See how your team really uses Claude Code, Codex CLI and Cursor.
Synopt is a small macOS agent plus a hosted dashboard. The agent reads the telemetry those tools already write on each engineer's Mac and turns it into three answers: who has adopted what, what it costs, and whether a secret just went into a prompt.
It is not a surveillance tool. No prompt text, no source code, no keystrokes, no screenshots, and secrets are detected and redacted on the device before anything is uploaded. See exactly what we capture.
- Free for 14 days
- No credit card
- Up to 25 engineers
- macOS only
Prefer to run it yourself? Synopt is self-hostable too.
Illustration. The match is replaced on the machine before upload: Synopt keeps the finding (type, severity, field), never the value and never the prompt text.
Sample data. See the real interface.
Captured today on macOS: three tools, no configuration per tool
- Claude Code
- Codex CLI
- Cursor
- GitHub CopilotPlanned
- ChatGPTPlanned
We host it, or you do
Same product, two operating models. Only one of them you can start on your own, today.
Synopt Cloud
Self-serve · start in a minuteWe host it. Ask for a trial, we set your org up, and each engineer installs the signed macOS agent. Events start arriving the first time a tool runs after the install.
- Free 14-day trial, no credit card, up to 25 engineers: each with as many Macs as they use.
- Runs on EU infrastructure in Germany (EU), operated by Codex Labs Technologies LLP.
- Data kept for 30 days rolling during early access: ask us if you need a longer evaluation window.
Want to inspect the agent first? Download it and check the signature (no account needed).
Self-hosted
Talk to us firstYou host it. You run the stack on your own hardware with Docker Compose. In a self-hosted deployment there are zero outbound data flows: no telemetry to us and no phone-home.
- For teams whose telemetry may not leave their own network.
- Sold with a support agreement, not self-serve: we scope and set it up with you.
- The agent is open source (Apache-2.0) either way, so your security team can read it first.
Three questions nobody can answer today
AI adoption outran governance. Every leader is flying blind in a different way.
“Did anyone paste a credential into a prompt?”
It happens, and today there is no log anywhere that would tell you, not in your IdP, not in your SIEM, not in the tool.
“Which AI licences are actually being used?”
Seats renew automatically and half of them sit idle. Spend climbs with no per-team attribution to defend it.
“Which teams have actually adopted this?”
Adoption is uneven and invisible. You can’t double down on what’s working if you can’t see what’s working.
One dashboard,
minutes to first data
Install the agent on a few Macs, sign in, and adoption, estimated cost and secret findings land in a single dashboard.
Sample data, not a real organisation. Open the live demo to click through the real interface.
One dashboard for AI coding tools across the org
Adoption, secret findings, estimated cost and agent fleet: from the endpoint up, in one place.
See which teams actually picked it up
Per-engineer and per-team activity, tool mix and model mix, trended over any window.
See the credentials that reached a prompt
Credentials are detected and redacted on the device before upload, then severity-scored and attributed to a person and a repo. You read findings in the dashboard; alert delivery is planned, not shipped, so nothing pages you yet. PII and proprietary-code detection are also planned.
- Highm.patelGitHub PAT in pasted diff
- Highj.doeAWS access key
- Mediuma.smithSlack bot token
Tie usage back to a team
Token spend per tool and per team, priced from what each tool's own telemetry reports. It is a modelled figure, not your invoice: a tool that reports no cost contributes nothing to the total. Licence-utilisation and idle-seat reclaim are planned.
One lightweight agent per Mac
Install with a Developer ID-signed, notarised installer or one CLI command, then watch health and version across the fleet. When a new version ships the agent tells you, and someone applies it from the menu-bar app: updates are not silent, and they are not automatic. macOS only; MDM push (Jamf, Kandji, Intune) is planned.
Figures shown are sample data.
New, in use, and honest about the gaps
Here is the actual state of things.
Early access
Synopt is new. It has been running continuously against real daily AI-tool usage since July 2026, and it is now open for its first hosted trials.
Small enough to answer you personally
A single pilot team has been running it since July 2026. Signing up is self-serve and takes a minute; the follow-up is not automated: we read what you hit and fix it, usually the same week.
The agent is open source
Apache-2.0 and public. Your security team can read every line that runs on an engineer's Mac before it is installed.
What isn't shipped yet
Not built yet. If your decision depends on one of these, tell us before you spend time on a trial.
- Alerting. Findings appear in the dashboard; nothing notifies you. There is no alert engine and no delivery (email, Slack, webhook) yet.
- PII and proprietary-code detection. Today's scanner finds credentials and tokens only.
- Shadow-AI discovery: finding tools nobody told you about.
- GitHub Copilot and ChatGPT capture. We have not written a reader for their log formats yet, so their events are dropped rather than guessed at.
- MDM push (Jamf, Kandji, Intune). Install is a signed installer or one CLI command per Mac.
- Windows and Linux agents. macOS only, deliberately (see /security).
- SSO/SAML, and any audited compliance certification. Synopt has never been SOC 2 audited or penetration tested.
What we capture. What we never capture.
Your engineers will ask this within an hour of the install, so here is the whole answer up front.
What we capture
- Which tool and which model
- Claude Code, Codex CLI or Cursor, plus the model name the tool reported.
- Timestamps and token counts
- When a request happened and how many input/output tokens it used.
- Estimated API-equivalent cost
- As reported by the tool's own telemetry, not your provider's billing data. Tools that report no cost contribute $0.
- Repository and branch
- Which repo, branch and project the activity happened in. Not which file, and not the contents of any file.
- A secret-detection verdict
- Type, severity and which field it was found in: a label, not the value.
What we never capture
- Prompt text
- Off by default, and the default fails closed: an absent, invalid or mistyped setting resolves to storing nothing. An org can turn prompt storage on for itself (some do, for incident review), and until it does, there is no prompt text anywhere.
- The secrets themselves
- Detected secrets are redacted on the device before upload. The scanner's output carries no matched substring, so the value never reaches us.
- Source code or diffs
- No file contents, no patches, no commit bodies.
- Keystrokes, screenshots or browser history
- There is no keylogger, no screen capture and no browser instrumentation in the agent. It is open source: check.
The agent also refuses to enroll at all until the engineer on that machine has acknowledged a disclosure of exactly this. Read the full security page or read the agent source.
Three steps, on hardware you already own
Install
A Developer ID-signed, notarised macOS installer, or one CLI command per Mac. macOS only; MDM push is planned.
Capture
The agent reads what the tools already emit locally, redacts secrets on the device, then ships the metadata to Synopt Cloud in Germany (EU), or to your own servers if you self-host.
Read
Adoption, estimated cost and secret findings in one dashboard. Each tool needs restarting once after the install; after that events arrive continuously.
We run on the laptop, so we can tell you the tool, model, repo and branch, not just that a request happened.
We roll up a whole org, not one laptop at a time.
The agent that runs on your engineers' Macs is open source, Apache-2.0: read it before you install it, or self-host the whole stack.
Start your free 14-day trial
Create an org, install the agent on a few Macs, and see real numbers this week.
Free for 14 days · No credit card · Up to 25 engineers · macOS only
Prefer to run it yourself? Synopt is self-hostable too.