Desktop agent quickstart

The desktop agent steers a device's AI traffic (the provider APIs, the AI web apps your organization inspects, coding agents) to the Maskflare proxy and nothing else. It runs on Windows, macOS, Linux, never inspects TLS on the device and keeps the last policy it received when offline.

1. Choose how devices enroll

• Managed (MDM): under Endpoints create an enrollment token, then deploy the installer with your MDM (Intune, Jamf, Group Policy or a Linux package repository) and the managed settings Server and EnrollmentToken. The device enrolls on install; nobody signs in.
• Self-service: turn on Let members enroll by signing in under Endpoints. People install the agent and sign in with their work account from the tray app.

2. Set the policy

The agent policy (under Endpoints) decides which hosts are steered, the fail mode (closed: AI apps stop when Maskflare is unreachable; open: they go direct), notifications, pause codes and update rings. It is signed; devices refuse a policy that isn't.

3. Check the devices

Devices lists every enrolled device with its protection state, last heartbeat, posture and the user who signed in. A device unprotected for more than an hour sends a notification email to admins (Account › Notifications).