Installation overview

Cost Intelligence is delivered as a Claude Code plugin that runs a local proxy on each developer machine. Rolling it out means doing two things: getting the plugin enabled, and pointing it at your Opik workspace.

Nothing needs to be installed on a server, and there is no per-developer manual step in any of the supported paths.

Choose a rollout path

MDM

Recommended. Push config with the tooling you already run (Jamf, Kandji, Intune, JumpCloud) and choose exactly which devices or groups get it, so you can pilot and stage the rollout.

Managed settings

Simplest. One JSON paste in the Claude admin console, but it applies to every authenticated user in the org, all at once.

macOS app

Transparent capture via a system extension. Covers every user, including those on the Claude Code desktop app.

Which one fits:

	MDM	Managed settings	macOS app
Requires	Any MDM / provisioning tool	Claude for Teams or Enterprise	MDM + macOS
Platforms	macOS, Linux, Windows	macOS, Linux, Windows	macOS only
Who receives it	Whichever devices or groups you target	Every authenticated user in the org	Targeted devices
Staged / pilot rollout	Yes	No, all users at once	Yes
Agent config needed	Yes (delivered for you)	Yes (delivered for you)	None to deliver — cert trust set up on-device
Intercepts TLS	No	No	Yes, locally
User can disable it	No, enforced	No, enforced	No, enforced
Effort	Low	Lowest	Highest

Try it on your own machine first

Before pushing anything to a fleet, install it on your own machine. It takes a minute, it proves your workspace credentials actually work, and it gives you a known-good reference to compare against if a fleet rollout later looks wrong.

From inside Claude Code:

/plugin marketplace add comet-ml/cost-intelligence-proxy
/plugin install opik-cipx@opik-enterprise

Point it at your workspace with the values from the configuration reference below, in ~/.opik-cipx/config.toml, then restart Claude Code. The session hook starts the daemon and routes the agent through it.

Run a short session, then check what happened:

Bash

opik-cipx status   # daemon state, effective config, spans shipped
opik-cipx logs     # tail the daemon log
opik-cipx viewer   # local UI: every capture, and where each byte was attributed

Finally, confirm the traces arrived in your Opik workspace. Once you have seen that work once, a fleet rollout is the same configuration delivered by a different mechanism.

What you'll need

Before starting any path:

An Opik workspace for coding-agent data
Use a dedicated workspace rather than a shared one. It keeps fleet-wide agent traffic isolated from individual developers' own Opik projects.
A workspace-scoped API key
Create a service-account key scoped to ingest, not a personal token. In every rollout path the key is readable on the developer's device, so it should carry no permission beyond writing traces. Rotate it by re-deploying the configuration.
Your Opik base URL
https://www.comet.com/opik/api for Opik Cloud, or your own origin if you self-host.

Configuration reference

Every path sets the same four values; only the delivery mechanism differs.

Variable	Purpose
`OPIK_CIPX_BASE_URL`	Opik installation to ship traces to
`OPIK_CIPX_WORKSPACE`	Target workspace
`OPIK_CIPX_API_KEY`	Workspace-scoped service-account key
`OPIK_CIPX_PROJECT`	Opik project the traces land in

Optional:

Variable	Purpose
`OPIK_CIPX_UPSTREAM_BASE_URL`	Send traffic to your own gateway instead of the provider directly (corporate LLM gateway, LiteLLM, Bedrock access gateway)
`CIPX_CAPTURE_CONTENT`	Content capture. Defaults to off; set `false` explicitly to prevent any user from enabling it
`CIPX_SENTRY`	Set `off` to disable error telemetry

Data collected

Only counts, costs, and structural metadata are reported. Prompt and response content is not collected unless content capture is explicitly enabled, and an organization can pin that off so no individual user can turn it on.

Data, privacy and security

The full field-by-field inventory, an example payload, the content capture control, where data goes, and how it is protected in transit and on disk.

Verify a rollout

On a target device, in a fresh Claude Code session:

Bash

opik-cipx status          # daemon state, effective config, spans shipped
claude plugin list        # opik-cipx@opik-enterprise -> enabled / managed

Then confirm traces are arriving in the target Opik workspace. That last check is the one that matters: a device can look fully installed and still be shipping nothing if the workspace credentials didn't land.