> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tolmo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrations catalog

> Every integration you can connect to Tolmo, what Tolmo reads through it, and what it unlocks.

Each integration sends data to the [production knowledge graph](https://docs.tolmo.com/knowledge-graph/overview.md). Tolmo crawls your connected sources again to find changes. The agents read the graph at the start of each run. Each integration that you add gives the agents more surface to test and more context for their findings.

The Red team agent needs at least one integration that discovers your attack surface. Start with a cloud provider. A cloud provider finds domains, hosts, and exposed services fastest. See [Connect an integration](https://docs.tolmo.com/integrations/connect.md).

## Cloud providers

Your cloud accounts are the main source of your attack surface: domains, hosts, load balancers, and exposed services.

| Provider | What Tolmo reads |
| - | - |
| AWS | Your AWS infrastructure, for security risks and misconfigurations |
| Google Cloud Platform (GCP) | Projects, folders, or a whole organization, through service account impersonation or a JSON key |
| Microsoft Azure | Subscriptions or management groups, through an app registration |
| Cloudflare | DNS records, zones, firewall rules, and security configuration |
| DigitalOcean | Your DigitalOcean infrastructure |
| OVHcloud | Public Cloud (including Kubernetes), dedicated servers, VPS, load balancers, IPs, and DNS |

## Source control

Tolmo uses your code to map applications and HTTP endpoints. Tolmo also links each finding to the code that causes it.

| Provider | What Tolmo reads |
| - | - |
| GitHub | Organizations, through a GitHub App installation, for repository analysis and code intelligence |
| GitLab | Groups, projects, repositories, merge requests, and branches |

## Hosting and infrastructure

| Provider | What Tolmo reads |
| - | - |
| Vercel | Projects, deployments, and security configuration |
| Heroku | Apps and platform resources, with read-only OAuth access |
| Fly.io | Organizations, apps, machines, networking, secrets, and identity |
| Railway | Workspaces, projects, services, and network exposure |
| Render | Deployed services, databases, and environment groups |
| Neon | Organizations, projects, databases, endpoints, and network security configuration |
| Supabase | Organizations, projects, auth configuration, and infrastructure posture |
| MongoDB Atlas | Organizations, projects, clusters, database users, network access, and encryption |
| Tailscale | Devices, users, ACL policy, DNS, and auth keys in a tailnet |
| Blaxel | Workspaces, deployed agents, MCP servers, model gateways, sandboxes, and connections |
| PyPI | Your packages and their new releases |

## Infrastructure as code

| Provider | What Tolmo reads |
| - | - |
| HCP Terraform | Workspaces, variables, teams, and policies |
| Pulumi Cloud | Organizations, stacks, and stack resources |

## Observability

Observability data tells Tolmo which services are live and who owns them.

| Provider | What Tolmo reads |
| - | - |
| Datadog | Monitors, hosts, users, and APM services. Also lets Tolmo [manage Datadog monitors](https://docs.tolmo.com/integrations/datadog-monitors.md). |
| Sentry | Projects and teams, linked to the repositories and services they monitor |
| New Relic | Accounts, monitored entities, and alert configuration |
| ClickHouse Cloud | Organizations, services, RBAC roles, and network security configuration |
| Honeycomb | Access to your Honeycomb environments |
| Anyshift | Lets Tolmo ask Annie, Anyshift's AI SRE, about your production |

## Security tools

Connect the security tools you already use. Tolmo reads their findings. The [Blue team agent](https://docs.tolmo.com/pentesting/third-party-findings.md) then proves or disproves each finding against your production.

| Provider | What Tolmo reads |
| - | - |
| Wiz | Cloud security findings |
| Snyk | Open-source, code, container, and IaC vulnerabilities |
| Aikido | SAST, open-source, secrets, IaC, container, and cloud issues |
| Socket | Supply-chain alerts: malware, typosquats, and risky dependencies |
| Upwind | Runtime threats, vulnerabilities, and posture findings |
| Corridor | Code-security findings, including pull-request findings |
| HackerOne | Bug bounty reports |
| Bugcrowd | Bug bounty submissions |
| Claude Security | Verified code-vulnerability findings, pushed to Tolmo through a signed webhook |
| Drata | Compliance posture: controls, monitoring tests, connections, personnel, and vendors |

## Ticketing

| Provider | What it unlocks |
| - | - |
| Linear | Create Linear issues from findings and sync their state. Tolmo also reads issues, projects, and teams. |
| Fibery | Create Fibery tickets from findings and sync their workflow state back to Tolmo |

See [Fix a finding](https://docs.tolmo.com/pentesting/fix.md).

## Messaging

| Provider | What it unlocks |
| - | - |
| Slack | Run results, new findings, and digests in the channels you choose. Mention the Tolmo bot in a channel to ask questions. |

See [Notifications](https://docs.tolmo.com/agents/notifications.md).

## Identity

| Provider | What Tolmo reads |
| - | - |
| Okta | Users, groups, app assignments, admin roles, and MFA posture. Connect-only for now: scanning is not available yet. |

## CI/CD

| Provider | What Tolmo reads |
| - | - |
| CircleCI | CI/CD context for your security workflows |
| Depot | Projects, builds, registries, caches, and usage |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.