Solution · For platform and DevEx teams
Every new laptop needs its agent set up by hand. Do it with one command, and check it from a script.
One command connects each machine, keeps a backup of the old config, and one command takes it back out. On Team, one Protect policy covers the whole org, and an agent cannot loosen it.
A new engineer opens a fresh laptop.
$ npx @context-mode/cli --agent all
picks the agents without askingIt finds Claude Code and Codex, writes each config and keeps a backup of the old file.
Is this machine set up?
$ npx @context-mode/cli setup --check writes nothing exit 0 every chosen agent is set up exit 2 one is not
status --json prints who is signed in and how each agent is set up, for scripts.
A change breaks one engineer's agent.
$ npx @context-mode/cli disconnect --dry-run lists what it would remove, writes nothing $ npx @context-mode/cli disconnect removes only what setup wrote
For the exact old file, copy the .cm-setup-bak- backup over it.
A member's agent tries to read .env.
Set once by the org on Team. An agent cannot loosen it.
Blocked by your team’s policy: Read environment files. .env files hold secrets.
Every member's agents follow it, on every machine.
A script tries to delete a block rule.
An API key
- Can tighten the policy
- Cannot loosen it
A person signed in
- Can loosen it, with a reason
- History marks the change
Export gives one policy.json. A git diff shows only real changes.
You want the team's skills and rules in every agent.
Each account, once
- Import the team's skills repo
- Paste the Instructions in Settings
Then
- Claude Code and Codex get them
- Nothing is written to a repo or disk
Skills and Instructions belong to each account today. No team roles yet.
Platform engineering, one laptop at a time. You cannot see which ones differ.
Each new laptop needs its agent config, its rule files and its skills, copied again.
You find a broken setup when an engineer asks why their agent acts in a different way.
Each client keeps its own rules, on one machine. Two agents means two places to change.
Connect, check, hold. Roll back when you must.
- 01Connect each machine
npx @context-mode/cli --agent allsigns in, writes the config for Claude Code and Codex and keeps a backup of each old file. - 02Check it from a script
setup --checkwrites nothing and exits 0 when every chosen agent is set up, 2 when one is not.status --jsonprints the same facts for scripts. - 03Roll back
disconnectremoves only what setup wrote. The rest of each config stays as it was.
Skills and Instructions belong to each account today, with no team roles yet. Nothing is written into a repo.
Check each machine from a script. Review the policy in git.
setup --check, which writes nothing: set up, or notpolicy.json export, so a git diff shows only real changesThe commands and exit codes are in the CLI docs. The export is in the Protect docs.
Where the setup lives. Gateway, managed settings or files.
| Context Mode | Each client's managed settings | Files in each repo | |
|---|---|---|---|
| Agents covered | Claude Code and Codex, from one place | One client each | One file per agent: CLAUDE.md, AGENTS.md |
| Skills | One catalog per account, imported from GitHub; no team roles yet | Deployed by an admin to every machine | SKILL.md folders on each machine |
| Tool-call rules | One policy for the org on Team; an agent cannot loosen it | Set by the admin per client | Rules per client, on one machine |
| Third party | Yes, a gateway | No, first-party | No |
Managed settings are free, first-party and users cannot override them, but each covers one client. For Claude Code, set ANTHROPIC_BASE_URL in managed settings to keep machines on the gateway. Codex cannot be held on the gateway this way today.
What this uses.
One command to connect, setup --check and status --json for scripts, disconnect to roll back.
One text per account for both agents. No file to copy into each repo. Docs.
Related: Team standards · For security teams · Share skills · Onboard a new engineer
One command per machine. One Protect policy for the org.
npx @context-mode/cli connects your agents. 1,000 requests free, no card. For Team, write to sales@context-mode.com.