For developers
Your agent stays your agent.
Keep personal configuration, native terminal behavior, and the CLI workflow you already use. Blue handles policy before launch and then gets out of the way.
Explore supported harnessesOpen-source governance for coding agents
One harness to rule them all.
Give every team one trusted way to use Codex, Claude Code, Kimi Code, and OpenCode, while every developer keeps the native CLI they chose.
Govern the work, not the way people work.
Blue sits between organization policy and the coding-agent CLIs developers already know. It adds control without replacing their tools or terminal experience.
Codex
Claude Code
Kimi Code
OpenCodeFor platform teams
One place to set the rules.
Publish policy, manage extensions, control versions, connect identity, and see client health across every supported agent.
Explore administrationOne terminal. Every governed workflow.
Authenticate, ship trusted tooling, move between agents, and pick up remote sessions without giving up the native CLI.
blue login
Confirmation code: BLUE-7K9P
Opened your browser to authorize the CLI.
Device authorization approved
Rotating credentials stored with owner-only permissions
Logged in as alex@acme.dev (org acme).
blue codex -- --model gpt-5
Identity verified · alex@acme.dev
Personalized policy revision 42 loaded
Codex 0.145.0 is installed, allowed, and verified
Managed overlay reconciled; personal config preserved
6 managed extensions ready
Launching the native Codex CLI
blue apply
secure-review@8c41f7 · SHA-256 verified
Linear MCP server activated
Skills, hooks, and plugins projected for Codex
Unmanaged local extensions left untouched
Applied revision 42 · all managed packages healthy
/agent
Choose your default coding agent
Codexcurrent default
Claude Codeinstalled and allowed
Kimi Codeinstalled and allowed
OpenCodeinstalled and allowed
Quit and reload the agent with the selection?
Quit and reload nowgracefully stop the current agent
Launching the native Kimi Code CLI
Current route · organization gateway
Opaque pseudotoken active · provider credentials stay server-side
/direct
Quit and reload the agent with direct credentials?
Keep current sessionuse direct mode after the next Blue restart
Quit and reload nowgracefully stop the current agent
Direct mode selected · governance remains active
Run /direct again to restore organization gateway routing.
Everything teams need to govern agentic coding.
Set policy once, ship trusted tooling, connect identity and inference, and maintain visibility across every supported coding agent.
01
Harness governance
Choose which coding agents and versions can run, then reject incompatible installations before launch.
02Managed extensions
Ship digest-pinned MCP servers, skills, plugins, hooks, subagents, and helper binaries from one catalog.
03Configuration policy
Reconcile organization settings into launch-scoped overlays without replacing developers’ personal configuration.
04Identity and access
Connect CLI device authorization and dashboard access with invitations, OIDC, and SCIM provisioning.
05Bring your own gateway
Connect your organization’s inference gateway and keep provider credentials server-side. LiteLLM is the first supported gateway.
06Session visibility
Opt in to native transcript capture using short-lived uploads to operator-controlled object storage.
Governance where you need it.
Gateway control when you want it.
Governance-only
DefaultBlue manages configuration while each agent talks directly to its provider using the developer’s existing credentials.
Bring your own gateway
OptionalConnect your organization-operated gateway and route inference with an opaque per-user pseudotoken. LiteLLM is supported first; provider credentials remain on your server.
Self-host the reference stack.
Replace the pieces you need.
Deploy with Docker Compose, Helm, and OpenTofu. Keep state in PostgreSQL and S3-compatible storage, or implement the published governance contract in your own services.
Docker Compose
Kubernetes
OpenTofu
PostgreSQL
S3
OpenAPIInstall Blue to get started.
Connect to your organization and keep using the coding-agent CLI you already know, now with governance built in.
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/BlocksOrg/governance-harness/releases/latest/download/install.sh | sh