Package, distribute and enrol the CID222 endpoint agent on Windows and Linux fleets, and verify that devices are enforcing.

The endpoint agent captures a managed device's outbound HTTPS to AI destinations, decrypts it with a CID-issued certificate authority, and asks the appliance for an allow, redact or block decision on every request. It is the only surface that follows a laptop off the corporate network and that reaches desktop AI applications and command-line tools rather than browsers alone.

Danger

The endpoint agent is pre-release. Its fleet console is hidden on a licensed appliance — the sidebar entry appears only where CID_ENABLE_LAB is true — and the page opens on a status panel rather than the console. Treat everything below as a pilot procedure, run with your CID222 contact, not as a production rollout.

What do I need?

Licence: Any
Role: superadmin

Prerequisites

The deployment runs with the lab surfaces enabled, so the fleet console is reachable at all.
The appliance is reachable from every managed device on 443, including from outside the corporate network if the fleet roams.
You are signed in as the superadmin. The fleet console refuses writes from any other role.
The signed package repository is published on the appliance, or you hold the signed Windows installer.
Your management tool can push a package plus three values: the CID endpoint, an enrollment token and an admin uninstall password.
You have a pilot group of at most a few machines that is not anyone's production workstation.

What is proven, and where

Read this before you plan a rollout. The agent's coverage is not uniform across platforms.

Component	State
Linux agent	Pilot. Verified end to end: install from the signed repository, enrol, redact, blocked jailbreak, tamper-gated removal. Capture is an nftables redirect with QUIC dropped, and it provisions trust into the system store, the machine-wide environment and browser certificate stores
Windows agent	Not ready. Capture through WinDivert local mode is coded but never tested end to end, the installer is unsigned until a code-signing certificate is procured, and only the system trust store is provisioned
macOS agent	Planned, not built. Cover macOS with the inline proxy and the browser extension instead
Fleet backend	Ready. Enrolment, signed policy, heartbeat and the admin API all work
Fleet console	Partial. It creates fleets, shows devices and issues commands; policy editing beyond the create dialog is not there yet

Danger

Do not deploy to production Windows machines yet. The Windows installer has no code signature, so SmartScreen blocks it, and the enforcement path has never been exercised on a managed Windows box. Treat the Windows path as a lab configuration until the signed release ships.

Create a fleet

A fleet is a group of devices sharing one signed policy. Its enrollment token is what turns a freshly installed package into an enrolled device.

Open the fleet console

Select Administration → Endpoint Agent, then Open the work-in-progress console.

The page opens on a status panel summarising what is built. Behind it, the console lists existing fleets with their device counts and policy versions.

Create the fleet

Select Create fleet and fill in:

Name — how you will recognise this group, for example Sales Laptops.
CID endpoint — the appliance URL these devices send AI traffic to.
Fail mode — fail-open allows AI traffic when the appliance is unreachable, fail-closed blocks it.
AI destinations — one hostname per line. Each becomes an intercepted destination.

Select Create fleet. The fleet appears in the list with policy version 1.

Copy the enrollment token

The Enrollment token & deploy commands dialog opens with the token shown.

Copy it now. The token is displayed once; afterwards you must use Rotate token on the fleet to issue a new one, which invalidates the old.

Screenshot pendingEnrollment token and deploy commands dialog listing the Linux repository, install and enrol commands and the Windows msiexec line/assets/screenshots/endpoint-agent-token@0.4.png

Take the deploy commands

The same dialog renders the paste-ready commands with this fleet's endpoint already substituted: a Linux repository line, a Linux install line, a Linux enrol line, and the Windows unattended installer line.

Each contains two placeholders you still supply — the enrollment token and the admin uninstall password.

Choose the admin uninstall password

Pick one value per fleet and store it where your management tool can read it.

A device bootstrapped with this value refuses package removal unless the same value is supplied. A device bootstrapped without one can be removed by any local administrator.

Warning

The enrollment token is fleet-wide and reusable, not per device. Anyone holding it can enrol a machine into the fleet. Treat it as a secret in your management tool, and rotate it when a device leaves your control.

Publish the packages

The appliance serves the packages itself, so an air-gapped site needs nothing external.

The release build produces a GPG-signed apt repository, a signed yum repository and the public key that endpoints install. Copy that output under the appliance's static web root so the following are served as plain files:

https://<appliance-fqdn>/repo/cid-gpg-key.asc
https://<appliance-fqdn>/repo/apt/…
https://<appliance-fqdn>/repo/yum/…

Keep the private signing key in your secret store, never in a repository. Rotating it means publishing the new public key, re-signing both repositories, and leaving the old key verifiable for a grace period.

Install and enrol

Add the repository, install the package, enrol, and start the service:

# 1. add the signed repository (apt shown; RHEL/Fedora drops a cid.repo instead)
CID_APPLIANCE=https://<appliance-fqdn> sh apt-setup.sh
 
# 2. install
sudo apt-get install -y cid-endpoint-agent
 
# 3. enrol
sudo cid-endpoint-agent bootstrap \
  --endpoint https://<appliance-fqdn> \
  --token <enrollment-token> \
  --admin-token <admin-password>
 
# 4. start
sudo systemctl start cid-endpoint-agent

The package depends on nftables and bundles its own inspecting proxy, so the endpoint needs no Python and no separately installed proxy. Installation creates an unprivileged cid-proxy account for the proxy process and enables a daily jittered self-update timer that upgrades the package from the same signed repository.

Push it with your management tool

Every path carries the same three inputs. Nothing else is per-device.

Tool	How
Ansible (Linux)	The shipped `cid_endpoint_agent` role adds the signed repository, installs the package, runs the bootstrap idempotently and enables the service. Pass the endpoint, token and admin password as variables and keep them in a vault
Microsoft Intune (Windows)	Wrap the signed MSI as a Win32 application. Install command is the `msiexec` line above; detect on the installed executable or the service; store the token and password as scoped values, never in the application name
Group Policy (Windows)	Software Installation cannot pass MSI properties, so author a transform that sets the three properties, place the MSI and the transform on a share the computer accounts can read, and assign the package to computers. It installs at next boot
SCCM / MECM (Windows)	Application model with an MSI deployment type, the same install command and detection as Intune, deployed as required to a device collection
Jamf (macOS)	Not available — the macOS agent is not built

Make clients trust the agent's certificate authority

Interception only works where the client trusts the agent's certificate. Different clients read different trust stores, and the agent does not provision all of them.

On Linux the agent provisions trust itself on every reconcile: it installs the certificate into the system store, writes a combined bundle, drops a machine-wide profile script that points the Node, Python, curl and git environment variables at that bundle, and imports the certificate into each user's browser certificate store. Uninstalling reverses all of it.

Client family	Trust store	Provisioned automatically
curl, wget, most system applications	System store	Yes, on Linux and Windows
Node command-line tools, including coding assistants	Node's own bundle	Linux only
Python SDKs	The `certifi` bundle	Linux only
Chrome, Edge, Firefox	Their own certificate store	Linux only, and best-effort per user profile
Certificate-pinned applications	Pinned key	Never possible — see the gaps below

Warning

The machine-wide environment applies to newly started processes only. A shell or an editor that was already running keeps the old environment until it restarts, and its requests break with a certificate error in the meantime.

For a managed fleet, push the certificate through browser enterprise policy as well. It is more reliable than the agent's per-user import, which races with profile creation.

Verify

On the device, run cid-endpoint-agent status. It prints the device id, the endpoint, whether the device is enrolled, whether a policy bundle has been applied, and an enforcement block whose last line reads ENFORCING when the interceptor is running and the certificate authority is installed.
Open Administration → Endpoint Agent and select the fleet. The device appears in the inventory with its hostname, agent version, last-seen time and applied policy version. A device whose applied version trails the fleet's policy version has not picked the change up yet.
Send a prompt containing test personal data to one of the fleet's AI destinations from that device. The request is redacted before it leaves the machine. Open All Detections, set Source to Endpoint agents, and confirm the row carries a redact verdict.
Confirm a destination outside the policy is untouched: on a domain-scoped fleet, ordinary web traffic must show no interception and no certificate change.
Restart the device. cid-endpoint-agent status reports ENFORCING again without intervention.

Remove the agent

Removal is gated by the admin password the device was bootstrapped with.

sudo CID_UNINSTALL_TOKEN=<admin-password> apt-get remove cid-endpoint-agent

Without the value the pre-removal script refuses and prints the command to re-run. With it, the agent removes the firewall redirect, removes its certificate from the system store, reverses trust provisioning and disables the service.

Reversal has been verified on Linux: the firewall table, the environment script, the combined bundle, the system certificate and the browser store entry are all removed, and AI destinations are reachable normally afterwards.

If it fails

cid-endpoint-agent status reports NOT enforcing — either the bundled proxy is not listening or the certificate has not been generated. Check the service is running and read its journal; the agent restarts the proxy under a watchdog, so a persistent failure is a configuration problem, not a crash loop.
A command-line tool fails with an unverified-leaf-certificate error — that client reads a trust store the agent has not provisioned, or it was started before provisioning ran. Restart the process; on Windows and macOS, provision the store yourself.
A browser shows a certificate error on an AI site — the certificate is not in that browser's own store. Push it through browser enterprise policy.
The device never appears in the fleet inventory — enrolment did not complete. Confirm the endpoint is reachable from the device and that the enrollment token has not been rotated since you built the deployment package.
The device is enrolled but its applied policy version trails the fleet — the poll has not landed yet, or the device is offline. It converges at the poll cadence; there is no push.
Traffic to a policy destination is not being inspected at all — the destination is fronted by a content-delivery network and the address the client resolved was not in the set the agent steered. See the gaps below.
Package removal is refused — the device carries an uninstall token. Re-run the removal with the fleet's admin password in the environment.

Known gaps

State these before a customer discovers them.

Steering is by address, not by server name. The agent resolves each policy destination to a set of addresses and redirects those. A destination on anycast infrastructure hands different clients different addresses, so traffic can go direct and uninspected. Interception based on the name in the TLS handshake is the fix and is not built.
Shared front-ends cause collateral interception. One consumer AI hostname expanded to eight shared addresses belonging to a large provider in testing. Non-AI clients that share such an address and do not trust the agent's certificate can break.
Two hostnames on one address cannot be separated. A vendor's web application and its API frequently resolve to the same address; steering one steers both.
Certificate-pinned applications cannot be inspected. The policy decides whether they are logged and passed or blocked. There is no third option.
No shared fleet certificate authority. Each device trusts a certificate it generated itself, so there is no single authority to distribute or revoke centrally. A shared, revocable fleet authority is planned.
The fleet's policy signing key is stored unencrypted in the gateway database. Anyone who reaches that row can forge a policy bundle. Encrypting it is a pre-release item.
Web front-end inspection rules go stale. The rules that recognise a vendor's prompt-submit request are brittle: one vendor moved its endpoint and the shipped rule silently stopped matching, so prompts passed uninspected. Vendor API endpoints are far more stable than their web applications.
The endpoint agent's copy of the inspection rules is build output. It is copied from the inline proxy at package time and goes stale between builds. Always test a freshly built package, never a stale checkout.
Rollout rings are stored but not served. A fleet records a canary, broad or all ring; policy is not yet served differently per ring.

Next steps

Endpoint Agent — the fleet console: policy editing, kill switch, device health and per-device commands.
Browser extension — the lighter surface for browser-only coverage, with no certificate authority and no interception.
Topologies — how the endpoint agent composes with the inline proxy and a third-party secure web gateway.

Roll out the endpoint agent