The Configure button appears for Admin and Analytics Viewer. Anyone else reaches the same page by going to
/configure directly.What’s on the page
Header
A line naming your organization — Deploy Unbound across your organization, then sanction the agents and MCP servers you allow — and an Actions menu.
An Analytics Viewer reads the page without the description line or the Actions menu.
Only an Admin can load either list, so a Member who opens either dialog gets Could not load sanctioned agents or Could not load MCP servers instead of the list.
Deploy — three steps
The left column, for everyone except an Analytics Viewer.
Step 2 offers:
Step 3 shows the command with a copy control. For My device, macOS and Linux run it in a terminal; Windows runs it in Command Prompt as Administrator and needs Python installed. For My org (MDM) the command is tabbed by platform, and the tabs that need Python say so. Devices appear under Deployment Posture once they check in.
Choosing My org (MDM) also offers the organization-wide extras, since those apply to a fleet rather than one machine: Set up Claude Cowork, which carries the OTLP values to enter in the Claude desktop app, and — for an Admin — a link to Set up Anthropic Compliance API on Settings → Integrations.
Unbound CLI
For an Analytics Viewer the left column is the CLI quickstart instead, in four steps: Prerequisites (Node.js 18 or higher with npm on your PATH), Install the CLI, Verify the install, and Log in. Each carries the exact command and a copy control.Deployment Posture
The top of the right-hand rail, for every role. Two figures, each with a reporting date beneath it once there is one.Tool Coverage
Below the posture figures, again for every role.
View tools opens Tools Reporting, which sets the two side by side tool by tool, in up to three groups — Not Governed Yet (tools Unbound can install governance hooks for that are not reporting yet), Governance Hooks Installed and AI Tools Discovered — each row carrying the number of devices, and a group with nothing in it left out. The tools Unbound can hook are Claude Code, Codex, Cursor, Copilot and Augment Code.
API access
Shown only where your organization has it turned on. The rail then also carries the API key — The Bearer token for calling the Unbound API — masked, with a copy control that copies it in full.Filters and controls
Scope, the install options, and the search fields inside each dialog. The install command rebuilds itself as you change the choices above it.What you can do
Agent approval wizard
Agents are listed by vendor, one collapsible row each — vendors with something discovered in your org start open, and a discovered agent carries the number of devices it was found on. Search narrows the list, and the checkbox on a vendor row takes that whole vendor. Save applies the selection, and the page confirms Sanctioned agents updated. The dialog says what sanctioning does: it shapes your Discovery insights — it does not block or restrict any request. Blocking lives in Policies, and for MCP servers in the approvals below. With nothing discovered yet the list is still the full supported catalog, every vendor collapsed, so you can approve agents before any device reports in.MCP server approvals
Tick the servers you sanction; search narrows the list. One Enforcement setting then decides what happens to everything you did not tick:
Under Block or Warn, a line beneath the choice counts the consequence before you save — how many of the servers in the list will be blocked or warned.
Warn adds one more choice, for unattended Claude Code and Agent SDK requests where there is no one to answer the notice: Allow (the default) or Deny, denials showing under Unsanctioned Usage.
Under Block or Warn you can add one optional message, shown to a developer whose request reaches an unsanctioned server — labelled Custom block message under Block and Enforcement message under Warn, up to 500 characters.
Save applies the change and the page confirms Sanctioned MCP servers updated. Three changes ask you to confirm in a dialog first: turning enforcement off (Turn Off MCP Enforcement?), switching from Off to Block (Enable MCP Enforcement?), and un-ticking servers while saving under Block (Block More Servers?). The two Block dialogs name how many servers stay allowed and how many will be blocked.
Disable Blocking Temporarily is an Admin control, shown while enforcement is Block. It allows every unsanctioned server for 24 Hours or 1 Week without changing your lists — the card then reads Blocking Temporarily Disabled with the time it lapses, and blocking returns on its own or on Re-enable Blocking, which takes effect immediately.