Terum Enterprise: publish policies, security scans, SSO and audit log

Control at every step.

Set the rules once. Every publish, install and tool grant follows them, across every team and repository in your company.

Governance

Rules every publish has to pass.

Decide what a skill needs before it reaches anyone. A policy applies to a project, a team or the whole company, and every exception is recorded with a reason.

Required reviewers for each team
A minimum eval lift over the version it replaces
Admin approval for any new tool grant
Separate rules for each project, team and the company

Publish policyPlatform14 skills

Require review2 approvals from Platform reviewers

Minimum lift+10% over the version it replaces

Passing evalA PASS receipt on the exact bytes published

New tool grantsAn admin approves any tool a skill adds

ChangelogEvery version says what changed

4 checks run on every publish to PlatformEdited by Mira Reyes, Sep 12

Security checks

Every skill and tool is scanned before it installs.

Each new version is checked for secrets, network calls, shell commands that reach outside the working tree, tool grants and dependencies. A flagged version is held until someone with the right role clears it.

Keys and tokens in any file of the skill
Network calls checked against your allow list
Shell commands that touch production or leave the working tree
Tool grants and dependency advisories, for skills and MCP tools

db-snapshot0.9.21 flag

Secrets

No keys or tokens in 7 files

Network

api.github.com, on your allow list

Shell

Reads a production database URL from the environment

scripts/snap.sh:14 pg_dump "$PROD_DB_URL" > /tmp/snap.sql

Tool grants

BashRead

Dependencies

2 packages, no advisories

Install held until someone clears the flag

Proper scoping

Skills reach only the teams they are meant for.

Publish a skill to one project, one team or the whole company. Engineers outside its scope never see it, and widening the scope goes through the same policy as a publish.

Scopes for a project, a team or the company
Teams and members come from your identity provider
Widening a scope needs approval
Engineers only see the skills that reach them

Scopesmigration-guard 3.0.0

Available to

Platform48 engineers

Engineers outside Platform never see it.

Audit trail

A record your auditors can read.

Every publish, install, grant, approval, eval and membership change is recorded with who did it, when, and what changed. Filter it in the dashboard, export it, or stream it to your SIEM.

Who, what and when for every change
SKILL.md diffs and eval receipts attached to each publish
Export as CSV or JSON
Streaming to your SIEM

Audit logAcme

09:42MRMira Reyes approved deploy-check 2.3.0Publish

09:40JLJon Lee ran an eval on deploy-check 2.3.0+18%

09:31AKAda Kim granted Bash to db-snapshotGrant

09:12SCIMSCIM removed dana from AcmeMember

08:57TSTom Sato installed migration-guard 3.0.0Install

08:40MRMira Reyes published flag-cleanup 1.2.0Publish

08:22SCIMSCIM added priya to MobileMember

Sep 22JLJon Lee revoked Network from slack-notifyGrant

Streaming to your SIEMKept for 7 years

Everything else a rollout needs.

SSO and SCIM

Sign in with Okta, Microsoft Entra ID or Google Workspace. Engineers are added and removed from your identity provider.

Any git host

Keep the team repository on GitHub Enterprise, GitLab or Bitbucket, in the cloud or self-managed.

Roles and permissions

Decide who can publish, approve, grant tools and change policy, separately from repository admin.

Hosted or self-hosted

Run the dashboard and registry in our cloud or inside your own network.

Adoption analytics

See which skills each team has installed, which versions they are on, and where an update is still rolling out.

Signed builds for IT

A signed, notarized desktop app your IT team can deploy through MDM.

Sandboxed evals

Evals run in isolated containers, away from engineers’ files and credentials.

Priority support

A named engineer, a shared Slack channel and agreed response times.

Your skills stay in your repository.

The open source tool and the self-hosted edition run with no Terum server between your engineers and your git host. Every network call is documented.

Stays with you

Skills, versions and receiptsIn a private repository your company owns
Who can read and change themYour git host’s permissions and your identity provider
Eval transcripts and sandboxesOn the machine that ran the eval
SettingsIn each engineer’s home folder, readable only by them

Leaves your machines, and where it goes

Git fetch and pushYour git host
Eval and judge sessionsAnthropic, through each engineer’s own Claude Code login
A daily release checkgithub.com, for the list of release tags only

No telemetry, analytics or crash reportingApache-2.0, so your security team can read every lineDownloads verified against GitHub build provenance

Read the full network inventory

Open source and Enterprise.

Enterprise is the same tool your engineers already run, with the controls a company needs on top.

Feature	Open source	Enterprise
Skills
Library, evals and receipts
Team marketplace in a private repository
Desktop app for macOS and Windows		Signed and notarized, deployable through MDM
Control
Publish policies
Security checks for skills and tools
Scoped publishing
Audit log	Git history	Filtered, exportable, streamed to your SIEM
Identity
Sign-in	GitHub CLI	SSO and SCIM
Roles	Repository admin and member	Custom roles and permissions
Git hosts	Any git remote, invites on GitHub	GitHub, GitHub Enterprise, GitLab, Bitbucket
Operations
Dashboard	The desktop app on each machine	Hosted or self-hosted, plus the desktop app
Adoption analytics
Sandboxed evals
Support	Discord and GitHub issues	A named engineer, a shared Slack channel, agreed response times
Price	Free, Apache-2.0	Book a call

From one team to the whole company.

Most companies start with a single team and widen from there. Each step keeps everything the one before it set up.

Step 1
Pilot one team
Start with the open source tool on one team’s repository and evaluate the skills they already use.
Step 2
Set the rules
Connect your identity provider, choose roles, and write the publish policy and security checks.
Step 3
Open it up
Scope skills to more teams. SCIM adds engineers as they join, and IT deploys the signed app.
Step 4
Watch adoption
Follow installs and versions for each team, and review the audit log as usage grows.

Design partners

Become a design partner.

We work closely with a small group of companies as they roll Terum out. Partners get new features first and help decide what comes next.

Book a call

Early accessNew enterprise features reach you before anyone else.
Direct line to the teamA shared channel with the engineers building Terum, and regular calls.
Roadmap inputYour requests shape what we build next.

Questions.

What security, IT and procurement usually ask before a rollout.

Still have a question?

Book a callTalk it through with the team Ask on DiscordThe engineers building Terum answer there

Buying

Is the open source version still free?

Yes. terum-skills stays free and open source under Apache-2.0. The enterprise edition adds governance, identity and support on top of it.

How is the enterprise edition priced?

Pricing depends on the size of your engineering team and how you deploy. Book a call and we’ll walk you through it.

What does a design partner commit to?

Using the enterprise edition with at least one team and telling us what works. We meet on a schedule that suits you.

Security and data

Where does our data live?

Skills, versions and receipts live in a git repository you own. With the self-hosted edition the dashboard runs inside your network as well. Evals reach Anthropic through each engineer’s own Claude Code login.

Who pays for the model usage in evals?

Evals run on each engineer’s own Claude Code login, so model usage stays on the plan your company already has with Anthropic.

Rollout

What does IT need to roll it out?

The signed desktop app deployed through your MDM, single sign-on with your identity provider, and access to the git host where the team repository lives.

Which git hosts are supported?

GitHub, GitHub Enterprise, GitLab and Bitbucket, in the cloud or self-managed.

Which agents does it work with?

Claude Code, Codex and Cursor, the agents your engineers already use.

Can we keep what our team already has?

Yes. The enterprise edition reads the same team repository as the open source tool, so skills, versions and receipts carry over.

Roll out agent skills to every engineer.