How it works
Three parts, one network seam, and the rule that keeps a verdict separate from the fact it was made about.
On this page
Three parts, and the seam between them is the point.
A ~3 MB Rust binary on macOS, Windows and Linux. Collects 21 signals, spools them to disk, and delivers them to your deployment. No runtime dependencies, no window, no in-product updater.
Ingest, grading, rollups, retention and the console's API. Authenticates devices, redacts before storage, and grades each signal against your organisation's policy.
The estate as tables and charts: devices, MCP servers, apps, agents, people, token cost, controls, events and evidence.
What a scan costs the machine
A scan is one pass of the collectors, and it is bounded by construction: five seconds per collector,
eight at a time, so a hung collector produces one unknown signal rather than a failed scan.
| One scan | ~320 ms, ~23 MB peak RSS, measured warm with ordinary AI activity |
| Cadence | 900 seconds ± 20% jitter by default, supported from 30 seconds to 24 hours |
| One snapshot | ~49 KB on the wire; ~18 KB on a quiet machine |
| Offline tolerance | a 200-entry on-disk spool, written before any delivery attempt — about 50 hours |
The jitter is not decoration. An MDM push installs a fleet within minutes of each other, and a fixed cadence would turn that into a synchronised wave against one endpoint every fifteen minutes forever.
The spool is why an agent on a plane loses nothing: snapshots are queued to disk first and delivered when there is a network, so a laptop that spent a week offline arrives with its week.
Facts on one side of the seam, verdicts on the other
The agent reports facts. It has no policy, because a device is the wrong place to keep one — a laptop that can be told what the rules are is a laptop that can be told the rules are different.
The backend grades them, one grader per signal your organisation has an opinion about. The graders are pure functions, which is what makes a verdict reproducible and lets history be re-graded when a rule changes rather than only new snapshots.
Three grading rules are worth knowing before you read a number off the console:
| Rule | Why |
|---|---|
unknown and n/a pass through untouched | grading a measurement the device could not take is inventing one |
A missing policy input yields ungraded, never pass | an empty allowlist means "nobody has said yet" |
| The four states are four columns and are never summed | a pass rate whose denominator quietly included unknowns will not survive an auditor |
One network seam
The agent makes outbound HTTPS calls to one host: your deployment. There is no telemetry endpoint, no update server, no third party, and nothing listens for inbound connections on the machine.
Delivery is off until it is configured. With no remote URL in the managed configuration, nothing
leaves the machine at all — the agent still scans, and a --json scan is how you see exactly what it
would send before it sends anything.
On the device
Two writers, one of them policy
Your deployment
Two paths that share no code
People
Reading, not writing
Devices never touch the identity provider, and no human credential can reach a device's surface. The organisation a request belongs to always comes from the verified token, never from a parameter.
Fuller treatment of all of this is in the architecture and core concepts pages of the full documentation.