> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kontext.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Home

> See which agents run on your endpoints, what they can reach, and whether Kontext manages them.

After you finish self-serve setup, the dashboard opens Home. Home lists reporting endpoints with the agents Kontext found and their reported access.

Endpoints report their agents from Kontext CLI 1.5.0 onward. Endpoints on older CLI versions still check in but report no agents.

## Agents

The **Agents** card counts installs. One install is one agent on one endpoint. Each install has one of three states:

| State           | Meaning                                                                                                    |
| --------------- | ---------------------------------------------------------------------------------------------------------- |
| **Managed**     | Installed hooks or a session your workspace previously received from the agent.                            |
| **Unmanaged**   | A supported agent with no hooks on that endpoint. Kontext does not see its activity and no policy applies. |
| **Unsupported** | An agent with no Kontext hooks available yet.                                                              |

Confirm current coverage by finding a new tool call in Explore. Blocking also requires an enforced policy that covers the agent and endpoint.

**Home** counts Claude Cowork as **Unmanaged** when it runs in Anthropic's cloud. Kontext cannot observe those sessions yet.

Select an agent to see the endpoints it runs on, or a state to filter the endpoints table.

When **Home** lists only some endpoints, the card counts the most recently active endpoints and states this limit.

## Elevated access

The **Elevated access** card counts endpoints where an agent has any of the following:

| Fact                            | Meaning                                                                                                                                                                                                   |
| ------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Full Disk Access granted**    | The app the agent runs in can read every file on the endpoint.                                                                                                                                            |
| **Bypass or auto mode**         | The agent runs commands and edits files without asking the person first.                                                                                                                                  |
| **Keys an agent could pick up** | Any command can use these keys and tokens on the endpoint. The resource scan reads supported configuration files to identify credential presence and metadata. It excludes secret values from the report. |

Select a fact to filter the endpoints table.

## Resources

The **Resources** card lists MCP servers, plugins, connectors and stored credentials your agents can reach. Select **All resources** for the full list, or a resource to open its drawer.

The drawer lists who can reach the resource, by person or endpoint. **Ways in** lists each route. Kontext marks routes from agent settings as **Configured**. It marks routes from recorded sessions as **Seen in use**. **What a policy can do** explains how a policy can cover the resource. Select **New policy** to open **Policies**.

Kontext finds resources through its resource scan. You can disable the scan under **Settings → Data Collection**. See [data collection](/deploy/data-collection).

## Endpoints

The endpoints table lists each endpoint's agents and the resources they can reach. Search by name, or filter by **Status**, **Installs** or **Reaches**. The dashboard shows **Active** if the endpoint checked in within the last 15 minutes. It shows **Stale** after that, or **Never seen** before the first check-in. The dashboard counts endpoints on older CLI versions below the table. Use the toggle to show them.

Select an endpoint to open its drawer. The dashboard shows the person's email, Kontext version, and last check-in above these details:

* In a self-serve workspace, the **Person** section says when an endpoint connected with a workspace API key and has no person attached. Run a fresh **Get started** setup command on the endpoint to attach a person.
* **How to fix it** appears when an agent's hooks are missing and gives the command or package step that restores them.
* The agent list shows the agents Kontext found on the endpoint and each agent's last use.
* The drawer reports Claude Code and Codex hooks as **Installed** or **Missing**. It shows **Not detected** if it cannot find the agent, or **Not reported** if the CLI cannot report hook status because it is too old.
* Use **Guardrail LLM** to turn the endpoint's local guardrail model on or off. See [detection](/risk/detection).
* **Version** shows the endpoint's Kontext version.

Select **Open in Explore** to see the endpoint's sessions. Owners and admins can select **Remove endpoint** to remove it from **Home**. The workspace keeps its history. **Home** lists a running endpoint again at its next check-in. To remove Kontext from the endpoint, see [Deploy Kontext](/deploy/overview#remove-kontext).