What the agent can and cannot see
The endpoint agent integrates with AI coding tools through their official hook and configuration surfaces. It receives events about AI sessions: prompts being submitted, tools being called, files being edited by the assistant, MCP servers being invoked. It does not install keyboard or input hooks, capture screens, read terminal history or observe applications outside the supported AI tools.
Before anything leaves the machine the agent reduces it to metadata: counts, SHA-256 fingerprints, risk labels, repository state and provider identity. In the default metadata-only mode the server additionally rejects any event carrying raw prompt or source fields, so a misconfigured or tampered client cannot upload content.
Device identity
- Each device generates an Ed25519 key pair at enrollment. The private key never leaves the machine.
- Enrollment uses a one-time token that expires after 15 minutes and is bound to a specific seated user.
- Every request is signed with a short-lived (under five minutes) EdDSA token carrying a unique identifier. There are no shared organization API keys in installers or scripts.
- Administrators can revoke a device instantly; revoked devices cannot upload telemetry or fetch policy.
Local policy and secret scanning
Policy evaluation runs on the endpoint in milliseconds and does not require connectivity. Secret and sensitive-data detection (API keys, private keys, connection strings, configurable patterns) also runs locally; only the resulting labels and counts are reported. Hooks fail open: if MainLayer is unavailable, developers keep working.
Configuration changes on developer machines
The agent only edits the tool configuration entries it owns, identified by its own marker, backs up every file before modifying it and writes atomically. Uninstalling restores the previous configuration. It never overwrites unrelated user settings.
Transport and storage
- All traffic is TLS. Telemetry is batched, compressed and delivered at-least-once with idempotent ingestion.
- Control-plane state lives in PostgreSQL; telemetry in ClickHouse with a 30-day default retention for detailed events and longer retention for aggregates. Retention is configurable per organization.
- Every query is scoped to a tenant at the data-access layer. Identifiers from other organizations resolve to “not found”, never to another tenant's data.
- Third-party connector credentials (GitHub, GitLab, Bitbucket) are encrypted at rest and never returned by any API.
- Administrative actions that affect identity, enforcement, repository scope or data collection are written to an audit log in the same transaction as the change.
Developer transparency
Every developer has a personal page showing exactly what their organization can see about them, the current privacy mode, the last upload and any policy notices. We consider this a security control as much as a product feature.
Roadmap
Single sign-on (OIDC and SAML), SCIM provisioning, mutual TLS for devices, customer-managed encryption keys, SIEM export and hybrid or on-premises deployment are on the enterprise roadmap. Ask us about timing for your evaluation.
Reporting a vulnerability
Please report security issues to [email protected]. We acknowledge reports within two business days and do not pursue researchers who act in good faith.