Get started

Get started

Quick Start

Connect Blekline in under three minutes — sign up, wire Claude Code or Cursor, and prove mask + audit without cloning OSS.

View as Markdown
Tip: Agent context files live at /llms.txt and /llms-full.txt.

Overview

Blekline governs prompts and tool calls before they reach models: mask secrets, enforce MCP policy, and write metadata-only audit events. The Local path runs local mask on your machine — no OSS clone required.

You want to…Start here
Connect an IDE in minutesConnect a client below
Pick a plan path (Local → Enterprise)Choose your path
Scan a K8s cluster (no account)[NHIM audit quickstart](/docs/get-started/nhim-audit-quickstart)
Platform eval (fleet / sidecar)[Eval journey](/docs/get-started/eval-journey)

Prerequisites

  • A Blekline workspace (sign up — Local is local mask only)
  • One supported client: Claude Code, Claude Desktop, or Cursor
  • Optional: workspace API token (blw_...) with mask:write and events:write from Admin → API keys

Step 1 — Create a workspace

  1. Open app.blekline.com/auth/signup.
  2. Complete onboarding — Local uses local mask only (no hosted /api/mask quota). See Blekline Local.
  3. Note your workspace — you'll connect clients to this tenant.

Step 2 — Connect a client

Pick one client first:

ClientTimeGuide
Claude Code~2 minClaude Code — copy .claude/settings.json.example, set BLEKLINE_WORKSPACE_TOKEN
Claude Desktop~2 minClaude connector — OAuth from Operations → MCP, or stdio
Cursor~3 minCursor — MCP + hooks; native chat uses block + clipboard

More clients: Guides hub · VS Code · Codex

Optional — MCP in 60 seconds (no clone)

export BLEKLINE_WORKSPACE_TOKEN="blw_..."
export BLEKLINE_API_URL="https://app.blekline.com"
export BLEKLINE_CLIENT_SURFACE="sdk"
npx -y @blekline/mcp-server

Step 3 — Prove mask + audit

  1. Reload the client. Confirm tools: blekline_mask_prompt, blekline_evaluate_tool_call.
  2. Send a test prompt with an email and a fake AWS key (AKIAIOSFODNN7EXAMPLE).
  3. Confirm the model sees placeholders, not raw secrets.
  4. Open Operations → Activity — metadata only; we never store raw prompts.

Deployment paths

When you're ready to move beyond Local:

PathBest forDoc
LocalLocal hooks, stdio MCPBlekline Local
MarkHosted proxy + team policyMark hosted
RedactK8s sidecar + Enclave in your clusterEnclave AKS
EnterpriseIn-VPC, dual-control, customer keysEnterprise in-VPC

Plan details: Choose your path · in-app Billing

What's not step 1

  • Cloning blekline-oss — for contributors and CI templates, not the Free wedge.
  • Kubernetes / Docker sidecar — [platform eval](/docs/get-started/eval-journey), after you prove MCP mask locally.

Next steps

Open workspace · Report issue