Is Toknbase an AI agent or a secrets manager?

Both — the vault is the engine, the agent is the product. Toknbase is an AI SecOps agent that actively scans repos, fixes exposed secrets, opens PRs, verifies every fix, and logs each action with a tamper-evident on-chain receipt. The vault stores secrets with zero-knowledge encryption so even the agent cannot read the values it protects.

What can the AI SecOps agent do?

The agent scans public and private GitHub repos for exposed credentials, monitors continuously on every new commit, proposes fix PRs to replace hardcoded secrets with secure runtime calls, verifies fixes are gone after application, checks whether found credentials have appeared in known breach databases, and sends a weekly CISO briefing with your full security posture. Every action is logged on-chain with a cryptographic receipt.

Can Toknbase — or its employees — read my secrets?

No. Client-side encryption means we store only ciphertext. We never have your encryption key. Even a Toknbase engineer with direct canister access would only see encrypted bytes. This is a cryptographic guarantee, not a policy promise.

How do I use Toknbase with AI agents like Claude or Cursor?

Toknbase provides a hosted MCP (Model Context Protocol) endpoint at https://4wj64-piaaa-aaaan-q5q7q-cai.icp0.io/mcp. Add it to your Claude Desktop, Cursor, or Windsurf config as a JSON block — no installation, no npm package, no local server required.

What is the pricing for Toknbase?

Toknbase offers three plans: Free ($0 — 1 seat, 50 secrets, 3 scans/month, free forever), Pro ($19.99/seat/month or $15.99/seat/month billed annually — unlimited seats, private repo scanning, AI auto-remediation, full MCP endpoint, pre-commit hook), and Enterprise ($499.99/month flat — everything in Pro plus SSO/SAML, custom detectors, dedicated support, DPA, and 99.9% SLA). Annual billing saves 20% on Pro.

Can I change plans at any time?

Yes — upgrade, downgrade, or cancel at any time. Upgrades take effect immediately. Downgrades apply at the next billing cycle.

Is there a free trial?

The Free plan is free forever and includes public repo scanning and an on-chain audit trail — no credit card required. Pro and Enterprise plans can be started immediately with a paid subscription.

How does Toknbase compare to Doppler or HashiCorp Vault?

Three key differences: (1) It's an AI agent, not a passive vault — it actively watches repos, finds leaks, and opens fix PRs without being asked. (2) Zero-knowledge encryption — Toknbase cryptographically cannot read your secrets, even under subpoena. (3) On-chain audit trail — every agent action has a tamper-evident cryptographic receipt. No other secrets management tool provides all three.

How is Toknbase different from using .env files?

.env files store secrets on disk in plaintext and are frequently committed to version control by accident. Toknbase encrypts secrets in your browser before they leave your device, stores only ciphertext, actively scans your repos for accidentally exposed values, and can automatically open a fix PR when it finds one. It's a proactive agent, not a static file.

Can Toknbase scan private GitHub repos?

Yes. Public repos can be scanned instantly with no signup. To scan private repos, connect your GitHub account via OAuth — Toknbase requests the minimum required permissions and uses a short-lived access token. Private repo scanning is included in the Pro plan.

What happens if a secret is exposed in an old commit?

Removing a secret from a file does not remove it from git history — anyone with access to the repository can still find it in old commits. Toknbase scans git history for exposed secrets, not just the current state of the code. When it finds one, it flags it as a historical exposure and recommends rotating the credential immediately, since it must be treated as compromised.

What does"Unable to authenticate" mean in Toknbase MCP?

This error has three causes: (1) Missing Authorization header — your hosted MCP config must include headers: { Authorization: 'Bearer YOUR_AGENT_TOKEN' }. (2) Token with wrong scope — limited scope tokens fail silently; the token needs full_access or MCP-enabled scope. (3) Expired or revoked token — check Dashboard → Tokens for token status.

What does IC0536 mean in Toknbase?

IC0536 means 'method not found on canister'. This usually means you're using an outdated MCP server version. Update to @toknbase/mcp-server@1.7.0, or use the hosted endpoint which is always up to date.

Why is my Toknbase agent token returning 403?

A 403 error means your token exists but lacks the required scope for the operation. Check the token scope in Dashboard → Tokens. You may need read_write or full_access scope. Also check if the secret is in a folder your token is restricted from accessing.

REFERENCE

Error Reference

A complete reference for all error codes you may encounter when using Toknbase. IC host for all connections:https://icp-api.io

Auth Errors Common Errors HTTP Errors Agent Token Errors MCP Errors

Tip

Most errors include a human-readable message. If you're seeing a raw trap message, check the troubleshooting section at the bottom or contactsupport@toknbase.net.

Auth Errors

Most common

Unable to authenticateMCP server returns authentication failure

Cause

The Authorization header is missing from your hosted MCP config, the token has the wrong scope, or the token is expired/revoked.

Fix

1. Confirm your config includes headers: { Authorization: 'Bearer YOUR_AGENT_TOKEN' }. 2. Ensure the token has full_access or MCP-enabled scope — limited scope tokens fail silently. 3. Check Dashboard → Tokens for token status.

401 UnauthorizedMissing or invalid Authorization header

Cause

The request was made without an Authorization header, or with a malformed token value.

Fix

Every request must include: Authorization: Bearer YOUR_AGENT_TOKEN. Create tokens in Dashboard → Tokens → Service Identities.

403 ForbiddenToken exists but lacks permission

Cause

Agent token exists but lacks the required scope for this operation, or the secret is in a folder the token cannot access.

Fix

Check the token's scope and folder restrictions in Dashboard → Tokens. Create a new token with the correct scope (read_write or full_access).

Common Errors

IC0536Canister has no update method

Cause

The canister wasm is outdated or the method name is misspelled.

Fix

Check you're using the correct canister ID (4wj64-piaaa-aaaan-q5q7q-cai) and the latest MCP server version (@toknbase/mcp-server@1.7.0).

IC0502Canister trapped explicitly

Cause

The canister rejected the call, usually due to invalid input or a business logic check.

Fix

Read the error message for details. Common causes: duplicate secret name, invalid token, missing required fields.

IC0503Canister out of cycles

Cause

The canister has run out of compute cycles.

Fix

Contact support at support@toknbase.net immediately.

HTTP Errors

400Bad Request

Cause

Missing required fields or malformed request body.

Fix

Check the request body matches the expected schema. Use the API Reference for the correct field names.

404Not Found

Cause

Secret with that name does not exist.

Fix

Verify the secret name is correct. Use GET /api/secrets to list all available names.

429Too Many Requests

Cause

Rate limit exceeded.

Fix

Back off and retry after a short delay. Implement exponential backoff for production pipelines.

500Internal Server Error

Cause

Canister error or network issue.

Fix

Check canister status at dashboard.internetcomputer.org searching for 4wj64-piaaa-aaaan-q5q7q-cai. Retry after a few seconds.

Agent Token Errors

token_revokedAgent token has been revoked

Cause

The token was manually revoked in the Toknbase dashboard.

Fix

Create a new agent token in Dashboard → Tokens → Service Identities.

token_expiredAgent token has passed its expiry date

Cause

The token was created with an expiry and that date has passed.

Fix

Create a new agent token with a new expiry date in Dashboard → Tokens → Service Identities.

token_scope_exceededOperation requires higher scope

Cause

Trying to write with a read_only token, or other scope mismatch.

Fix

Create a token with the appropriate scope: read_write or full_access.

folder_restrictedSecret is in a restricted folder

Cause

The token has folder restrictions and the secret is in a folder the token cannot access.

Fix

Update the token's folder restrictions or create a new token scoped to the correct folder.

MCP Errors

method_not_foundMCP server version mismatch

Cause

The installed MCP server version doesn't match the canister's deployed methods.

Fix

Update to @toknbase/mcp-server@1.7.0: npx @toknbase/mcp-server@1.7.0. Or use the hosted endpoint which is always up to date.

agent_not_configuredTOKNBASE_AGENT_TOKEN not set

Cause

The TOKNBASE_AGENT_TOKEN environment variable is missing from your MCP config (self-hosted mode only).

Fix

Add TOKNBASE_AGENT_TOKEN to the env section of your MCP server config. For the hosted endpoint, use the Authorization header instead.

canister_unreachableCannot reach the ICP canister

Cause

Network issue, incorrect IC_HOST, or canister is temporarily unavailable.

Fix

Confirm IC host is https://icp-api.io (not ic0.app). Check your internet connection and retry after a few seconds.

Note

If you're seeing errors not listed here, check the status page attoknbase.net/statusor contact support atsupport@toknbase.net.

What's next

API Reference

REST endpoints and MCP tool reference.

Security Architecture

Zero-knowledge encryption model.

Was this page helpful?