# AI Vendor Usage

> **Beta, early access.** Flag: `vendor_usage`. A workspace without access gets `404` from these routes.

Your AI vendors already know who used their agent and when. Connect their admin usage reports once, and Bumpkit puts that on every release: who used which agent on the days the commits were written. Zero setup for developers: nobody installs a hook, a plugin or a managed setting.

This page is for owners and admins. Only they can connect a vendor, see per-person usage or change a mapping, and every change lands in the [audit log](/docs/security-compliance).

## What you get

- **On every release:** a line like "Ana used Claude Code on the commit days (Anthropic usage report: 340 lines, 3 commits those days)", with the agent's logo, on the release page, in the pull request comment, on the Slack card, in `bumpkit` output and in MCP results.
- **On Insights:** which agents your team uses, how many people, and the sessions, lines and commits each vendor reports.
- **In Settings > AI vendor usage:** who used which agent in the last 30 days, which committer each person matched, and a field to fix any match.

## Supported vendors

| Vendor | Report Bumpkit reads | Key you need | Matches commits by |
|---|---|---|---|
| Claude Code (Claude Console) | Claude Code analytics | Admin API key (`sk-ant-admin…`) | Email |
| Claude Code (Claude Enterprise) | Claude Enterprise analytics | Analytics API key with `read:analytics` | Email |
| Cursor | Admin API daily usage | Team Admin API key | Email |
| GitHub Copilot | Copilot usage metrics, one day per report | Token with Organization Copilot metrics read access | GitHub login |

Connect Claude Console and Claude Enterprise both if your team signs in both ways. The Claude Console report leaves out anyone who signs in with a Claude Pro, Max, Team or Enterprise plan.

## Set it up

Owners and admins open **Settings** and go to **AI vendor usage**.

1. Pick a vendor and paste its admin key. Copilot also needs the GitHub organization name.
2. Bumpkit checks the key against the vendor before saving anything. A rejected key is never stored.
3. The key is stored encrypted. Bumpkit shows only its last four characters after that.
4. Bumpkit reads the last 30 days, then keeps it current. Click **Sync now** to read right away.

Or from a terminal:

```bash
# Connect Claude Console; the key is read from a file or standard input, never an argument
bumpkit agents vendors connect anthropic --key-file -
# Connect Copilot for the acme organization
bumpkit agents vendors connect copilot --org acme --key-file ./copilot-token
# Read the latest usage now
bumpkit agents vendors sync anthropic
# See who used which agent
bumpkit agents vendors status
```

### Getting each key

- **Claude Console:** in Claude Console, go to Settings > Admin keys. Only admins can create an Admin API key.
- **Claude Enterprise:** the primary owner creates an Analytics API key with the `read:analytics` scope under Organization settings > API on claude.ai.
- **Cursor:** a team admin creates an Admin API key in the Cursor dashboard under Settings.
- **GitHub Copilot:** an org owner creates a fine-grained token with the Organization Copilot metrics read permission, or a classic token with `read:org`. Copilot usage metrics must be turned on for the organization.

## What Bumpkit keeps

Per person, per day, per vendor: the vendor user (email, or GitHub login for Copilot), the day, and that day's sessions, lines, commits and pull requests. That's it.

**Never read or stored:** prompts, code, file names, chat activity, model and cost breakdowns, and any API keys a vendor returns about its users.

## Who matches which commits

Bumpkit matches each vendor user to the people who wrote the release's commits, by commit email or GitHub login. Wrong match, or none? Set it yourself in Settings or with `bumpkit agents vendors identities map VENDOR USER COMMITTER`, where the committer is `@github-login` or a commit email. Your mapping always wins.

## How it shows on a release

A match adds an **inferred** authorship signal, `vendor_usage`, naming the agent. It says a person used the agent on the commit days. It doesn't prove which lines the agent wrote, so it never counts as verified. For that, use [agent hooks](/docs/agent-hooks) or [agent telemetry](/docs/agent-telemetry).

In the API and MCP results it shows up as an authorship signal with `source` set to `vendor_usage` and `tier` set to `inferred`, naming the agent and the usage behind it. `checked.vendor_usage` is `true` on every release Bumpkit checked against vendor usage, including releases with no match.

## Retention and disconnecting

- Usage is kept for 90 days by default. Choose 30, 90, 180 or 365 days.
- **Disconnect** deletes the vendor's key, its stored usage and its identity mappings right away. Releases already checked keep their recorded signal.
- Revoke the key at the vendor too if you no longer need it.

```bash
# Keep usage for 30 days
bumpkit agents vendors retention 30 --yes
# Disconnect Cursor and delete its key and usage
bumpkit agents vendors disconnect cursor --yes
```

## CLI and MCP

| Command | MCP tool |
|---|---|
| `bumpkit agents vendors status` | `agent_vendors_status` |
| `bumpkit agents vendors connect VENDOR --key-file PATH` | `agent_vendors_connect` (reads the key from `key_env` or `key_file`) |
| `bumpkit agents vendors sync VENDOR` | `agent_vendors_sync` |
| `bumpkit agents vendors disconnect VENDOR --yes` | `agent_vendors_disconnect` |
| `bumpkit agents vendors retention DAYS --yes` | `agent_vendors_retention` |
| `bumpkit agents vendors identities list` | `agent_vendors_identities_list` |
| `bumpkit agents vendors identities map VENDOR USER COMMITTER` | `agent_vendors_identities_map` |
| `bumpkit agents vendors identities unmap VENDOR USER --yes` | `agent_vendors_identities_unmap` |

## What vendors don't report

- **Commits and pull requests per person:** only the two Claude reports have these counts.
- **Cursor and Copilot** report lines and activity, not commits.
- **Copilot** reports per-person usage by GitHub login only. Pull requests the Copilot coding agent opens are already recognized from their author.
- **Claude Enterprise** usage arrives about a day late.
- **OpenAI Codex and Gemini Code Assist** aren't supported yet: neither offers a per-person coding usage report to connect.