Skip to main content
You can deploy Kontext yourself or through your MDM. Both methods install the same CLI, daemon and hooks. Claude Code hooks are system-wide in both cases. What Kontext installs lists every file.

​
Self-serve

Owners and admins can connect an endpoint from Get started. The dashboard supplies two commands with a personal API key already filled in:
A personal API key links one endpoint to its creator. You must use it within 24 hours. To connect another endpoint, run a new command from Get started on that endpoint. See the quickstart for the full process. In self-serve workspaces, owners and admins can create workspace API keys under Settings → API Keys with Generate key. A workspace API key has no associated person. Home shows a note on endpoints that use one. The dashboard shows each API key once. Revoking an API key immediately stops every endpoint using it from reporting. To rotate an API key, run kontext setup with the new key on the endpoint. Check it with kontext whoami before you revoke the old key.

​
MDM-managed

Enterprise workspaces deploy Kontext through their MDM. Every workspace member can open Deployments. Owners and admins can download artifacts.
  • Release summary shows the latest version and the release and artifact counts.
  • Deployment scripts contains the Installation Command, Condition Script and Removal Script. Copy or download each script, then paste it into the matching field of your MDM’s software item. The dashboard shows each script’s SHA-256 checksum. A badge marks scripts that changed since the last release.
  • Releases lists each version with its status and artifacts. Expand a release to read its changes, required admin actions and deployment instructions. You can download each artifact and copy its SHA-256 checksum.
MDM customers receive their workspace API key from their Kontext contact during onboarding. Settings → API Keys is only available in self-serve workspaces. Your MDM passes the workspace API key to the Installation Command through a secret variable. Open View full script to find the variable name. System-wide configuration overrides self-serve configuration. Interactive kontext setup offers to remove the managed setup before continuing. Decline this prompt on an MDM-managed endpoint and change its configuration through your MDM. Non-interactive setup refuses to continue.

​
Policy mode on managed endpoints

The package configuration sets each endpoint’s mode to observe, enforce or remote. With remote, the endpoint follows the mode you set on the Policies page. With observe or enforce, the endpoint uses the package’s fixed mode. The dashboard shows a warning badge on Policies when tool call decisions use a different mode from the dashboard setting. See rollout.

​
Roll out

  1. Deploy the package to one pilot endpoint.
  2. Run kontext doctor on it and fix the reported problems.
  3. Find the endpoint on Home and check that its hooks show Installed.
  4. Run one small tool call and find it in Explore.
  5. Deploy to a small group, then to the fleet.
To update, deploy the new release through your MDM. Once the endpoint runs the new version, its drawer on Home shows that version.

​
Remove Kontext

On a self-serve endpoint, run kontext setup --uninstall, then brew uninstall kontext. Kontext removes the daemon and hooks. It removes API keys from the keychain. It keeps local records and logs and prints their paths. On an MDM-managed endpoint, run the Removal Script through your MDM. Remove endpoint on Home only removes the endpoint from the list. Kontext keeps running on it until you uninstall it. The endpoint reappears on its next check-in.