The workspace holds endpoints and policies. Agents run on endpoints and report sessions. Sessions contain tool calls. Kontext evaluates those calls against the applicable policies.
Objects
Endpoint
An endpoint is a computer with Kontext installed. Select one in Home to see its user, agents, and Kontext version. The dashboard also shows its last check-in and each agent’s hook status. Kontext evaluates policies for the endpoint. When you add a policy, you choose whether Kontext evaluates it for all endpoints or selected endpoints.Agent
An agent is an AI tool such as Claude Code, Codex, or Claude Cowork that makes tool calls. One endpoint can run several agents. Home shows each agent as Managed, Unmanaged, or Unsupported. A policy can target one agent or all agents. See supported agents.Session
A session groups the tool calls that one agent reports on one endpoint. Kontext uses the agent’s session ID to identify it. Open a session in Explore to review its tool calls.Tool call
A tool call is an agent’s request to run a shell command, edit a file, fetch a web page, or use an MCP tool. Open one in Explore to see what Kontext recorded:
An allowed tool call can still fail. In Observe, the endpoint runs a tool call even when Kontext records Deny.
Policy
A policy is a rule Kontext uses to decide tool calls. You can add a preset such as Block GitHub force pushes or write a policy in Cedar. Policies lists each policy under Enforced or Observing. The workspace creates a policy version for every change you save. History lists who saved each version and when.Relationships
- The workspace holds endpoints and policies.
- Agents run on endpoints. An agent on an endpoint produces sessions.
- A session contains tool calls.
- Kontext evaluates each tool call against applicable policies. Each policy’s scope says which endpoints and agents it covers.