Security tools your agent already has
Checks you would run if you had the time, run by something that does.
12 toolsMost security work is checking things nobody has time to check: a certificate about to expire, a dependency with a new advisory, a credential that reached a file it should not be in. An agent that runs these on a schedule and only speaks up when something changed is the version of this job that actually gets done.
The tools
Preinstalled on every plan, with nothing to set up. A few depend on the engine you pick.
trivyScan images, filesystems and repositories for known vulnerabilities.
sopsEncrypt and decrypt secrets in place, inside a config file.
ageModern file encryption with one small key and no configuration.
baoOpenBao. Read and write secrets in Vault-compatible stores.
stepIssue, inspect and renew certificates and JWTs.
certbotRequest and renew Let’s Encrypt certificates.
gpgSign, verify, encrypt and decrypt with GnuPG keys.
shellcheckCatch quoting, portability and logic bugs in shell scripts.
hadolintLint Dockerfiles against best practice before they build.
age-keygenGenerate an age keypair for encrypting files and sops secrets.
gitleaksScan files and git history for leaked secrets.
dopplerFetch and inject secrets from Doppler.
A real command line, already set up
Every agent runs on a sandboxed machine with the whole toolbox preinstalled. No setup step, on any plan.