# Device agent

The device agent runs on-device, enforces the organization's required AI-tool plugins and MCP configuration across every coding assistant, and reports compliance back to the platform. Open the **Device Agent** page from **Organization settings > Secure > Device Agent** in the dashboard.

<Callout type="info">{BADGE_DEFINITIONS.Beta}</Callout>

## Access requirements

<Callout type="info">
  Viewing this page requires the `org:read` scope, so both Admins and Members can see it. Administrative actions, including creating the API keys used for enrollment, require the `org:admin` scope, which only the [Admin role](/docs/ai-control-plane/org-admin/roles-and-permissions) holds by default.
</Callout>

## What the device agent does

Instead of relying on each developer to configure every coding assistant by hand, the agent applies the organization's required plugins and MCP configuration centrally on each machine. Plugin assignments determine what the agent delivers to a given device, so assignment changes in [plugins](/docs/ai-control-plane/distribute/plugins) flow through to enrolled machines. Each enrolled device reports its compliance state back to the platform.

## Setup and enrollment

Setup lives in the **Instrument agent platforms** step of the setup wizard (see [getting started](/docs/ai-control-plane/getting-started)), with walkthroughs for macOS, Windows, and Linux.

Enrollment tokens come from an API key with the **Agent** scope, created on the [API keys](/docs/ai-control-plane/org-admin/api-keys) page.

## Fleet deployment through MDM

For fleets, deploy the agent through an MDM such as Kandji, Jamf, or Intune. Binaries install alongside a `managed.json` file, so identity and enrollment are set centrally with no per-user setup.