> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kontext.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Introduction

> Connect agents to your workspace, control tool calls with policies, and review risk and cost.

export const Architecture = () => <div className="k-fig-wrap">
    <svg className="k-fig" viewBox="0 0 640 300" width="100%" style={{
  maxWidth: 640
}} role="img" aria-label="Agents send each tool call to the Kontext daemon on the endpoint. The daemon makes the policy decision. It sends recorded tool calls to the workspace and receives policies from it. The workspace holds Home, Explore, Risk, Cost and Policies.">
      <defs>
        <marker id="arch-arrow" viewBox="0 0 10 10" refX="8" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
          <path className="arrowhead" d="M 1 1 L 8 5 L 1 9" />
        </marker>
      </defs>
      <rect className="region" x="8" y="8" width="412" height="284" rx="10" />
      <text className="t-label" x="24" y="32" textAnchor="start">On the endpoint</text>
      <rect className="box" x="24" y="60" width="176" height="64" rx="6" />
      <text className="t" x="112.0" y="87.0" textAnchor="middle">Agent</text>
      <text className="t-small t-muted" x="112.0" y="107.0" textAnchor="middle">Claude Code, Codex, Cowork</text>
      <rect className="box-accent" x="268" y="60" width="124" height="64" rx="6" />
      <text className="t-on-accent" x="330.0" y="97.0" textAnchor="middle">Kontext daemon</text>
      <path className="line" d="M 204 80 L 264 80" markerEnd="url(#arch-arrow)" />
      <text className="t-muted" x="234" y="73" textAnchor="middle" style={{
  fontSize: 11
}}>tool call</text>
      <path className="line" d="M 264 106 L 204 106" markerEnd="url(#arch-arrow)" />
      <text className="t-muted" x="234" y="121" textAnchor="middle" style={{
  fontSize: 11
}}>decision</text>
      <text className="t-muted" x="24" y="166" textAnchor="start" style={{
  fontSize: 12.5
}}>The daemon evaluates the policy on the endpoint.</text>
      <text className="t-muted" x="24" y="185" textAnchor="start" style={{
  fontSize: 12.5
}}>It records the decision and the reported outcome.</text>
      <text className="t-muted" x="24" y="204" textAnchor="start" style={{
  fontSize: 12.5
}}>It sends both to the workspace.</text>
      <text className="t-muted" x="24" y="240" textAnchor="start" style={{
  fontSize: 12.5
}}>The agent waits for the decision. The workspace</text>
      <text className="t-muted" x="24" y="259" textAnchor="start" style={{
  fontSize: 12.5
}}>is not on the path of a tool call.</text>
      <rect className="region-solid" x="464" y="8" width="168" height="284" rx="10" />
      <text className="t-label" x="480" y="32" textAnchor="start">Kontext workspace</text>
      <rect className="box" x="480" y="56" width="136" height="32" rx="6" />
      <text className="t" x="548" y="77" textAnchor="middle">Home</text>
      <rect className="box" x="480" y="100" width="136" height="32" rx="6" />
      <text className="t" x="548" y="121" textAnchor="middle">Explore</text>
      <rect className="box" x="480" y="144" width="136" height="32" rx="6" />
      <text className="t" x="548" y="165" textAnchor="middle">Risk</text>
      <rect className="box" x="480" y="188" width="136" height="32" rx="6" />
      <text className="t" x="548" y="209" textAnchor="middle">Cost</text>
      <rect className="box" x="480" y="232" width="136" height="32" rx="6" />
      <text className="t" x="548" y="253" textAnchor="middle">Policies</text>
      <path className="line-dashed" d="M 396 80 L 460 80" markerEnd="url(#arch-arrow)" />
      <text className="t-muted" x="442" y="72" textAnchor="middle" style={{
  fontSize: 11
}}>calls</text>
      <path className="line-dashed" d="M 464 248 H 440 V 144 H 330 V 128" markerEnd="url(#arch-arrow)" />
      <text className="t-muted" x="386" y="139" textAnchor="middle" style={{
  fontSize: 11
}}>policy</text>
    </svg>
  </div>;

Kontext connects your team's agents to one workspace. It checks each tool call against your policies before the call runs. The dashboard shows what happened and the activity's risk and cost.

On each endpoint, the Kontext daemon receives tool calls from agent hooks. The daemon makes the policy decision locally and records the decision and outcome. The workspace receives those records and holds your team's policies.

<Frame caption="The endpoint daemon makes the decision. The workspace receives activity records and supplies policies.">
  <Architecture />
</Frame>

## What you find in the dashboard

| Page | What it shows |
| - | - |
| **Home** | Your endpoints, the agents Kontext found on each one, and whether their hooks are installed. |
| **Explore** | Sessions and tool calls with the agent's request, the policy decision, and the outcome. |
| **Risk** | Tool calls flagged for review, with a severity, a category, and an explanation. |
| **Cost** | API-equivalent cost of the model requests behind tool calls, by model, tool activity, and person. |
| **Authorization → Policies** | The **Enforced** and **Observing** lists and the available policy presets. |
| **Authorization → History** | Every saved change to your policies. |

## How policy works

Kontext evaluates policies on the endpoint inside the agent's pre-tool hook. The agent waits for the decision. The workspace takes no part in that step. A new policy starts in the **Observing** list. You can see how many calls it would block before it blocks anything. When the matches look right, enforce the policy. In Enforce mode, a Deny stops the call before it runs.

Kontext also reports risk and cost for the same activity. Neither changes a decision. [How decisions work](/guides/how-decisions-work) explains the tool call sequence and failure behavior.

## Two ways to deploy

* To set up one endpoint, open **Get started** and create a personal API key. Run `brew install kontext-security/tap/kontext`, then `kontext setup`. See the [quickstart](/getting-started/quickstart).
* To set up many endpoints, download the signed package and scripts from **Deployments**. Push them with your MDM. See [deploying Kontext](/deploy/overview).

## Where to go next

<CardGroup cols={2}>
  <Card title="Core concepts" href="/guides/core-concepts">
    Learn how Kontext connects agents, tool calls, and policies to risk and cost.
  </Card>

  <Card title="Supported agents" href="/getting-started/supported-agents">
    See what Claude Code, Codex, and Claude Cowork report to Kontext.
  </Card>

  <Card title="Policies" href="/policies/overview">
    Review what **Block GitHub force pushes** would block in the **Observing** list before you enforce it.
  </Card>

  <Card title="Management API" href="/api/overview">
    Use the API to read and change policies or manage API keys.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.