Integrations catalog

Each integration sends data to the production knowledge graph. Tolmo crawls your connected sources again to find changes. The agents read the graph at the start of each run. Each integration that you add gives the agents more surface to test and more context for their findings. The Red team agent needs at least one integration that discovers your attack surface. Start with a cloud provider. A cloud provider finds domains, hosts, and exposed services fastest. See Connect an integration.

Cloud providers

Your cloud accounts are the main source of your attack surface: domains, hosts, load balancers, and exposed services.

Provider	What Tolmo reads
AWS	Your AWS infrastructure, for security risks and misconfigurations
Google Cloud Platform (GCP)	Projects, folders, or a whole organization, through service account impersonation or a JSON key
Microsoft Azure	Subscriptions or management groups, through an app registration
Cloudflare	DNS records, zones, firewall rules, and security configuration
DigitalOcean	Your DigitalOcean infrastructure
OVHcloud	Public Cloud (including Kubernetes), dedicated servers, VPS, load balancers, IPs, and DNS

Source control

Tolmo uses your code to map applications and HTTP endpoints. Tolmo also links each finding to the code that causes it.

Provider	What Tolmo reads
GitHub	Organizations, through a GitHub App installation, for repository analysis and code intelligence
GitLab	Groups, projects, repositories, merge requests, and branches

Hosting and infrastructure

Provider	What Tolmo reads
Vercel	Projects, deployments, and security configuration
Heroku	Apps and platform resources, with read-only OAuth access
Fly.io	Organizations, apps, machines, networking, secrets, and identity
Railway	Workspaces, projects, services, and network exposure
Render	Deployed services, databases, and environment groups
Neon	Organizations, projects, databases, endpoints, and network security configuration
Supabase	Organizations, projects, auth configuration, and infrastructure posture
MongoDB Atlas	Organizations, projects, clusters, database users, network access, and encryption
Tailscale	Devices, users, ACL policy, DNS, and auth keys in a tailnet
Blaxel	Workspaces, deployed agents, MCP servers, model gateways, sandboxes, and connections
PyPI	Your packages and their new releases

Infrastructure as code

Provider	What Tolmo reads
HCP Terraform	Workspaces, variables, teams, and policies
Pulumi Cloud	Organizations, stacks, and stack resources

Observability

Observability data tells Tolmo which services are live and who owns them.

Provider	What Tolmo reads
Datadog	Monitors, hosts, users, and APM services. Also lets Tolmo manage Datadog monitors.
Sentry	Projects and teams, linked to the repositories and services they monitor
New Relic	Accounts, monitored entities, and alert configuration
ClickHouse Cloud	Organizations, services, RBAC roles, and network security configuration
Honeycomb	Access to your Honeycomb environments
Anyshift	Lets Tolmo ask Annie, Anyshift’s AI SRE, about your production

Security tools

Connect the security tools you already use. Tolmo reads their findings. The Blue team agent then proves or disproves each finding against your production.

Provider	What Tolmo reads
Wiz	Cloud security findings
Snyk	Open-source, code, container, and IaC vulnerabilities
Aikido	SAST, open-source, secrets, IaC, container, and cloud issues
Socket	Supply-chain alerts: malware, typosquats, and risky dependencies
Upwind	Runtime threats, vulnerabilities, and posture findings
Corridor	Code-security findings, including pull-request findings
HackerOne	Bug bounty reports
Bugcrowd	Bug bounty submissions
Claude Security	Verified code-vulnerability findings, pushed to Tolmo through a signed webhook
Drata	Compliance posture: controls, monitoring tests, connections, personnel, and vendors

Ticketing

Provider	What it unlocks
Linear	Create Linear issues from findings and sync their state. Tolmo also reads issues, projects, and teams.
Fibery	Create Fibery tickets from findings and sync their workflow state back to Tolmo

See Fix a finding.

Messaging

Provider	What it unlocks
Slack	Run results, new findings, and digests in the channels you choose. Mention the Tolmo bot in a channel to ask questions.

See Notifications.

Identity

Provider	What Tolmo reads
Okta	Users, groups, app assignments, admin roles, and MFA posture. Connect-only for now: scanning is not available yet.

CI/CD

Provider	What Tolmo reads
CircleCI	CI/CD context for your security workflows
Depot	Projects, builds, registries, caches, and usage

Get started

Continuous pentesting

Agentic platform

Production knowledge graph

Integrations

Integrations catalog

Cloud providers

Source control

Hosting and infrastructure

Infrastructure as code

Observability

Security tools

Ticketing

Messaging

Identity

CI/CD

​Cloud providers

​Source control

​Hosting and infrastructure

​Infrastructure as code

​Observability

​Security tools

​Ticketing

​Messaging

​Identity

​CI/CD

Cloud providers

Source control

Hosting and infrastructure

Infrastructure as code

Observability

Security tools

Ticketing

Messaging

Identity

CI/CD