Enterprise MDM Rollout
Coding-Agent Telemetry is set
through environment variables (Claude Code, GitHub Copilot CLI) or a
config file (OpenAI Codex CLI, ~/.codex/config.toml). This page shows how
to push those settings to a fleet with your MDM.
Using Discover AI? The Discover AI enrollment script already detects and
configures these three tools on each device, including the per-user
user.id and the project's content-capture setting. Distribute the
enrollment script with your MDM (see
Deploying Agents & Extensions) and skip the
manual payloads below.
Before you start
- Admin access to your MDM (Jamf, Kandji, Intune) or Group Policy.
- A project public key and secret key from Project Settings > API Keys. Use a dedicated key pair for fleet telemetry.
- The ingest endpoint:
https://<your-ants-host>/api/public/otel. - The Basic auth value, computed once:
What to manage
| Tool | Setting | Fleet mechanism |
|---|---|---|
| Claude Code | Environment variables | Managed /etc/zshenv or a LaunchAgent (macOS); machine and user environment variables (Windows) |
| GitHub Copilot CLI | Environment variables | Same as Claude Code |
| OpenAI Codex CLI | ~/.codex/config.toml | Script payload per user (macOS); Intune script (Windows) |
Gemini CLI and Cursor have no ANTS Platform parser. See Other tools.
Do not set OTEL_SERVICE_NAME in a machine-wide payload. Each tool
reports its own service name. One shared value makes every agent on the
device look like the same tool. The enrollment script leaves it unset for the
same reason.
Content capture is opt-in
The payloads below send metadata only: counts, models, durations and tool names. Add the content settings only if your data-handling review allows it.
| Tool | Add to capture content |
|---|---|
| Claude Code | OTEL_LOG_USER_PROMPTS=1, OTEL_LOG_TOOL_DETAILS=1, OTEL_LOG_TOOL_CONTENT=1, and OTEL_LOG_RAW_API_BODIES=1 for assistant responses |
| GitHub Copilot CLI | OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT=true |
| OpenAI Codex CLI | log_user_prompt = true in the [otel] table |
Codex CLI always sends tool arguments and tool output, even with
log_user_prompt = false. Shell commands and file contents read by Codex can
appear in this data.
User attribution
ANTS Platform attributes a trace to the resource attribute user.id. A
resource-level user.email is ignored as an override.
| Tool | Identity without user.id | user.id in the payload |
|---|---|---|
| Claude Code | The user's Claude login email | Optional |
| OpenAI Codex CLI | The user's ChatGPT login email | Optional |
| GitHub Copilot CLI | Only a non-reversible hash | Required for a readable user |
Template user.id per device from the device's assigned user. One value
pushed to every device attributes everyone to one person. Common sources: a
Jamf script parameter (for example $4, filled from an LDAP or extension
attribute lookup), a Kandji Blueprint variable, or whoami /upn on an
Entra-joined or domain-joined Windows device.
Environment-variable tools (Claude Code, Copilot CLI)
Option A: managed /etc/zshenv. Push a script, run as root, that writes a
shell-wide file. zsh reads /etc/zshenv for every shell, so the variables
reach the tools however they start. This assumes one assigned user per device.
The heredoc is unquoted (<<EOF) so ${USER_EMAIL} expands. Remove the
Claude Code or Copilot lines for tools you do not use.
Option B: a LaunchAgent with launchctl setenv. A LaunchAgent runs in the
logged-in user's session, so it can derive the user locally, which suits
shared Macs. It also exposes the variables to apps started from the Dock.
Push a plist such as /Library/LaunchAgents/com.example.ants-otel.plist:
Add the Claude Code variables from Option A the same way if you use it.
Config-file tool (Codex CLI)
Codex reads ~/.codex/config.toml for each user. Push the [otel] table to
each user's home. If a user already has an [otel] table, merge rather than
overwrite.
Keep trace_exporter = "none". The Codex trace exporter sends only internal
spans. The logs endpoint needs the explicit /v1/logs path, because Codex
does not append it.
Secret handling
Distribute the key through managed configuration
The Basic auth value contains your secret key. Push it only through MDM payloads (managed files, registry or config profiles). Never commit it to a repository or a shared dotfile.
Use a dedicated key pair
A separate project key pair for fleet telemetry can be revoked without affecting other integrations.
Rotate by re-pushing
Create a new key pair under Project Settings > API Keys, compute the new Basic auth value, update the payloads and redeploy. Revoke the old key after all devices have checked in. See API Keys.
Verify
On a test device, open a new terminal, run a prompt in each tool and check Tracing in ANTS Platform. Each prompt appears as its own trace within a minute or two. See Troubleshooting if nothing arrives.