Kontext can find an agent without observing it, and observe an agent without enforcing policy on it.
Hook coverage
Kontext stops tool calls only at the pre-tool-use hook. It records activity from the other events. Claude Code sends session and stop events in the background without delaying the agent.
Codex
Kontext setup enables hooks in~/.codex/config.toml. Codex requires you to review new hooks before it runs them. Open /hooks in Codex and trust the Kontext hooks. Until then, Codex sends no events to Kontext.
Claude Cowork
Kontext records Cowork sessions under the Cowork agent name. Explore lists them separately from Claude Code. Policies that target Claude Code also apply to Cowork. Some accounts run Cowork sessions in Anthropic’s cloud instead of on the endpoint. Kontext cannot observe those sessions. Home marks Cowork as Unmanaged on that endpoint and says the sessions run in Anthropic’s cloud.Other agents on Home
Kontext also looks for about 20 other agents on each endpoint, such as Cursor, Gemini CLI, GitHub Copilot CLI, Windsurf, and OpenCode. Home lists each agent it finds with one of three states:
Confirm current coverage by finding a new tool call in Explore. Blocking also requires an enforced policy that covers the agent and endpoint.
Check coverage on an endpoint
1
Check the hooks
Run
kontext doctor. It checks the hook files and the Kontext daemon.2
Make a tool call
Ask the agent to make a tool call, such as listing a directory.
3
Find it in Explore
Open the session in Explore and find the tool call. A decision confirms that Kontext covers the agent.