Documentation
Install the Koban agent, write fleet rules, and sync observations to Fleet.
Koban inventories packages, hooks, skills, and MCP configs from developer Macs. The open-source agent runs on each machine; Fleet receives synced observations, current inventory, and findings across your org.
What Koban does
- Reads inventory from disk (Homebrew, npm, pip, AI tool configs, and more)
- Diffs snapshots and runs YAML policy rules locally
- Syncs observations outbound to Fleet when enrolled
- Alerts via Slack, webhooks, or your SIEM
Koban is a passive sensor. It does not block installs, intercept network traffic, or run remote commands on endpoints.
Fleet authenticates sync with tenant sensor tokens: a tenant-scoped secret managed in Fleet that the agent presents for config, check-in, and upload routes. New agents register once with a short-lived enrollment token to obtain their device identity. Self-hosted enterprise deployments can enable mTLS with device client certificates instead.
The open-source agent speaks an open JSON sensor protocol. Fleet is Koban's commercial implementation of that protocol, not a requirement for running the agent.
Quick links
Installation
Deploy the menubar agent on macOS
Quick start configs
Production-ready configs for enrolling Macs and syncing to Fleet
Authentication
Understand tenant sensor tokens, enrollment, and mTLS
Sensor protocol
Implement the JSON protocol spoken by the open-source agent
Compatible backends
Build a backend that can enroll agents and receive sync data
Fleet rules
Write YAML rules that flag risky package and AI config changes
Agent on GitHub
Source, releases, and local development
Open core
The agent is open source. Fleet (enrollment, policy, review, and alerting) is the paid control plane. Contact hello@kobanhq.com for Fleet access.