The only platform that sees what your agents actually do.
Quint reads what an agent says it is about to do, then watches what it actually does. The gap between the two is the signal. It sits underneath every agent at the operating system, so coverage never depends on a vendor shipping a hook.
GET STARTEDMCP is the 6%.
We see the 94%.
Four layers.
Evaluated in parallel. Cross-validated.
Every tool call is observed from four independent vantage points at once. Risk scoring runs on the machine, with no cloud round-trip in the decision path. Separately, in your cloud tenant, 98 forward-chaining rules map each action to control families: SOC 2 CC6.7 · GDPR Art 32 · HIPAA 164.312 · EU AI Act. All deterministic, zero LLM in the scoring path.
Nine independent signal families — Bloom-filter novelty, Markov transitions, EWMA temporal drift, Count-Min frequency, HyperLogLog exploration, Jensen-Shannon capability shift, structural flow divergence — all read from one fixed-size ~6 KB per-agent fingerprint whose size is pinned by test regardless of how many actions it absorbs. Sketch-backed, so it never grows unbounded.
What leaves the machine is your call.
Inspect the dial. Audit the wire.
Everything Quint captures lands in your own tenant. In privacy mode, content — prompts, arguments, file bodies — is redacted on-device with a deny-by-default allowlist before a single byte leaves the machine: the cloud sees findings and metadata, never the content. With full capture on, payloads power deeper detection. Either way, the local event log shows exactly what shipped.
Declared intent.
Then what actually happened.
Other tools pick one signal. Observability watches traces. Gateways watch traffic. Governance writes docs. Quint derives what the agent intended from what it declared, then measures it against what it actually did at the OS level. The divergence between stated intent and observed behavior is the signal, scored against what is normal for this agent at this scope. Intent alone tells you what was promised. OS truth alone tells you what happened. Neither alone tells you: “this support agent is behaving unusually for Alice's queue at 2 am, and what it just did doesn't match what it said it would do.”
Policy lives on the endpoint.
Evaluated before the action, not after.
Policy pushes to every machine on the next heartbeat and evaluates on-device, ahead of the action — no cloud round-trip on the decision path. Enforcement is observe-first: verdicts are recorded before anything is ever blocked, the same shadow-then-enforce discipline Quint's scope compiler already runs across the fleet, recording what it would have refused. The panel below is illustrative.
“Block any agent from reading SSH keys or AWS credentials outside the ~/.aws/sso cache.”
- match
- Read · Bash
- target
- ~/.ssh/** · ~/.aws/credentials
- except
- ~/.aws/sso/
- action
- BLOCK
- severity
- critical
- BLOCKclaude-codeRead ~/.ssh/id_rsa
- BLOCKdevinRead ~/.aws/credentials
- ALLOWcursorRead ~/.aws/sso/cache
An immutable ledger of every agent action.
Hand it to your auditor. Let them verify it themselves.
Every decision is signed with Ed25519 and SHA-256 chained to the previous block. Any attempt to edit history breaks the chain and breaks the signature, visibly, on the next verification sweep. Export with an OpenSSL one-liner or quint verify.
“Every agent action should leave a receipt that an auditor can verify without us, and a verdict your security team can explain without lawyers.”
One control plane.
Every machine you have. Every SIEM you use.
A signed macOS package: a daemon plus an Endpoint Security system extension. Linux and Windows sensors, and the browser extension, are on the roadmap. SIEM delivery is configured over the REST API — Splunk, Sentinel, Chronicle, Slack, PagerDuty — with a live event stream for anything that prefers to subscribe.
Your agents are running.
See what they're actually doing.
Deploy fleet-wide via MDM. Start with visibility, enforce when ready. No agent configuration required.