1. Create your organization
Open app.mainlayer.ai/signup. The person who signs up becomes the organization owner. Invite admins, managers and viewers from People & Seats; they are free and never consume a monitored seat.
2. Connect your Git provider
Under Repositories → Connectors add GitHub, GitLab, Bitbucket or Azure DevOps with a token that can read repository metadata. MainLayer imports the repository inventory and keeps it in sync every 30 minutes. Only repository names, remotes and default branches are stored; no source code is fetched.
This inventory is what makes managed versus unmanaged repository detection possible: AI activity in a repository whose remote is not in the inventory is flagged, with only a fingerprint of the remote leaving the developer's machine.
3. Assign monitored seats
A developer needs a monitored seat before a device can enroll. Assign seats from People & Seats. Seats are the pricing unit; everyone else is free.
4. Install the agent
On macOS and Linux, one command downloads the release for your CPU, verifies its SHA-256 checksum and puts mainlayer on your PATH. Nothing is enrolled or configured yet at this point.
curl -fsSL https://mainlayer.ai/install.sh | shPrefer to inspect first? Read the script, or download an archive directly from the release directory. Windows: download the .zip from the same directory and place mainlayer.exe on your PATH.
5. Enroll the machine
For each seated developer, generate a one-time enrollment command from their row in People & Seats. The token is bound to that person, expires after 15 minutes and can be used once. The command the portal shows does everything in one step (download, verify, enroll, start the service):
curl -fsSL https://mainlayer.ai/install.sh | sh -s -- --token enr_••••••••If the agent is already installed, enrolling alone is:
mainlayer enroll --server https://api.mainlayer.ai --token enr_••••••••The agent creates an Ed25519 key pair on the machine, registers the public key and keeps the private key local. Every later request is signed with it; there is no shared API key to leak. Revoking a device is a single click and takes effect immediately.
Then install the background service and provider hooks:
mainlayer install mainlayer statusinstall writes a launchd agent on macOS or a systemd user unit on Linux, and adds MainLayer's hook entries to the supported tools' configuration. It backs up every file it touches and only ever edits entries it owns; mainlayer uninstall restores them.
6. Supported providers and capabilities
The agent discovers installed tools automatically and reports, per tool, which capabilities are supported, partial, detect-only or unsupported. You can see this matrix on every device in the portal.
| Provider | Session lifecycle | Prompt metadata | Tool & file events | Generated diff evidence | MCP inventory |
|---|---|---|---|---|---|
| Claude Code | Supported | Supported | Supported | Partial | Supported |
| Cursor | Partial | Supported | Supported | Partial | Supported |
| Codex, Gemini CLI | Planned; detect-only inventory today | ||||
7. What the agent sends
Every event is a small JSON envelope: event type, provider, model when known, session id, repository state and fingerprint, timestamps, and a payload of counts, hashes and labels. In the default metadata-only mode the server rejects any event that carries prompt or source content, even if a client tried to send it. See the Privacy Policy and Security pages for the full boundary.
8. Troubleshooting
mainlayer doctorchecks tool discovery, hook installation and server reachability without changing anything.mainlayer statusshows module health, buffer depth and the last upload result. Events are buffered on disk while offline and uploaded when the connection returns.- If a device shows disconnected in the portal, the agent has not sent a heartbeat for three minutes; check that the service is running.
- Questions: [email protected].