> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kontext.security/llms.txt
> Use this file to discover all available pages before exploring further.

# CLI reference

> Connect endpoints, check Kontext health, and manage agent hooks with the CLI.

Use the `kontext` CLI to connect self-serve endpoints and check their health. Install it with Homebrew:

```bash theme={"system"}
brew install kontext-security/tap/kontext
```

| Command                                         | What it does                                                                   |
| ----------------------------------------------- | ------------------------------------------------------------------------------ |
| `kontext setup`                                 | Connects the endpoint to your workspace or removes Kontext with `--uninstall`. |
| `kontext whoami`                                | Shows the endpoint's workspace and associated person.                          |
| `kontext doctor`                                | Checks the daemon and agent hooks.                                             |
| `kontext report`                                | Shows the endpoint's last reported agents and permissions.                     |
| `kontext hooks install`, `kontext hooks remove` | Adds or removes hooks for Claude Code and Codex.                               |
| `kontext claude managed-settings`               | Prints or checks Claude Code managed settings with Kontext hooks.              |

Run `kontext <command> --help` to see the options in your installed version.

## setup

```bash theme={"system"}
kontext setup --token <api-key>
```

The CLI checks the API key with Kontext and stores it in your login keychain. Setup installs Claude Code and Codex hooks and starts a daemon to send agent activity to your workspace. It may request your password to install Claude Code managed hooks. Without `--token`, setup prompts for the API key.

| Option              | Purpose                                                                                                                                                     |
| ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--token <api-key>` | Pass the API key from **Get started** or **Settings → API Keys**.                                                                                           |
| `--token-stdin`     | Read the API key from standard input, so it stays out of the process list and shell history.                                                                |
| `--with-local-llm`  | Run the optional local risk model. Requires `llama-server` on your `PATH`. Setup downloads about 680 MB of model weights. See [detection](/risk/detection). |
| `--uninstall`       | Remove what setup installed.                                                                                                                                |

Codex asks you to review new hooks before it runs them. After setup, open `/hooks` in Codex and trust the Kontext hooks.

You can rerun setup at any time. A new API key for the same workspace replaces the stored key and restarts the daemon. An API key for another workspace switches the endpoint to that workspace.

On an MDM-managed endpoint, setup detects the managed package and asks before removing it. Decline and update the endpoint through your MDM.

The `kontext setup --uninstall` command removes the daemon, hooks and stored configuration. It removes every stored API key from your keychain. The endpoint keeps its identity so later setup uses the same endpoint. Local data and logs remain under `~/Library/Application Support/Kontext` and `~/Library/Logs/Kontext`. Run `brew uninstall kontext` to remove the remaining `kontext` binary.

## whoami

```bash theme={"system"}
kontext whoami
kontext whoami --json
```

The CLI checks the stored API key with Kontext and prints the endpoint's workspace and associated person. For workspace API keys, the CLI prints `none (workspace key)` as the person. See [API keys](/api/api-keys) for the two key types.

## doctor

```bash theme={"system"}
kontext doctor
kontext doctor --fix
kontext doctor --json
```

Doctor checks that the daemon runs and agent hooks exist. It exits with a nonzero status if a check fails.

| Option   | Purpose                                                                                                                                      |
| -------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| `--fix`  | Restart the daemon if it runs an older binary, for example after `brew upgrade`. Doctor cannot fix other problems automatically.             |
| `--json` | Print results as JSON. Doctor reports health in `healthy` and exits zero even if a check fails. You cannot combine this option with `--fix`. |

See [Troubleshooting](/deploy/troubleshooting) for each doctor result.

## report

```bash theme={"system"}
kontext report
kontext report --json
```

This command shows the endpoint's last report. The report lists agents, hook status, MCP servers and plugins. It also shows whether agents bypass prompts and which credentials exist on the endpoint. The resource scan reads supported configuration files to identify credential presence and metadata. It excludes secret values from the report. This command does not start a new scan. Before the endpoint sends its first report, the command prints that it has sent none.

## hooks

```bash theme={"system"}
kontext hooks install --binary "$(which kontext)" --dry-run
kontext hooks remove --dry-run
```

Use these commands to repair Claude Code and Codex hooks or preview changes. `kontext setup` also installs and removes these hooks. These commands leave the daemon running unchanged.

| Option                             | Purpose                                                                                                                                      |
| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| `--scope user` or `--scope system` | Select the hook scope. The default is `user`. Use `sudo` for `system`.                                                                       |
| `--dry-run`                        | Print the plan without writing files.                                                                                                        |
| `--binary <path>`                  | Set the executable's absolute path for `hooks install` only. The default is `/usr/local/bin/kontext`. Pass your Homebrew path if it differs. |

[What Kontext installs](/deploy/what-kontext-installs) lists every file these commands touch.

## claude managed-settings

```bash theme={"system"}
kontext claude managed-settings template
kontext claude managed-settings validate
```

Use these commands when your MDM manages the Claude Code settings file and you need the Kontext hooks inside it. The `template` command prints managed settings containing Kontext hooks. The `validate [path]` command checks that the file contains them. Without a path, it checks `/Library/Application Support/ClaudeCode/managed-settings.json`. Both commands accept `--kontext-binary <path>` for an executable outside `/usr/local/bin/kontext`.

## Version and updates

```bash theme={"system"}
kontext --version
brew upgrade kontext-security/tap/kontext
kontext doctor
```

The `--version` option prints the version and source revision. After an upgrade, run `kontext doctor`. If the daemon runs an older binary, run `kontext doctor --fix`. Your MDM updates MDM-managed endpoints.