# Getting started The AI Control Plane is backed by [Gram](https://github.com/speakeasy-api/gram), an open source project maintained by the Speakeasy team. References to Gram may be seen across the product. This guide gets you from sign-in to a governed AI rollout. You'll connect your identity provider, publish a plugin marketplace, distribute MCP servers to the team, instrument your AI agents, and turn on security policies — then watch live traffic confirm it's all working. ## The setup wizard After [signing up](https://login.speakeasy.com/sign-up?state=return_url%3Dhttps%253A%252F%252Fapp.getgram.ai%252Frpc%252Fauth.callback%26speakeasy_as_provider%3Dtrue%26state%3DeyJmaW5hbF9kZXN0aW5hdGlvbl91cmwiOiIvIn0&redirect_uri=https%3A%2F%2Fapp.speakeasy.com%2Fv1%2Fauth%2Fcallback) or [logging in](https://login.speakeasy.com/?client_id=client_01J0XGGZ8MEQS57C5RKB00KN35&redirect_uri=https%3A%2F%2Fapp.speakeasy.com%2Fv1%2Fauth%2Fcallback), the setup wizard guides organization admins through rollout. The **Finish setup** banner in the dashboard (with a **Continue setup** button) leads there, and it's always available at the organization's `/setup` path. The wizard remembers progress and resumes at the right step. Skip the identity steps if needed and complete them later from organization settings. ### Connect identity provider Pick the organization's SSO provider (Okta, Entra ID, Google Workspace, OneLogin, JumpCloud, PingFederate, and more) and click **Connect** so the team signs in with existing credentials. ![The Connect identity provider step with a searchable grid of SSO providers](/assets/docs/ai-control-plane/getting-started/setup-connect-identity-provider.webp) ### Directory sync Connect the identity provider's directory to sync users, groups, and roles automatically. Changes in the IdP flow through to the platform. Clicking **Connect directory** opens the configuration portal in a new tab. Finish there, then return and continue. ![The Directory sync step, which opens the connection setup in a new tab](/assets/docs/ai-control-plane/getting-started/setup-directory-sync.webp) ### Create plugin marketplace The platform publishes a private GitHub repository that acts as the team's plugin marketplace for Claude Code, Cursor, and Codex. It ships with the core observability plugin, which collects usage metrics and enforces authorization, and any plugins built later publish there too. Add at least one member of the GitHub organization as a collaborator so the repository is discoverable inside agent platforms. ![The Create plugin marketplace step showing the published private marketplace repository](/assets/docs/ai-control-plane/getting-started/setup-create-plugin-marketplace.webp) ### Distribute MCP servers Choose MCP servers from the catalog to roll out to the organization. Selected servers deploy to the project, bundle into the default plugin, and publish to the marketplace so the team can install them. ![The Distribute MCP servers step with a searchable catalog of servers to distribute](/assets/docs/ai-control-plane/getting-started/setup-distribute-mcp-servers.webp) ### Instrument agent platforms Choose how the team's AI coding assistants get instrumented. **Manual Setup** walks through per-platform hooks for Claude Code, Claude Cowork, OpenAI Codex, and Cursor, with more platforms on the way. ![The Instrument agent platforms step with per-platform manual setup entries](/assets/docs/ai-control-plane/getting-started/setup-instrument-agents-manual.webp) The **Device Agent** (beta) is the centralized alternative. One on-device agent enforces the organization's required plugins and MCP configuration across every assistant and reports compliance back. For fleets, deploy it through MDM (Kandji, Jamf, Intune, or similar): identity and enrollment are set centrally with no per-user setup, and walkthroughs cover macOS, Windows, and Linux. ![The Device Agent option with platform walkthroughs for macOS, Windows, and Linux](/assets/docs/ai-control-plane/getting-started/setup-instrument-agents-device-agent.webp) ### Additional agent configuration Optionally connect admin and compliance APIs so the platform can import usage, spend, and review data across agent platforms: the Cursor Admin API, the Anthropic Compliance API, and the OpenAI Compliance Logs API. This step is optional. Add or edit provider keys later from organization settings. ![The Additional agent configuration step with Cursor, Anthropic, and OpenAI provider connections](/assets/docs/ai-control-plane/getting-started/setup-additional-agent-configuration.webp) ### Confirm traffic The wizard listens for events from the instrumented agent platforms. Trigger any action in Claude Code, Cursor, or Codex on a managed machine, and the live activity feed shows tool-call events arriving, followed by confirmation that the organization is receiving hook events. ![The Confirm traffic step with a live feed of arriving tool-call events](/assets/docs/ai-control-plane/getting-started/setup-confirm-traffic.webp) ### Configure policies Pick what to flag or block in agent traffic. Shadow MCP enforcement forces every MCP tool call through the control plane, so unmanaged servers are blocked and RBAC, authorization, and audit trails stay enforced. Each detection category (secrets, personal identifiable information, prompt injection, financial information, and more) can flag or block on a finding. Refine actions, message scopes, and individual rules any time in [Risk Policies](/docs/ai-control-plane/secure/risk-policies). ![The Configure policies step with shadow MCP enforcement and detection categories](/assets/docs/ai-control-plane/getting-started/setup-configure-policies.webp) Once setup completes, agent activity flows into [Observe](/docs/ai-control-plane/observe), policies scan sessions under [Secure](/docs/ai-control-plane/secure), and [Distribute](/docs/ai-control-plane/distribute) manages rollout.