Kryex Admin · console

The control plane for coding agents. Who can do what, on which system, with which model.

Kryex Admin is where your organization governs every coding agent. Approve requests, grant exactly the access each person needs, set what the agent may do on every device, choose the models, and keep a complete record of what happened.

Book a demoRead the admin guide
DashboardSample dataSearch ⌘KAadmin@acme.com
Tokens · 7d4.2M
Tokens today612k
Active users38
Models live6
Gateway traffic · last 14 days
Recent activity
dev-b requested WRITE on orders-dbPending
admin approved transition_issue onceApproved
Kryex Admin with sample data. Select any highlighted page to explore it.
Inbox

Every decision that needs a human, in one place.

Access requests, held tool calls, model requests and security notes land in one inbox, sorted into “Needs your decision”, “Needs attention” and “For your information”.

  • Approve or Deny an access request, with the person's reason in front of you.
  • Approve and run once a held call — Kryex runs exactly the call that was held, nothing more.
  • Grant READ, WRITE or ADMIN, or grant a model, straight from the request.
  • Find any request in seconds, by person, team, group, role, source, type or date.
People & access

Least privilege, for every person and every team.

OrganizationYour organization as a directory or a live org chart. Invite engineers, form teams, and open anyone to review their access, Kryex Code policy, devices and activity.
RolesFive built-in roles — Developer, Team admin, Policy admin, Auditor and Org admin. Each sees and changes only what its role permits.
GroupsGrant tools to an entire group in one step. When membership changes, access follows automatically.
Connections

Register a system once. Decide exactly what the agent may do there.

Every database, data platform and web tool the agent can reach is registered here. Give people READ, WRITE or ADMIN, set rules per table and per operation — Allow, Ask or Block — and hold every call for approval when you want a human in the loop.

  • Test connection and Try a statement before anyone uses it.
  • The browser gets its own levels — Observe, Interact, Full control — plus a domain policy.
PostgreSQLSupabaseMySQLMongoDBTiDBMariaDBCockroachDBDatabricksDatadogWeb Access · agent browserWeb Research · SearXNGSQL ServerComing soonOracleComing soon
MCP servers & connectors

Every tool approved by a person, before anyone can use it.

Register an MCP server in three steps and Kryex discovers its tools, suggests a tier for each, and keeps them quarantined until you approve. For personal connectors like GitHub or Jira, turn one on or off for the whole organization, block single tools, and manage each person who signed in.

AI-assisted tiering, with a safety floorDiscovery → review
The AI suggests a tier. A keyword floor sets the minimum. The result is the higher of the two, so the AI can raise a tool's risk but never lower it. Every tool still waits for an admin.
READ2
search_issuesAI: READ · Returns issues matching a filter.quarantined
get_pageAI: READ · Reads one Confluence page.quarantined
WRITE3
create_issueAI: WRITE · Creates a new issue.quarantined
add_commentAI: READ · Looks low impact.floor → WRITE (“add” floors at WRITE)quarantined
transition_issueAI: WRITE · Moves an issue between statuses.quarantined
ADMIN2
delete_issueAI: WRITE · Removes one issue.floor → ADMIN (“delete” floors at ADMIN)quarantined
run_exportAI: READ · Exports results.floor → ADMIN (“run” floors at ADMIN)quarantined
Red border: the floor overruled the AI. Words like delete, exec, run and sql floor at ADMIN; create, update, add and send floor at WRITE.
Suggestions ready · an admin approves each tool to activate it
Set up MCP servers and connectors
Kryex Code policy

One policy for every agent, enforced on every machine.

Choose how far the agent may go on its own, and the furthest permission mode anyone can pick. Turn shell commands off entirely, or set Allow, Ask or Block for each command category. Changes reach running apps in seconds.

  • Test a command to see exactly what would decide it.
  • Lock it on devices, even offline — the policy is written to each machine.
  • See every device that's live, and revoke one in a click.
Test a command before anyone runs itKryex Code policy
Admins set each command category once — Allow, Ask or Block — and Kryex Code enforces it on every device. Pick a command to see what decides it.
ASKIn the category Git history rewrites, set to Ask. This applies in every mode, Bypass included.
Destructive file deletes
rm -rf · del /s · Remove-Item -RecurseBLOCK
Git history rewrites
git push --force · git reset --hard · git clean -fdxASK
Disk and system
format · mkfs · dd · diskpart · shutdownBLOCK
Example settings. Your admin chooses Allow, Ask or Block for each category.
Model gateway

Every model, governed like any other system.

LLM configConnect a provider, verify it, and release each model to everyone or to named people, with a usage limit per user.
Access & quotasModel grants and token budgets per person — daily from midnight UTC, or rolling from first use — with requests sent for review.
UsageTokens, requests, latency and error rate per model across 7, 14 or 30 days, measured against the prior period.
Security & audit

Signals that need a human. Evidence for everything else.

SecurityFindings worth a human's eye — several devices at once, a device changing networks, a revoked device trying again, a spike in denials, license tampering — sorted into “Worth checking now” and “Worth a look”. Resolve, dismiss or reopen each one.
Audit logHash-chained and immutable. Follow it live, filter by kind, actor, outcome, team, user or date, and export to CSV.
Self-hosted

Your infrastructure. Your administrators. Your rules.

On Kryex Cloud, Kryex Labs operates the platform. Self-hosted or air-gapped, your own administrators run all of it.

  • Sign-ups. Who joined and how far they got, with account actions from Suspend to Delete permanently, and a block list.
  • Model health. Failure rate, prompt-cache hit rate, and open problems like a rejected key or a retired model.
  • OAuth Apps and the connector catalog. Register provider apps and publish the connectors your people can use.

See Kryex Admin running on your own stack.

Book a demoMeet Kryex Code
CtrlI