> ## Documentation Index > Fetch the complete documentation index at: https://docs.getunbound.ai/llms.txt > Use this file to discover all available pages before exploring further. # Configure > Deploy Unbound across your organization, sanction the agents and MCP servers you allow, and rotate keys | | | | ----------- | ---------------------------------------------------------------------- | | **URL** | `/configure` | | **Sidebar** | Not in the sidebar — the **Configure** button, top right of the header | | **Roles** | Everyone · the **Actions** menu and the deploy flow vary by role | The **Configure** button appears for **Admin** and **Analytics Viewer**. Anyone else reaches the same page by going to `/configure` directly. Configure is the single page that takes an organization from nothing installed to reporting and governed: it builds the install command, shows what has checked in since, and holds the approvals — which coding agents are sanctioned, and which MCP servers your agents may reach. ## What's on the page ### Header A line naming your organization — *Deploy Unbound across **your organization**, then sanction the agents and MCP servers you allow* — and an **Actions** menu. | Action | Who sees it | Opens | | ------------------------ | ----------------------------------- | -------------------------------- | | **Sanction Agents** | Everyone except an Analytics Viewer | The agent approval wizard | | **Sanction MCP Servers** | Everyone except an Analytics Viewer | The MCP server approvals | | **Rotate API Keys** | Admin | Key rotation for selected people | An Analytics Viewer reads the page without the description line or the **Actions** menu. Only an **Admin** can load either list, so a Member who opens either dialog gets *Could not load sanctioned agents* or *Could not load MCP servers* instead of the list. ### Deploy — three steps The left column, for everyone except an Analytics Viewer. | Step | What you choose | | ------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | | **1 · Choose scope** | **My device** — this machine only, best for evaluating first · **My org (MDM)** — every device through your MDM, recommended for rollout | | **2 · Choose what to install** | Discovery always runs; governance is what enforces policy | | **3 · Run the install command** | The command the first two steps produce | Step 2 offers: | Option | What it does | | ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Discover your coding agents** | Finds the AI tools running across your devices — Cursor, Claude, Copilot and the rest. Marked **Included**, always on | | **Govern coding agent actions** | Enforces policies on tool calls, file writes and shell commands | | **Seed events from past activity** | Fills the dashboard with what your agents did before the install. Offered once **Govern coding agent actions** is ticked, and covers Claude Code, Codex and Copilot | | **Keep governance up to date** | Keeps governance in place and discovery current, checked daily. Offered on the **My device** scope; its info tooltip is headed **Automatic Updates on This Device** | Step 3 shows the command with a copy control. For **My device**, macOS and Linux run it in a terminal; Windows runs it in Command Prompt as Administrator and needs Python installed. For **My org (MDM)** the command is tabbed by platform, and the tabs that need Python say so. Devices appear under **Deployment Posture** once they check in. Choosing **My org (MDM)** also offers the organization-wide extras, since those apply to a fleet rather than one machine: **Set up Claude Cowork**, which carries the OTLP values to enter in the Claude desktop app, and — for an Admin — a link to **Set up Anthropic Compliance API** on [Settings → Integrations](/dashboard/settings). ### Unbound CLI For an Analytics Viewer the left column is the CLI quickstart instead, in four steps: **Prerequisites** (Node.js 18 or higher with npm on your PATH), **Install the CLI**, **Verify the install**, and **Log in**. Each carries the exact command and a copy control. ### Deployment Posture The top of the right-hand rail, for every role. Two figures, each with a reporting date beneath it once there is one. | Figure | Shows | | ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------- | | **Devices discovered** | Devices that have checked in, dated **Last discovered** — or **First seen** until a device reports again | | **Users with hooks installed** | People with governance actually running, dated **Last installed** — or **Oldest check-in**, the device that has gone longest without reporting | ### Tool Coverage Below the posture figures, again for every role. | Figure | Shows | | ------------------------------ | ------------------------------- | | **AI tools discovered** | Tools found across your devices | | **Governance hooks installed** | How many are actually governed | **View tools** opens **Tools Reporting**, which sets the two side by side tool by tool, in up to three groups — **Not Governed Yet** (tools Unbound can install governance hooks for that are not reporting yet), **Governance Hooks Installed** and **AI Tools Discovered** — each row carrying the number of devices, and a group with nothing in it left out. The tools Unbound can hook are Claude Code, Codex, Cursor, Copilot and Augment Code. ### API access Shown only where your organization has it turned on. The rail then also carries the **API key** — *The Bearer token for calling the Unbound API* — masked, with a copy control that copies it in full. ## Filters and controls Scope, the install options, and the search fields inside each dialog. The install command rebuilds itself as you change the choices above it. ## What you can do | Action | Result | | ---------------------------------- | ------------------------------------------------------------------------------------------------ | | Change scope | Rebuilds the command for one machine or for MDM rollout | | Tick an install option | Adds it to the command in step 3 | | **Copy** | Copies the command, or the API key | | **Actions → Sanction Agents** | Opens the **agent approval wizard**, below | | **Actions → Sanction MCP Servers** | Opens the **MCP server approvals**, below | | **Actions → Rotate API Keys** | Opens **key rotation**, below | | **?** beside **Unbound CLI** | A note describing the CLI, with a link that opens the [CLI overview](/cli/overview) in a new tab | ### Agent approval wizard Agents are listed by vendor, one collapsible row each — vendors with something discovered in your org start open, and a discovered agent carries the number of devices it was found on. Search narrows the list, and the checkbox on a vendor row takes that whole vendor. **Save** applies the selection, and the page confirms *Sanctioned agents updated*. The dialog says what sanctioning does: it shapes your Discovery insights — it does not block or restrict any request. Blocking lives in [Policies](/dashboard/policies/agentic-use), and for MCP servers in the approvals below. With nothing discovered yet the list is still the full supported catalog, every vendor collapsed, so you can approve agents before any device reports in. ### MCP server approvals | Section | Contents | | --------------------- | ----------------------------------------- | | **Sanctioned** | Servers you allow | | **Other MCP servers** | Everything else seen in your organization | Tick the servers you sanction; search narrows the list. One **Enforcement** setting then decides what happens to everything you did not tick: | Enforcement | What an unsanctioned server gets | | ----------- | ----------------------------------------------------------------------------------------------------------- | | **Off** | Every MCP server is allowed · nothing is blocked or warned, and your ticked list is staged until you switch | | **Block** | *Deny by default* — requests to unsanctioned servers are denied | | **Warn** | *Warn by default* — users get a notice but can still proceed | Under **Block** or **Warn**, a line beneath the choice counts the consequence before you save — how many of the servers in the list will be blocked or warned. **Warn** adds one more choice, for unattended Claude Code and Agent SDK requests where there is no one to answer the notice: **Allow** (the default) or **Deny**, denials showing under Unsanctioned Usage. Under **Block** or **Warn** you can add one optional message, shown to a developer whose request reaches an unsanctioned server — labelled **Custom block message** under Block and **Enforcement message** under Warn, up to 500 characters. **Save** applies the change and the page confirms *Sanctioned MCP servers updated*. Three changes ask you to confirm in a dialog first: turning enforcement off (*Turn Off MCP Enforcement?*), switching from **Off** to **Block** (*Enable MCP Enforcement?*), and un-ticking servers while saving under **Block** (*Block More Servers?*). The two **Block** dialogs name how many servers stay allowed and how many will be blocked. **Disable Blocking Temporarily** is an Admin control, shown while enforcement is **Block**. It allows every unsanctioned server for **24 Hours** or **1 Week** without changing your lists — the card then reads **Blocking Temporarily Disabled** with the time it lapses, and blocking returns on its own or on **Re-enable Blocking**, which takes effect immediately. ### Key rotation Admin only. Search and select up to five people whose keys should be reissued, then type **ROTATE** to confirm — the dialog notes that **this action cannot be undone**, and that the selected members' keys are invalidated immediately, so their connected tools and devices need the new key. Rotation runs in the background: *API key rotation started. You'll be notified when it finishes.* ## Messages you may see | Message | What it means | | ------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `Unable to load configuration data. Please try again later.` | The page could not fetch your configuration. Refresh to retry | | `Unable to load connection status.` | Tool Coverage could not load. The rest of the page is unaffected | | `Unable to load deployment posture.` | The posture panel could not load. The rest of the page is unaffected | | `Nothing is reporting yet. Run the install command below and this fills in as devices check in.` | Deployment Posture has nothing to show yet | | `No devices connected yet. Run the command above to get started.` | Nothing has checked in yet. The install command in step 3 is the next step | | `Could not load MCP servers. Please close and try again.` | The approvals dialog could not load its list. Close it and reopen. **Sanction Agents** and **Rotate API Keys** say the same thing about their own lists — *Could not load sanctioned agents* and *Could not load organization members* | | `No hooks are reporting yet, so no tool is governed.` | Discovery is running but governance is not. Tick **Govern coding agent actions** and run the command again | | `Hooks not reporting yet` | The same, shown against Deployment Posture | | `Failed to disable blocking. Please try again.` | Enforcement is unchanged and still applies | | `Failed to re-enable blocking. Please try again.` | Blocking stays disabled until it succeeds | ## Common questions **Where do I get my Unbound API key?** It is inside the install command in step 3. Where your organization has API access turned on, the rail also shows the key on its own with a copy control. **Does sanctioning an agent block the ones I leave out?** No. Sanctioning agents shapes your Discovery insights; it does not stop any request. MCP server approvals do enforce, once **Enforcement** is set to **Block** or **Warn**. **How do I roll Unbound out to everyone rather than just my machine?** Set scope to **My org (MDM)** in step 1. The command changes to the MDM form and the organization-wide extras appear. **My tools are discovered but nothing is being enforced.** Discovery and governance install separately. Tick **Govern coding agent actions** in step 2 and run the command again; **Governance hooks installed** under Tool Coverage is the figure to watch. **How do I decide which MCP servers my agents can reach?** **Actions → Sanction MCP Servers**. Tick the ones you sanction, then set **Enforcement** to decide what happens to everything else — **Block** denies them, **Warn** lets a developer proceed after a notice, **Off** allows everything. **How do I reissue someone's API key?** **Actions → Rotate API Keys**, select the people, and type **ROTATE**. It runs in the background and notifies you when it finishes. ## Related | Page | For | | --------------------------------------------------- | ---------------------------------------------- | | [Discovery — Summary](/dashboard/discovery/summary) | Confirming devices are reporting | | [MCP Connections](/dashboard/mcp-connections) | The servers your agents actually reached | | [Settings](/dashboard/settings) | Provider API keys, which are a different thing |