Tokynd SetrightPR Review & Auto-Fix
Reviews agent code, MCP configs, prompts, and RAG pipelines in the pull request — and returns a merge-ready patch a human approves, not another ticket.
Tokynd Security · Enterprise AI Security
Seen.
Approved.
Proven.
Our mission: help teams ship AI agents that are secure by construction — and prove it. Tokynd puts AI security colleagues inside the tools your teams already use: they review agent code, MCP servers, and prompts, propose merge-ready fixes a human approves, verify every fix, and turn each verified closure into signed evidence.
One platform. Every framework. Agents assessed, findings fixed, proof signed.
HUMAN GATE · EVERY MERGE
UNVERIFIED FIXES SHIPPED · 0
EVIDENCE · PER FIX
SUITE · 9 PRODUCTS / 4 PILLARS
Human gate on every merge · Verified closure per fix · Signed evidence, verifiable offline
Watch it work
Finding → fix → verified.
Every Tokynd review runs the same loop: a finding with its blast radius, a merge-ready patch no human has to write, and a re-verified close with the evidence logged. Walkthrough on a sample pull request — no repository is contacted.
Sample finding
Product demo
High
mcp/tools.json · server: crm-lookup
MCP tool granted write scope it never uses
The crm-lookup server holds crm.records.write and crm.records.delete, but the agent only calls read paths. Reachability analysis confirms no write call in 90 days of traces. Combined with an unvalidated prompt template, a single injected instruction could delete customer records.
Control SOC 2 CC6.1
Framework OWASP MCP Top 10
Reachable yes — tool layer
Fix proposed
setright-output/fix-482 · 2 files changed
// mcp/tools.json — scope the server to what the agent uses
- "scopes": ["crm.records.read", "crm.records.write", "crm.records.delete"]
+ "scopes": ["crm.records.read"]
+ "identity": "tokynd://agent/support/crm-lookup (15-min token)"
// prompts/triage.md — bind tool calls to the approved spec
+ tool_policy: spec://support-agent/v3#tools.read-only
Tests 41 passed
Spec check v3 ✓
Human gate approval required
✓
Patch approved — local patch approved; simulated merge event recorded — no repository contacted.
✓
Identity re-issued — long-lived key retired; scoped 15-minute token provisioned by Tokynd Namesake.
✓
Finding re-verified — Wiz re-queried: exposure closed. Evidence written back to Wiz and your ticket.
✓
Control evidence logged — SOC 2 CC6.1 / ISO 42001 A.6 evidence pack updated automatically.
Controls mapped to
SOC 2ISO/IEC 42001NIST AI RMFEU AI ActOWASP LLM & MCP Top 10CIS Benchmarks
Products
Eight products. One platform.
One list, one loop: every product sees the action, fixes the path, governs the identity, or proves the outcome — and every closure feeds the same signed evidence chain.
Tokynd StandoutVulnerability Curation
Collapses the findings your scanners already produce into one deduplicated queue — ranked by what is actually reachable, each with an owner and a fix.
Tokynd TemperamentAgent Behavior Baselining
Learns each agent’s normal behavior — its tools, sequences, and destinations — and flags the deviations that matter.
Tokynd VestibuleMCP Permission Scanner
Scans every MCP server’s manifest for over-scoped tools and permissions before it reaches production — and shows the safer manifest.
Tokynd NamesakeAgent Identity Provisioning
Provisions every agent’s identity at creation: a named owner, scoped tools, an expiry, and a kill switch — recorded on a signed Birth Certificate.
Tokynd RefereeAI Governance Fleet
Inventories your AI systems, tiers their risk, and maps them to SOC 2, ISO/IEC 42001, NIST AI RMF, and the EU AI Act — then generates the remediation.
Tokynd SparringAdversarial AI Red-Teaming
Red-teams your agents before attackers do — prompt injection, poisoned tool descriptions, MCP overreach — run as a repeatable test pack.
Tokynd DossierCompliance Evidence Pack
Turns each approved fix and verified re-scan into a signed evidence pack an auditor can verify offline.
Integrations
Works with the systems you already run.
Tokynd reads configuration, identity, and access evidence from the platforms your estate already runs on, ingests findings from the security scanners already in your pipeline — and mirrors fix status back into the trackers your teams already work in.
Cloud
AWS
Reads account, IAM, S3, CloudTrail, and network configuration posture.
Microsoft Azure
Reads resource configuration, Entra directory observations, and Defender device posture.
Google Cloud
Reads asset inventory, IAM bindings, and Security Command Center signals.
Identity
Okta
Reads users, groups, applications, and access policies.
Google Workspace
Reads directory users and groups, admin roles, OAuth grants, and domain settings.
Code
GitHub
Reads organization and repository posture — members, Actions settings, and branch protection.
Ticketing
Jira
Fix status is mirrored into Jira issues — staged, approved, applied, verified.
ServiceNow
Fix status is mirrored into ServiceNow change requests, step for step.
Data
Snowflake
Reads database and table inventory, classification tags, privilege grants, and access history.
Sensors & scanners
Snyk
Ingests Snyk issue exports — findings with severity, CVE references, affected packages, and available fixes.
Microsoft Defender for Endpoint
Ingests device inventory and configuration state — endpoints with their security control settings.
Dependabot
Ingests Dependabot alerts — dependency vulnerabilities with the affected package, manifest, and fixed version.
Trivy
Ingests Trivy scan reports — package and image vulnerabilities, plus infrastructure-as-code misconfigurations.
SARIF
Ingests findings in SARIF format — code-scanning results with rule, severity, and file location, from any tool that exports SARIF.
A mirrored ticket carries status only — a finding counts as closed when Tokynd’s re-scan verifies the fix, never when a ticket moves.
The moat
Why Tokynd is hard to copy.
A scan is not a fix. A dashboard is not a decision. A report is not proof.
Hash-bound verified closure
When a fix lands, Tokynd re-scans the changed state and binds the result to the hash of the change itself. The closure is signed into a Dossier evidence pack that anyone can verify offline — “fixed” becomes a checkable fact, not a status someone set in a dashboard.
A governed journal under every action
Every agent action runs inside a governed harness and is written to a decision journal: the proposal, the spec it was checked against, the human approval, the change, the re-verification. Any closure can be replayed end to end — who decided, and on what evidence.
Agent security, built in from the start
Sparring’s adversarial testing, Vestibule’s MCP permission review, and Namesake’s agent identity are not add-ons — they run on the same platform and the same graph as the fixing itself. The system that repairs agents is the system that attacks, scopes, and identifies them.
How it works
See. Fix. Govern. Prove.
One loop runs under every product. A finding enters at See — and it leaves at Prove as signed evidence, or it doesn’t leave at all.
01 · SEE
See the action
Inventory every agent, MCP server, and identity — and watch what each one actually does.
02 · FIX
Fix the path
Every finding leaves as a merge-ready patch a human approves — never another ticket queue.
03 · GOVERN
Govern the identity
Scope and policy enforced at the decision point, with a named owner and an expiry on every token.
04 · PROVE
Prove the outcome
A verified rescan closes the finding at the source — and the closure itself emits signed evidence.
No step is optional, and none is silent: a human approves every fix, and the verified closure — not the ticket — is what becomes the evidence.
Tokynd Security · Contact
Tell us what you need.
Design partner, a question about the build, or a working session — one route into Tokynd Security. Messages go directly to the Tokynd Security team, and a human replies.
FAQ
Straight answers.
No — deliberately. The Tokynd platform ingests findings from Wiz, Prisma Cloud, Orca, Snyk-style SCA, Semgrep/CodeQL, Dependabot, Trivy, and cloud-native scanners; traces each to the code, IaC, agent, and owner; deduplicates them into one owned queue; drafts the PR-ready diff + PR body; and verifies closure back at the source. Keep the scanners and CSPM contracts you trust. Tokynd Security closes the loop they leave open.
Three rules: agents propose and humans approve; every action is scoped by the approved spec and a short-lived identity; and every action is logged to your audit trail and mapped to a control. The Tokynd platform can draft a validated fix diff, tests, risk note, spec check, and PR body. Opening a real PR inside your repo ships with design partners; merging always stays with the human owner under normal branch protection. Agents cannot deploy, widen their own access, or delay revocation.
The spec — capabilities, tools, data access, identity, and guardrails — is written and approved before code is generated. It becomes the contract every later stage checks against: PR review, identity provisioning, testing, and evidence. Security stops being a review at the end and becomes a property of how the system was built.
Starter mappings cover SOC 2, ISO/IEC 42001, NIST AI RMF, the EU AI Act, OWASP LLM and MCP Top 10, and CIS Benchmarks. One control is tested once and mapped where it applies; mappings are starter crosswalks, not certifications or legal determinations. AWS actions are grounded through AWS MCP servers for documentation, IaC validation, pricing, and Bedrock knowledge retrieval; Azure actions use current Microsoft documentation. Recommendations cite real APIs, limits, and service behavior, then tests and rescans validate the proposed fix.
We are onboarding design partners now, ahead of general availability. Eight products run today as tooling in your environment; hosted connectors, live runtime sensing, and opening real repository PRs roll out first to partners. A working session starts by inventorying agents, MCP servers, and shadow AI, curating one real queue, and drafting the first merge-ready fixes against your stack. Partners shape the roadmap, get FDE support, and lock founding-partner terms. Register through Contact below — messages go straight to the Tokynd Security team.
The build focus is AWS and Microsoft Azure, GitHub and GitLab as code systems of record, and Okta and Microsoft Entra ID for identity. Connector depth is phased in the catalog. Customer code, prompts, tool definitions, and data are tenant-isolated and never train models without explicit opt-in; agents work from the minimum artifact needed, and every action is attributable to a human approver and a scoped identity.
Published structure, no invented numbers: Launch bundles platform + services for a first SOC 2 motion, AI-Native is per-developer platform pricing with optional FDE, and Scale is an annual agreement by deployment shape. Final numbers publish at GA; design partners lock launch pricing.