> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oriant.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Endpoint agent

> Install the Oriant endpoint agent to see which AI tools and MCP servers people use, who uses them, and to block the ones you forbid.

The MCP gateway sees what goes through Oriant. The endpoint agent sees the machine: which AI tools are installed, which MCP servers they're set up to use, and how much people use AI.

On each machine, the agent:

* **Scans the machine** for AI clients and the MCP servers in their configs. See [Device scan](https://docs.oriant.app/endpoint-agent/device-scan.md).
* **Finds the Skills** those AI clients load, so Oriant can scan them. See [Skills scanning](https://docs.oriant.app/endpoint-agent/skills.md).
* **Names the AI tool and the person** behind AI traffic, and blocks tools you've set to Blocked. See [AI Tools](https://docs.oriant.app/endpoint-agent/ai-tools.md).
* **Records prompts sent in Claude on the web**, with the sender's email. Responses are not recorded. These prompts drive [AI adoption](https://docs.oriant.app/ai-adoption.md).

Every report is tied to one person: the email stamped on the machine at install. Oriant never guesses identity from the machine.

## Connect one machine

Use this to try Oriant on one machine before a fleet rollout.

**1. Get an install command**

In Oriant, open **Add machines → Single machine**. Copy the command.

**2. Run it on the machine**

```bash theme={null}
curl -fsSL https://api.oriant.app/connect | sh -s -- --code <your-code>
```

The code works once and expires after 10 minutes. If the code wasn't issued for a member, add `--email you@company.com`.

**3. Check it reports**

The dialog updates when the machine claims its code and again on its first report. The machine then shows under **Assets**.

To check the agent on the machine:

```bash theme={null}
curl --noproxy '*' http://127.0.0.1:8080/healthz
```

`"status": "ok"` means the agent has its configuration and is healthy.

## Deploy to a fleet

Under **Add machines**, generate a Microsoft Intune deployment template. It contains the agent binaries for Apple silicon and Intel, an install script that runs as root and checks the stamped email, and the LaunchDaemon. Every managed install needs a stamped email, so configure that in Intune before you assign the template to devices.

## Safe by default

If the agent stops, the machine's proxy settings are turned off so the machine keeps working. The agent only reads Claude web traffic once the operating system trusts its device-local certificate, which is limited to `claude.ai`. Everything else passes through untouched.

> [!WARNING]
>
> The agent covers apps that use the system proxy. Apps that bypass it aren't covered yet.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.