Blekline meets developers where agents already run: Layer 5 MCP clients, IDE extensions, and headless CI. One workspace token, one policy plane — mask prompts, evaluate tool calls, and stream governance events without replacing your stack.
Supported surfaces
| Client | Status | Setup guide |
|---|---|---|
| Cursor | Verified | .cursor/mcp.json.example |
| Claude Code | Verified | .claude/settings.json.example |
| Claude Desktop | Verified | config/claude_desktop_config.json.example |
| Codex | Verified | .codex/config.toml.example |
| GitHub Copilot / VS Code | Verified | .vscode/mcp.json.example |
| Continue | Verified | .vscode/continue.config.json.example |
| CLI / SDK | Verified | TypeScript SDK |
| OpenHands | Pattern | MCP server + proxy |
| Sourcegraph Cody | Pattern | MCP server + proxy |
Full matrix and repo paths: integrations/manifest.json on blekline-oss.
Connect in three steps
1. Create a workspace key with mask:write and events:write scopes at app.blekline.com.
2. Set environment variables (same for every surface):
export BLEKLINE_WORKSPACE_TOKEN="blw_..."
export BLEKLINE_API_URL="https://app.blekline.com"
export BLEKLINE_CLIENT_SURFACE="cursor" # cursor | claude-code | github-copilot | sdk | …
3. Add Blekline MCP to your client config:
npx -y @blekline/mcp-server
Or route downstream tools through @blekline/mcp-proxy when you need a transparent execution firewall in front of existing MCP servers.
What you get on every client
- Prompt masking before content leaves your environment
- Tool-call evaluation — allow, mask, or block before downstream MCP servers act
- Governance events — metadata-only audit trail in the Blekline workspace
- Policy sync — workspace rules apply without redeploying local configs
Verify headless (CI / pre-commit)
git clone https://github.com/Blekline/blekline-oss.git && cd blekline-oss
pnpm install && pnpm build:packages
export BLEKLINE_WORKSPACE_TOKEN="blw_..." BLEKLINE_API_URL="https://app.blekline.com"
pnpm verify:integrations
Downstream MCP servers
Use @blekline/mcp-proxy to sit between your agent and any MCP server (filesystem, database, internal APIs). Blekline evaluates each forwarded call against policy — same allow/mask/block semantics as the native server.
→ [MCP proxy](/docs/mcp/proxy) · MCP server API
Next: [Eval journey — Track 03](/docs/get-started/eval-journey) · Quick start · Model providers hub