Getting started

Built in the open

The AI Control Plane is backed by Gram, an open source project maintained by the Speakeasy team. References to Gram may be seen across the product.

This guide gets you from sign-in to a governed AI rollout. You’ll connect your identity provider, publish a plugin marketplace, distribute MCP servers to the team, instrument your AI agents, and turn on security policies — then watch live traffic confirm it’s all working.

The setup wizard

After signing up or logging in, the setup wizard guides organization admins through rollout. The Finish setup banner in the dashboard (with a Continue setup button) leads there, and it’s always available at the organization’s /setup path. The wizard remembers progress and resumes at the right step. Skip the identity steps if needed and complete them later from organization settings.

Connect identity provider

Pick the organization’s SSO provider (Okta, Entra ID, Google Workspace, OneLogin, JumpCloud, PingFederate, and more) and click Connect so the team signs in with existing credentials.

Directory sync

Connect the identity provider’s directory to sync users, groups, and roles automatically. Changes in the IdP flow through to the platform. Clicking Connect directory opens the configuration portal in a new tab. Finish there, then return and continue.

Create plugin marketplace

The platform publishes a private GitHub repository that acts as the team’s plugin marketplace for Claude Code, Cursor, and Codex. It ships with the core observability plugin, which collects usage metrics and enforces authorization, and any plugins built later publish there too. Add at least one member of the GitHub organization as a collaborator so the repository is discoverable inside agent platforms.

Distribute MCP servers

Choose MCP servers from the catalog to roll out to the organization. Selected servers deploy to the project, bundle into the default plugin, and publish to the marketplace so the team can install them.

Instrument agent platforms

Choose how the team’s AI coding assistants get instrumented. Manual Setup walks through per-platform hooks for Claude Code, Claude Cowork, OpenAI Codex, and Cursor, with more platforms on the way.

The Device Agent (beta) is the centralized alternative. One on-device agent enforces the organization’s required plugins and MCP configuration across every assistant and reports compliance back. For fleets, deploy it through MDM (Kandji, Jamf, Intune, or similar): identity and enrollment are set centrally with no per-user setup, and walkthroughs cover macOS, Windows, and Linux.

Additional agent configuration

Optionally connect admin and compliance APIs so the platform can import usage, spend, and review data across agent platforms: the Cursor Admin API, the Anthropic Compliance API, and the OpenAI Compliance Logs API. This step is optional. Add or edit provider keys later from organization settings.

Confirm traffic

The wizard listens for events from the instrumented agent platforms. Trigger any action in Claude Code, Cursor, or Codex on a managed machine, and the live activity feed shows tool-call events arriving, followed by confirmation that the organization is receiving hook events.

Configure policies

Pick what to flag or block in agent traffic. Shadow MCP enforcement forces every MCP tool call through the control plane, so unmanaged servers are blocked and RBAC, authorization, and audit trails stay enforced. Each detection category (secrets, personal identifiable information, prompt injection, financial information, and more) can flag or block on a finding. Refine actions, message scopes, and individual rules any time in Risk Policies.

Once setup completes, agent activity flows into Observe, policies scan sessions under Secure, and Distribute manages rollout.