Plugin with MDM

This is the path we recommend for most organizations. You deliver the configuration as a file on each device using the device management you already run: Jamf, Kandji, Intune, JumpCloud, or Linux provisioning tooling.

Two reasons it’s usually the better choice:

• You choose who gets it. Target specific devices or groups, so you can pilot with one team, confirm the data looks right, and widen from there. Managed settings applies to every authenticated user in the org at once, with no way to stage it.
• It uses tooling admins already operate. Pushing a config file to a device group is routine work for whoever runs your fleet, with no new admin surface, and it covers developers on personal Claude accounts and machines whose accounts you don’t centrally control.

The configuration itself is identical to the managed settings path; only the delivery differs. Claude Code reads it locally instead of fetching it from Anthropic.

What lands on the device

A single JSON drop-in, written as root:

Claude Code deep-merges everything in managed-settings.d/ with any existing managed-settings.json, so this is additive: it won’t clobber other policies you already push.

Settings delivered this way are org-enforced: users cannot disable the plugin or override the OPIK_CIPX_* environment, and they apply to every user on the device.

Prepare the configuration

Generate it from Cost Intelligence → Organization Policies → Copy settings file, or start from this template:

1
{
2
  "extraKnownMarketplaces": {
3
    "opik-enterprise": {
4
      "source": { "source": "github", "repo": "comet-ml/cost-intelligence-proxy" },
5
      "autoUpdate": true
6
    }
7
  },
8
  "enabledPlugins": {
9
    "opik-cipx@opik-enterprise": true
10
  },
11
  "env": {
12
    "OPIK_CIPX_BASE_URL": "https://www.comet.com/opik/api",
13
    "OPIK_CIPX_WORKSPACE": "your-org-cc-workspace",
14
    "OPIK_CIPX_API_KEY": "<workspace-scoped API key>",
15
    "OPIK_CIPX_PROJECT": "claude-code"
16
  }
17
}

Validate before shipping. A malformed payload is silently ignored by some MDMs, which gives you a rollout that reports success and enforces nothing:

$
plutil -convert json -o /dev/null 50-opik-cipx.json   # macOS
$
python3 -m json.tool 50-opik-cipx.json > /dev/null    # any platform

Deploy

$
#!/bin/bash
$
set -euo pipefail
$
DIR="/Library/Application Support/ClaudeCode/managed-settings.d"
$
/bin/mkdir -p "$DIR"
$
/bin/cp 50-opik-cipx.json "$DIR/50-opik-cipx.json"
$
/usr/sbin/chown root:wheel "$DIR/50-opik-cipx.json"
$
/bin/chmod 644 "$DIR/50-opik-cipx.json"

Verify

As the logged-in user, in a fresh Claude Code session (managed settings load at startup):

$
claude plugin list
$
cat "/Library/Application Support/ClaudeCode/managed-settings.d/50-opik-cipx.json"
$
opik-cipx status

Then confirm traces are arriving in the target workspace.

Updating configuration later

Two things worth separating, because it determines how often you touch your MDM:

• Bootstrap configuration: workspace, API key, base URL, upstream gateway. Changing these means re-deploying the file.
• Cost policies: model defaults, output caps, denied MCP servers and skills, thinking budgets. These do not require an MDM push. The daemon fetches the effective policy for the signed-in user from Opik on startup and on an interval, then applies it to the agent’s config.

So you push this file once, and manage cost policy from the Opik dashboard afterwards.

Uninstall

$
sudo rm "/Library/Application Support/ClaudeCode/managed-settings.d/50-opik-cipx.json"

Then, on each device, opik-cipx uninstall removes the hook, stops the daemon, and deletes local state.

Next steps