Early access · hosted trials now open

See how your team really uses Claude Code, Codex CLI and Cursor.

Synopt is a small macOS agent plus a hosted dashboard. The agent reads the telemetry those tools already write on each engineer's Mac and turns it into three answers: who has adopted what, what it costs, and whether a secret just went into a prompt.

It is not a surveillance tool. No prompt text, no source code, no keystrokes, no screenshots, and secrets are detected and redacted on the device before anything is uploaded. See exactly what we capture.

  • Free for 14 days
  • No credit card
  • Up to 25 engineers
  • macOS only

Prefer to run it yourself? Synopt is self-hostable too.

synopt.dev/overview
Active engineers
18/25
+12.3%
AI events (7d)
41,902
+23.1%
Tokens (7d)
2.4M
+8.4%
Usage Over Time
Claude CodeCursorCodex CLI
On-device scanbefore uploadon the engineer's Mac

Illustration. The match is replaced on the machine before upload: Synopt keeps the finding (type, severity, field), never the value and never the prompt text.

Sample data. See the real interface.

Captured today on macOS: three tools, no configuration per tool

  • Claude Code
  • Codex CLI
  • Cursor
  • GitHub CopilotPlanned
  • ChatGPTPlanned
Two ways to run Synopt

We host it, or you do

Same product, two operating models. Only one of them you can start on your own, today.

Synopt Cloud

Self-serve · start in a minute

We host it. Ask for a trial, we set your org up, and each engineer installs the signed macOS agent. Events start arriving the first time a tool runs after the install.

  • Free 14-day trial, no credit card, up to 25 engineers: each with as many Macs as they use.
  • Runs on EU infrastructure in Germany (EU), operated by Codex Labs Technologies LLP.
  • Data kept for 30 days rolling during early access: ask us if you need a longer evaluation window.

Want to inspect the agent first? Download it and check the signature (no account needed).

Self-hosted

Talk to us first

You host it. You run the stack on your own hardware with Docker Compose. In a self-hosted deployment there are zero outbound data flows: no telemetry to us and no phone-home.

  • For teams whose telemetry may not leave their own network.
  • Sold with a support agreement, not self-serve: we scope and set it up with you.
  • The agent is open source (Apache-2.0) either way, so your security team can read it first.
The visibility gap

Three questions nobody can answer today

AI adoption outran governance. Every leader is flying blind in a different way.

CISO

“Did anyone paste a credential into a prompt?”

It happens, and today there is no log anywhere that would tell you, not in your IdP, not in your SIEM, not in the tool.

CFO

“Which AI licences are actually being used?”

Seats renew automatically and half of them sit idle. Spend climbs with no per-team attribution to defend it.

VP Engineering

“Which teams have actually adopted this?”

Adoption is uneven and invisible. You can’t double down on what’s working if you can’t see what’s working.

Product tour

One dashboard,
minutes to first data

Install the agent on a few Macs, sign in, and adoption, estimated cost and secret findings land in a single dashboard.

01
Deploy the agent
A signed installer or one CLI command per Mac. Each AI tool needs restarting once afterwards, then events flow on their own.
02
Capture telemetry
Usage, tokens and model mix chart in, trended over any window.
03
See the secrets that got pasted
Detected and redacted on the Mac at capture, so the value never reaches the server. Synopt isn't in the request path, so it can't stop a prompt being sent, and nothing pages anyone yet. Alerting, PII and proprietary-code detection are planned.
synopt.dev/overview
Active engineers
18/25
+12.3%
AI events
41,902
+23.1%
Tokens
2.4M
+8.4%
Secret findings
3
last 7 days
Usage Over Time
Claude CodeCursorCodex CLI
Highm.patelGitHub PAT in pasted diff12m ago
Highj.doeAWS access key detected32m ago
Mediuma.smithAPI key in shell command3h ago

Sample data, not a real organisation. Open the live demo to click through the real interface.

The product

One dashboard for AI coding tools across the org

Adoption, secret findings, estimated cost and agent fleet: from the endpoint up, in one place.

Adoption

See which teams actually picked it up

Per-engineer and per-team activity, tool mix and model mix, trended over any window.

Backend
17,203
Frontend
12,486
Data Sci
7,908
Platform
4,305
Secret detection

See the credentials that reached a prompt

Credentials are detected and redacted on the device before upload, then severity-scored and attributed to a person and a repo. You read findings in the dashboard; alert delivery is planned, not shipped, so nothing pages you yet. PII and proprietary-code detection are also planned.

  • Highm.patelGitHub PAT in pasted diff
  • Highj.doeAWS access key
  • Mediuma.smithSlack bot token
Estimated cost

Tie usage back to a team

Token spend per tool and per team, priced from what each tool's own telemetry reports. It is a modelled figure, not your invoice: a tool that reports no cost contributes nothing to the total. Licence-utilisation and idle-seat reclaim are planned.

Est. spend / mo
$3,180
+6.2%
Tokens / mo
9.6M
+8.4%
Agent fleet

One lightweight agent per Mac

Install with a Developer ID-signed, notarised installer or one CLI command, then watch health and version across the fleet. When a new version ships the agent tells you, and someone applies it from the menu-bar app: updates are not silent, and they are not automatic. macOS only; MDM push (Jamf, Kandji, Intune) is planned.

Agent healthall up to date
Online21
Idle3
Offline1

Figures shown are sample data.

Where Synopt is today

New, in use, and honest about the gaps

Here is the actual state of things.

Early access

Synopt is new. It has been running continuously against real daily AI-tool usage since July 2026, and it is now open for its first hosted trials.

Small enough to answer you personally

A single pilot team has been running it since July 2026. Signing up is self-serve and takes a minute; the follow-up is not automated: we read what you hit and fix it, usually the same week.

The agent is open source

Apache-2.0 and public. Your security team can read every line that runs on an engineer's Mac before it is installed.

What isn't shipped yet

Not built yet. If your decision depends on one of these, tell us before you spend time on a trial.

  • Alerting. Findings appear in the dashboard; nothing notifies you. There is no alert engine and no delivery (email, Slack, webhook) yet.
  • PII and proprietary-code detection. Today's scanner finds credentials and tokens only.
  • Shadow-AI discovery: finding tools nobody told you about.
  • GitHub Copilot and ChatGPT capture. We have not written a reader for their log formats yet, so their events are dropped rather than guessed at.
  • MDM push (Jamf, Kandji, Intune). Install is a signed installer or one CLI command per Mac.
  • Windows and Linux agents. macOS only, deliberately (see /security).
  • SSO/SAML, and any audited compliance certification. Synopt has never been SOC 2 audited or penetration tested.
The honest answer

What we capture. What we never capture.

Your engineers will ask this within an hour of the install, so here is the whole answer up front.

What we capture

Which tool and which model
Claude Code, Codex CLI or Cursor, plus the model name the tool reported.
Timestamps and token counts
When a request happened and how many input/output tokens it used.
Estimated API-equivalent cost
As reported by the tool's own telemetry, not your provider's billing data. Tools that report no cost contribute $0.
Repository and branch
Which repo, branch and project the activity happened in. Not which file, and not the contents of any file.
A secret-detection verdict
Type, severity and which field it was found in: a label, not the value.

What we never capture

Prompt text
Off by default, and the default fails closed: an absent, invalid or mistyped setting resolves to storing nothing. An org can turn prompt storage on for itself (some do, for incident review), and until it does, there is no prompt text anywhere.
The secrets themselves
Detected secrets are redacted on the device before upload. The scanner's output carries no matched substring, so the value never reaches us.
Source code or diffs
No file contents, no patches, no commit bodies.
Keystrokes, screenshots or browser history
There is no keylogger, no screen capture and no browser instrumentation in the agent. It is open source: check.

The agent also refuses to enroll at all until the engineer on that machine has acknowledged a disclosure of exactly this. Read the full security page or read the agent source.

How it works

Three steps, on hardware you already own

01

Install

A Developer ID-signed, notarised macOS installer, or one CLI command per Mac. macOS only; MDM push is planned.

02

Capture

The agent reads what the tools already emit locally, redacts secrets on the device, then ships the metadata to Synopt Cloud in Germany (EU), or to your own servers if you self-host.

03

Read

Adoption, estimated cost and secret findings in one dashboard. Each tool needs restarting once after the install; after that events arrive continuously.

vs. gateway and proxy tools

We run on the laptop, so we can tell you the tool, model, repo and branch, not just that a request happened.

vs. per-developer tools

We roll up a whole org, not one laptop at a time.

vs. closed agents

The agent that runs on your engineers' Macs is open source, Apache-2.0: read it before you install it, or self-host the whole stack.

Start your free 14-day trial

Create an org, install the agent on a few Macs, and see real numbers this week.

Free for 14 days · No credit card · Up to 25 engineers · macOS only

Prefer to run it yourself? Synopt is self-hostable too.