Endpoint protection

Network interception

A macOS Network Extension (NETransparentProxyProvider, self-serve entitlement, no Apple approval required) diverts AI application traffic to a local MITM proxy transparently — no proxy settings to configure on individual apps. The extension identifies AI applications by process signature and diverts only their flows, leaving all other traffic untouched.

A QUIC kill-switch drops UDP:443 on AI application flows and forces HTTP/2 over TCP, making the traffic inspectable. Encrypted Client Hello is handled via SNI peek on the ClientHello before the handshake completes.

Covered applications: Claude Desktop, Claude Code, Cowork, Cursor, and the Anthropic API.

AI-scoped certificate authority

MITM inspection requires a trusted certificate authority. RayShield installs an X.509 name-constrained CA that is cryptographically incapable of vouching for non-AI TLS. The permitted-names constraint covers the AI domains under inspection — anthropic.com, claude.ai, cursor.sh, github.com and equivalents. macOS and Chromium enforce name constraints: an out-of-scope certificate is rejected at the TLS layer, not by policy. This is AI-scoped MITM, not system-wide.

The CA is installed into the system keychain with operator consent and an audit log entry. At startup the proxy verifies its CA is still trusted; if not, it degrades to tunnelling AI hosts rather than silently breaking TLS handshakes.

Content DLP

AI traffic is inspected in memory on the device before it leaves. Rules can block rather than only alert. Unicode anti-evasion is applied before matching: fullwidth digits fold to ASCII, zero-width characters are stripped.

A blocked request returns a clear error to the application — the agent does not hang or fail silently. Inspection is in-memory only; no content is persisted.

Connector write blocking

The most important DLP control for agentic workloads: blocking an AI agent from writing protected content to an external connector such as Notion, Slack or Google Drive. The interception happens on the Anthropic transport leg — the instruction is blocked before the model acts on it, so the third-party connector is never contacted.

Protected content is fingerprinted by content-word bigrams rather than exact string match. A model that rewrites, summarises or reformats protected content before writing it to a connector is still caught — the co-occurrence of distinctive bigrams from the source material survives rephrasing. This is the control that stops Cowork-style exfiltration reliably, and has been verified against both Claude Haiku and Claude Opus with retries.

Credential isolation

Every AI tool holds a sentinel placeholder, not a real API key or OAuth token. The real credential is substituted at the transport layer, in host memory, before the connection leaves the device. It is never written to disk inside any application environment and never visible in environment variables or logs. Confirmed in source and verified by pentest: printenv inside any session returns only the placeholder.

When a key rotates, there is one place to update it — not every tool, every developer's machine, and every CI runner separately.

Browser AI DLP

A Chrome MV3 extension extends endpoint protection to AI web applications — ChatGPT, Gemini, Claude.ai, Copilot, Perplexity and equivalents. A PAC script routes only AI-site traffic through the existing host proxy; all other browser traffic goes direct. DLP runs identically to the desktop application path — the delivery mechanism differs, the inspection engine does not.

Shadow AI discovery data from the browser feeds the same fleet inventory: per-host, per-day deduplicated usage events from real browser navigation, attributed to the device.