Skip to main content
The MCP gateway sees what goes through Oriant. The endpoint agent sees the machine: which AI tools are installed, which MCP servers they’re set up to use, and how much people use AI. On each machine, the agent:
  • Scans the machine for AI clients and the MCP servers in their configs. See Device scan.
  • Finds the Skills those AI clients load, so Oriant can scan them. See Skills scanning.
  • Names the AI tool and the person behind AI traffic, and blocks tools you’ve set to Blocked. See AI Tools.
  • Records prompts sent in Claude on the web, with the sender’s email. Responses are not recorded. These prompts drive AI adoption.
Every report is tied to one person: the email stamped on the machine at install. Oriant never guesses identity from the machine.

Connect one machine

Use this to try Oriant on one machine before a fleet rollout.
1

Get an install command

In Oriant, open Add machines → Single machine. Copy the command.
2

Run it on the machine

The code works once and expires after 10 minutes. If the code wasn’t issued for a member, add --email [email protected].
3

Check it reports

The dialog updates when the machine claims its code and again on its first report. The machine then shows under Assets.
To check the agent on the machine:
"status": "ok" means the agent has its configuration and is healthy.

Deploy to a fleet

Under Add machines, generate a Microsoft Intune deployment template. It contains the agent binaries for Apple silicon and Intel, an install script that runs as root and checks the stamped email, and the LaunchDaemon. Every managed install needs a stamped email, so configure that in Intune before you assign the template to devices.

Safe by default

If the agent stops, the machine’s proxy settings are turned off so the machine keeps working. The agent only reads Claude web traffic once the operating system trusts its device-local certificate, which is limited to claude.ai. Everything else passes through untouched.
The agent covers apps that use the system proxy. Apps that bypass it aren’t covered yet.
Last modified on November 11, 2026