Is Toknbase an AI agent or a secrets manager?

Both — the vault is the engine, the agent is the product. Toknbase is an AI SecOps agent that actively scans repos, fixes exposed secrets, opens PRs, verifies every fix, and logs each action with a tamper-evident on-chain receipt. The vault stores secrets with zero-knowledge encryption so even the agent cannot read the values it protects.

What can the AI SecOps agent do?

The agent scans public and private GitHub repos for exposed credentials, monitors continuously on every new commit, proposes fix PRs to replace hardcoded secrets with secure runtime calls, verifies fixes are gone after application, checks whether found credentials have appeared in known breach databases, and sends a weekly CISO briefing with your full security posture. Every action is logged on-chain with a cryptographic receipt.

Can Toknbase — or its employees — read my secrets?

No. Client-side encryption means we store only ciphertext. We never have your encryption key. Even a Toknbase engineer with direct canister access would only see encrypted bytes. This is a cryptographic guarantee, not a policy promise.

How do I use Toknbase with AI agents like Claude or Cursor?

Toknbase provides a hosted MCP (Model Context Protocol) endpoint at https://4wj64-piaaa-aaaan-q5q7q-cai.icp0.io/mcp. Add it to your Claude Desktop, Cursor, or Windsurf config as a JSON block — no installation, no npm package, no local server required.

What is the pricing for Toknbase?

Toknbase offers three plans: Free ($0 — 1 seat, 50 secrets, 3 scans/month, free forever), Pro ($19.99/seat/month or $15.99/seat/month billed annually — unlimited seats, private repo scanning, AI auto-remediation, full MCP endpoint, pre-commit hook), and Enterprise ($499.99/month flat — everything in Pro plus SSO/SAML, custom detectors, dedicated support, DPA, and 99.9% SLA). Annual billing saves 20% on Pro.

Can I change plans at any time?

Yes — upgrade, downgrade, or cancel at any time. Upgrades take effect immediately. Downgrades apply at the next billing cycle.

Is there a free trial?

The Free plan is free forever and includes public repo scanning and an on-chain audit trail — no credit card required. Pro and Enterprise plans can be started immediately with a paid subscription.

How does Toknbase compare to Doppler or HashiCorp Vault?

Three key differences: (1) It's an AI agent, not a passive vault — it actively watches repos, finds leaks, and opens fix PRs without being asked. (2) Zero-knowledge encryption — Toknbase cryptographically cannot read your secrets, even under subpoena. (3) On-chain audit trail — every agent action has a tamper-evident cryptographic receipt. No other secrets management tool provides all three.

How is Toknbase different from using .env files?

.env files store secrets on disk in plaintext and are frequently committed to version control by accident. Toknbase encrypts secrets in your browser before they leave your device, stores only ciphertext, actively scans your repos for accidentally exposed values, and can automatically open a fix PR when it finds one. It's a proactive agent, not a static file.

Can Toknbase scan private GitHub repos?

Yes. Public repos can be scanned instantly with no signup. To scan private repos, connect your GitHub account via OAuth — Toknbase requests the minimum required permissions and uses a short-lived access token. Private repo scanning is included in the Pro plan.

What happens if a secret is exposed in an old commit?

Removing a secret from a file does not remove it from git history — anyone with access to the repository can still find it in old commits. Toknbase scans git history for exposed secrets, not just the current state of the code. When it finds one, it flags it as a historical exposure and recommends rotating the credential immediately, since it must be treated as compromised.

Can Toknbase read my secrets?

No. Your secrets are encrypted with AES-256-GCM in your browser before upload. Only ciphertext is stored on-chain. Toknbase never receives or handles your plaintext. This is a cryptographic guarantee, not a privacy policy. You can verify it in the open-source client code.

What encryption standard does Toknbase use?

Your secrets are encrypted on your device before they ever leave — we use AES-256, the same standard used by governments and banks. When you save a secret, your browser derives a unique encryption key locally using HKDF (a secure key derivation function), then encrypts the value with AES-256-GCM. Your encryption key never leaves your device, and we never see your secrets in plain text. Even a Toknbase engineer with direct access to our servers would only ever see scrambled ciphertext.

What happens if Toknbase is hacked?

There is nothing to steal. The canister stores only ciphertext. Even with full read access to the canister, an attacker would get encrypted blobs that are useless without your device-bound key.

How does the audit log work?

Every access, rotation, deletion, and permission change is written to a tamper-evident on-chain audit log tied to ICP consensus. Entries are cryptographically signed and cannot be silently altered — if an entry changes, the signature breaks. Note: users can delete their own data via GDPR data deletion. You can export your audit log as CSV at any time.

Is the encryption code open source?

Yes. The client-side encryption logic is open and auditable. You can verify that encryption happens in the browser and that plaintext is never transmitted to the canister.

What does Toknbase scan for?

Toknbase scans for exposed secrets and credentials — API keys, tokens, database passwords, and environment variables hardcoded in source code, config files, CI/CD workflows, and git history. It does not scan for code logic vulnerabilities or software CVEs.

Does Toknbase scan for code vulnerabilities like Snyk or Semgrep?

No — Toknbase specializes in secret detection and remediation. It finds exposed credentials, not code logic bugs or dependency CVEs. For code-level vulnerability scanning, tools like Snyk or Semgrep are excellent complements. Most teams use both alongside Toknbase.

What is Internet Identity?

Internet Identity is a WebAuthn-based authentication system built into the Internet Computer. It uses your device's biometrics (Face ID, Touch ID, Windows Hello) or a hardware security key. No email or password is required — and there's nothing to phish.

What if I lose my device?

You can add multiple authentication devices to your Internet Identity. We recommend adding a backup device (a second phone, a hardware key like a YubiKey) before you lose access to your primary one. You can manage your recovery options at identity.ic0.app, or use the Account Recovery link in the sidebar.

Do I need to create a password?

No. Toknbase uses Internet Identity exclusively. Authentication is handled by your device's built-in biometrics or a hardware security key. There are no passwords in the system.

What counts as a"secret"?

Any key-value pair: API keys, database credentials, tokens, environment variables, certificates — anything you'd put in a .env file. Secrets can be tagged, versioned, organized into folders, and shared across team workspaces.

Can I upgrade or downgrade anytime?

You can upgrade at any time. Upgrades take effect immediately. Plan changes flow through Stripe. You can manage your plan from the Billing section in your dashboard.

Is there truly a free tier?

Yes. The Free tier is $0 with no credit card required. It includes 1 user, 1 project, 50 secrets, AES-256-GCM encryption, WebAuthn login, and an audit log. Free forever — no expiry, no surprise charges.

What happens when I hit my plan limits?

You'll see a plan limit warning in the dashboard and be prompted to upgrade. Existing secrets are not deleted — you simply cannot create new ones until you upgrade or remove existing secrets.

How do I use Toknbase in CI/CD?

Generate an API token from the API Tokens page, enable API access on each secret you want to expose, then use the @toknbase/cli or curl to fetch secrets in your pipeline. Example:`toknbase get MY_SECRET_KEY`.

Is there an MCP server or CLI?

Yes. @toknbase/mcp-server is a live npm package for connecting AI editors to Toknbase. @toknbase/cli is available now — run 'npx @toknbase/cli scan' from any terminal, no install required. Both are available from the MCP & CLI page in the dashboard.

Can I use API tokens with any language?

Yes. API tokens return plaintext values over HTTPS. Any language that can make an HTTP request can fetch a secret. The MCP server and CLI are convenience tools — not required.

How do I rotate secrets automatically?

Set a rotation schedule on any secret from the secret detail view (Pro and Enterprise plans). You can also trigger rotation via the API or configure a webhook to be called after every rotation event.

How is Toknbase different from a secrets manager like Doppler or Infisical?

Doppler and Infisical store secrets securely — they're passive vaults. Toknbase actively finds secrets already exposed in your repos, remediates them autonomously (opens PRs, rotates values), monitors for new exposures on every commit, and logs every action with a tamper-evident on-chain receipt. It's an AI SecOps agent, not just a vault.

Where is my data stored?

Your encrypted secrets are stored in a canister on the Internet Computer (ICP), a decentralized blockchain network. There are no traditional servers or databases. The network is distributed across independent data centers globally.

Is Toknbase GDPR-ready?

Toknbase is designed to support GDPR compliance — every access event is cryptographically logged, users can export or delete their data on demand, and Enterprise plan users have access to a dedicated Compliance & Audit Center. You can delete all your data with a single call from Settings > Account. deleteMyData() removes all secrets, profiles, and tokens immediately. Audit log entries are anonymized (not deleted) for security compliance — no support ticket, no waiting period.

Can I export my audit log?

Yes. The audit log page includes a CSV export button scoped to your current workspace. All events (access, rotation, deletion, permission changes) are included. Available on Pro and Enterprise plans.

How do I delete my account and all my data?

Navigate to Settings > Account and use the"Delete My Data" option. This permanently removes all secrets, team memberships, profile data, and audit entries tied to your principal. This action is irreversible.

Toknbase

Try Demo

FREQUENTLY ASKED

FAQ

Everything you need to know about how Toknbase works, what we can see, and what we can’t.

Security

Authentication

Pricing

Integration

Compliance

Security

Authentication

Pricing

Integration

Compliance

Still have questions?

Read the docs →

Uses Internet Identity (WebAuthn). No password required.