Govern coding agents on developer machines

Claude Code, Cursor, and Codex through the local broker — plus anything MCP-compatible on the same governed endpoint.

Switch the agent off for the organization. From that moment no laptop can establish a session, and because the broker re-authenticates rather than holding a standing key, its automatic reconnect is refused too. Revoking a developer’s live session from the console closes out what is already open.

No — setup is a copy-paste config and one sign-in. After that the agent works exactly as before, just through a governed endpoint instead of raw keys.

No. Sign-in is an OAuth login — a device code flow for headless machines — and provider credentials stay in the vault, injected server-side at call time. Nothing a developer holds locally can reach a provider on its own.

The tools the developer has connected, through the org’s hub. It inherits that person’s access rather than carrying standing credentials of its own — so offboarding the developer offboards their agent with them.

Yes — live broker sessions are visible in the console as they happen, each one attributed to the developer who started it.