Quickstart

Connect your first endpoint from the Get started page and find its first session in Explore.

Use this guide to set up Kontext on a macOS endpoint. For MDM setup, follow Deploy Kontext.

​

Before you start

• You are an owner or admin of a Kontext workspace. Other members see a note on Get started asking them to contact an owner or admin.
• Your endpoint runs macOS with Homebrew and Claude Code or Codex installed.
• Setup needs no administrator access. It writes only files in your home folder and never asks for your password.

The dashboard opens Get started and locks other pages until you finish setup.

​

Set up

1. Connect the endpoint

   Open Get started and expand the first step. Run the two commands in Terminal:

   brew install --cask kontext-security/tap/kontext
   kontext setup --token <your personal API key>
   

   The dashboard creates a personal API key and inserts it into the second command. The key attaches one endpoint to you. You must use it within 24 hours. Keep the command private. To keep the key out of your shell history, run kontext setup on its own and paste the key at the prompt.

   Kontext setup stores the key in your login keychain. It installs hooks for Claude Code, Codex and Cursor in your home folder, without sudo, and starts the background daemon. You can launch your agents as usual.

   The cask updates itself: the daemon upgrades it through Homebrew and restarts on the new version. If you prefer the homebrew-core formula (brew install kontext), update it with brew upgrade kontext. Homebrew does not allow formulae to update themselves.

   If you use Codex, open /hooks in Codex and trust the Kontext hooks. Codex only runs them after you do.

   The dashboard shows Connected once the endpoint checks in.

2. Take the tour

   Select Start tour to open a one-minute tour of a demo workspace. The tour shows where agents run, their activity and cost, and how policies work. You can skip it and return with Replay tour.

3. Send a trace

   Select your agent and run the dashboard’s command in any folder. For Claude Code:

   claude -p 'Use Bash to run ls. Summarize what this folder contains in one sentence. Do not modify files.' --allowedTools Bash
   

   For Codex:

   codex exec --skip-git-repo-check --sandbox read-only 'Run ls and summarize what this folder contains in one sentence. Do not modify files.'
   

   Each command makes one read-only tool call. When the workspace receives it, the dashboard shows Received and previews the trace.

4. Finish setup

   Select Finish setup to turn off demo data and unlock the rest of the dashboard. You can then select View trace to open the session in Explore.

​

Check the endpoint

Run these commands on the endpoint:

kontext doctor
kontext whoami

kontext doctor checks the daemon, agent hooks, and activity export. It reports not installed (agent not present) for an agent missing from the endpoint. This result indicates no problem. kontext whoami prints the workspace and the API key’s owner.

Then open Home and select your endpoint. The hooks for the agent you used should show Installed.

If Explore does not show the tool call, follow troubleshooting.

​

Next steps

Add a policy

Review what a preset such as Block GitHub force pushes would block in the Observing list before you enforce it.

Read a session

Open a session to review each tool call’s policy decision and outcome.

Review risk

Review the tool calls Kontext flagged and its reasons.

Connect more endpoints

Add endpoints one at a time, or roll Kontext out through your MDM.