---
name: kontext-setup
description: Install Kontext on this Mac and connect it to the user's Kontext workspace.
---

# Kontext setup

You are setting up Kontext for the person you are working with. Kontext shows which AI agents run on an endpoint, what they do and what they cost, and lets a security team set policies for them.

Follow the steps in order. Tell the user what you are about to run before you run it.

## Rules

- Never ask for, read, print or store the install token. The user enters it themselves in step 3.
- Do not use `sudo`. Self-serve setup does not need it.
- Do not create an account or sign in for the user.
- If a step fails, show the user the output and stop. Do not work around it.

## Step 0: Check the platform

```bash
uname -s
```

Continue only if the result is `Darwin`. Self-serve setup supports macOS. Kontext also runs on Windows and Linux endpoints, rolled out by an administrator through device management. On those platforms stop and point the user to https://cal.com/jensernstberger/30min-europe to book a demo.

## Step 1: Install the CLI

```bash
command -v kontext
```

If it is missing, check that Homebrew is installed (`command -v brew`), then run:

```bash
brew install --cask kontext-security/tap/kontext
```

If Homebrew is missing, tell the user and stop. Do not install Homebrew for them.

## Step 2: The user gets an install token

Ask the user to:

1. Open https://app.kontext.security and sign up or sign in.
2. Create or join a workspace. Connecting an endpoint needs the workspace owner or admin role.
3. Open **Get started** in the dashboard. It shows their install token.

Wait for the user to confirm they have the token. Do not ask them to paste it to you.

## Step 3: The user connects this Mac

Ask the user to run this in their own terminal window, not through you, and paste the token at the prompt:

```bash
kontext setup
```

Setup stores the token in the macOS login keychain, installs hooks for supported agents in the user's home folder, starts the local Kontext daemon and connects this Mac to the workspace. Running it again is safe.

Wait for the user to confirm it finished.

## Step 4: Verify

```bash
kontext doctor
```

Report the result to the user. If `kontext doctor` warns that the Homebrew cask is not trusted, show the user the command it prints and let them decide whether to run it. If the user runs Codex, tell them to trust the Kontext hooks when Codex asks.

## Step 5: Send a first trace

Hooks apply to new agent sessions, so this session may not be reported. Ask the user to:

1. Start a new agent session and run the read-only test command shown under **Get started** in the dashboard.
2. Click **Finish setup** in the dashboard once the tool call appears.

## What changes on this Mac

- Agent activity from supported agents is sent to the user's Kontext workspace.
- Risk assessment runs locally and is advisory by default. Nothing is blocked until someone in the workspace puts a policy in enforce mode.
- To remove everything setup installed: `kontext setup --uninstall`.

## More

- Quickstart: https://docs.kontext.security/getting-started/quickstart
- Manage the workspace from this agent (policies, logs and risks, directory sync): https://github.com/kontext-security/agent-skills
- Pricing and product overview for agents: https://kontext.security/llms.txt