Get started with Oconee Runtime

Oconee Runtime governs what your team and AI agents send to AI tools. The fastest path to value is the browser extension — install it, sign in, and prompts are scanned against your organization's policies immediately.

1. 1. Create a workspace and start your free trial at app.oconeeruntime.com.
2. 2. Install the browser extension and sign in — it auto-enrolls to your org.
3. 3. Review the seeded policy pack, then switch from monitor to enforce.

The browser extension is the front line. It runs an inline scanner on supported AI sites and inspects prompts, pastes, and attachments before they leave the browser — warning, blocking, or redacting based on your policies. Nothing is sent to an AI tool until the policy check passes.

Install

Add Oconee Runtime from the Chrome Web Store (Chrome or Edge), then pin it to your toolbar. On first run it's ready to sign in — no configuration required.

Sign in & organization binding

Click the extension icon and sign in with your workspace account (email and password, plus a six-digit code if your account uses two-factor). The extension receives a JWT — refreshed silently so your session persists across browser restarts — and enrolls your device to your organization. The popup then shows your organization, user, policy sync status, and device id, and the device appears in your dashboard fleet.

Supported surfaces

• ChatGPT (chatgpt.com)
• Claude (claude.ai)
• Google Gemini (gemini.google.com)
• Perplexity (perplexity.ai)
• Microsoft Copilot (copilot.microsoft.com)

What it detects

• Credentials & API keys
• PII & PHI (regulated data)
• Source code & secrets
• Financial & confidential data
• Internal repo & infrastructure references
• Prompt-injection & unsafe instructions

The live inline scanner

As you type into a supported AI tool, a subtle indicator ring reflects your prompt's risk in real time — green when it's clear, amber for a warning, and red when it would violate policy — so you get feedback before you ever hit send.

How enforcement works

Prompts, pastes, and attachments are inspected before they leave the browser. When content matches a policy signal, the extension applies the policy's action and records the decision to your audit trail:

• Warn — an in-page popup names the policy that fired; you can review and continue. The event is logged.
• Block — the submission is stopped and an in-page modal explains which policy fired and how to remediate. Nothing is transmitted to the AI tool.
• Redact — sensitive values are replaced with tokens (e.g. AWS_SECRET_ACCESS_KEY=********) before the site receives them; you see the redacted version and an audit event is generated.
• Allow — clean prompts pass straight through, with lightweight telemetry.

Dashboard visibility

Every detection, warning, block, and redaction lands on your dashboard with full context — timestamp, user, organization, policy, device, browser, and URL — and appears in Policy Violations with severity, driving Slack / email alerts.

Offline & resilience

If the network drops, events queue locally and upload on reconnect, and cached policies keep enforcing through a sync failure. The extension survives browser restarts and version updates without re-authenticating — your device stays enrolled.

The IDE extension extends governance to agentic coding. It monitors coding agents (such as Claude Code), command execution, git operations, and file mutations inside VS Code, Cursor, and Windsurf — and scans what you send to AI tools — surfacing high-risk actions and enforcing policy on autonomous behavior.

Install

Install Oconee Runtime from the VS Code Marketplace (or Extensions → ··· → Install from VSIX for a packaged build), then reload if prompted. It activates automatically — a shield icon appears in the Activity Bar and an Oconee: Active pill in the status bar. Set your API endpoint once:

// VS Code settings.json
"oconeeRuntime.apiEndpoint": "https://api.oconeeruntime.com"

Sign in

Open the Oconee Runtime panel from the Activity Bar (or run Oconee Runtime: Sign In), enter your workspace email and password, and — if your account uses two-factor — the six-digit code we email you. No browser round-trip. On success the panel shows Protection Active with your organization; your device enrolls and your policies sync. Access tokens refresh silently, so you stay signed in across restarts.

The side panel

The Activity Bar panel is your at-a-glance governance surface:

• Protection status — a live shield showing you're connected and policy is synced.
• Enforcement feed — recent block, warn, and redact actions; click any row to open it in the dashboard.
• AI Activity feed — the monitored-but-allowed stream, for context.
• Workspace context — bound repo, current AI tool, agent session, and permission mode (safe metadata only).

Detection & enforcement

Content on its way to an AI tool — chat, paste, or the @oconee chat participant — is scanned first. Detected signals map to a policy action with an in-editor dialog:

• Secrets — credentials, API keys, private keys, and tokens (including env-style names like AWS_SECRET_ACCESS_KEY).
• PII, PHI, and financial data — SSNs, health identifiers, card numbers.
• Prompt injection — instruction-override and data-exfiltration prompts.
• Source code, sensitive files, and internal endpoints.
• Allow · Warn · Block · Redact — each with a dialog, and one-click exception requests routed to your admins.

Agent & behavioral monitoring

Beyond content, the extension watches how AI agents behave:

• Dangerous commands — rm -rf, sudo, curl | bash, chmod 777.
• Git operations — commits, pushes, force-pushes, and PR / merge intent toward production.
• External tool & MCP invocations, and repository routing to untrusted remotes.
• Autonomous runs, background (out-of-focus) activity, permission-mode escalations, and context drift across a session.

Editor scanning (optional)

Passive file scanning is off by default so your code isn't marked up. Turn on oconeeRuntime.editorDlp.enabled for inline secret warnings as you open, edit, and save files, or run Oconee Runtime: Scan Workspace / Scan Selection on demand.

Dashboard visibility

Every event lands on your dashboard with full attribution — user, organization, workspace, repository, session and correlation ids, agent and permission mode, timestamp, policy, and severity. Block, warn, and redact decisions appear in Policy Violations and drive Slack / email alerts.

Policies map detected signals to actions. Every organization starts with a seeded policy pack you can tune per tool and per repo.

• Actions: allow, warn, block, redact.
• Rollout modes: monitor (observe only) or enforce.
• Scope policies by AI tool, surface, and repository sensitivity.
• Every decision is logged with risk severity to the audit trail.

The Oconee Runtime API is REST/JSON over HTTPS. Authenticate with a Bearer token from your workspace settings.

curl https://api.oconeeruntime.com/v1/orgs/{orgId}/activity/events \
  -H "Authorization: Bearer <token>"

Full endpoint reference is coming soon. The public health probe below is unauthenticated and safe to poll.

GET https://api.oconeeruntime.com/health
→ 200 { "ok": true }

Live status of the Oconee Runtime API, checked from this page against the health probe.