The only platform that sees what your agents actually do.
Quint reads what an agent says it is about to do, then watches what it actually does. The gap between the two is the signal. It sits underneath every agent at the operating system, so coverage never depends on a vendor shipping a hook.
GET STARTEDMCP is the 6%.
We see the 94%.
Four layers.
Evaluated in parallel. Cross-validated.
A tool call is observed from up to four independent vantage points. Risk scoring runs on the machine, with no cloud round-trip in the decision path. Separately, in Quint's cloud, 98 rules map each action to control families: SOC 2 CC6.7 · GDPR Art 32 · HIPAA 164.312 · EU AI Act. All deterministic, zero LLM in the scoring path.
Nine independent signal families (Bloom-filter novelty, Markov transitions, EWMA temporal drift, Count-Min frequency, HyperLogLog exploration, Jensen-Shannon capability shift, structural flow divergence) all read from one fixed-size ~6 KB per-agent fingerprint whose size is pinned by test regardless of how many actions it absorbs. Sketch-backed, so it never grows unbounded.
What leaves the machine.
Content is sent by default. Two settings keep it out of Quint's cloud storage.
By default the daemon sends what it captures to Quint's cloud: prompts and model responses, tool arguments and results, command lines, file paths and network destinations. Credentials its detector recognises are masked on some capture paths, not all; command lines from the kernel sensor and from agent hooks are sent unmasked today. Set log_bodies: false on the daemon and prompts, responses, tool arguments and results are replaced with a marker before they leave the machine. With content suppression, which Quint enables for an organization on request, Quint's ingest removes them before anything is stored, apart from times when ingest cannot read the setting or the setting has just changed. Either way the working directory, session name, file and program names, and network destinations still reach the cloud, and the audit log on each machine keeps tool arguments and results, and the prompts agent telemetry reports.
Declared intent.
Then what actually happened.
Other tools pick one signal. Observability watches traces. Gateways watch traffic. Governance writes docs. Quint derives what the agent intended from what it declared, then measures it against what it actually did at the OS level. The divergence between stated intent and observed behavior is the signal, scored against what is normal for this agent at this scope. Intent alone tells you what was promised. OS truth alone tells you what happened. Neither alone tells you: “this support agent is behaving unusually for Alice's queue at 2 am, and what it just did doesn't match what it said it would do.”
Policy lives on the endpoint.
Evaluated before the action, not after.
Policy pushes to every machine on the next heartbeat and evaluates on-device, ahead of the action, with no cloud round-trip on the decision path. Enforcement is observe-first: verdicts are recorded before anything is ever blocked, the same shadow-then-enforce discipline Quint's scope compiler already runs across the fleet, recording what it would have refused. The panel below is illustrative.
“Block any agent from reading SSH keys or AWS credentials outside the ~/.aws/sso cache.”
- match
- Read · Bash
- target
- ~/.ssh/** · ~/.aws/credentials
- except
- ~/.aws/sso/
- action
- BLOCK
- severity
- critical
- BLOCKclaude-codeRead ~/.ssh/id_rsa
- BLOCKdevinRead ~/.aws/credentials
- ALLOWcursorRead ~/.aws/sso/cache
A signed ledger of agent tool calls.
Signed on each machine, and checked there.
On each machine, every tool call the daemon records is signed with Ed25519 and SHA-256 chained to the previous record. Editing a record's signed fields (its tool, arguments, result, verdict and risk) fails its signature check, unless an administrator on that Mac re-signs it, the next time sudo quint audit verify --data-dir /var/lib/quint runs there; deleting the newest records is not detectable, so we do not call the log tamper-evident. Kernel-sensor events are not in that log. Quint's cloud keeps a separate hash chain over each event's type, tool name, decision, risk score and time; it is not signed and does not cover the event's content.
“Every agent action should leave a receipt that an auditor can verify without us, and a verdict your security team can explain without lawyers.”
One control plane.
Every machine you have. Every SIEM you use.
A signed macOS package: a daemon plus an Endpoint Security system extension. Linux and Windows sensors, and the browser extension, are on the roadmap. SIEM delivery is configured over the REST API (Splunk, Sentinel, Chronicle, Slack, PagerDuty), with a live event stream for anything that prefers to subscribe.