← all tools
Choose a badge style and copy the code →
◆ Detection Engineering
Cotool
v0.63.0 commercialThe section your link pointed to isn't on Cotool's page any more, so we've brought you to the top.
Cotool is an AI-powered code analysis and security tool that identifies vulnerabilities and provides automated fixes for software development.
Summary
Cotool is a commercial AI agent platform for building and running security-focused automation, run as a hosted service that connects to third-party tools rather than as a library or standalone CLI. It is aimed at security teams looking to delegate investigation and remediation work — the integration list spans email security (Barracuda), endpoint and MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. tooling (Huntress, Kolide), application security (OX Security), and network detection (Darktrace) — alongside agent-builder features like instruction-aware integration recommendations and durable, restart-safe agent runs. It sits in the category of AI coding and automation agents rather than a fixed scanning or SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. tool, letting teams wire agents into whatever systems they already run. With 33 releases in the window we track, spanning new integrations, audit-log detail, and agent-management controls, it shows active, continuous development.
Cotool is an AI-powered code analysis and security tool that identifies vulnerabilities and provides automated fixes for software development.
How Cotool helps
Which email threats need investigation or remediation right now?
pulls the flagged messages from the connected email security integration and lets the agent trace and act on them directly, without a separate console
Which endpoints or managed accounts have unresolved security findings?
queries endpoint and MSP tooling across organizations, with optional scoping so a single agent run can cover one account or many
Which applications or artifacts carry a known vulnerability or risky attack path?
searches the connected application security integration's inventory of applications, artifacts, and SBOMs and surfaces the issues tied to them
Which network model breaches still need a human decision?
lists breaches from the connected network detection integration and lets the agent acknowledge, reopen, or comment on them directly
Did an agent's work survive the process that was running it?
tracks each run, delegated sub-agent, tool call, waiting prompt, and handoff as durable state, so a restart resumes rather than loses the work
Who or what actually triggered a given agent run?
records API-triggered executions separately from interactive runs in the audit log, so the two are never confused after the fact
Languages
Not documented
Features
43 capabilities across 5 areas
Built from Cotool's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.
- Cotool covers 1 of the 6 ai evaluation and governance capabilities we track.
What Cotool offers you
- Ticketing integration4
- GraphQL API support1
- MCP server1
- REST API1
- Role-based access control1
No capabilities match.
＋ Agent orchestration and lifecycle 5 capabilities Cotool provides the core infrastructure for building, running, and maintaining agents. This covers agent construction, durable execution across interruptions, context handling, and model management. ▸
＋ Durable agent execution shipped Keeps agent runs and all associated sub-tasks alive even when the underlying worker restarts, so no work is lost mid-execution. 8 releases · first seen Sep 2026 ▸
Also counts toward: Ticketing integration
release 8 total
- Sub-agents can now run in the background while sharing the parent chat's sandbox during delegated work. v0.78.0 · Nov 2026 · source · release history
-
New endpoint POST
/api/agents/{agentId}/run-async/{runId}/messages1.0.0 · Oct 2026 · source · release history -
New endpoint GET
/api/agents/{agentId}/run-async/{runId}/messages︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ 1.0.0 · Oct 2026 · source · release history - Allows every agent and chat to delegate focused subtasks to sub-agents. changelog · Oct 2026 · source · release history
- Every agent and chat can now delegate focused subtasks to sub-agents. v0.73.0 · Oct 2026 · source · release history
- Adds delivery tracking to agent runs, showing what each run sent and whether it succeeded, with one-click resend for failed deliveries. v0.71.0 · Sep 2026 · source · release history
＋ Agent model management shipped Guides operators through upgrading the model powering an agent, using research-backed recommendations that require explicit approval before applying. 6 releases · first seen Sep 2026 ▸
release
- GPT-6.1 Terra is now available in the model catalog. v0.78.0 · Nov 2026 · source · release history
- Adds Claude Haiku 5.5 to the model catalog and adds an extra-high reasoning effort level to Claude models. changelog · Oct 2026 · source · release history
- Adds Claude Sonnet 5.5 and GPT-6.1 Sol, plus Latest model options that automatically follow the newest Opus, Sonnet, Sol, Terra, or Luna release. changelog · Oct 2026 · source · release history
- Adds Claude Haiku 5.5 to the model catalog, and adds an extra-high reasoning effort level to Claude models. v0.73.0 · Oct 2026 · source · release history
- Adds Claude Opus 5.5, GPT-6 Sol, and GPT-6 Luna to the model catalog. v0.71.0 · Sep 2026 · source · release history
- Adds guided, user-approved model upgrades for agents with supporting research for each recommendation v0.62.0 · seen Aug 2026 · source · release history
＋ Agent builder shipped Lets operators build agents interactively, with recommendations on which integrations to include based on the agent's instructions. 4 releases · first seen Sep 2026 ▸
release
- Adds Created by and Updated by columns to the Agents list. v0.76.0 · Oct 2026 · source · release history
- Adds JSON editing for Agent Output schemas, including pasted-schema normalization and live Builder and Preview synchronization. changelog · Oct 2026 · source · release history
- Improves agent investigations with dismissed and expired alerts in alert searches, Slack user lookup by email, Wiz Blue Agent analysis retrieval, and Code42 watchlist membership lookups. v0.71.0 · Sep 2026 · source · release history
- Adds instruction-aware integration recommendations directly in the agent builder v0.62.0 · seen Aug 2026 · source · release history
＋ Conversation context management shipped Manages long conversations by compacting context in a provider-native way so the agent retains as much useful history as possible. 3 releases · first seen Oct 2026 ▸
release
- Improves active chats by queueing follow-up messages instead of interrupting the agent's current work. changelog · Oct 2026 · source · release history
- Queues follow-up messages in active chats instead of interrupting the agent's current work. v0.74.0 · Oct 2026 · source · release history
- Improves long conversations with provider-native compaction that preserves more useful context v0.62.0 · seen Aug 2026 · source · release history
＋ Skill version history shipped Records the history of skill versions so operators can review past iterations and roll back to an earlier version if needed. 1 release ▸
release
- Adds skill version history with the ability to inspect and restore earlier versions v0.62.0 · seen Aug 2026 · source · release history
＋ Security tool integrations 5 capabilities Cotool connects agents to a set of dedicated cyber tools covering endpoint, email, network, and application security. Agents can query, investigate, and act on findings within each platform directly. ▸
＋ Barracuda email security integration shipped Connects agents to Barracuda so they can investigate and take remediation action on email threats. 1 release ▸
release
- Adds a Barracuda email security integration for investigating and remediating email threats. v0.63.0 · seen Aug 2026 · source · release history
＋ Darktrace integration shipped Lets agents interact with Darktrace model breaches, including acknowledging, reopening, and adding comments. 1 release ▸
release
- Expands Darktrace with actions to acknowledge, reopen, and comment on model breaches v0.62.0 · seen Aug 2026 · source · release history
＋ Huntress integration shipped Connects agents to Huntress for endpoint threat visibility, with support for MSP and MSSP account structures and optional scoping to a specific organization. 1 release ▸
release
- Expands Huntress support for MSP and MSSP accounts with optional organization scoping v0.62.0 · seen Aug 2026 · source · release history
＋ OX Security integration shipped Lets agents search OX Security for applications, artifacts, and SBOMs, and investigate identified issues and attack paths. 1 release ▸
release
- Adds an OX Security integration to search applications, artifacts, and SBOMs and investigate issues and attack paths. v0.63.0 · seen Aug 2026 · source · release history
＋ Supabase integration shipped Connects agents to Supabase so they can review an organization's project security posture, configuration settings, and logs. 1 release ▸
release
- Adds a Supabase integration for organization and project security posture, configuration review, and project logs. v0.63.0 · seen Aug 2026 · source · release history
＋ Developer and productivity tool integrations 4 capabilities Cotool integrates agents with the collaboration and development platforms teams already use. This allows agents to retrieve context from and act within those systems as part of a broader workflow. ▸
＋ GitHub integration shipped Connects agents to GitHub, supporting multi-organization app scoping and the ability to upload files generated in the agent's sandbox. 2 releases ▸
release
- Adds multi-organization GitHub App installation scoping. v0.63.0 · seen Aug 2026 · source · release history
- Adds support for GitHub tools to upload sandbox-generated files v0.62.0 · seen Aug 2026 · source · release history
＋ Kolide integration shipped Lets agents query Kolide for device and fleet reports, handling parameters that accept multiple values. 1 release ▸
release
- Expands Kolide report queries with improved multi-value parameter handling v0.62.0 · seen Aug 2026 · source · release history
＋ Linear integration shipped Lets agents search Linear issues using full-text queries, with filters for team, status, archive state, and comments. 1 release ▸
Also counts toward: Ticketing integration
release
- Adds full-text Linear issue search with team, status, archive, and comment filters v0.62.0 · seen Aug 2026 · source · release history
＋ Slack integration shipped Allows agents to be triggered from Slack, including by placing an emoji reaction on a message. 1 release ▸
release
- Adds Slack emoji-reaction triggers so reacting to a message can run an agent. v0.63.0 · seen Aug 2026 · source · release history
＋ Administration, alerting, and audit 3 capabilities Cotool gives administrators controls over session behaviour, alert noise, and activity records. These capabilities support operational governance and accountability across the platform. ▸
＋ Alert notification filtering shipped Filters alert notifications so that only escalations at or above a configured severity threshold are surfaced to operators. 9 releases · 3 other sources · first seen Sep 2026 ▸
release 9 total
-
New endpoint PUT
/api/agents/{agentId}/trigger/{triggerId}/alert-created-notification1.0.0 · Nov 2026 · source · release history - Adds suggested dispositions to escalated alerts: confirm a statement about your environment from the alert page or Slack to close the alert, with later triage runs reusing it as context. v0.73.0 · Oct 2026 · source · release history
-
New endpoint PUT
/api/output-destinations/{destinationId}/enabled1.0.0 · Oct 2026 · source · release history -
New endpoint DELETE
/api/output-destinations/{destinationId}︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ 1.0.0 · Oct 2026 · source · release history -
New endpoint GET
/api/mitre/technique-labels︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ 1.0.0 · Sep 2026 · source · release history - Adds Cotool Alerts to the agent tool picker so any agent can search, read, comment on, update, and create alerts. v0.71.0 · Sep 2026 · source · release history
example
-
Route a critical Wiz threat detection to incident.io with a severity floor so only high-severity findings page on-call.
$ In Settings, open Alert Routing, select the Wiz source, add an escalation route to incident.io, and set the severity floor to the minimum severity you want paged.changelog · Oct 2026 · source -
Triage an escalated alert faster by confirming an environment statement directly from the alert page, so future runs skip the same question.
$ In the Cotool alert page, open an escalated alert, then select the suggested disposition and confirm the statement about your environment to close the alert.v0.73.0 · Oct 2026 · source -
Enable an agent to triage and update alerts end-to-end without leaving the agent workflow — useful for auto-escalation or enrichment pipelines.
$ In the agent tool picker, enable 'Cotool Alerts'. The agent can now call search, read, comment on, update, and create alerts as part of its investigation steps.v0.71.0 · Sep 2026 · source
＋ Audit logging shipped suggested Records agent activity in audit logs and distinguishes whether each run was triggered via the API or interactively. 3 releases · first seen Oct 2026 ▸
Suggested capability: LLM application tracing. This is our guess, not confirmed.
release
-
GET
/api/audit-logs/count: param mcpConnectionId (query) added 1.0.0 · Oct 2026 · source · release history -
GET
/api/audit-logs: param mcpConnectionId (query) added 1.0.0 · Oct 2026 · source · release history - Distinguishes API agent executions from interactive runs in audit logs v0.62.0 · seen Aug 2026 · source · release history
＋ Session management shipped Lets administrators set a maximum session length on a per-organization basis. 1 release ▸
release
- Adds a per-organization session length setting in Settings. v0.63.0 · seen Aug 2026 · source · release history
＋ Other 26 capabilities ▸
＋ Alert disposition suggestions shipped Suggests dispositions on escalated alerts so operators can confirm a statement from the alert page or Slack to close the alert, with later triage runs reusing that disposition as context. 6 releases · first seen Oct 2026 ▸
Also counts toward: REST API
release
- Alert workflows now let agents set severity, close true-positive alerts from Slack requests, and keep trigger alerts in one Slack thread through closure. v0.78.0 · Nov 2026 · source · release history
-
New endpoint POST
/api/alerts/feedback-questions/{questionId}/reject1.0.0 · Nov 2026 · source · release history -
New endpoint POST
/api/alerts/feedback-questions/{questionId}/confirm1.0.0 · Nov 2026 · source · release history -
New endpoint GET
/api/alerts/feedback-questions︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ 1.0.0 · Nov 2026 · source · release history -
GET
/api/alerts: param sort (query) added︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ 1.0.0 · Oct 2026 · source · release history - Adds suggested dispositions to escalated alerts: confirm a statement from the alert page or Slack to close the alert, and later triage runs reuse it as context. changelog · Oct 2026 · source · release history
＋ Additional integrations shipped Adds integrations for SEON, Vercel, TruffleHog, Jamf Pro, Material Security, Zoom, and Wiz audit logs, threat detections, and issues, including managed log ingestion and built-in detections where applicable. 3 releases · 2 other sources · first seen Oct 2026 ▸
release
-
Managed log ingestion now supports
AWS,GCP, Cloudflare,CrowdStrike Falcon Data Replicator, Tines audit logs,GitHubaudit logs, and1Passwordaudit events, plus newSentinelOnemanaged log ingestion with threat and alert investigation actions. v0.78.0 · Nov 2026 · source · release history - Jira actions now support setting required fields when creating issues and updating existing issues. v0.78.0 · Nov 2026 · source · release history
-
Adds a
SEONintegration with a dedicated SEON webhook trigger, integrations for Vercel,TruffleHog, Jamf Pro, Material Security, and Zoom with managed log ingestion and built-in detections, and managed log ingestion and detections for Wiz audit logs, threat detections, and issues, and for Sublime… v0.76.0 · Oct 2026 · source · release history
example
-
Enable 1Password audit event ingestion so agents can correlate vault access events with active investigations.
$ In the Cotool console, go to Integrations > Managed Log Ingestion, select '1Password audit events', provide your 1Password Events API token, and save.v0.78.0 · Nov 2026 · source -
Add SentinelOne as a managed log source so agents can investigate threats and take alert actions directly from Cotool.
$ In the Cotool console, go to Integrations > Managed Log Ingestion, select 'SentinelOne', enter your SentinelOne API URL and token, and enable 'Threat and alert investigation actions'.v0.78.0 · Nov 2026 · source
＋ Alert routing configuration shipped Provides API endpoints for managing alert triage routes and hunt-alert routing rules. 5 releases · first seen Oct 2026 ▸
release
- Cotool MCP now includes Hunt, threat intelligence, detection, ingest health, alert routing, and agent follow-up actions. v0.78.0 · Nov 2026 · source · release history
-
New endpoint PATCH
/api/agents/{agentId}/trigger/{triggerId} 1.0.0 · Oct 2026 · source · release history -
New endpoint PUT
/api/alert-routing/hunt-alerts 1.0.0 · Oct 2026 · source · release history -
New endpoint PUT
/api/alert-triage-routes 1.0.0 · Oct 2026 · source · release history -
New endpoint GET
/api/alert-triage-routes︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ 1.0.0 · Oct 2026 · source · release history
＋ incident.io integration shipped Creates incident.io incidents from agent actions, including severity and incident-type lookup, enabling agents to open incidents without leaving the agent workflow. 2 releases · 2 other sources · first seen Oct 2026 ▸
Also counts toward: Ticketing integration
release
-
Adds
incident.ioas an escalation destination, with configurable severity floors per destination.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ v0.76.0 · Oct 2026 · source · release history -
Adds
incident.ioincident creation — including severity and incident-type lookup — to agent actions. changelog · Oct 2026 · source · release history
example
-
Route high-severity incidents to incident.io automatically while keeping low-severity alerts in a separate destination.
$ In the Cotool console, go to Agents > [your agent] > Escalation Destinations, add `incident.io` as a destination, and set the severity floor (e.g.v0.76.0 · Oct 2026 · source -
Automatically open an incident.io incident with the correct severity when an agent detects a confirmed threat — without leaving the agent workflow.
$ In the agent action builder, add the 'incident.io' action, select 'Create Incident', then configure severity and incident-type lookup so the agent resolves both fields at runtime before posting.changelog · Oct 2026 · source
＋ Proofpoint integration shipped Connects to Proofpoint TAP, Essentials, and Threat Response to access threat events, forensics, campaigns, CTR incidents, and block and safe list management. 3 releases · 1 other source · first seen Oct 2026 ▸
release
- Improves Proofpoint triage by showing when a threat was removed from mailboxes and flagging verdicts reached after delivery. v0.76.0 · Oct 2026 · source · release history
- Adds a Proofpoint integration covering TAP, Proofpoint Essentials, and Threat Response, including threat events, forensics, campaigns, CTR incidents, and block and safe list management.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ changelog · Oct 2026 · source · release history
- Adds a Proofpoint integration covering TAP, Proofpoint Essentials, and Threat Response, including threat events, forensics, campaigns, CTR incidents, and block and safe list management.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ v0.73.0 · Oct 2026 · source · release history
example
-
Triage phishing campaigns by connecting Proofpoint TAP — pull forensics and threat events directly into an agent investigation.
$ In the Cotool console, go to Settings > Integrations, select 'Proofpoint', and configure your TAP, Proofpoint Essentials, or Threat Response credentials to enable threat events, forensics, campaigns,…changelog · Oct 2026 · source
＋ Microsoft Sentinel integration shipped Connects to Microsoft Sentinel for queries against both standard and data lake tables, including long-retention investigations of events that have aged out of hot storage, with agent-facing table mapping. 2 releases · 2 other sources · first seen Oct 2026 ▸
release
- Adds Microsoft Sentinel data lake queries and table mapping for long-retention investigations. changelog · Oct 2026 · source · release history
- Adds Microsoft Sentinel data lake queries and table mapping for long-retention investigations. v0.74.0 · Oct 2026 · source · release history
example
-
Run long-retention threat hunts directly against your Sentinel data lake without leaving Cotool.
$ In a Cotool chat, instruct the agent to query Microsoft Sentinel — e.g.changelog · Oct 2026 · source -
Run a long-retention query against Microsoft Sentinel data lake tables to investigate events that have aged out of hot storage.
$ In Cotool, open a chat with the Microsoft Sentinel integration active and ask the agent to query a Sentinel data lake table — the agent maps the table and returns results from the long-retention tier.v0.74.0 · Oct 2026 · source
＋ Sourcegraph integration shipped Connects to Sourcegraph for repository discovery, code search, file and commit retrieval, and read-only GraphQL queries, enabling agents to search an organisation's codebase during investigations. 2 releases · 2 other sources · first seen Oct 2026 ▸
Also counts toward: GraphQL API support
release
- Adds Sourcegraph integration supporting repository discovery, code search, file and commit retrieval, and read-only GraphQL queries.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ changelog · Oct 2026 · source · release history
- Adds Sourcegraph integration supporting repository discovery, code search, file and commit retrieval, and read-only GraphQL queries.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ v0.74.0 · Oct 2026 · source · release history
example
-
Search code across your org's repositories inside a Cotool investigation without leaving the platform.
$ In a Cotool chat, ask the agent to search Sourcegraph for a function or file — e.g.changelog · Oct 2026 · source -
Search your organisation's codebase for a suspicious function or string during an investigation without leaving Cotool.
$ In Cotool, open a chat and connect the Sourcegraph integration, then ask the agent to search repositories for a target string — results include file contents, commits, and read-only GraphQL query…v0.74.0 · Oct 2026 · source
＋ Microsoft Entra response actions shipped Allows agents to disable a compromised Microsoft Entra user and revoke their active sessions as part of incident response. 1 release · 2 other sources · first seen Oct 2026 ▸
release
- Adds response actions to reset Google Workspace user passwords and to disable Microsoft Entra users and revoke their sessions. v0.76.0 · Oct 2026 · source · release history
example
-
Automatically lock out a compromised Microsoft Entra account and kill active sessions as part of an agent-driven incident response.
$ In an agent playbook, add the 'Disable Microsoft Entra user and revoke sessions' response action, providing the user identifier from the alert context.changelog · Oct 2026 · source -
Automatically disable a compromised Microsoft Entra user and revoke their active sessions as part of an incident response playbook.
$ In the Cotool console, go to Agents > [your agent] > Response Actions, select 'Disable Microsoft Entra user and revoke sessions', and bind it to the relevant alert trigger.v0.76.0 · Oct 2026 · source
＋ Databricks integration shipped Connects to Databricks using service principal authentication for read-only queries, step-by-step table discovery, and a weekly table map for agents and detection planning. 3 releases · first seen Oct 2026 ▸
release
- Improves Code42, Databricks, and Wiz connections with actor search, scoped OAuth secrets, and region validation before saving. v0.76.0 · Oct 2026 · source · release history
- Rebuilds the Databricks integration with faster read-only queries, service principal authentication, step-by-step table discovery, and a weekly map of Databricks tables for agents and detection planning. changelog · Oct 2026 · source · release history
- Rebuilds the Databricks integration with faster, read-only queries, service principal authentication, step-by-step table discovery, and a weekly map of Databricks tables for agents and detection planning. v0.73.0 · Oct 2026 · source · release history
＋ Role permissions management shipped Lets administrators grant access to all current and future resources while selectively excluding specific ones using an 'all except' permission model. 2 releases · 1 other source · first seen Oct 2026 ▸
Also counts toward: Role-based access control
release
- Adds all except role permissions so administrators can grant access to every current and future resource except selected exclusions. changelog · Oct 2026 · source · release history
- Adds all except role permissions so administrators can grant access to every current and future resource except selected exclusions. v0.74.0 · Oct 2026 · source · release history
example
-
Grant a new analyst role access to all current and future resources while explicitly blocking sensitive exclusions.
$ In Cotool, go to Settings > Roles, create or edit a role, select 'All except' under resource permissions, and add the specific resources to exclude — future resources are covered automatically…changelog · Oct 2026 · source
＋ Proxycheck.io integration shipped Queries proxycheck.io to score IPs and emails for proxy, VPN, TOR, and risk indicators during investigations. 2 releases · 1 other source · first seen Oct 2026 ▸
release
- Adds a proxycheck.io integration for IP and email reputation, including proxy, VPN, TOR, and risk scoring. changelog · Oct 2026 · source · release history
- Adds a proxycheck.io integration for IP and email reputation, including proxy, VPN, TOR, and risk scoring. v0.73.0 · Oct 2026 · source · release history
example
-
Use the proxycheck.io integration to score an IP for proxy, VPN, TOR, and risk indicators during an investigation.
$ In the Cotool agent chat, prompt the agent to check an IP address using the proxycheck.io integration for proxy, VPN, TOR, and risk scoring to determine whether traffic is anonymized.v0.73.0 · Oct 2026 · source
＋ Custom OpenAPI integrations shipped Lets operators connect any service that exposes an OpenAPI or Swagger specification by configuring authentication, operations, and approval requirements, without requiring a built-in connector. 1 release · 1 other source · first seen Nov 2026 ▸
release
-
Adds new integrations: custom integrations built from OpenAPI and Swagger specifications with configurable authentication, operations, and approval requirements, a new
ArmorCodeintegration for security finding management, and a newHaveIBeenPwnedintegration for breach exposure checks.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ v0.78.0 · Nov 2026 · source · release history
example
-
Wire up an internal ticketing or threat-intel service that has no built-in connector, using its OpenAPI spec with API-key auth.
$ In the Cotool console, go to Integrations > Add Integration, select 'OpenAPI / Swagger', paste the spec URL or upload the file, configure authentication (API key, OAuth, or none), choose which…v0.78.0 · Nov 2026 · source
＋ Google Workspace response actions shipped Allows agents to reset Google Workspace user passwords as part of incident response. 2 releases · first seen Oct 2026 ▸
release
- Google Workspace domain-wide delegation now includes Alert Center access for agents. v0.78.0 · Nov 2026 · source · release history
- Adds response actions to reset Google Workspace user passwords and to disable Microsoft Entra users and revoke their sessions. v0.76.0 · Oct 2026 · source · release history
＋ Agent email sending shipped Lets agents send email to an allowlist of recipients, such as replying to employees who reported phishing. 1 release · 1 other source · first seen Oct 2026 ▸
release
- Adds a Cotool Email tool so agents can send email to an allowlist of recipients (e.g. replying to employees who reported phishing). v0.76.0 · Oct 2026 · source · release history
example
-
Let an agent reply to employees who self-reported phishing without exposing an unrestricted outbound email channel.
$ Enable the Cotool Email tool for your phishing-triage agent and configure the recipient allowlist to include only your internal reporting alias.changelog · Oct 2026 · source
＋ Agent run quality alerting shipped Sends notifications to an agent's failure destinations when a run's evaluation score falls below a configured minimum threshold. 1 release · 1 other source · first seen Oct 2026 ▸
Shared capability: Model evaluation
release
- Adds notifications to an agent's failure destinations when a run's evaluation score falls below a minimum threshold you set. v0.76.0 · Oct 2026 · source · release history
example
-
Get alerted when an agent run performs poorly, so you can catch degraded automation before it misses real threats.
$ In the Cotool console, go to Agents > [your agent] > Failure Destinations, enable evaluation score alerting, and set the minimum score threshold — notifications fire to the configured failure…v0.76.0 · Oct 2026 · source
＋ Git-managed agent routing shipped Surfaces direct links to source YAML and marks alert-routing triggers as read-only when agents are managed via Git. 2 releases · first seen Oct 2026 ▸
release
- Improves Git-managed agents with direct links to their source YAML and read-only synced triggers in alert routing. changelog · Oct 2026 · source · release history
- Adds direct links to source YAML and read-only synced triggers in alert routing for Git-managed agents. v0.74.0 · Oct 2026 · source · release history
＋ Interface and navigation shipped Provides a refreshed UI with a redesigned sidebar, unified page headers, consistent light and dark mode, and grouped chat work summaries. 2 releases · first seen Oct 2026 ▸
release
- Delivers a refreshed interface with a consistent light/dark design, redesigned sidebar, unified page headers and lists, and cleaner chat transcripts grouped into single work summaries. changelog · Oct 2026 · source · release history
- Introduces a refreshed Cotool interface with a redesigned sidebar, unified page headers, consistent light and dark mode, and grouped chat work summaries. v0.74.0 · Oct 2026 · source · release history
＋ MITRE ATT&CK coverage shipped Maintains MITRE ATT&CK technique coverage, currently at v19.2, with new ATT&CK releases applied automatically. 2 releases · first seen Sep 2026 ▸
release
-
GET
/api/detections/hits: param excludeAlerted (query) added; param includeSummary (query) added; param requireExperiment (query) added 1.0.0 · Oct 2026 · source · release history - Updates MITRE ATT&CK coverage to v19.2, with new ATT&CK releases now applying automatically. v0.71.0 · Sep 2026 · source · release history
＋ Sandbox network controls shipped Lets administrators define which hosts and ports agent sandboxes are permitted to reach. 2 releases · first seen Sep 2026 ▸
release
- Adds per-agent sandbox network overrides and a clearer allowlist editor. changelog · Oct 2026 · source · release history
- Adds Sandbox network settings so administrators control which hosts and ports agent sandboxes can reach.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ v0.71.0 · Sep 2026 · source · release history
＋ Cisco Umbrella integration shipped Connects to Cisco Umbrella for DNS activity and domain reputation lookups, with approval-gated remediation of destination lists. 1 release · first seen Oct 2026 ▸
release
- Adds a Cisco Umbrella integration for DNS activity and domain reputation, with approval-gated destination list remediation. v0.77.0 · Oct 2026 · source · release history
＋ MCP server shipped Exposes the tool's capabilities as an MCP server so it can be used from compatible AI clients such as ChatGPT, Claude, Cursor, Codex, and VS Code using existing login and permissions. 1 release · first seen Oct 2026 ▸
Also counts toward: MCP server
release
- Adds Cotool MCP so Cotool can be used from ChatGPT, Claude, Cursor, Codex, VS Code, and custom AI clients using existing login and permissions.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ v0.77.0 · Oct 2026 · source · release history
＋ Tailscale integration shipped Connects to Tailscale using scoped OAuth client credentials. 1 release · first seen Oct 2026 ▸
release
- Enhances Tailscale connections with scoped OAuth client credentials. v0.77.0 · Oct 2026 · source · release history
＋ Detection auto-tuning shipped Automatically updates customized detections to use new library versions so they remain current without manual intervention. 1 release · first seen Oct 2026 ▸
release
- Enables customized detections to pick up new library versions through auto-tuning instead of falling behind. v0.76.0 · Oct 2026 · source · release history
＋ Integration reliability under rate limits shipped Handles provider concurrency and rate-limit errors for Splunk, Freshservice, and Vectra to reduce failed requests. 1 release · first seen Oct 2026 ▸
release
- Improves Splunk, Freshservice, and Vectra reliability when provider concurrency or rate limits are reached. changelog · Oct 2026 · source · release history
＋ HackerOne integration shipped Allows agents to comment on, change the state of, and close HackerOne reports. 1 release · first seen Oct 2026 ▸
Also counts toward: Ticketing integration
release
- Agents can now comment on, change the state of, and close HackerOne reports. v0.73.0 · Oct 2026 · source · release history
＋ AWS assume-role authentication shipped Supports AWS CLI assume-role authentication for agent deployments in EU regions. 1 release · first seen Sep 2026 ▸
release
- Adds AWS CLI assume-role authentication for EU deployments. v0.71.0 · Sep 2026 · source · release history
Lines in monospace are the tool's own words: help text
parsed from its source, or an endpoint from its API document. Under
release, a line is our summary of a dated release. Under
docs, it is quoted from the tool's own documentation or
website. Each links back to the source it came from.
Release-note detail over time
See how much detail Cotool puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.
Checking release-note history…
Releases
2 entries
No entries match these filters.
- August 20262
Add the badge to your README
Maintain this project? The badge links readers straight to this page, so they can follow every release here.
Choose a badge style and copy the code →