> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kontext.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Core concepts

> How Kontext connects agents, tool calls, and policies to risk and cost.

## Concepts

### Agents on endpoints

An agent is an AI coding tool such as Claude Code, Codex, or Claude Cowork. It runs on an endpoint, a computer with Kontext installed. **Home** lists your endpoints and the agents Kontext found on each.

### Tool calls

A tool call is an agent's request to run a shell command, edit a file, or use an MCP tool. Kontext checks each tool call on the endpoint before it runs and records the result.

### Policies

A policy decides Allow or Deny for a tool call. A policy in the **Observing** list shows what it would block without blocking calls. A policy in the **Enforced** list blocks matching calls.

### Risk and cost

**Risk** flags tool calls for review. **Cost** prices the model requests behind those calls. Neither changes a decision.

## Example

Your workspace enforces no policies yet and has **Block GitHub force pushes** in the **Observing** list. A developer asks Claude Code to clean up a branch. The agent tries to run `git push --force`.

Kontext evaluates the push on the developer's endpoint and records a Deny. The endpoint lets the push run. **Explore** shows "Would deny: but the call ran." **Risk** may flag the push and explain its potential effects.

After a week, the policy has matched only force pushes. You click **Enforce**. The endpoint denies the next force push before it runs. **Explore** shows "Denied: the call was blocked." The reason reads "Blocked by rule block-github-force-push".

## Next steps

* [Object model](/guides/object-model) shows how endpoints, agents, sessions, tool calls, and policies relate.
* [How decisions work](/guides/how-decisions-work) follows one tool call from the hook to the dashboard.