HypAware Team and Fleet Setup

This guide covers rolling HypAware out beyond a single machine: enrolling a team on the central server, and unattended installs pushed over MDM. For the single-developer local flow, see Claude Code OpenTelemetry Setup or run npx hypaware and follow the walkthrough.

HypAware captures conversations and traffic from local AI clients (Claude Code, Codex), raw Anthropic and OpenAI API traffic, and OpenTelemetry logs, traces, and metrics. Solo, everything stays in a local query cache on the machine. Enrolled in an organization, each machine forwards its recordings to the central server so usage, spend, and activity can be queried and reported across the whole team.

Requirements

• Node.js 22.12 or newer
• macOS (launchd) or Linux (systemd --user) for the persistent daemon

Enroll a machine (hyp remote login)

Once your organization is set up on the central server, enrolling a machine is one command:

npx hypaware remote login

This opens a browser sign-in. The organization is resolved from the work email domain, and the machine enrolls itself: it provisions the forwarding sink, stores a per-machine credential, installs the persistent daemon, and starts capturing and forwarding. No bootstrap token, no URL to copy, no hand-edited config.

The same sign-in unlocks remote queries across the whole team's recordings:

hyp query sql "select count(*) from ai_gateway_messages" --remote

Organizations are hosted by Hyperparam, with data segregated per organization. Contact us and we will set one up for your email domain; after that, everyone on the team onboards with the single command above.

Unattended enrollment over MDM (hyp join)

For scripted rollouts (Jamf, Kandji, Intune, dotfiles, CI images) where no browser is available, hyp join enrolls a host with a fleet policy token instead of an interactive sign-in:

hyp join <url> --token-file <path>     # read the token from a file (recommended for MDM)
echo "<token>" | hyp join <url>        # or from stdin

The policy token is a multi-use fleet-wide credential, so prefer --token-file or stdin over a positional argument, which would land in shell history and process listings. hyp join writes the enrollment config to a dedicated layer, so joining augments an existing local install rather than replacing it, then installs and starts the daemon.

For the full rollout story (fleet tokens, managed config, verifying machines), see the team setup guide in the HypAware repo.

Privacy controls

Enrollment does not ship anything immediately. The first sync, including backfilled history, waits until at least 11:59pm local time on the day of enrollment, and the login prints the exact deadline. Before then, each developer can run the hypaware-privacy skill in Claude Code or Codex to review what will ship and purge anything sensitive.

Every directory subtree resolves to a usage class, evaluated gitignore-style: sync (recorded and forwarded, the default), local-only (recorded, never forwarded), or ignore (never recorded at all). Developers mark subtrees with hyp ignore [path], which writes a committable .hypignore file that travels with the repo. When multiple markings apply, the most restrictive wins. See what HypAware records and how to control it for the details.

Analyzing the data

Once machines are enrolled and forwarding, the collected logs are queryable from the command line with hyp query, and at scale in Hyperparam: filter, search, and cluster millions of traces in the browser, generate label columns at scale, and feed the findings back into the prompts and skills your team maintains. See the architecture overview for how the pieces fit.