# Thoth Documentation

> Thoth, from Aten Security, is the runtime enforcement layer for AI agents. It evaluates each agent tool call before it executes and returns ALLOW, STEP_UP or BLOCK, with tamper-evident decision evidence. SDKs: Python (atensec-thoth), TypeScript (@atensec/thoth) and Go (github.com/atensecurity/thoth-go).

Every page below is available as Markdown at the listed URL. All pages in one file: https://docs.atensecurity.com/llms-full.txt

## Start here

- [Thoth overview](https://docs.atensecurity.com/docs.md): Decide what your AI agent may do before it acts, then inspect the decision.
- [Overview](https://docs.atensecurity.com/docs/getting-started.md): Install atensec-thoth for Python, @atensec/thoth for TypeScript, or thoth-go for Go.
- [Set up Thoth end to end](https://docs.atensecurity.com/docs/getting-started/setup-guide.md): Create your keys, configure the workspace as code, choose a profile and connect your first agent.
- [Your first governed agent](https://docs.atensecurity.com/docs/getting-started/quickstart.md): Run a safe tool, see Thoth stop a disallowed action, and inspect both decisions.
- [Instrument your own agent](https://docs.atensecurity.com/docs/getting-started/your-agent.md): Put real tool callbacks behind Thoth's policy check and preserve actor context.
- [Govern your first agent](https://docs.atensecurity.com/docs/getting-started/govern-your-first-agent.md): Connect an agent, confirm what its tools do, choose a profile, and see decisions, without writing a rule.
- [Profiles and action classes](https://docs.atensecurity.com/docs/getting-started/profiles.md): The action classes, the safe-default rules, the agent profiles and the action_class rule condition.
- [Troubleshooting your first agent](https://docs.atensecurity.com/docs/getting-started/troubleshooting.md): Resolve setup failures and distinguish a policy refusal from a service error.
- [Trial access and setup](https://docs.atensecurity.com/docs/getting-started/trial-quickstart.md): Get the connection details you need for your first governed agent.
- [Configure trial settings as code](https://docs.atensecurity.com/docs/getting-started/trial-settings.md): Import and review existing governance settings with Terraform or Pulumi.

## Build integrations

- [SDK references](https://docs.atensecurity.com/docs/sdks.md): Choose a language to explore Thoth SDK methods, configuration, and integration examples.
- [Python SDK](https://docs.atensecurity.com/docs/sdks/python.md): Full reference for the Thoth Python SDK — ThothConfig, instrument(), instrument_toolchain(), toolchain_function_map(), instrument_anthropic(), instrument_openai(), instrument_claude_agent_sdk(), LangGraph and CrewAI integrations.
- [LangGraph Integration (Python)](https://docs.atensecurity.com/docs/sdks/langgraph-integration.md): First-class Thoth governance for LangGraph StateGraph, CompiledStateGraph, and ToolNode patterns.
- [Go SDK](https://docs.atensecurity.com/docs/sdks/go.md): Full reference for the Thoth Go SDK — Config, NewClient(), WrapTool(), WrapToolFunc(), InstrumentAnthropic(), InstrumentOpenAI(), StartSession(), Session, PolicyViolationError, StepUpRequiredError.
- [TypeScript SDK](https://docs.atensecurity.com/docs/sdks/typescript.md): Full reference for the Thoth TypeScript SDK — ThothConfig, instrument(), wrapAnthropicTools(), wrapOpenAITools(), ThothClient, EnforcementMode, ThothPolicyViolation.
- [Govern MCP tools](https://docs.atensecurity.com/docs/mcp.md): Put a policy check between an MCP client and external tool execution.
- [Configure Thoth from Claude Code or Cursor](https://docs.atensecurity.com/docs/mcp/configure-thoth.md): Connect an MCP client to your workspace to inspect setup, preview changes, and approve them in the browser.
- [Claude Desktop Proxy](https://docs.atensecurity.com/docs/mcp/proxy.md): Govern Claude Desktop MCP servers with zero code changes and wrap your claude_desktop_config.json in one command.
- [Claude Desktop Fleet Configuration](https://docs.atensecurity.com/docs/mcp/fleet-deployment.md): Customer-facing rollout workflow for browser-first Thoth deployment across managed fleets with Jamf/Intune plus manual endpoint enrollment.
- [Skills for Claude Code and Codex](https://docs.atensecurity.com/docs/agent-skills.md): Install the Thoth skills so your coding agent can govern tool calls, write policy, configure Thoth as code, and troubleshoot decisions.
- [Core concepts](https://docs.atensecurity.com/docs/getting-started/concepts.md): Understand actions, policy decisions, attribution, approvals, and evidence.
- [API Reference](https://docs.atensecurity.com/docs/api-reference.md): Authentication, request format, errors and endpoints for the Thoth runtime API, served from your unified tenant API base URL.
- [Enforcement API](https://docs.atensecurity.com/docs/api-reference/enforcement.md): Check a proposed tool call against policy with POST /v1/enforce, and poll a step-up hold with GET /v1/enforce/hold/{hold_token}.
- [Explain API](https://docs.atensecurity.com/docs/api-reference/explain.md): Turn a policy decision into a plain-language explanation with POST /v1/explain, and retrieve it later with GET /v1/explain/{violation_id}.
- [Events API](https://docs.atensecurity.com/docs/api-reference/events.md): Send behavioral events to the Thoth audit ledger with POST /v1/events/batch.

## Deploy and operate

- [Deployment Guides](https://docs.atensecurity.com/docs/deployments.md): Deploy Thoth MCP Proxy across enterprise environments with rollout and verification workflows.
- [Release Channels + Verification](https://docs.atensecurity.com/docs/deployments/release-channels.md): Enterprise release distribution pathways for thoth and thothctl, including Homebrew, notarized PKG, signatures, SBOMs, and provenance verification.
- [Deployment Validation Matrix](https://docs.atensecurity.com/docs/deployments/validation-matrix.md): Post-deployment validation checklist for Homebrew, PKG, Jamf, Intune, Kandji, and Santa rollout paths.
- [Windows Enterprise Release Platform](https://docs.atensecurity.com/docs/deployments/windows-enterprise-release.md): Official Windows distribution model for thoth and thothctl with MSI, Authenticode, Intune, and supply-chain verification.
- [Jamf, Kandji, and Santa Test Plan](https://docs.atensecurity.com/docs/deployments/jamf-kandji-santa-test-plan.md): End-to-end validation runbook for testing thoth deployment through Jamf or Kandji with Santa trust enforcement.
- [Santa macOS Trust Policy](https://docs.atensecurity.com/docs/deployments/santa-macos.md): Deploy Santa trust rules for thoth and thothctl using published Team ID, signing metadata, and release checksums.
- [Jamf Onboarding Overview](https://docs.atensecurity.com/docs/deployments/jamf-overview.md): End-to-end onboarding workflow for IT admins deploying thoth governance across managed macOS fleets with Jamf Pro.
- [Jamf macOS Runbook](https://docs.atensecurity.com/docs/deployments/jamf-macos.md): Step-by-step Jamf Pro runbook for deploying thoth governance to managed macOS endpoints.
- [macOS Deployment Reference (Jamf)](https://docs.atensecurity.com/docs/deployments/macos-jamf.md): Jamf-focused deployment reference for installing, configuring, and validating Thoth MCP Proxy on managed macOS fleets.
- [Kandji macOS Runbook](https://docs.atensecurity.com/docs/deployments/kandji-macos.md): Step-by-step Kandji runbook for deploying notarized thoth packages, managed config, and governed Claude Desktop runtime.
- [Intune Onboarding Overview](https://docs.atensecurity.com/docs/deployments/intune-overview.md): End-to-end onboarding workflow for IT admins deploying thoth governance through Microsoft Intune.
- [Intune macOS Runbook](https://docs.atensecurity.com/docs/deployments/intune-macos.md): Step-by-step Intune deployment runbook for onboarding managed macOS endpoints to thoth governance.
- [Intune Linux Runbook](https://docs.atensecurity.com/docs/deployments/intune-linux.md): Step-by-step Intune deployment runbook for onboarding managed Linux endpoints to thoth governance.
- [Intune Windows Runbook](https://docs.atensecurity.com/docs/deployments/intune-windows.md): Deploy and operate thoth on managed Windows endpoints through Intune using signed MSI packages.
- [Intune Graph API Automation](https://docs.atensecurity.com/docs/deployments/intune-graph-api.md): Automate Intune setup-script updates using Microsoft Graph in your own Azure tenant.
- [Operations](https://docs.atensecurity.com/docs/operations.md): Validate your deployment, rotate credentials, respond to incidents, and roll back safely.
- [Headless E2E Runbook](https://docs.atensecurity.com/docs/operations/headless-e2e-runbook.md): End-to-end validation runbook for the Thoth headless control plane using thothctl, the Thoth Control Plane API, proxy check-ins, SIEM webhooks, and PAM callback flows.
- [Key Rotation](https://docs.atensecurity.com/docs/operations/key-rotation.md): Rotate Thoth MCP Proxy fleet credentials with validation and revocation controls.
- [Incident Response](https://docs.atensecurity.com/docs/operations/incidents.md): Respond to active deployment and runtime incidents for Thoth MCP Proxy fleets.
- [Rollback](https://docs.atensecurity.com/docs/operations/rollback.md): Roll back Thoth MCP Proxy deployment safely when deployment SLOs are breached.
- [Headless Operations](https://docs.atensecurity.com/docs/headless-gitops.md): Operate Thoth without a dashboard using thothctl, the Thoth Control Plane API, and your existing CI/CD workflows.

## Infrastructure as code

- [Terraform Provider](https://docs.atensecurity.com/docs/terraform-provider.md): Manage Aten Security Thoth control-plane configuration with the official Terraform provider.
- [Quickstart](https://docs.atensecurity.com/docs/terraform-provider/quickstart.md): Install and configure the Thoth Terraform provider.
- [Resources and Data Sources](https://docs.atensecurity.com/docs/terraform-provider/resources-and-data-sources.md): Supported Terraform resources and data sources in the Thoth provider.
- [Versioning and Releases](https://docs.atensecurity.com/docs/terraform-provider/versioning-and-releases.md): Terraform provider versioning model and upgrade guidance.
- [Pulumi Provider](https://docs.atensecurity.com/docs/pulumi-provider.md): Manage Aten Security Thoth control-plane configuration using the official Pulumi provider.
- [Quickstart](https://docs.atensecurity.com/docs/pulumi-provider/quickstart.md): Install and configure the Thoth Pulumi provider.
- [Resources and Functions](https://docs.atensecurity.com/docs/pulumi-provider/resources-and-functions.md): Supported Pulumi resources and invoke functions in the Thoth provider package.
- [Versioning and Releases](https://docs.atensecurity.com/docs/pulumi-provider/versioning-and-releases.md): Pulumi provider versioning model and release guidance.
- [Kubernetes Operator](https://docs.atensecurity.com/docs/kubernetes-operator.md): Deploy and reconcile Thoth tenant governance in customer Kubernetes clusters with the official thoth-operator.
- [Quickstart](https://docs.atensecurity.com/docs/kubernetes-operator/quickstart.md): Install thoth-operator and reconcile a tenant in Kubernetes.
- [CRD Reference](https://docs.atensecurity.com/docs/kubernetes-operator/crd-reference.md): ThothTenant custom resource schema and field behavior.

## Updates

- [Changelog](https://docs.atensecurity.com/docs/changelog.md): Release notes for Thoth SDKs, the Thoth binary line (proxy + thothctl), and IaC providers.