. The verifier keeps the request and the response that exploited the issue. Only then does Tolmo mark the finding as validated.
Sometimes the agents cannot decide if an issue is real. In this case, Tolmo holds the issue as **Needs review**. A person on your team makes the decision.
See [Understand a finding](https://docs.tolmo.com/pentesting/findings.md).
## Fix
Each finding includes these items:
* What happened, and why it is important
* The evidence
* A recommended fix
To fix the issue, give the fix prompt to Claude Code, Codex, Cursor, or another coding agent. You can also create a Linear or Fibery ticket. When a pull request is open, move the finding to **In review** and attach the PR URL.
Tolmo does not modify your code. You decide what to ship. See [Fix a finding](https://docs.tolmo.com/pentesting/fix.md).
## Retest
After you ship the fix, retest the finding. Tolmo replays the stored attack against production. When the attack fails, Tolmo resolves the finding. The Green run that does the retest appears in Mission Control. See [Retest a fix](https://docs.tolmo.com/pentesting/retest.md).
## Where you work with Tolmo
| Surface | Use it to |
| - | - |
| **Web app** | Monitor changes and agent activity in [Mission Control](https://docs.tolmo.com/agents/mission-control.md). Set up scope, review findings, and retest fixes. |
| **Slack and email** | Receive new findings, a daily or weekly digest, and an alert when an agent starts a run. See [Notifications](https://docs.tolmo.com/agents/notifications.md). |
| **Your coding agent** | Paste fix prompts. You can also install the Tolmo skill, so that the agent can read findings. See [Use Tolmo from your coding agent](https://docs.tolmo.com/agents/coding-agents.md). |
| **CLI and API** | Automate runs, triage, and queries. See the [CLI](https://docs.tolmo.com/cli/installation.md) and the [API reference](https://docs.tolmo.com/api-reference/introduction.md). |
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.