Skip to main content
Tolmo proves the vulnerability and gives you the information to fix it. Tolmo does not change your code. You make the change, and you decide what to ship.

​
Copy the fix prompt into your coding agent

Each finding has a fix prompt. When you copy the fix prompt, Tolmo puts the full finding on your clipboard as one instruction for a coding agent.
The action row of an opened finding, with Copy fix prompt as the primary button next to Open in Findings.

Copy the fix prompt from a finding.

Paste the prompt into Claude Code, Codex, Cursor, or a different coding agent. Use the agent in the repository that serves the affected endpoint. The prompt tells the agent to do these steps:
  1. Find the code or infrastructure-as-code that causes the finding.
  2. Make the smallest safe fix. Do not change the live infrastructure.
  3. Add or update focused tests, and run the related checks.
  4. Work on a new branch, and open a pull request if possible.
The prompt contains the summary, the evidence, the root cause, and the proposed fixes. Markers surround the text of the finding. The markers tell the agent to use the text as untrusted data. This protects you if an attacker wrote some of the text in a report. The prompt contains all the information that the agent needs. Thus, the person who receives the prompt does not need access to Tolmo. If the tolmo CLI is installed and signed in, the agent can also run tolmo findings get <finding-id>. This command gets the latest information about the finding.
Install the Tolmo skill. With the skill, your coding agent knows how to use the CLI. See Use Tolmo from your coding agent.

​
Track the fix

When you start the fix, move the finding to In review. You can add the pull request URL and a note for your team. After you ship the fix, retest the finding. The retest proves that the exploit does not work now. To close a finding or mark it as a false positive, you must give a justification. The justification stays on the finding for the next person who reads it. To move a finding to In review from the CLI, use this command:
See the findings command reference.

​
Create tickets

If you connected Linear or Fibery, you can create tickets for one or more findings at the same time. Each ticket links to the finding, its evidence, and its fix prompt. The finding shows the link to its ticket. Tolmo does not create a ticket for a finding that already has a ticket.

​
Export a pentest report

You can export findings as a PDF report for auditors or customers. Select the findings and a date range. To keep that exact PDF for your organization, save the report.

​
Next steps

Retest a fix

Prove that the exploit does not work now.

Use Tolmo from your coding agent

Install the Tolmo skill for Claude Code, Codex, and other agents.