Endpoint Suite problems

SmartScreen warns on Windows

ExpectedThe today:installer is Authenticode-signed, but SmartScreen also scores reputation, which a young signing certificate earns gradually — so the Windowswarning buildcan isstill notappear. yet Authenticode-signed.Click More info →and verify the publisher is BRIGHTOPS SMART SOLUTIONS SOCIEDAD LIMITADA before Run anyway. WeNo willpublisher removeshown this= stepnot whenour installer; stop there.

A tool is installed but shows "not detected"

The app looks for tools on your login shell's PATH. Claude Code's native installer puts the certificate isbinary in place.~/.local/bin (%USERPROFILE%\.local\bin on Windows) and does not add it to PATH — if claude doesn't run in a fresh terminal either, add that directory to your PATH (the installer prints the exact instruction), then fully quit and reopen the Endpoint Suite. It reads the tool list at startup.

The app cannot create a device identity

On macOS, this is nearly always running it from the disk image. Drag the app into Applications and open it from there — macOS otherwise runs it from a temporary read-only location where it cannot use the Keychain.

On Windows, it means Credential Manager refused. Signing out of Windows and back in usually clears it; if not, send us a log bundle.

"Can't reach {host}"

The banner names the host. Give that name to your network team — it is normally a VPN that has not come up yet or an egress rule that has not been widened. The app keeps retrying and recovers by itself once the host is reachable.

Buttons are missing

If your organization deploys a managed configuration, it can prevent signing out, disconnecting a tool, or ungoverning MCP servers. The card says the setting is managed by your organization. This is your own policy, not a fault.

Signing out did not ungovern my tools

Deliberate. Tools stay pointed at the Gateway and fail closed. Silently returning a machine to ungoverned direct access because someone signed out would be the worst possible failure for a governance product. An admin removes the device from the console.

Sending us logs

Account → Export logs, or ask your admin to request them from Diagnostics. Event logs only — no prompt content, no secrets, 14-day retention.