Skip to main content
Use the kontext CLI to connect self-serve endpoints and check their health. Install it with Homebrew:
The cask updates itself. The homebrew-core formula (brew install kontext) gets each release a few hours later; update it with brew upgrade kontext. Run kontext <command> --help to see the options in your installed version.

​
setup

The CLI checks the API key with Kontext and stores it in your login keychain. Setup installs Claude Code, Codex and Cursor hooks in your home folder and starts a daemon to send agent activity to your workspace. It never asks for your password. Without --token, setup prompts for the API key. Codex runs new hooks only after you trust them. After setup, run codex, open /hooks and trust the Kontext hooks. You can rerun setup at any time. A new API key for the same workspace replaces the stored key and restarts the daemon. An API key for another workspace switches the endpoint to that workspace. On an MDM-managed endpoint, setup detects the managed package and asks before removing it. Decline and update the endpoint through your MDM. The kontext setup --uninstall command removes the daemon, hooks and stored configuration. It removes every stored API key from your keychain. The endpoint keeps its identity so later setup uses the same endpoint. Local data and logs remain under ~/Library/Application Support/Kontext and ~/Library/Logs/Kontext. Run brew uninstall kontext to remove the remaining kontext binary.

​
whoami

The CLI checks the stored API key with Kontext and prints the endpoint’s workspace and associated person. For workspace API keys, the CLI prints none (workspace key) as the person. See API keys for the two key types.

​
doctor

Doctor checks that the daemon runs and agent hooks exist. It exits with a nonzero status if a check fails. See Troubleshooting for each doctor result.

​
report

This command shows the endpoint’s last report. The report lists agents, hook status, MCP servers and plugins. It also shows whether agents bypass prompts and which credentials exist on the endpoint. The resource scan reads supported configuration files to identify credential presence and metadata. It excludes secret values from the report. This command does not start a new scan. Before the endpoint sends its first report, the command prints that it has sent none.

​
hooks

Use these commands to repair Claude Code, Codex and Cursor hooks or preview changes. kontext setup also installs and removes these hooks. These commands leave the daemon running unchanged. What Kontext installs lists every file these commands touch.

​
claude managed-settings

Use these commands when your MDM manages the Claude Code settings file and you need the Kontext hooks inside it. The template command prints managed settings containing Kontext hooks. The validate [path] command checks that the file contains them. Without a path, it checks /Library/Application Support/ClaudeCode/managed-settings.json. Both commands accept --kontext-binary <path> for an executable outside /usr/local/bin/kontext.

​
Version and updates

The --version option prints the version and source revision. The cask updates itself: the daemon checks a few minutes after it starts and every six hours, upgrades through Homebrew, and restarts on the new version. kontext doctor shows the update source and the last check. For the homebrew-core formula, run brew upgrade kontext. If the daemon runs an older binary, run kontext doctor --fix. Your MDM updates MDM-managed endpoints.