Endpoint Suite

• Overview
• The Tools tab
• The MCP tab
• The Account tab
• Running in the background
• macOS and Windows differences
• Deploying with MDM

Overview

Sentilai Endpoint (desktop app)

The Sentilai Endpoint is the small desktop app that makes governance zero-touch: it discovers the AI tools on the machine, routes them through the Gateway, wraps local MCP servers, and reports device compliance.

Install & sign in

Download the signed installer from your invite or the downloads page, drag to Applications (macOS), open, and sign in with your work identity (passkey or your company SSO). The device registers automatically and gets its own credential.

Zero-click governing

With Automatic governing on (the default), the app governs every detected tool on launch — no clicks. Admins can pin this on for the whole fleet via managed configuration.

Updates

The app updates itself: it checks for signed updates, downloads in the background, and applies on restart. Versions are cryptographically verified end-to-end.

Managed configuration (MDM)

Fleet deployments can pre-set behavior via a managed config file (/Library/Application Support/Sentilai/managed-config.json on macOS, C:\ProgramData\Sentilai\managed-config.json on Windows): environment, autostart, pinned auto-govern, and user restrictions — disable disconnect, sign-out, or un-governing MCP servers, so a developer cannot quietly step outside governance.

Device compliance

Each device reports whether every installed tool is actually governed. Non-compliant devices are visible in the Admin Console's Devices screen, so drift (e.g. a manually removed setting) surfaces instead of hiding.

Local event log

The app keeps a local, exportable event log. Admins can request a device's logs from the console; with user-visible consent flows, support can be granted access for troubleshooting.

The Tools tab

Everything about which AI tools on this machine are governed.

Tool cards

One card per supported tool, each showing one of three states:

• routed through Sentilai — governed; its requests appear in the admin console.
• detected — installed, but still talking directly to the AI provider.
• not detected — not installed, or not where the app looks for it.

Each detected tool has Connect and, once governed, Disconnect.

Govern all detected tools

The card at the top connects everything detected in one action and reports the result per tool. See Govern all detected tools.

The provider-key warning

If your organization has not added a provider key yet, a warning sits above the tools: connecting a tool that runs in managed mode will not route its requests anywhere useful. Your admin adds the key on Providers in the console.

Restart reminders

Every card that needs it says so. All of these tools read their configuration at startup only, so a connect without a restart changes nothing.

When buttons are missing

If your organization deploys a managed configuration, it can prevent disconnecting, signing out, or ungoverning MCP servers. Where that applies, the button is absent and the card says the setting is managed by your organization.

The MCP tab

Model Context Protocol servers are the tools your AI assistant can call — file access, issue trackers, databases, browsers. They are also the most direct route from a prompt to something happening in the real world, which is why they get their own governance.

Local MCP governance

The card at the top shows how many local servers are governed. Govern local MCP servers puts them behind the Sentilai shim.

Before it edits anything it backs up the configuration file and it reverts exactly that file if you stop governing. Claude Code must be restarted afterwards.

Stop governing restores the backup — unless your organization has locked this down.

The server list

Every MCP server found on this machine, with its name, its project path, and how it is started. Servers configured in Cursor are listed separately, because Cursor keeps its own configuration.

"Scanning…" means the sweep is still running; "None found" means this machine has no local MCP servers configured.

What the shim actually does

Once governed, an AI tool calling an MCP server goes tool → Sentilai shim → real server. The shim only inspects tool calls; everything else passes through untouched.

For each call it asks the Gateway for a decision and caches the answer for as long as your admin's Local MCP decision cache setting allows. When a call is blocked, the agent gets a clean error naming the server and tool, so the assistant can tell the developer what happened instead of failing mysteriously.

The shim also watches the server's advertised tool list, which is what makes it possible to notice when a tool's description or schema changes underneath you.

The Account tab

Your session, this device, and the app's own behaviour.

Signed in

Shows who you are signed in as and your organization's seat usage.

Signing out ends the session only. Your governed tools keep pointing at the Gateway and start failing closed rather than quietly reverting to the direct provider. This is deliberate: silently ungoverning a machine because someone signed out would be the worst possible failure mode for a governance product. Removing the device entirely is an admin action, from the console.

Device identity

The ECDSA P-256 key pair for this machine, stored in the OS secure storage. Not exportable, not copyable to another machine.

Automatic governing

On by default. New tools and new local MCP servers are governed in the background as they appear, and tools that drift back to the direct provider are re-governed.

Start at login

Whether the app launches when you sign in to the machine. Both this and automatic governing can be pinned by a managed configuration, in which case they show as managed by your organization.

Diagnostics

Export logs writes a bundle and shows you where it is. Open logs folder opens the directory.

These are event logs only — no prompt content and no secrets — and they are kept for 14 days. This is the same material an admin receives when they request logs from your device.

Running in the background

The app is designed to be invisible once set up.

The system tray

Closing the window hides the app to the tray rather than quitting it. The tray menu has Show Sentilai Endpoint and Quit; left-clicking the icon reopens the window.

The connectivity badge

If a host the app needs is unreachable, the tray icon gains an amber badge and the window shows a banner naming the host. It keeps retrying — this is usually a VPN that has just come up, or a firewall rule that has not been widened yet.

Your network team may need the hostnames; see Hostnames and firewall rules.

Automatic updates

The app checks for updates, verifies the download's signature before installing it, and replaces itself. Verified on macOS; on Windows the updater ships but has not yet been proven end to end, so treat Windows updates as manual for now.

What it does periodically

• Adapter drift check — is each governed tool still pointing at the Gateway? A tool that has drifted is re-governed if automatic governing is on, and either way the console shows the device as Non-compliant.
• Log request poll — roughly every two minutes, so that an admin's request for logs is fulfilled promptly.
• Posture scan — read-only inspection of your AI tools' own autonomy settings, sent to the console as posture findings. It reads configuration, never prompts or code.

macOS and Windows differences

The two platforms are not at the same maturity, and it is better to know where before you roll out.

macOS

• Signed and notarized; no security warning on first launch.
• Install by dragging to Applications. Running from the mounted disk image leaves macOS executing it from a translocated read-only path where it cannot keep its device key.
• The device key lives in the Keychain.
• Environment changes are applied in the way that actually reaches applications launched from the Dock, not only terminal sessions.
• The app can compare an installed AI application's code-signing identity against the vendor's real one, and flag an imposter. This check is macOS-only.

Windows

• Installs per user via an NSIS installer — no administrator rights needed.
• Not yet Authenticode-signed, so SmartScreen warns on first run. This is the main outstanding gap on Windows.
• The device key lives in Credential Manager.
• Command-line tool detection understands Windows executable extensions, so claude.cmd is found the same way claude is on macOS.
• Automatic updates ship but are unproven; treat them as manual.
• There is no MSI and no Group Policy deployment path yet — the per-user installer is the only supported route.

Linux

The app builds, but Linux is not a supported distribution track and there is no signed package. If you need it, tell us — it is a matter of demand, not of feasibility.

Deploying with MDM

For fleets, the Endpoint Suite reads a managed configuration file that your device management tool can place on each machine. It pins behaviour so that individual users cannot undo your rollout.

Where the file goes

• macOS: under /Library, in the location your MDM normally uses for managed app configuration.
• Windows: C:\ProgramData\Sentilai\managed-config.json.

What you can pin

• Environment — which Sentilai environment this fleet belongs to.
• Start at login — force the app to launch with the session.
• Automatic governing — force new tools and MCP servers to be governed as they appear.
• Restrictions, three separate switches:
  • allow_signout — whether the user may sign out.
  • allow_disconnect — whether the user may disconnect a governed tool.
  • allow_ungovern_mcp — whether the user may stop governing local MCP servers.

How restrictions behave

Each is enforced in two places: the underlying command refuses, and the button disappears from the interface with an explanation that the setting is managed by your organization. Enforcing only in the UI would be theatre; enforcing only in the command layer would leave buttons that fail confusingly.

A sensible rollout

1. Pilot on a handful of machines with nothing pinned, so people can undo things and tell you what broke.
2. Then pin start at login and automatic governing — the two that make governance stick without taking anything away.
3. Only pin the restrictions once your policy is stable. A developer who cannot disconnect a tool that is genuinely misbehaving will open a ticket with you instead, so make sure you want that traffic.