A scan is not a fix.
Findings without a patch are homework. Tokynd ships the merge-ready fix.
Tokynd Security · Enterprise AI Security
Seen.
Approved.
Proven.
AI security colleagues inside the tools your teams already use — reviewing agent code, MCP, and prompts, proposing merge-ready patches, verifying the rescan, and turning every approved fix into evidence.
HUMAN GATE · EVERY MERGE
UNVERIFIED FIXES SHIPPED · 0
EVIDENCE · PER FIX
SUITE · 9 PRODUCTS / 4 PILLARS
Human gate on every merge · Verified closure per fix · Signed evidence, verifiable offline
The Tokynd position
A dashboard is not a decision.
Risk you can only look at is risk you keep. Tokynd puts a governed decision in front of a human.
A report is not proof.
Proof is a verified closure with signed evidence — produced by the fix itself.
Watch it work
Finding → fix → verified.
Every Tokynd review runs the same loop: a finding with its blast radius, a merge-ready patch no human has to write, and a re-verified close with the evidence logged. Walkthrough on a sample pull request — no repository is contacted.
Sample finding
Product demo
High
mcp/tools.json · server: crm-lookup
MCP tool granted write scope it never uses
The crm-lookup server holds crm.records.write and crm.records.delete, but the agent only calls read paths. Reachability analysis confirms no write call in 90 days of traces. Combined with an unvalidated prompt template, a single injected instruction could delete customer records.
Control SOC 2 CC6.1
Framework OWASP MCP Top 10
Reachable yes — tool layer
Fix proposed
setright-output/fix-482 · 2 files changed
// mcp/tools.json — scope the server to what the agent uses
- "scopes": ["crm.records.read", "crm.records.write", "crm.records.delete"]
+ "scopes": ["crm.records.read"]
+ "identity": "tokynd://agent/support/crm-lookup (15-min token)"
// prompts/triage.md — bind tool calls to the approved spec
+ tool_policy: spec://support-agent/v3#tools.read-only
Tests 41 passed
Spec check v3 ✓
Human gate approval required
✓
Patch approved — local patch approved; simulated merge event recorded — no repository contacted.
✓
Identity re-issued — long-lived key retired; scoped 15-minute token provisioned by Tokynd Namesake.
✓
Finding re-verified — Wiz re-queried: exposure closed. Evidence written back to Wiz and your ticket.
✓
Control evidence logged — SOC 2 CC6.1 / ISO 42001 A.6 evidence pack updated automatically.
Controls mapped to
SOC 2ISO/IEC 42001NIST AI RMFEU AI ActOWASP LLM & MCP Top 10CIS Benchmarks
Two problems. One cause.
AI crossed from assistant to operator.
Agents now take consequential actions in real systems. The security model has to govern the identity making the move, the path it takes, and the fix that follows — without turning innovation into another ticket queue.
Enterprise AI is here.
Agents move money, touch PII, call production tools, and change systems. Every non-human identity is a token; without a named owner, scoped permissions, expiry, and a kill switch, that token is governed too late.
Identity must be born with the agent.
Adversarial AI is here.
Direct and indirect injection, tool-description poisoning, MCP overreach, and noisy alert floods are already part of the operating model. Visibility matters; a governed response matters more.
Every deviation needs an owner and a fix loop.
One causeAgents act without governed identity and without a fix loop.
Tokynd Security closes both through the Tokynd platform: Tokynd Namesake at creation, then see → fix → govern → prove across every action.
Watch the decision, not just the output
An output can look fine. A decision can still be wrong.
A model can seem harmless. Its answer can read clean. Neither tells you whether the agent should have acted. Harm happens earlier — in the decision, the moment the agent weighs what it can reach against what it is trying to do, and moves. That moment fails in three distinct ways.
Wrong identity
The action is taken by a token nobody owns — a service key from three years ago, an agent nobody registered. No owner to approve, no expiry to enforce, no switch to kill.
Governed by Tokynd Namesake — identity at creation.
Wrong reach
The identity is legitimate but holds scope it never uses — write and delete on a tool that only reads. One steered instruction turns standing privilege into data loss.
Governed by Tokynd Vestibule — MCP scope reviewed like code.
Wrong intent
Identity and scope check out, but the action doesn’t match the mission — an unknown tool, an exfiltration domain, a quiet step off the known path.
Governed by Tokynd Temperament and Tokynd Sparring — behavior baselined, then exercised adversarially.
The platform
Unlike gateways, scanners, or dashboards, the Tokynd platform works where agents are built. Identity is minted at creation, fixes arrive as merge-ready patches a human approves, and evidence is generated by the fix itself.
Verb 01
Discover
Inventory every agent, MCP server, identity, and architecture gap — born at creation where possible, found fast where not.
Verb 02
Fix
Merge-ready fix patches a human approves — scope removals, IaC corrections, dependency bumps — never another ticket queue.
Verb 03
Prove
Verified rescans close the finding at the source, and every fix emits cross-framework evidence an auditor can follow.
Platform loopTokynd Setright fixes → Verification proves → Tokynd Referee maps → Audit Copilot answers
Gatewayroutes traffic
≠Scannerfinds issues
≠Dashboardorganizes risk
→Tokyndgoverns identity, proposes the fix, proves closure
Four operating pillars
See the action. Fix the path. Govern the identity. Prove the outcome.
Nine distinct products work as one colleague system. Each pillar has one operational job, one human gate, and one place in the Discover → Fix → Prove loop.
01 · SEE
See the action
Inventory every agent, MCP server, and identity — and watch what each one actually does.
02 · FIX
Fix the path
Every finding leaves as a merge-ready patch a human approves — never another ticket queue.
03 · GOVERN
Govern the identity
Scope and policy enforced at the decision point, with a named owner and an expiry on every token.
04 · PROVE
Prove the outcome
A verified rescan closes the finding at the source — and the closure itself emits signed evidence.
SEE
Every action, visible in context.
Tokynd Standout turns scanner noise into one owned queue. Tokynd Temperament learns the deterministic baseline and surfaces deviations without claiming a live sensor.
Tokynd Standout · Vulnerability CurationTokynd Temperament · Agent Behavior Baselining
Explore See →FIX
Security that arrives as help.
Tokynd Setright produces the smallest reviewable patch, tests it locally, drafts the PR body, and waits for a human. Opening real repository PRs rolls out with design partners.
Tokynd Setright · PR Review & Auto-Fix
Explore Fix →GOVERN
Every token has a kind, owner, and boundary.
Tokynd Referee tiers and maps. Tokynd Namesake creates the identity record. Tokynd Vestibule reviews MCP permissions. Tokynd Sparring exercises adversarial configurations.
Tokynd Referee · Tokynd NamesakeTokynd Vestibule · Tokynd Sparring
Explore Govern →PROVE
Evidence generated by remediation.
Tokynd Dossier packages the approved fix and verified rescan. A built-in drift scanner compares architecture intent with deployed descriptors and emits the gap register into the same pack.
Tokynd Dossier · Compliance Evidence Pack
Explore Prove →Scope and intent
Scope says what it can reach. Behavior says what it wants.
A scanner calls it a permissions problem. An IAM team calls it an identity problem. A SOC calls it an anomaly problem. Each is partly right — and none of them is enough, because an agent’s decision doesn’t stay inside one category.
What it can reach
The kind of the token: owner, scopes, expiry. Tokynd Namesake writes it at creation; Tokynd Vestibule keeps MCP scope honest. On its own, this only says what’s possible — not whether it makes sense.
What it is trying to do
The behavior against the baseline: the tool path it usually takes, the destinations it usually touches. Tokynd Temperament learns that path and surfaces the deviation with a reason. On its own, this only says something changed — not whether it was allowed.
Tokynd Security assesses both together — the reach and the reason. A kind without behavior is a permission slip. Behavior without a kind is a guess.
Proof without theater
Show the method. Publish the benchmark. Let the work speak.
Tokynd Security earns proof from reproducible artifacts and design partners willing to judge the fix.
Design-partner program
One repo, one scanner export, one named security and engineering owner. The pilot is measured on accepted patches and verified closures — not alerts generated.
See the program →Fix-corpus transparency
Finding → proposed patch → human decision → verification result. Internal merge-rate targets stay labeled as targets until they become measured outcomes.
Reproducible benchmark plan
A public benchmark repo is planned with planted vulnerable and hardened fixtures, deterministic expected outputs, and versioned rules. It is a plan, not a published benchmark today.
Changelog in the open
v0.4.0. Every status on this page names what runs locally today, what needs a design partner, and what remains roadmap.
Field notes
Attack patterns we’re studying with design partners.
Tokynd Security publishes what it learns in the open — methods, fixtures, and findings. The first notes ship as the design-partner program produces them. Nothing here is backdated or borrowed.
Tool-description poisoning in MCP servers
How a poisoned tool description steers an agent toward over-scoped tools — and what a least-privilege manifest check catches.
Scope drift in agent identities
How standing permissions accumulate across agent versions — and what the birth record reveals at review time.
Exfiltration paths through RAG pipelines
How retrieved context becomes a carrier for instructions — and where the behavior baseline breaks first.
AI security products
Eight products. One platform. One Assurance Graph.
Every product reads from and writes to the Tokynd Assurance Graph. Product badges show where each one stands: Available now runs today as deterministic tooling in your environment, and Design Partner marks what rolls out with partners next.
AppSec for every team
Start with your SCA/SAST backlog. Grow into agents.
Tokynd Standout turns the scanner exports you already have into one reachable, owned queue. Tokynd Setright turns that queue into merge-ready patches with a human gate. When MCP, RAG, identities, and runtime behavior enter the stack, the same graph expands with you — no platform reset.
SCA / SAST→Tokynd Standout→Tokynd Setright→Agent + MCP security→Tokynd Dossier
Tokynd Setright
PR Review & Auto-Fix
Security review that ends in a merge-ready patch, not another ticket. The flagship: a senior security colleague in every pull request that touches agent code, MCP, prompts, or RAG.
Design PartnerFix
Failure preventedAgent changes merging with over-scoped tools, prompt-injection surface, and RAG permission bleed — found by an auditor or an incident instead of a reviewer.
Capabilities
- Reviews agent code, MCP configs, prompts, RAG in the PR
- Generates the validated fix diff + PR body (runs locally today)
- Secrets & NHI-in-code checks folded into every review
OutcomeFindings leave as mergeable fixes with tests and a spec check — measured on merge rate, not alert count.
IntegrationsGitHub · GitLab · Cursor / Copilot / Windsurf (with design partners)
Platform loopReceives findings + spec from the Assurance Graph → sends fix diffs, merge outcomes, and corpus labels back.
Human gateThe agent owner merges. Tokynd Setright never merges, deploys, or widens its own access.
Try it: the live simulated PR at the top of this page — pick a finding, review the fix, approve the merge yourself.
Fix loop — available nowReview commenting and opening real PRs in your repos roll out with design partners.View demoJoin design partners
Tokynd Vestibule
MCP Permission Scanner
Every MCP server reviewed like code — tools, permissions, description drift — before it holds production scope.
Available nowDiscover
Failure preventedAn MCP server quietly holding write/delete scope it never calls — the standing privilege a steered prompt turns into data loss.
Capabilities
- Static MCP manifest scan: rules TK-MCP-001..009
- Risk score + safer-manifest diff per scan
- Sample: over-scoped = 7 findings, 100/100 · least-privilege = clean
OutcomeOver-scoped manifests caught before they hold production scope; least-privilege manifests verify clean.
IntegrationsMCP manifests (file in / file out) · repo configs · IDE agent settings (with design partners)
Platform loopReceives manifests → sends scope findings and risk scores to the graph.
Human gateSecurity approves every new server and every scope widening.
Try it: run the live simulated demo at the top of this page.
Static manifest scan — available nowLive server probing, registry, and CI gates roll out with design partners.View demoRegister interest
Tokynd Namesake
Agent Identity Provisioning
Identity at creation, not discovered after the incident. Every agent is born with a named owner, scoped tools, an expiry, and a kill switch.
Available nowDiscover → Fix
Failure preventedOwnerless agents running on 214-day console keys that nobody can revoke safely because nobody recorded what they were for.
Capabilities
- Birth Certificate JSON + Markdown: owner fail-closed, expiry/rotation, provenance hash
- Orphan + over-scope detection against the registry
- Just-in-time credential issuance (with design partners — no credential is issued today)
OutcomeEvery agent provable in one record: who owns it, what it may touch, when it expires, how it dies.
IntegrationsApproved specs (file in / file out) · Okta / Entra (with design partners) · MCP manifests
Platform loopReceives the approved spec → sends the birth record into the Identity Graph every other product reads.
Human gateNamed owner approves scopes; revocation never waits for a gate. Missing owner fails closed.
Agent Identity Birth Certificate
Generated in your browser from the Birth Certificate record (owner · scopes · provenance · kill-switch field). No credential is issued — just-in-time issuance arrives with design partners. Sample artifact, not a live identity.
Birth Certificate — available nowJSON + Markdown, owner fail-closed; no credential issued. JIT issuance + IdP wiring arrive with design partners.View demoRegister interest
Tokynd Standout
Vulnerability Curation
Five scanners, one weakness, one owner, one fix. Duplicate alerts collapse into a reachable, owned queue developers trust.
Available nowDiscover
Failure preventedThe same CVE paged by three scanners under three IDs, owned by nobody, ageing past the 252-day mean-time-to-fix baseline.
Capabilities
- File ingest today: SARIF / Dependabot-style / Trivy-style reports normalized to one record
- Dedupe + reachability ranking + owner routing
- Verified closure propagated back to every source (live connectors roll out with design partners)
OutcomeOne canonical queue, reachable first — each item carrying file:line, owner, fix, and proof.
IntegrationsToday: exported finding files · Roadmap: live GitHub / GitLab / AWS / Azure APIs
Platform loopReceives scanner exports → sends canonical issues to Tokynd Setright (fix) and Tokynd Dossier (evidence).
Human gateAppSec approves merges of critical duplicates; suppression reasons stay auditable.
See it: the requests CVE sample in the hero demo — three scanner alerts curated into one owned issue.
Tokynd Referee
AI Governance Fleet
AI governance that produces remediation. The 10-agent Tokynd Referee fleet: inventory, tier, map, mint, test, remediate, evidence, third-party, drift, audit.
Available now · liteFix → Prove
Failure preventedGovernance theater: beautiful registers and heat maps while the same reachable weakness survives another quarter.
Capabilities
- Tokynd Referee lite: tiering for 3 sample systems (high / minimal / unacceptable-flag)
- TAI-01..TAI-10 starter crosswalk; screening heuristics — not a legal determination
- The full 10-agent fleet rolls out with design partners, beyond the Inventory/Tiering slices
OutcomeReachable risk removed and controls proven from the same loop — not two programmes duplicating each other.
IntegrationsThe full fleet below · EU AI Act / NIST AI RMF / ISO 42001 / SOC 2 mappings (starter)
Platform loopReceives the whole graph → sends tiers, control maps, fix diffs, and evidence to Tokynd Dossier.
Human gateNamed risk owner approves every tier; GRC approves every external answer.
Try it: run the live simulated demo at the top of this page.
Tokynd Referee lite — available nowTiering + crosswalk starter run today; the full fleet rolls out beyond Inventory/Tiering.View demoExplore the fleet
Tokynd Dossier
Compliance Evidence Pack
One approved fix testifies four times. Fix + verified rescan become auditor-ready evidence, cross-framework.
Available nowProve
Failure preventedAudit-season archaeology: reconstructing March in November from tickets and memory, four frameworks collected four times.
Capabilities
- Auditor pack export: manifest / findings.md / controls.csv / evidence.json / zip
- Starter-mapping disclaimer in every export — a mapping, never a certification
- Questionnaire answers cited to artifacts (with design partners)
OutcomeEvidence as a byproduct of engineering: fresh, linked, exportable in minutes.
IntegrationsVerified closures (file in / file out) · Vanta / Drata / RegScale evidence push (planned)
Platform loopReceives verified closures from every product → sends evidence packs + control status back to the graph.
Human gateGRC reviews exceptions and approves the pack before any auditor sees it.
Try it: run the live simulated demo at the top of this page.
Auditor pack export — available nowEvery export carries the starter-mapping note: a mapping, not a certification.View demoRegister interest
Tokynd Temperament
Agent Behavior Baselining
Know the normal path. Surface the meaningful deviation. Deterministic behavior baselining for agent tool calls, destinations, and policy decisions.
Available nowObserve → Prove
Failure preventedAn agent leaves its known tool path, reaches an unknown tool, or follows an exfiltration instruction without an explainable deviation record.
Capabilities
- Deterministic baseline learned from a training trace using TK-RG-001..007
- Attack sample: 5 deviations; policy denies shell.exec, unknown tool, and exfiltration domain
- Normal sample: 0 deviations; policy allows
OutcomeEach deviation becomes a reasoned finding that can enter Tokynd Referee, trigger human review, and land in Tokynd Dossier.
Scope todayLocal trace simulation only — no live sensor, network, credentials, model calls, latency, or performance claims.
Platform loopReceives trace events → compares them to baseline → sends deviations and policy decisions to the Assurance Graph.
Human gateSecurity owns baseline approval and policy changes; runtime sensor integration rolls out with design partners.
Product demo · sample traces
Baseline / deviation check
ALLOW · 0 deviationsKnown tool sequence, approved destination, and expected scope. Deterministic sample; no model queried.
TK-RG-001..007 — available nowRuntime sensor integration rolls out with design partners; this demo runs on sample traces.View demoPilot Tokynd Temperament
Tokynd Sparring
Adversarial AI Red-Teaming
Exercise the agent configuration before an attacker does. Deterministic probes surface injection paths, poisoned tool descriptions, excessive MCP scope, exfiltration instructions, and missing hygiene controls.
Available nowGovern
Failure preventedA vulnerable agent configuration reaching production without anyone exercising the instructions, tools, scopes, and exfiltration paths together.
Capabilities
- RT-P01..P06: direct/indirect injection, tool-description poisoning, MCP overreach, exfiltration instruction, hygiene
- Vulnerable fixture fails 6/6 → high; hardened fixture passes → minimal
- Findings enter a screening-heuristics risk register
OutcomeA reviewable adversarial gap list tied to the same owners, controls, fixes, and evidence as the rest of the platform.
Scope todayDeterministic local config checks only — no model queried, no payload executed, no live attack, and no claim that a model is attack-proof.
Platform loopReceives agent configs and policies → sends probe findings to Tokynd Referee for tiering and Tokynd Setright for remediation.
Human gateSecurity defines the authorized probe scope, reviews every high finding, and approves the hardening change.
RT-P01..P06 · deterministic sample
Choose the agent configuration
No model is queried and no payload is executed.
HIGH · 6/6 probes failedInjection, poisoned description, excessive MCP scope, exfiltration instruction, and hygiene findings enter the risk register.
RT-P01..P06 — available nowScreening heuristics only — no model call, no payload execution, no live runtime protection.View demoExplore the sprint
Why existing tools miss it
The stack was built for a human actor.
Scanners read code. IAM governs people. EDR watches endpoints. Each is doing its job — but none of them sees the agent’s decision, because the decision doesn’t live in any one of their categories.
Scanners see the code
They find the vulnerable dependency and the misconfigured template. They don’t see the agent choosing which tool to call at 2 a.m.
IAM sees the humans
It governs the people who log in. It doesn’t see the hundred machine identities acting between the logins.
EDR sees the endpoint
It watches the process tree. It doesn’t see the plan unfolding across the MCP server, the RAG pipeline, and the API.
Tokynd Security doesn’t replace them. It is the neutral fix-and-prove layer across the stack you already own — the decision is governed where the agent is built, the fix arrives as a patch a human approves, and the evidence is generated by the fix itself.
See the platform →
FAQ
Straight answers.
No — deliberately. The Tokynd platform ingests findings from Wiz, Prisma Cloud, Orca, Snyk-style SCA, Semgrep/CodeQL, Dependabot, Trivy, and cloud-native scanners; traces each to the code, IaC, agent, and owner; deduplicates them into one owned queue; drafts the PR-ready diff + PR body; and verifies closure back at the source. Keep the scanners and CSPM contracts you trust. Tokynd Security closes the loop they leave open.
Three rules: agents propose and humans approve; every action is scoped by the approved spec and a short-lived identity; and every action is logged to your audit trail and mapped to a control. The Tokynd platform can draft a validated fix diff, tests, risk note, spec check, and PR body. Opening a real PR inside your repo ships with design partners; merging always stays with the human owner under normal branch protection. Agents cannot deploy, widen their own access, or delay revocation.
The spec — capabilities, tools, data access, identity, and guardrails — is written and approved before code is generated. It becomes the contract every later stage checks against: PR review, identity provisioning, testing, and evidence. Security stops being a review at the end and becomes a property of how the system was built.
Starter mappings cover SOC 2, ISO/IEC 42001, NIST AI RMF, the EU AI Act, OWASP LLM and MCP Top 10, and CIS Benchmarks. One control is tested once and mapped where it applies; mappings are starter crosswalks, not certifications or legal determinations. AWS actions are grounded through AWS MCP servers for documentation, IaC validation, pricing, and Bedrock knowledge retrieval; Azure actions use current Microsoft documentation. Recommendations cite real APIs, limits, and service behavior, then tests and rescans validate the proposed fix.
We are onboarding design partners now, ahead of general availability. Eight products run today as tooling in your environment; hosted connectors, live runtime sensing, and opening real repository PRs roll out first to partners. A working session starts by inventorying agents, MCP servers, and shadow AI, curating one real queue, and drafting the first merge-ready fixes against your stack. Partners shape the roadmap, get FDE support, and lock founding-partner terms. Register through Contact below — messages go straight to the Tokynd Security team.
The build focus is AWS and Microsoft Azure, GitHub and GitLab as code systems of record, and Okta and Microsoft Entra ID for identity. Connector depth is phased in the catalog. Customer code, prompts, tool definitions, and data are tenant-isolated and never train models without explicit opt-in; agents work from the minimum artifact needed, and every action is attributable to a human approver and a scoped identity.
Published structure, no invented numbers: Launch bundles platform + services for a first SOC 2 motion, AI-Native is per-developer platform pricing with optional FDE, and Scale is an annual agreement by deployment shape. Final numbers publish at GA; design partners lock launch pricing.
About · Tokynd Security
Tokynd Security: Token + Kind.
Every non-human identity is a token — a service account, API key, workload credential, MCP server, or AI agent. Each token has a kind: what it is, who owns it, what it may do, and when it expires. Tokynd Security exists to govern agents by kind, and to turn security work into approved fixes with evidence attached.
What our mark means
The logo is the thesis, drawn in three strokes — in security terms.
Hover, focus, or tap a card to isolate its part of the mark.
The ring is the token
The credential as an object: a thing that exists, that can be held, copied, and stolen. It is drawn as a ring because a token is only as strong as the boundary around it.
The K is the kind
The policy inside the credential. The K sits within the ring the way a kind sits within a token — the classification that decides what the token may do. A ring without the K is just a coin: value with no rules.
The amber node is the identity
Pinned at the junction of the K — the exact center of the token's scope: observed, owned, expiring. Amber, the color of a struck token — an identity under governance, not an alarm.
No shields, no padlocks, no fear. Tokynd governs identity — and a governed identity is a quiet one.
Mission
Help AI engineers ship agents secure by construction — and prove it. We put security agents inside the tools developers already use, so the secure path is the normal path: spec, identity, review, fix, verification, and evidence in one thread.
Why now
Agent sprawl is outrunning review. Teams are adding IDE agents, MCP servers, RAG pipelines, and model tools faster than security can inventory them — while machine identities already vastly outnumber human ones (sourced on this page). Discovery after the fact is too late; governance has to start at creation.
Principles
How we build, and how our agents are allowed to behave.
Agents propose, humans approve
No agent merges, deploys, widens privilege, or changes cloud state without a human gate. Speed comes from a better proposal, not from removing the approver.
Evidence by default
Every fix carries its spec version, tests, source finding, approval, and re-verification. If it cannot be shown, it is not done.
No rip-and-replace
Keep Wiz, Prisma Cloud, Orca, GitHub, GitLab, AWS, and Azure. The Tokynd platform is the neutral fix-and-prove layer across the stack you already own.
Your code trains nothing without opt-in
Customer code, prompts, and data are not used to train models unless a customer explicitly opts in. Tenant isolation is a product requirement, not a policy footnote.
Tokynd Security is now onboarding design partners. Work directly with our team to deploy the platform in your environment, shape the roadmap, and lock founding-partner terms before general availability.
Put an AI security colleague on your next pull request.
Tokynd Security is now onboarding design partners. Work directly with our team to deploy the platform in your environment, shape the roadmap, and lock founding-partner terms before general availability.
Tokynd Security · Contact
Tell us what you need.
Design partner, a question about the build, or a working session — one route into Tokynd Security. Messages go directly to the Tokynd Security team, and a human replies.