llms.txt
# MindFort
> MindFort deploys autonomous security agents that continuously pen test web apps, APIs, and infrastructure, prove every finding with a working exploit, and open a validated patch, completely unattended.
- Agents run continuously on a cadence you set, at any scale, probing targets like an attacker would, rather than point-in-time scanning.
- Each finding is validated with a working exploit, keeping false positives under 1%, and ships with a contextual patch and a threat model explaining the fix.
- Assessment modes trade speed for depth: Balanced (200 credits, ~4 hrs, frequent/daily use), Deep (400 credits, ~6 hrs, weekly/bi-weekly), and Ultra (800 credits, ~8 hrs, pre-release and release gates). Task agents (1 credit) handle smaller, directed work like validating findings or triaging bug bounty reports. Retesting a finding after a fix costs 1 credit, and generating a fix pull request (patch) for a finding costs 1 credit. All draw from the same credit pool.
- Access-control testing: dual credential mode runs an assessment with two stored accounts (for example, users in different tenants, or a user and an admin) to find IDOR, broken object-level authorization, role bypass, and cross-tenant access. Agents authenticate through SSO redirect flows and authenticator app (TOTP), SMS, and email MFA.
- Plans: Free ($0, 200 credits, about 1 pen test, 1 target), Starter (from $199/month, 400 credits/month, 1 concurrent assessment, 1 target), Scale (from $999/month, 800 credits/month, 5 concurrent assessments, unlimited targets), and Enterprise (custom credits and concurrency, unlimited targets). Scale and Enterprise can also buy one-time credit packs with volume discounts up to 30%, and enable usage-based billing for overage.
- Remediation spans code (PRs in GitHub), cloud config (AWS/Azure/GCP IAM, security groups), and issue tracking (Jira, Linear).
- For full technical and API documentation, see the separate docs site and its own llms.txt.
## Core pages
- [Home](https://www.mindfort.ai/): Overview of the platform, continuous AI pen testing, exploit validation, and automated remediation.
- [Product](https://www.mindfort.ai/product): How agents detect, validate, and remediate across code, cloud infrastructure, and network configurations.
- [Pricing](https://www.mindfort.ai/pricing): Plans, credits per assessment mode, task agent, retest, and patch costs, and a competitor comparison.
- [About](https://www.mindfort.ai/about): Company mission, the case for autonomous security, and the founding team.
- [Support](https://www.mindfort.ai/support): Contact, demo booking, and answers to common product, pricing, and technical questions.
## Solutions
- [Enterprise Security Teams](https://www.mindfort.ai/solutions/enterprise): Continuous pen testing for enterprise security teams. Agents run inside your guardrails with SSO, RBAC, approval workflows, compliance evidence, and a full audit trail.
- [Startup Engineering](https://www.mindfort.ai/solutions/startups): Continuous pen testing for startup engineering teams. Test every release, get fixes as pull requests, and pass security reviews without hiring a security team.
- [Legacy IT](https://www.mindfort.ai/solutions/legacy-it): Continuous pen testing for legacy applications. Agents test the running app from the outside, map what is still exposed, and prove every fix, with or without source access.
## Use cases
- [Continuous Pen Testing](https://www.mindfort.ai/use-cases/continuous-pentesting): AI agents pen test live apps and APIs around the clock, confirming real exploits before attackers do.
- [Security Code Review](https://www.mindfort.ai/use-cases/code-analysis): Static and dynamic analysis to find exploitable flaws across source, dependencies, and the running app.
- [Business Logic Testing](https://www.mindfort.ai/use-cases/business-logic-testing): Agents chain legitimate app features into real abuse, like price manipulation, checkout bypass, and privilege escalation, that scanners can't find.
- [Attack Surface Management](https://www.mindfort.ai/use-cases/surface-management): Agents discover the domains, APIs, and forgotten environments you expose, then test them continuously as your surface changes.
- [Vulnerability Triage](https://www.mindfort.ai/use-cases/triaging): Agents validate, deduplicate, and risk-score every finding so teams only see what's real and what matters.
- [Remediation](https://www.mindfort.ai/use-cases/remediation): Agents generate, test, and open pull requests for confirmed vulnerabilities to speed up MTTR.
- [Security Reporting](https://www.mindfort.ai/use-cases/reporting): Pen test reports and audit evidence generated as agents work, exportable for SOC 2, ISO 27001, and customer security reviews.
- [Custom Security Tasks](https://www.mindfort.ai/use-cases/custom-tasks): Describe a security task in plain language and agents execute it: your playbooks, checks, and one-off investigations, on demand or on a schedule.
- [Agent Context](https://www.mindfort.ai/use-cases/context): Upload architecture docs, policies, and accepted risks, and agents apply them on the next run to cut findings you already knew about.
- [Coverage](https://www.mindfort.ai/use-cases/coverage): Agents track a security hypothesis for every part of your attack surface and re-test it each assessment, so you can prove what's been tested.
## Trust and security
- [Trust Center](https://app.vanta.com/mindfort.ai/trust/3jfz4wb9s0n5q04a1gl7u): Request access to the SOC 2 Type II report and security documentation, hosted by Vanta. Security contact: security@mindfort.ai.
- [Safety](https://www.mindfort.ai/safety): How agents are scoped, constrained, and monitored during testing.
- [Terms of Service](https://www.mindfort.ai/terms) and [Privacy Notice](https://www.mindfort.ai/privacy).
## Documentation
- [Docs home](https://docs.mindfort.ai): Setup, onboarding, assessments, findings, reporting, and integrations.
- [Docs index (llms.txt)](https://docs.mindfort.ai/llms.txt): Machine-readable index of all documentation, API reference, and MCP guides.
- [Quick Start](https://docs.mindfort.ai/quickstart): From account creation to your first completed assessment.
- [Dual Credentials](https://docs.mindfort.ai/guides/dual-credentials): Two-account assessments for IDOR, role bypass, and cross-tenant isolation testing.
- [Authentication & Credentials](https://docs.mindfort.ai/guides/authentication-credentials): Password, SSO, TOTP, SMS, email MFA, magic link, and API credentials for authenticated testing.
- [API Introduction](https://docs.mindfort.ai/api-reference/introduction): Programmatically trigger assessments, tasks, and findings via REST.
- [MCP Server](https://docs.mindfort.ai/guides/mcp): Connect Cursor, Claude Code, or Codex to MindFort findings.
## Optional
- [Y Combinator profile](https://www.ycombinator.com/companies/mindfort): Company background, team, and hiring (YC X25).
