> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kontext.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Quickstart

> Connect your first endpoint from the Get started page and find its first session in Explore.

Use this guide to set up Kontext on a macOS endpoint. For MDM setup, follow [Deploy Kontext](/deploy/overview).

## Before you start

* You are an owner or admin of a [Kontext workspace](https://app.kontext.security). Other members see a note on **Get started** asking them to contact an owner or admin.
* Your endpoint runs macOS with Homebrew and Claude Code or Codex installed.
* You have administrator access to the endpoint. Kontext setup may ask for your password to write Claude Code's managed settings file.

The dashboard opens **Get started** and locks other pages until you finish setup.

## Set up

<Steps>
  <Step title="Connect the endpoint">
    Open **Get started** and expand the first step. Run the two commands in Terminal:

    ```bash theme={"system"}
    brew install kontext-security/tap/kontext
    kontext setup --token <your personal API key>
    ```

    The dashboard creates a personal API key and inserts it into the second command. The key attaches one endpoint to you. You must use it within 24 hours. Keep the command private. To keep the key out of your shell history, run `kontext setup` on its own and paste the key at the prompt.

    Kontext setup stores the key in your login keychain. It installs hooks for Claude Code and Codex and starts the background daemon. You can launch your agents as usual.

    If you use Codex, open `/hooks` in Codex and trust the Kontext hooks. Codex only runs them after you do.

    The dashboard shows **Connected** once the endpoint checks in.
  </Step>

  <Step title="Take the tour">
    Select **Start tour** to open a one-minute tour of a demo workspace. The tour shows where agents run, their activity and cost, and how policies work. You can skip it and return with **Replay tour**.
  </Step>

  <Step title="Send a trace">
    Select your agent and run the dashboard's command inside a Git repository. For Claude Code:

    ```bash theme={"system"}
    claude -p 'Use Bash to run git status --short. Summarize whether this workspace has uncommitted changes. Do not modify files.' --allowedTools Bash
    ```

    For Codex:

    ```bash theme={"system"}
    codex exec --sandbox read-only 'Run git status --short and summarize whether this workspace has uncommitted changes. Do not modify files.'
    ```

    Each command makes one read-only tool call. When the workspace receives it, the dashboard shows **Received** and previews the trace.
  </Step>

  <Step title="Finish setup">
    Select **Finish setup** to turn off demo data and unlock the rest of the dashboard. You can then select **View trace** to open the session in Explore.
  </Step>
</Steps>

## Check the endpoint

Run these commands on the endpoint:

```bash theme={"system"}
kontext doctor
kontext whoami
```

`kontext doctor` checks the daemon, agent hooks, and activity export. It reports `not installed (agent not present)` for an agent missing from the endpoint. This result indicates no problem. `kontext whoami` prints the workspace and the API key's owner.

Then open [**Home**](/home/overview) and select your endpoint. The hooks for the agent you used should show **Installed**.

If **Explore** does not show the tool call, follow [troubleshooting](/deploy/troubleshooting).

## Next steps

<CardGroup cols={2}>
  <Card title="Add a policy" href="/policies/add-a-policy">
    Review what a preset such as **Block GitHub force pushes** would block in the **Observing** list before you enforce it.
  </Card>

  <Card title="Read a session" href="/explore/overview">
    Open a session to review each tool call's policy decision and outcome.
  </Card>

  <Card title="Review risk" href="/risk/overview">
    Review the tool calls Kontext flagged and its reasons.
  </Card>

  <Card title="Connect more endpoints" href="/deploy/overview">
    Add endpoints one at a time, or roll Kontext out through your MDM.
  </Card>
</CardGroup>