Solution · For platform and DevEx teams

# Every new laptop needs its agent set up by hand. *Do it with one command, and check it from a script.*

One command connects each machine, keeps a backup of the old config, and one command takes it back out. On Team, one Protect policy covers the whole org, and an agent cannot loosen it.

[Get started free](https://console.context-mode.com/login) [Read the docs](https://context-mode.com/docs/cli) [Talk to us about Team](mailto:sales@context-mode.com)

Your rollout

New laptop Check a machine Roll back Agent reads .env Loosen a rule Skills and rules

A new engineer opens a fresh laptop.

```
$ npx @context-mode/cli --agent all
picks the agents without asking
```

It finds Claude Code and Codex, writes each config and keeps a backup of the old file.

Is this machine set up?

```
$ npx @context-mode/cli setup --check
writes nothing
exit 0  every chosen agent is set up
exit 2  one is not
```

status --json prints who is signed in and how each agent is set up, for scripts.

A change breaks one engineer's agent.

```
$ npx @context-mode/cli disconnect --dry-run
lists what it would remove, writes nothing
$ npx @context-mode/cli disconnect
removes only what setup wrote
```

For the exact old file, copy the .cm-setup-bak- backup over it.

A member's agent tries to read .env.

Blocked · never reaches your shell **Read environment files**

Set once by the org on Team. An agent cannot loosen it.

```
Blocked by your team’s policy: Read environment files. .env files hold secrets.
```

Every member's agents follow it, on every machine.

A script tries to delete a block rule.

An API key

- Can tighten the policy
- Cannot loosen it

A person signed in

- Can loosen it, with a reason
- History marks the change

Export gives one policy.json. A git diff shows only real changes.

You want the team's skills and rules in every agent.

Each account, once

- Import the team's skills repo
- Paste the Instructions in Settings

Then

- Claude Code and Codex get them
- Nothing is written to a repo or disk

Skills and Instructions belong to each account today. No team roles yet.

The problem

## Platform engineering, one laptop at a time. *You cannot see which ones differ.*

**Setup by hand**

Each new laptop needs its agent config, its rule files and its skills, copied again.

**No check you can script**

You find a broken setup when an engineer asks why their agent acts in a different way.

**Rules per client**

Each client keeps its own rules, on one machine. Two agents means two places to change.

How it works

## Connect, check, hold. *Roll back when you must.*

1. 01 **Connect each machine** `npx @context-mode/cli --agent all` signs in, writes the config for Claude Code and Codex and keeps a backup of each old file.
2. 02 **Check it from a script** `setup --check` writes nothing and exits 0 when every chosen agent is set up, 2 when one is not. `status --json` prints the same facts for scripts.
3. 03 **Roll back** `disconnect` removes only what setup wrote. The rest of each config stays as it was.

Skills and Instructions belong to each account today, with no team roles yet. Nothing is written into a repo.

Your own Anthropic or OpenAI account pays the model. We add no fee on tokens.

Proof

## Check each machine from a script. *Review the policy in git.*

**Exit 0 or 2** from `setup --check`, which writes nothing: set up, or not **Same bytes** from each `policy.json` export, so a git diff shows only real changes **One command** connects each machine, with a backup of each old config

The commands and exit codes are in the [CLI docs](https://context-mode.com/docs/cli). The export is in the [Protect docs](https://context-mode.com/docs/protect).

Compared

## Where the setup lives. *Gateway, managed settings or files.*

|  | Context Mode | Each client's managed settings | Files in each repo |
| --- | --- | --- | --- |
| Agents covered | Claude Code and Codex, from one place | One client each | One file per agent: CLAUDE.md, AGENTS.md |
| Skills | One catalog per account, imported from GitHub; no team roles yet | Deployed by an admin to every machine | SKILL.md folders on each machine |
| Tool-call rules | One policy for the org on Team; an agent cannot loosen it | Set by the admin per client | Rules per client, on one machine |
| Third party | Yes, a gateway | No, first-party | No |

Managed settings are free, first-party and users cannot override them, but each covers one client. For Claude Code, set `ANTHROPIC_BASE_URL` in managed settings to keep machines on the gateway. Codex cannot be held on the gateway this way today.

Products used

## What this *uses.*

**[CLI](https://context-mode.com/docs/cli)**

One command to connect, `setup --check` and `status --json` for scripts, `disconnect` to roll back.

**[Protect](https://context-mode.com/protect)**

Checks every tool call before the terminal runs it. One policy for the org on Team. [Docs](https://context-mode.com/docs/protect).

**[Skills](https://context-mode.com/skills)**

Import your skills repo from GitHub once per account. The reply names the skill. [Docs](https://context-mode.com/docs/skills).

**[Instructions](https://context-mode.com/instructions)**

One text per account for both agents. No file to copy into each repo. [Docs](https://context-mode.com/docs/instructions).

Related: [Team standards](https://context-mode.com/solutions/team-standards) · [For security teams](https://context-mode.com/solutions/security-teams) · [Share skills](https://context-mode.com/use-cases/share-skills) · [Onboard a new engineer](https://context-mode.com/use-cases/onboard-new-engineer)

## One command per machine. *One Protect policy for the org.*

*npx @context-mode/cli* connects your agents. 1,000 requests free, no card. For Team, write to sales@context-mode.com.

[Get started free →](https://console.context-mode.com/login) [Read the docs →](https://context-mode.com/docs/cli) [Talk to us about Team →](mailto:sales@context-mode.com)