Skip to content
How It Works

One Binary, One Connection, No Runtime Dependencies

Kraitos AIDR is a single self-contained agent that registers as a native service, streams telemetry over mutual TLS, and evaluates policy locally so nothing sits in the developer's critical path.

Read the DocsBook a Technical Demo
Architecture

From Endpoint to Dashboard

  1. 01
    Endpoint agent
    Single binary · 7 engines · local policy eval
  2. 02
    Encrypted transport
    Mutual TLS 1.3 · per-device certs · offline buffering
  3. 03
    Ingestion service
    Scaled separately from the API
  4. 04
    Processing
    Attribution · pricing · policy · evidence
  5. 05
    Dashboard
    Alerts · evidence · response
The Agent

A Single Binary With No Dependencies

Built natively for macOS, Linux, and Windows and registered as a LaunchDaemon, systemd unit, or Windows Service. No runtime to install, no framework to patch.

Memory
< 50 MB
CPU
< 1%
Platforms
macOS (Apple Silicon + Intel), Linux (x64 + ARM), Windows
WSL
Full cross-boundary support
Service model
LaunchDaemon · systemd · Windows Service
Updates
Automatic - verified before install, applied atomically
Binary signing
Cryptographically signed releases on every platform
Deployment

Three Steps to Your First Enrolled Endpoint

Enrollment codes carry their own constraints: OS restrictions, CIDR allowlists, team auto-assignment, single- or multi-use, and an expiry window.

  1. Step 01

    Create an enrollment code

    Generate a short enrollment code in the dashboard. Codes carry their own constraints: OS restrictions, CIDR allowlists, team auto-assignment, single- or multi-use, and an expiry window.

  2. Step 02

    Install the agent

    Download the signed Windows MSI or the macOS and Linux installer from the dashboard and run it with the code, or push it through your existing endpoint management tooling. No reboot, no imaging, no developer interaction.

  3. Step 03

    Devices report instantly

    AI tools, sessions, posture, and inventory flow into the dashboard within seconds of the agent starting. A short guided tour on first sign-in walks you through deployment, the Live Floor, AI Sessions, Inventory, and Compliance.

Create an AccountBook a Demo
Data Flow

What Is Collected, and What Is Not

The platform collects metadata about AI usage patterns and policy-relevant findings - not wholesale copies of proprietary code.

Collected

  • AI tool presence, version, and usage
  • Session structure: prompts, responses, tool calls, file paths, shell commands, MCP destinations
  • Per-turn token counts and computed cost
  • Policy evaluations, enforcement events, and DLP findings
  • Hardware, software, browser extension, and repository inventory
  • Endpoint posture: disk encryption, screen lock, firewall

Handled carefully

  • Detected secrets can be redacted out of session data on the endpoint
  • Sensitive values are stripped from AI Profiles before distribution
  • Telemetry buffers to local disk and replays on reconnect, so an offline laptop loses nothing
  • Tenant data is isolated at four independent layers, down to the database row
Transport is mandatory TLS 1.3 with mutual TLS between agent and ingestion. The codebase has no insecure fallback and no plaintext mode to misconfigure.
Updates

Automatic, Verified, Atomic

The agent keeps itself current. Every release is cryptographically signed, every download is verified before install, and upgrades apply atomically - no maintenance window, no half-updated endpoint.

Backend

The Platform Behind the Agent

Architecture at a glance
LayerHow it works
AgentA single self-contained binary for macOS, Linux, and Windows with native service registration
TransportStreaming telemetry over mutual TLS 1.3, buffered locally and replayed on reconnect
IngestionA dedicated ingestion tier, scaled separately from the API so telemetry bursts never slow the dashboard
Data isolationTenant boundaries enforced at four independent layers, down to database row-level security
DeliveryEvery release is vulnerability-scanned, signed, and rolled out with zero downtime
ReliabilityContinuous health monitoring at every layer, with alerts when an endpoint goes quiet
Scale & Reliability

Built for Many Tenants at Once

Full isolation at every layer means MSSPs and MSPs run many clients on one platform with guaranteed data boundaries.

  • Tenant isolation enforced at four independent layers, down to the database row
  • Ingestion scaled independently of the API, so telemetry bursts do not degrade the dashboard
  • Zero-downtime rollouts from pinned, reproducible releases
  • Per-agent health monitoring with automatic alerts when an endpoint stops reporting

Evaluate It on Your Own Fleet

Start a 14-day free trial on your own endpoints, or book a technical walkthrough of the architecture and data flow.

Start Free TrialBook a Technical Demo

[email protected]kraitos.io