> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kontext.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Deploy Kontext

> Connect endpoints from Get started or deploy Kontext through your MDM from Deployments.

You can deploy Kontext yourself or through your MDM. Both methods install the same CLI, daemon and hooks.

|                 | Self-serve                                          | MDM-managed                           |
| --------------- | --------------------------------------------------- | ------------------------------------- |
| Suits           | Small teams, pilots, individual developers          | Company fleets                        |
| Where you start | **Get started**                                     | **Deployments**                       |
| Who installs    | The person using the endpoint                       | Your MDM                              |
| API key         | A personal API key links the endpoint to one person | Your MDM supplies a workspace API key |
| Hook scope      | The person's own Codex settings                     | System-wide Codex settings            |

Claude Code hooks are system-wide in both cases. [What Kontext installs](/deploy/what-kontext-installs) lists every file.

## Self-serve

Owners and admins can connect an endpoint from **Get started**. The dashboard supplies two commands with a personal API key already filled in:

```bash theme={"system"}
brew install kontext-security/tap/kontext
kontext setup --token <your personal API key>
```

A personal API key links one endpoint to its creator. You must use it within 24 hours. To connect another endpoint, run a new command from **Get started** on that endpoint. See the [quickstart](/getting-started/quickstart) for the full process.

In self-serve workspaces, owners and admins can create workspace API keys under **Settings → API Keys** with **Generate key**. A workspace API key has no associated person. Home shows a note on endpoints that use one. The dashboard shows each API key once. Revoking an API key immediately stops every endpoint using it from reporting.

To rotate an API key, run `kontext setup` with the new key on the endpoint. Check it with `kontext whoami` before you revoke the old key.

## MDM-managed

Enterprise workspaces deploy Kontext through their MDM. Every workspace member can open **Deployments**. Owners and admins can download artifacts.

* **Release summary** shows the latest version and the release and artifact counts.
* **Deployment scripts** contains the **Installation Command**, **Condition Script** and **Removal Script**. Copy or download each script, then paste it into the matching field of your MDM's software item. The dashboard shows each script's SHA-256 checksum. A badge marks scripts that changed since the last release.
* **Releases** lists each version with its status and artifacts. Expand a release to read its changes, required admin actions and deployment instructions. You can download each artifact and copy its SHA-256 checksum.

MDM customers receive their workspace API key from their Kontext contact during onboarding. **Settings → API Keys** is only available in self-serve workspaces.

Your MDM passes the workspace API key to the **Installation Command** through a secret variable. Open **View full script** to find the variable name.

System-wide configuration overrides self-serve configuration. Interactive `kontext setup` offers to remove the managed setup before continuing. Decline this prompt on an MDM-managed endpoint and change its configuration through your MDM. Non-interactive setup refuses to continue.

### Policy mode on managed endpoints

The package configuration sets each endpoint's mode to `observe`, `enforce` or `remote`. With `remote`, the endpoint follows the mode you set on the Policies page. With `observe` or `enforce`, the endpoint uses the package's fixed mode. The dashboard shows a warning badge on Policies when tool call decisions use a different mode from the dashboard setting. See [rollout](/policies/rollout).

### Roll out

1. Deploy the package to one pilot endpoint.
2. Run `kontext doctor` on it and fix the reported problems.
3. Find the endpoint on [Home](/home/overview) and check that its hooks show **Installed**.
4. Run one small tool call and find it in [Explore](/explore/overview).
5. Deploy to a small group, then to the fleet.

To update, deploy the new release through your MDM. Once the endpoint runs the new version, its drawer on Home shows that version.

## Remove Kontext

On a self-serve endpoint, run `kontext setup --uninstall`, then `brew uninstall kontext`. Kontext removes the daemon and hooks. It removes API keys from the keychain. It keeps local records and logs and prints their paths.

On an MDM-managed endpoint, run the **Removal Script** through your MDM.

**Remove endpoint** on Home only removes the endpoint from the list. Kontext keeps running on it until you uninstall it. The endpoint reappears on its next check-in.