FAQ
Short answers to the questions we get most about prompts, blocking, plans, uninstalling, and what leaves the workstation.
Does AgentKeeper read my prompts?
Only if Prompt Vault is on. By default AgentKeeper stores the tool name, arguments, file paths, and command lines — not prompt text. See Data handling.
Does it store my IP address?
No. The country is derived at ingest and the raw IP is discarded. You can turn off country capture per organization in Settings → Privacy.
Can it block, or only watch?
It blocks where the agent asks before executing. Claude Code, the MCP Gateway, and the browser extension can all deny an action before it runs. Surfaces that only report after the fact cannot. IDE coverage parity has the per-agent table.
Do I need an MDM?
No. A single developer can connect in under five minutes with a browser login. MDM matters when you need silent install and tamper resistance across a fleet. See Choose your rollout.
What happens if AgentKeeper is unreachable?
The hook fails open — the agent keeps working and the event is not recorded. Nothing hangs waiting for a verdict.
Can a developer uninstall it?
On a self-installed workstation, yes. On an MDM-managed fleet, control integrity detects and reports removal, and your MDM reinstalls it.
Does turning off a connector uninstall anything?
No. Ingestion stops and new events are dropped. Installed hooks keep running, and evidence already stored stays visible.
Which plan do I need?
Runtime hooks, the MCP Gateway, and the browser extension work on Free. Endpoint discovery needs Team. SSO, directory sync, OTLP forwarding, and the compliance API connectors need Enterprise. Full table in Coverage overview.
Can I export the data?
Yes — Data export for scheduled exports, the API reference for reads, and Webhooks for push.
Does it work offline or on-prem?
Private, staging, BYOC, and on-prem environments use the same API paths behind a tenant-specific base URL. See Architecture.