Blekline is Layer 4 governance in the AI Enablement Stack — mask, enforce, and audit agent traffic before it reaches models and L1 sandboxes.
1. Workspace token
Create an API key in Admin → API keys (or Operations → MCP) with scopes mask:write and events:write.
2. Headless smoke (CLI first)
git clone https://github.com/Blekline/blekline-oss.git
cd blekline-oss
pnpm install && pnpm build:packages
export BLEKLINE_WORKSPACE_TOKEN="blw_..."
export BLEKLINE_API_URL="https://app.blekline.com"
export BLEKLINE_CLIENT_SURFACE="sdk"
pnpm demo:mcp-smoke
Or without clone: npx -y @blekline/mcp-server with the same env vars.
See cli/ on blekline-oss.
3. CI verify (optional)
pnpm verify:integrations
Copy ci/github-actions/blekline-gate.yml.example for GitHub Actions. See CI/CD.
4. Connect your agent client
Full matrix: Integrations index · Agent clients
| Client | Repo path | Doc |
|---|---|---|
| Claude Code | .claude/settings.json.example | Claude Code |
| Cursor | .cursor/mcp.json.example | Cursor |
| Claude Desktop | config/claude_desktop_config.json.example | Claude Desktop |
| Codex | .codex/config.toml.example | Codex |
| Continue / Copilot | .vscode/ | Continue · Copilot |
Generate examples: pnpm generate:mcp-configs — live configs: pnpm generate:mcp-configs --local
5. Verify in IDE
Reload your client and confirm MCP tools: blekline_mask_prompt, blekline_evaluate_tool_call, etc.
Sandboxes and models
- L1 sandboxes: Sandbox providers +
@blekline/mcp-proxy - Model APIs: Model providers
Try the simulator: [Runtime Enforcement Simulator](/docs/playground/runtime-enforcement) · [NHIM overview](/docs/introduction/nhim) · Definitions
Next steps: AI Enablement Stack · Architecture · Open workspace