> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kontext.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Data collection

> Control the tool call data endpoints send and review what Kontext collects.

Owners and admins control collection under **Settings → Data Collection**. You can set **Resource scan** and **Payload capture mode** independently.

## Payload capture mode

You choose how much tool call input and output endpoints send. The setting applies to every endpoint and agent.

| Option            | What endpoints send and Kontext stores                                        |
| ----------------- | ----------------------------------------------------------------------------- |
| **Omitted**       | Size-only input and output payload records.                                   |
| **Summaries**     | Redacted summaries of tool parameters. This is the default.                   |
| **Full payloads** | Redacted tool inputs and outputs, including command output and file contents. |

Even with **Omitted**, endpoints still send redacted command and request summaries. For calls Merlin flags, they also send redacted user-request and tool-history context.

Endpoints report each tool call's decision, mode, tool, endpoint and timing with every option, including **Omitted**.

Endpoints apply changes to new tool calls after receiving the setting. **Full payloads** cannot recover earlier content. Choose the setting before you need that content. Decisions alone are enough to see what a policy would block. Choose **Full payloads** if you need to see arguments, file contents or destinations when you investigate.

Kontext redacts secrets and credential values before storing payloads. It also limits payload size. Redaction looks for credentials, so other confidential content in files or command output can still get through. Choose the setting based on the data your agents handle. In Explore, Kontext marks redacted payloads with **Secrets redacted**.

## Resource scan

Kontext scans agent configuration on every endpoint. The scan reads MCP servers, plugins, permission settings and whether credentials exist. The report includes credential presence but excludes secret values. The dashboard uses the scan for the **Elevated access** and **Resources** cards on [Home](/home/overview).

Kontext enables the scan by default. When you turn it off, the dashboard asks you to confirm before deleting stored resource reports. Tool call records and payload capture stay unchanged.

Run `kontext report` on an endpoint to see its last report. Use `kontext report --json` for machine-readable output.

## Usage data for Cost

For [Cost](/cost/overview), endpoints read agents' local session files. They send model names, token counts, timing and links to each model request's tool calls. Endpoints exclude prompt text, model reasoning, tool arguments and tool output from usage records. Endpoints send usage records even with **Omitted** payload capture. See [how cost is calculated](/cost/how-cost-is-calculated).

## Risk detection

Kontext runs Risk detectors on the endpoint and records findings with the decision. For flagged tool calls, Kontext runs a hosted AI assessment of the redacted tool call and nearby session context. The endpoint decides without waiting for the assessment. The local guardrail model is off by default. You can turn it on or off per endpoint with **Guardrail LLM** on Home. See [detection](/risk/detection).

## Local records and removal

Each endpoint makes and records decisions locally. The endpoint exports records to your workspace in the background. The dashboard may show them after a short delay.

`kontext setup --uninstall` preserves the endpoint's local identity and records and prints their paths. The command leaves the Homebrew binary installed. Your workspace keeps the endpoint's recorded activity. To delete hosted records, follow your workspace's agreed retention and deletion process.