Organization Rules and Reports

Part of Sync.

Org Rules

On Max and Ultra, owners and admins set rules for every repo on the Rules tab of Sync in the app; every member can read them:

• Instructions added to every repo’s AGENTS.md and each agent’s instruction file.
• Denied permissions in the same vocabulary, added to every agent; a repo cannot allow them back.
• Banned MCP servers, by name or source pattern such as npm:@unknown-vendor/*.
• Required agents, and checks that forbid unrestricted shell or require pinned servers.
• Required skills, written into every repo.

Each banned pattern shows which MCP servers your repos reported to Guard it matches today, and each agent shows how many repos already write its files, so you can see what a rule affects before you save. Each save is a new version, and the save button names it. A repo applies them with cedr sync pull --org <organization ID> (which writes .cedr/org-rules.json), then cedr sync. The Overview tab shows which version each repo runs and which are behind, and the Roll out these rules prompt has your agent apply a new version across your repos.

Report to the App

cedr sync push --org <organization ID> sends the repo’s state to the Sync page: each generated file’s state, the check’s findings and the org rule version it applied. It needs an API key, in CEDR_API_KEY or ~/.config/cedr/api-key (mode 600). It sends no file contents, variable values or rule text.

The Overview tab lists every repo with its status (filter to the ones with problems or behind on rules, or search by name), opens one repo’s files, findings and push history, and charts pushes over the last two weeks. Fix this repo gives your agent a prompt with that repo’s findings.

Your Agent’s Tools

Local MCP (cedr mcp) gives your agent sync_check (the findings) and sync_plan (what cedr sync would change, without writing). The hosted MCP adds sync_repos, sync_repo and sync_rules for your organization’s data.