Skip to main content
The Origin agent is a lightweight background service that installs on your endpoints and collects AI activity in real time. Once installed, the agent gathers events from the AI tools running on that host, enriches them with endpoint context, and reports the activity back to the Origin platform — giving your security team full visibility into how AI is being used across the fleet.

​
How the agent works

The agent runs as two cooperating services: the core agent, which collects AI event data and reports telemetry, and a watchdog service, which starts at boot and automatically restarts the core agent if it ever stops. Capture happens at the application layer on both platforms. The agent configures each AI tool’s native OpenTelemetry exporter to report to a local collector it runs on the endpoint’s loopback interface, and uses application-level hooks for applications that expose no telemetry of their own. There is no network proxy, no traffic interception, and no certificate to trust. All collected data is forwarded over outbound HTTPS to the Origin cloud.
The collector’s loopback port defaults to 4318 and is configurable fleet-wide from Settings → Settings. Change it only if your endpoints already run a corporate OTel collector on that port — see Console Setup.

​
Supported platforms

​
Installation paths

You can deploy the agent in two ways:
  • Manual install — an IT admin runs the installer directly on the endpoint. This is the fastest path for piloting on a single machine or a small group of machines.
  • MDM / management tool deployment — the installer is pushed silently to a fleet of endpoints via your existing MDM or software-deployment tooling (Jamf, Intune, SCCM, etc.). This is the recommended approach for production rollouts.
Both paths require a JWT provisioning token scoped to your tenant. You can generate and download the token from Settings → Installers in the Origin dashboard.

​
Before you begin

Review the prerequisites before starting any installation. Key requirements include outbound HTTPS access to Origin’s registration and endpoint APIs, and — for the Windows MSI installer — the Microsoft Visual C++ 2015–2022 Redistributable (x64).
See Prerequisites & Known Issues for the full list of network endpoints, Visual C++ requirements, and compatibility notes for SASE and Application Control solutions.

​
Next steps

macOS Installation

Run the .pkg installer, approve system extensions, and confirm the agent is reporting in the Origin dashboard.

Windows Installation

Deploy the MSI silently with a provisioning JWT, with options for enhanced logging and OTEL configuration.

MDM Overview

Push the agent fleet-wide using Jamf, Intune, or other management tooling.

Verifying Installation

Confirm the agent is healthy and capturing AI activity using tray diagnostics, service checks, and test prompts.