Solution · For platform and DevEx teams

Every new laptop needs its agent set up by hand. Do it with one command, and check it from a script.

One command connects each machine, keeps a backup of the old config, and one command takes it back out. On Team, one Protect policy covers the whole org, and an agent cannot loosen it.

Your rollout

A new engineer opens a fresh laptop.

$ npx @context-mode/cli --agent all
picks the agents without asking

It finds Claude Code and Codex, writes each config and keeps a backup of the old file.

Is this machine set up?

$ npx @context-mode/cli setup --check
writes nothing
exit 0  every chosen agent is set up
exit 2  one is not

status --json prints who is signed in and how each agent is set up, for scripts.

A change breaks one engineer's agent.

$ npx @context-mode/cli disconnect --dry-run
lists what it would remove, writes nothing
$ npx @context-mode/cli disconnect
removes only what setup wrote

For the exact old file, copy the .cm-setup-bak- backup over it.

A member's agent tries to read .env.

Blocked · never reaches your shellRead environment files

Set once by the org on Team. An agent cannot loosen it.

Blocked by your team’s policy: Read environment files. .env files hold secrets.

Every member's agents follow it, on every machine.

A script tries to delete a block rule.

An API key

  • Can tighten the policy
  • Cannot loosen it

A person signed in

  • Can loosen it, with a reason
  • History marks the change

Export gives one policy.json. A git diff shows only real changes.

You want the team's skills and rules in every agent.

Each account, once

  • Import the team's skills repo
  • Paste the Instructions in Settings

Then

  • Claude Code and Codex get them
  • Nothing is written to a repo or disk

Skills and Instructions belong to each account today. No team roles yet.

The problem

Platform engineering, one laptop at a time. You cannot see which ones differ.

Setup by hand

Each new laptop needs its agent config, its rule files and its skills, copied again.

No check you can script

You find a broken setup when an engineer asks why their agent acts in a different way.

Rules per client

Each client keeps its own rules, on one machine. Two agents means two places to change.

How it works

Connect, check, hold. Roll back when you must.

  1. 01Connect each machine

    npx @context-mode/cli --agent all signs in, writes the config for Claude Code and Codex and keeps a backup of each old file.

  2. 02Check it from a script

    setup --check writes nothing and exits 0 when every chosen agent is set up, 2 when one is not. status --json prints the same facts for scripts.

  3. 03Roll back

    disconnect removes only what setup wrote. The rest of each config stays as it was.

Skills and Instructions belong to each account today, with no team roles yet. Nothing is written into a repo.

Each machine connects with one command and can be checked with setup --check. Its agents send requests to Context Mode. Context Mode checks each tool call against the org policy on Team, and adds each account's Instructions and the skill that matches from that account's catalog. Then the model gets the request. Each machine one command, then setup --check Context Mode check tool calls: one org policy on Team add each account's Instructions load the skill from the account's catalog The model your own account
Your own Anthropic or OpenAI account pays the model. We add no fee on tokens.
Proof

Check each machine from a script. Review the policy in git.

Exit 0 or 2from setup --check, which writes nothing: set up, or not
Same bytesfrom each policy.json export, so a git diff shows only real changes
One commandconnects each machine, with a backup of each old config

The commands and exit codes are in the CLI docs. The export is in the Protect docs.

Compared

Where the setup lives. Gateway, managed settings or files.

Context ModeEach client's managed settingsFiles in each repo
Agents coveredClaude Code and Codex, from one placeOne client eachOne file per agent: CLAUDE.md, AGENTS.md
SkillsOne catalog per account, imported from GitHub; no team roles yetDeployed by an admin to every machineSKILL.md folders on each machine
Tool-call rulesOne policy for the org on Team; an agent cannot loosen itSet by the admin per clientRules per client, on one machine
Third partyYes, a gatewayNo, first-partyNo

Managed settings are free, first-party and users cannot override them, but each covers one client. For Claude Code, set ANTHROPIC_BASE_URL in managed settings to keep machines on the gateway. Codex cannot be held on the gateway this way today.

Products used

What this uses.

CLI

One command to connect, setup --check and status --json for scripts, disconnect to roll back.

Protect

Checks every tool call before the terminal runs it. One policy for the org on Team. Docs.

Skills

Import your skills repo from GitHub once per account. The reply names the skill. Docs.

Instructions

One text per account for both agents. No file to copy into each repo. Docs.

Related: Team standards · For security teams · Share skills · Onboard a new engineer

One command per machine. One Protect policy for the org.

npx @context-mode/cli connects your agents. 1,000 requests free, no card. For Team, write to sales@context-mode.com.

Get started free

Your coding agent costs less and remembers your project.

Start free: 1,000 requests, every feature, no card. After you sign in, the console gives you one command to connect Claude Code or Codex.

Read the docs