Org Admin
Device agent
The device agent runs on-device, enforces the organization’s required AI-tool plugins and MCP configuration across every coding assistant, and reports compliance back to the platform. Open the Device Agent page from Organization settings > Secure > Device Agent in the dashboard.
Access requirements
Section titled “Access requirements”Viewing this page requires the org:read scope, so both Admins and Members can see it. Administrative actions, including creating the API keys used for enrollment, require the org:admin scope, which only the Admin role holds by default.
What the device agent does
Section titled “What the device agent does”Instead of relying on each developer to configure every coding assistant by hand, the agent applies the organization’s required plugins and MCP configuration centrally on each machine. Plugin assignments determine what the agent delivers to a given device, so assignment changes in plugins flow through to enrolled machines. Each enrolled device reports its compliance state back to the platform.
Setup and enrollment
Section titled “Setup and enrollment”Setup lives in the Instrument agent platforms step of the setup wizard (see getting started), with walkthroughs for macOS, Windows, and Linux.
Enrollment tokens come from an API key with the Agent scope, created on the API keys page.
Fleet deployment through MDM
Section titled “Fleet deployment through MDM”For fleets, deploy the agent through an MDM such as Kandji, Jamf, or Intune. Binaries install alongside a managed.json file, so identity and enrollment are set centrally with no per-user setup.