# Enterprise deployment

## Private tenant

Set `PLASMO_PUBLIC_BLEKLINE_APP_ORIGIN` for the browser extension so agents talk to your tenant first (see internal `ENTERPRISE_GOVERNANCE_AND_DEPLOYMENT.md`).

Control plane URL examples:

- SaaS: `https://app.blekline.com`
- Private: `https://app.customer.com`

## MCP fleet rollout

1. Build packages once in CI: `pnpm build:packages`
2. Generate configs: `pnpm generate:mcp-configs`
3. Distribute via internal git template:
   - `.cursor/mcp.json` (Cursor)
   - `config/claude-desktop.generated.json` (Claude Desktop merge)
   - `.codex/config.toml` (Codex)
4. Subscribe sidecars to `GET /api/workspace/policy-stream` (SSE) for live policy updates.

## MDM / forced extension

Chrome/Edge enterprise policies can pin the Blekline extension ID and allowlist `app.blekline.com` (or private tenant origin).

## Remote MCP (SSE)

For k8s or VPC deployments without stdio:

```bash
BLEKLINE_MCP_TRANSPORT=sse BLEKLINE_MCP_PORT=3200 node packages/mcp-server/dist/index.js
```

Health: `GET http://127.0.0.1:3200/health`  
Connect: `GET http://127.0.0.1:3200/sse`

## Regions

EU data residency: contact enterprise sales with `dataResidency=EU` on lead form (`/api/enterprise/lead`).

---

**Next steps:** [AI Enablement Stack](/docs/introduction/ai-enablement-stack) · [Architecture](/docs/introduction/architecture) · [SSO & deployment](/docs/enterprise/sso-deployment) · [Open workspace](https://app.blekline.com) · [Report issue](https://github.com/Blekline/blekline-oss/issues/new?template=bug_report.yml)