Skip to main content
Coverage alerts tell administrators when ReclaimLLM protection is missing, turned off, or bypassed on developer machines — and what share of the org is covered — without requiring MDM. Protection lives in local hooks. A developer can remove them, disable them, or install with --no-dlp. Coverage closes that visibility gap using device check-ins, deterministic anomaly detectors, and a Coverage dashboard.
Coverage is detection, not OS-level prevention. Fully removing rclm plus the heartbeat is visible mainly as silence (and only when corroborating activity exists). Signed policy detects cache edits, not patched binaries. Prevention still needs managed hooks or MDM.

​
What you get

​
How enrollment works

Devices enroll lazily — there are no synthetic “bootstrap” devices for existing members.
  1. A developer installs hooks (rclm-hooks-install) or runs an update / session start.
  2. The client creates a stable device_id under ~/.reclaimllm/ and sends check-ins with integrity, DLP, and routing class.
  3. The first observation of a client status is a baseline. AD-010 fires only on later transitions away from installed.
  4. A 30-minute grace period holds installed → missing/partial right after an rclm version change (upgrade/reinstall races).
Check-ins also run from SessionStart (throttled) and from rclm-heartbeat when the OS timer is installed (--heartbeat or org Require heartbeat).

​
Integrity rules that reduce false alarms

  • A client is healthy when global or cwd-local hooks are healthy (local-only installs are not treated as missing).
  • Ephemeral environments (Codespaces, containers, and similar) are classified; orphans auto-retire; AD-012 does not email for ephemeral devices.
  • Coverage counts only clients the developer actually used in the coverage window — not every possible agent.
  • Routing reports a class (gateway / direct / unknown) only — never URLs or API keys. unknown is never treated as bypass.
  • AD-013a/b stay inactive when the org has no gateway hosts / required providers configured.

​
Detectors at a glance

Full calculation logic lives in Anomalies. Findings appear on the Signals tab and can feed email digests and SIEM.

​
Privacy: what is collected

Coverage check-ins include:
  • Hook install status per coding agent
  • DLP on/off (and whether the org requires DLP)
  • Heartbeat enabled flag
  • Gateway-vs-direct routing class (not URLs or keys)
  • rclm version and a hashed hostname
  • Optional admin-editable device alias
They do not include keystrokes, process lists, file contents, or secrets. Developers can review their own devices under User Settings → Device health.

​
Admin workflow

1

Roll out hooks

Have developers run rclm-hooks-install (optionally with --heartbeat). Org keys enroll into the shared device plane automatically on check-in.
2

Open Coverage

Use the Coverage tab for org %, team bars, filters (Uncovered, DLP off, Silent, Direct), and device rows.
3

Set policy

In Coverage settings, turn on Require DLP and optionally Require heartbeat. Grant time-boxed DLP exceptions when needed.
4

Respond to findings

Investigate AD-010…013 on Signals. Typical repair: rclm-hooks-install --repair.

​
Limits to state clearly

  • Removing hooks without removing rclm is visible quickly (especially with heartbeat).
  • Removing rclm entirely is mainly silence + gateway corroboration.
  • Alternate config directories, cloud agents, and personal provider accounts on personal machines can remain outside coverage.
  • Provider reconciliation (AD-013c) is Enterprise-only and lags provider usage APIs by design.