The Configure button appears for anyone with Configuration · View.
What’s on the page
Header
A line naming your organization — Deploy Unbound across your organization, then sanction the agents and MCP servers you allow — and an Actions menu.
Everyone other than an Admin reads the page without the description line or the Actions menu.
Deploy — three steps
The left column, for an Admin.
Step 2 offers:
Step 3 shows the command with a copy control. For My device, macOS and Linux run it in a terminal; Windows runs it in Command Prompt as Administrator and needs Python installed. For My org (MDM) the command is tabbed by platform, and the tabs that need Python say so. Devices appear under Deployment Posture once they check in.
Choosing My org (MDM) also offers the organization-wide extras, since those apply to a fleet rather than one machine: Set up Claude Cowork, which carries the OTLP values to enter in the Claude desktop app, and — for an Admin — a link to Set up Anthropic Compliance API on Settings → Integrations.
Unbound CLI
For every other role the left column is the CLI quickstart instead, in four steps: Prerequisites (Node.js 18 or higher with npm on your PATH), Install the CLI, Verify the install, and Log in. Each carries the exact command and a copy control.Deployment Posture
The top of the right-hand rail, for every role. Two figures, each with a reporting date beneath it once there is one.Tool Coverage
Below the posture figures, again for every role.
View tools opens Tools Reporting, which sets the two side by side tool by tool, in up to three groups — Not Governed Yet (tools Unbound can install governance hooks for that are not reporting yet), Governance Hooks Installed and AI Tools Discovered — each row carrying the number of devices, and a group with nothing in it left out. The tools Unbound can hook are Claude Code, Codex, Cursor, Copilot, Augment Code and Pi (Beta).
API access
Available to organizations with API access. The rail then also carries an API Tokens card with Manage in Settings, which opens Settings → API Tokens - personal tokens for the Unbound CLI, one per machine, each scoped and revocable. They are not the install key from step 3; see CLI Authentication.Filters and controls
Scope, the install options, and the search fields inside each dialog. The install command rebuilds itself as you change the choices above it.What you can do
Agent approval wizard
Agents are listed by vendor, one collapsible row each — vendors with something discovered in your org start open, and a discovered agent carries the number of devices it was found on. Search narrows the list, and the checkbox on a vendor row takes that whole vendor. Save applies the selection, and the page confirms Sanctioned agents updated. The dialog says what sanctioning does: it shapes your Discovery insights — it does not block or restrict any request. Blocking lives in Policies, and for MCP servers in the approvals below. With nothing discovered yet the list is still the full supported catalog, every vendor collapsed, so you can approve agents before any device reports in.MCP server approvals
Tick the servers you sanction; search narrows the list. One Enforcement setting then decides what happens to everything you did not tick:
Under Block or Warn, a line beneath the choice counts the consequence before you save — how many of the servers in the list will be blocked or warned.
Warn adds one more choice, for unattended Claude Code and Agent SDK requests where there is no one to answer the notice: Allow (the default) or Deny, denials showing under Unsanctioned Usage.
Under Block or Warn you can add one optional message, shown to a developer whose request reaches an unsanctioned server — labelled Custom block message under Block and Enforcement message under Warn, up to 500 characters.
Include unofficial servers applies the Block or Warn setting to servers that are not published or verified by the vendor of the service they connect to, even on a gateway host or as an exception. A Grace period of 0 to 30 days (None, start immediately at zero) delays that enforcement so people can move to the official servers, and the card then reads Enforced since the date it began.
Allow everything through your MCP gateway lets any MCP server whose address is on a gateway host you list through. Hosts you declared at setup or that look like a gateway in your inventory are offered, tagged Declared, Suggested or Added, and you can add your own.
Save applies the change and the page confirms Sanctioned MCP servers updated. Three changes ask you to confirm in a dialog first: turning enforcement off (Turn Off MCP Enforcement?), switching from Off to Block (Enable MCP Enforcement?), and un-ticking servers while saving under Block (Block More Servers?). The two Block dialogs name how many servers stay allowed and how many will be blocked.
Disable Blocking Temporarily is an Admin control, shown while enforcement is Block. It allows every unsanctioned and unofficial server for 24 Hours or 1 Week without changing your lists — the card then reads Blocking Temporarily Disabled with the time it lapses, and blocking returns on its own or on Re-enable Blocking, which takes effect immediately.