Quickstart

Connect your first endpoint from the Get started page and find its first session in Explore.

Use this guide to set up Kontext on a macOS endpoint. For MDM setup, follow Deploy Kontext.

Before you start

• You are an owner or admin of a Kontext workspace. Other members see a note on Get started asking them to contact an owner or admin.
• Your endpoint runs macOS with Homebrew and Claude Code or Codex installed.
• You have administrator access to the endpoint. Kontext setup may ask for your password to write Claude Code’s managed settings file.

The dashboard opens Get started and locks other pages until you finish setup.

Set up

1. Connect the endpoint

   Open Get started and expand the first step. Run the two commands in Terminal:

   brew install kontext-security/tap/kontext
   kontext setup --token <your personal API key>
   

   The dashboard creates a personal API key and inserts it into the second command. The key attaches one endpoint to you. You must use it within 24 hours. Keep the command private. To keep the key out of your shell history, run kontext setup on its own and paste the key at the prompt.

   Kontext setup stores the key in your login keychain. It installs hooks for Claude Code and Codex and starts the background daemon. You can launch your agents as usual.

   If you use Codex, open /hooks in Codex and trust the Kontext hooks. Codex only runs them after you do.

   The dashboard shows Connected once the endpoint checks in.

2. Take the tour

   Select Start tour to open a one-minute tour of a demo workspace. The tour shows where agents run, their activity and cost, and how policies work. You can skip it and return with Replay tour.

3. Send a trace

   Select your agent and run the dashboard’s command inside a Git repository. For Claude Code:

   claude -p 'Use Bash to run git status --short. Summarize whether this workspace has uncommitted changes. Do not modify files.' --allowedTools Bash
   

   For Codex:

   codex exec --sandbox read-only 'Run git status --short and summarize whether this workspace has uncommitted changes. Do not modify files.'
   

   Each command makes one read-only tool call. When the workspace receives it, the dashboard shows Received and previews the trace.

4. Finish setup

   Select Finish setup to turn off demo data and unlock the rest of the dashboard. You can then select View trace to open the session in Explore.

Check the endpoint

Run these commands on the endpoint:

kontext doctor
kontext whoami

kontext doctor checks the daemon, agent hooks, and activity export. It reports not installed (agent not present) for an agent missing from the endpoint. This result indicates no problem. kontext whoami prints the workspace and the API key’s owner.

Then open Home and select your endpoint. The hooks for the agent you used should show Installed.

If Explore does not show the tool call, follow troubleshooting.

Next steps

Add a policy

Review what a preset such as Block GitHub force pushes would block in the Observing list before you enforce it.

Read a session

Open a session to review each tool call’s policy decision and outcome.

Review risk

Review the tool calls Kontext flagged and its reasons.

Connect more endpoints

Add endpoints one at a time, or roll Kontext out through your MDM.