Is Toknbase an AI agent or a secrets manager?

Both — the vault is the engine, the agent is the product. Toknbase is an AI SecOps agent that actively scans repos, fixes exposed secrets, opens PRs, verifies every fix, and logs each action with a tamper-evident on-chain receipt. The vault stores secrets with zero-knowledge encryption so even the agent cannot read the values it protects.

What can the AI SecOps agent do?

The agent scans public and private GitHub repos for exposed credentials, monitors continuously on every new commit, proposes fix PRs to replace hardcoded secrets with secure runtime calls, verifies fixes are gone after application, checks whether found credentials have appeared in known breach databases, and sends a weekly CISO briefing with your full security posture. Every action is logged on-chain with a cryptographic receipt.

Can Toknbase — or its employees — read my secrets?

No. Client-side encryption means we store only ciphertext. We never have your encryption key. Even a Toknbase engineer with direct canister access would only see encrypted bytes. This is a cryptographic guarantee, not a policy promise.

How do I use Toknbase with AI agents like Claude or Cursor?

Toknbase provides a hosted MCP (Model Context Protocol) endpoint at https://4wj64-piaaa-aaaan-q5q7q-cai.icp0.io/mcp. Add it to your Claude Desktop, Cursor, or Windsurf config as a JSON block — no installation, no npm package, no local server required.

What is the pricing for Toknbase?

Toknbase offers three plans: Free ($0 — 1 seat, 50 secrets, 3 scans/month, free forever), Pro ($19.99/seat/month or $15.99/seat/month billed annually — unlimited seats, private repo scanning, AI auto-remediation, full MCP endpoint, pre-commit hook), and Enterprise ($499.99/month flat — everything in Pro plus SSO/SAML, custom detectors, dedicated support, DPA, and 99.9% SLA). Annual billing saves 20% on Pro.

Can I change plans at any time?

Yes — upgrade, downgrade, or cancel at any time. Upgrades take effect immediately. Downgrades apply at the next billing cycle.

Is there a free trial?

The Free plan is free forever and includes public repo scanning and an on-chain audit trail — no credit card required. Pro and Enterprise plans can be started immediately with a paid subscription.

How does Toknbase compare to Doppler or HashiCorp Vault?

Three key differences: (1) It's an AI agent, not a passive vault — it actively watches repos, finds leaks, and opens fix PRs without being asked. (2) Zero-knowledge encryption — Toknbase cryptographically cannot read your secrets, even under subpoena. (3) On-chain audit trail — every agent action has a tamper-evident cryptographic receipt. No other secrets management tool provides all three.

How is Toknbase different from using .env files?

.env files store secrets on disk in plaintext and are frequently committed to version control by accident. Toknbase encrypts secrets in your browser before they leave your device, stores only ciphertext, actively scans your repos for accidentally exposed values, and can automatically open a fix PR when it finds one. It's a proactive agent, not a static file.

Can Toknbase scan private GitHub repos?

Yes. Public repos can be scanned instantly with no signup. To scan private repos, connect your GitHub account via OAuth — Toknbase requests the minimum required permissions and uses a short-lived access token. Private repo scanning is included in the Pro plan.

What happens if a secret is exposed in an old commit?

Removing a secret from a file does not remove it from git history — anyone with access to the repository can still find it in old commits. Toknbase scans git history for exposed secrets, not just the current state of the code. When it finds one, it flags it as a historical exposure and recommends rotating the credential immediately, since it must be treated as compromised.

Setting up a full CI/CD pipeline?See the Pipeline Integration guide →

Installation Authentication Commands CI/CD Integration Environment Variables What's Next

// @toknbase/cli

CLI Reference

The Toknbase CLI lets you fetch, store, and export secrets from any terminal or pipeline script. Zero config — authenticate once with an agent token and you're ready.

@toknbase/cliNode.js 18+ESM

Installation

Install globally to use thetoknbasecommand anywhere, or usenpxfor one-off runs without installing.

Global install (recommended)

npm install -g @toknbase/cli

One-off via npx (no install required)

npx @toknbase/cli@latest get MY_SECRET

Verify installation

toknbase --version

No daemon or background process

Each CLI command is a single, stateless HTTP call to the Toknbase canister. Nothing runs in the background and no ports are opened.

Authentication

The CLI authenticates using a scopedagent token. Tokens are created in theAI Agentssection of your dashboard.

Create an agent token

Navigate toAI Agentsand create a new token. For most CLI use cases, chooseread_writescope so you can both fetch and set secrets.

!The token is shown only once. Copy it immediately and store it securely.

Set the environment variable

For this session only

export TOKNBASE_AGENT_TOKEN=agt_your_token_here

Persist in shell profile (~/.zshrc or ~/.bashrc)

echo 'export TOKNBASE_AGENT_TOKEN=agt_your_token_here' >> ~/.zshrc
source ~/.zshrc

Never commit your agt_token to source control. Use your shell profile or a secrets manager for persistent storage.

Verify authentication works

toknbase list

Should return your secrets list (or an empty array if you have no secrets yet).

Commands

Command reference

toknbase get NAME

Print the value of a single secret

read_only

toknbase list

List all secrets (names + environments, no values)

read_only

toknbase set NAME VALUE

Create or update a secret

read_write

toknbase export

Dump all secrets in .env format

read_only

get

read_only

Prints the raw value of a single secret to stdout. Designed for shell substitution — the output contains only the value with no extra formatting.

toknbase get MY_SECRET

Shell substitution (most common use case)

export STRIPE_KEY=$(toknbase get STRIPE_SECRET_KEY)
npm run deploy

Pass directly to a command

STRIPE_KEY=$(toknbase get STRIPE_SECRET_KEY) node server.js

list

read_only

Lists all secrets accessible to the current token. Returns names, environments, and descriptions — never plaintext values.

toknbase list

Example output:

NAME ENVIRONMENT DESCRIPTION
STRIPE_SECRET_KEY production Stripe live secret key
STRIPE_WEBHOOK_SECRET production Stripe webhook signing secret
OPENAI_API_KEY production OpenAI API key
DATABASE_URL staging Postgres connection string

set

read_write

Creates a new secret or updates an existing one. If the named secret already exists, its value is updated. Requiresread_writeorfull_accessscope.

toknbase set MY_SECRET my-secret-value

Quote values with spaces or special characters

toknbase set DATABASE_URL"postgres://user:pass@host:5432/db"

Pipe value from another command

openssl rand -hex 32 | toknbase set APP_SECRET

export

read_only

Dumps all accessible secrets in.envformat (KEY=VALUE per line). Suitable for piping into a file or sourcing directly into the current shell.

toknbase export

Write to a .env file

toknbase export > .env

Source directly into the current shell session

source <(toknbase export)

Filter by environment (coming soon)

toknbase export --env production > .env.production

!Never commit the output oftoknbase export to source control. Add .env to your.gitignore.

CI/CD Integration

The CLI is a drop-in replacement forcurl | jqcalls in pipeline scripts. Install it in your pipeline runner and calltoknbase getortoknbase exportto inject secrets.

GitHub Actions

.github/workflows/deploy.yml

Store your agent token as a GitHub Actions secret namedTOKNBASE_AGENT_TOKEN.

Pattern 1 — export entire vault as .env

name: Deploy
on: [push]
jobs:
 deploy:
 runs-on: ubuntu-latest
 steps:
 - uses: actions/checkout@v4
 - uses: actions/setup-node@v4
 with:
 node-version: 20
 - name: Install Toknbase CLI
 run: npm install -g @toknbase/cli
 - name: Load secrets
 run: toknbase export >> $GITHUB_ENV
 env:
 TOKNBASE_AGENT_TOKEN: ${{ secrets.TOKNBASE_AGENT_TOKEN }}
 - name: Build & Deploy
 run: npm ci && npm run deploy

Pattern 2 — single secret via $GITHUB_OUTPUT

 - name: Fetch Stripe key
 id: secrets
 run: echo"STRIPE_KEY=$(toknbase get STRIPE_SECRET_KEY)" >> $GITHUB_OUTPUT
 env:
 TOKNBASE_AGENT_TOKEN: ${{ secrets.TOKNBASE_AGENT_TOKEN }}
 - name: Deploy
 env:
 STRIPE_KEY: ${{ steps.secrets.outputs.STRIPE_KEY }}
 run: npm run deploy

GitLab CI

.gitlab-ci.yml

build:
 image: node:20
 script:
 - npm install -g @toknbase/cli
 - toknbase export > .env
 - source .env && npm ci && npm run build
 artifacts:
 paths:
 - dist/

CircleCI

.circleci/config.yml

jobs:
 build:
 docker:
 - image: cimg/node:20.0
 steps:
 - checkout
 - run:
 name: Load secrets
 command: |
 npm install -g @toknbase/cli
 toknbase export >> $BASH_ENV
 - run:
 name: Build
 command: npm ci && npm run build

Full platform coverage

For Vercel, Bitbucket Pipelines, and more — including the rawcurlendpoint alternative — see thePipeline Integration guide.

Environment Variables

All configuration is passed via environment variables. Only the agent token is required — the rest are optional overrides.

Configuration

TOKNBASE_AGENT_TOKEN

required

Your agt_ agent token from the AI Agents dashboard.

TOKNBASE_CANISTER_ID

optional

Override the canister ID. Only needed for custom deployments.

Default:4wj64-piaaa-aaaan-q5q7q-cai

TOKNBASE_IC_HOST

optional

Override the Internet Computer boundary node. Defaults to icp-api.io.

Default:https://icp-api.io

What's next

Go further with Toknbase

Pipeline Integration

Full CI/CD guides for all major platforms.

AI Agents & MCP

Connect Cursor, Claude Code, and other AI editors.

Quickstart

Store your first secret in 5 minutes.

Tip

Use toknbase export for local development only — not in CI/CD pipelines. For pipelines, use the REST endpoint directly to avoid writing secrets to disk.

Was this page helpful?