> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kontext.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Claude Cowork EDR integration

> What the Kontext sensor observes in the local Cowork VM, where it sends data, and how to deploy and remove it.

The Kontext sensor is in development. It is designed to observe supported tool calls in the local Claude Cowork virtual machine (VM) on a device running Claude Desktop. Cowork sessions hosted by Anthropic and activity on the host operating system are outside that scope.

The initial package is designed for detection. It will record activity and policy results while tool calls continue. Deployment requires Anthropic approval and a Claude Desktop release that recognizes the Kontext signing key.

## Planned data collection

The sensor is designed to report tool call activity from inside the VM to the deploying customer's Kontext workspace. We will document which fields the package sends and how the workspace's [data collection settings](https://docs.kontext.security/deploy/data-collection.md) apply to those fields before rollout.

The sensor will retrieve policy and send reports over HTTPS on TCP port 443 to `api.kontext.security`, or to the Kontext API URL configured by the customer. It will authenticate with a customer-scoped install token that an admin can revoke in Kontext. Keep that token out of the Claude Desktop install arguments file, which is for identifiers.

## Deploy and verify

Follow these steps once Anthropic approves the integration and Kontext supplies a signed package and vendor ID. Use a Claude Desktop release that includes that vendor ID and key and meets [Anthropic's platform requirements](https://support.claude.com/en/articles/17828685-run-your-endpoint-detection-and-response-edr-sensor-in-claude-cowork-on-claude-desktop). Use the package for the VM's CPU architecture: arm64 for Apple silicon Macs and Arm-based Windows PCs, x86\_64 for Intel Macs and x64 Windows PCs.

1. Copy the package and its detached signature, named as the package plus `.sig`, into one folder that ordinary users can't write to, nor any folder above it. On Windows, use the system drive and no symbolic links or junctions on the path.
2. Set `coworkEDRIntegration` to the full package path and `coworkEDRIntegrationVendor` to Kontext's vendor ID, in lower case. On macOS, set both in an MDM profile. On Windows, set both as string values under `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Claude`.
3. Quit and reopen Claude Desktop. On Windows, quit with **File → Exit**.

When the local VM starts, Claude Desktop verifies the package and runs its installer. The sensor is designed to run as an unprivileged user without Linux capabilities or kernel modules. Deploy a new signed package to update it.

Start a local Cowork session and run a harmless tool call, such as listing a directory. Find the session and tool call in [Explore](https://docs.kontext.security/explore/overview.md) to verify reporting. If activity is missing, open the Claude Desktop diagnostic report and read `cowork-edr-integration.txt`. A run marked `kind=installed` means the installer exited without an error, not that the sensor is running. When the installer fails, the file shows the end of its output.

## Stop future installs

Clear the `coworkEDRIntegration` setting through device management to stop future installs. An installed sensor requires a separate uninstall procedure. Previously reported activity remains in the workspace and follows your workspace's retention and deletion process.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.