Is Toknbase an AI agent or a secrets manager?

Both — the vault is the engine, the agent is the product. Toknbase is an AI SecOps agent that actively scans repos, fixes exposed secrets, opens PRs, verifies every fix, and logs each action with a tamper-evident on-chain receipt. The vault stores secrets with zero-knowledge encryption so even the agent cannot read the values it protects.

What can the AI SecOps agent do?

The agent scans public and private GitHub repos for exposed credentials, monitors continuously on every new commit, proposes fix PRs to replace hardcoded secrets with secure runtime calls, verifies fixes are gone after application, checks whether found credentials have appeared in known breach databases, and sends a weekly CISO briefing with your full security posture. Every action is logged on-chain with a cryptographic receipt.

Can Toknbase — or its employees — read my secrets?

No. Client-side encryption means we store only ciphertext. We never have your encryption key. Even a Toknbase engineer with direct canister access would only see encrypted bytes. This is a cryptographic guarantee, not a policy promise.

How do I use Toknbase with AI agents like Claude or Cursor?

Toknbase provides a hosted MCP (Model Context Protocol) endpoint at https://4wj64-piaaa-aaaan-q5q7q-cai.icp0.io/mcp. Add it to your Claude Desktop, Cursor, or Windsurf config as a JSON block — no installation, no npm package, no local server required.

What is the pricing for Toknbase?

Toknbase offers three plans: Free ($0 — 1 seat, 50 secrets, 3 scans/month, free forever), Pro ($19.99/seat/month or $15.99/seat/month billed annually — unlimited seats, private repo scanning, AI auto-remediation, full MCP endpoint, pre-commit hook), and Enterprise ($499.99/month flat — everything in Pro plus SSO/SAML, custom detectors, dedicated support, DPA, and 99.9% SLA). Annual billing saves 20% on Pro.

Can I change plans at any time?

Yes — upgrade, downgrade, or cancel at any time. Upgrades take effect immediately. Downgrades apply at the next billing cycle.

Is there a free trial?

The Free plan is free forever and includes public repo scanning and an on-chain audit trail — no credit card required. Pro and Enterprise plans can be started immediately with a paid subscription.

How does Toknbase compare to Doppler or HashiCorp Vault?

Three key differences: (1) It's an AI agent, not a passive vault — it actively watches repos, finds leaks, and opens fix PRs without being asked. (2) Zero-knowledge encryption — Toknbase cryptographically cannot read your secrets, even under subpoena. (3) On-chain audit trail — every agent action has a tamper-evident cryptographic receipt. No other secrets management tool provides all three.

How is Toknbase different from using .env files?

.env files store secrets on disk in plaintext and are frequently committed to version control by accident. Toknbase encrypts secrets in your browser before they leave your device, stores only ciphertext, actively scans your repos for accidentally exposed values, and can automatically open a fix PR when it finds one. It's a proactive agent, not a static file.

Can Toknbase scan private GitHub repos?

Yes. Public repos can be scanned instantly with no signup. To scan private repos, connect your GitHub account via OAuth — Toknbase requests the minimum required permissions and uses a short-lived access token. Private repo scanning is included in the Pro plan.

What happens if a secret is exposed in an old commit?

Removing a secret from a file does not remove it from git history — anyone with access to the repository can still find it in old commits. Toknbase scans git history for exposed secrets, not just the current state of the code. When it finds one, it flags it as a historical exposure and recommends rotating the credential immediately, since it must be treated as compromised.

What does Toknbase scan for?

Toknbase scans for exposed credentials, API keys, tokens, and secrets hardcoded in source code, config files, CI/CD workflows, and git history. This includes AWS keys, Stripe keys, OpenAI API keys, GitHub tokens, database connection strings, private keys, and OAuth tokens.

Does Toknbase scan for code vulnerabilities?

No. Toknbase specializes in credential exposure detection and remediation. For code-level vulnerability scanning, tools like Snyk or Semgrep are the right choice. Most teams use both.

How is Toknbase different from Doppler or Infisical?

Doppler and Infisical store secrets. Toknbase finds exposed credentials across your repos, fixes them automatically, monitors continuously, and logs every action on-chain. It's the agent that closes the gap.

Developer Documentation

Build with Toknbase

Everything you need to integrate the AI SecOps agent into your stack — MCP, REST API, CLI, CI/CD, and GitHub integrations.

Start here

Recommended

MCP Integration

The fastest path for AI agents. Connect Cursor, Claude, Windsurf, or VS Code with one config block.

Get started

GitHub Actions

Scan every PR automatically. Add credential exposure detection as a required check in under 5 minutes.

Get started

REST API

Full programmatic access. Every Toknbase capability available via authenticated HTTP endpoints.

Get started

All documentation

Quickstart

5 min

Store your first secret and connect an AI editor — 5 min.

MCP Configuration

Hosted MCP endpoint setup for all major AI clients.

CLI Reference

Get, set, export secrets from the terminal. CI-friendly, stateless.

CI/CD Integration

GitHub Actions, GitLab CI, CircleCI, and Vercel.

API Reference

REST endpoints with examples and interactive playground.

What We Scan

Credential exposure detection — what Toknbase finds and what it doesn't.

Getting started

Generate an agent token

Dashboard → Tokens → Service Identities → Create new token. Select MCP scope. Copy — it's shown only once.

Add the MCP config to your AI client

Paste the config block into your editor's MCP settings with the Authorization header. Replace YOUR_AGENT_TOKEN with your token.

Connect your GitHub repos

Go to Scanner → Connect GitHub. The agent begins scanning immediately — full git history, all branches, CI/CD configs.

The agent watches, fixes, and logs everything

Continuous monitoring. Auto-remediation PRs. Every action logged on-chain with a tamper-evident receipt.

Note

Credential exposure detection — not code vulnerability scanning.Toknbase finds exposed API keys, tokens, and secrets in your repos. It does not scan for SQL injection, CVEs, or insecure code patterns. For code-level vulnerability scanning, Snyk and Semgrep complement Toknbase perfectly.

Tip

All secrets are encrypted with AES-256-GCM in your browser before leaving your device. Every agent action is logged on-chain with a tamper-evident receipt. Even Toknbase cannot read your secrets.

Was this page helpful?