Skip to main content
Endpoint AI Risk is the part of Guardway that runs on your developers’ machines. A small agent (gw-cli) inventories the AI tools, skills, MCP servers and accounts on each laptop, measures how every AI tool is used and what it costs, and, when you choose, routes model traffic through your gateway and stops risky actions before they run. Everything rolls up into the console under Endpoint AI Risk.

​
The three views

The sidebar entry mirrors how the fleet is organized:

Fleet

One row per machine: who is signed in, which AI tools run there, how its traffic is governed, and what needs attention.

People

The same fleet regrouped by person: what they installed, asked, were stopped from doing and spent.

Policy

The Endpoint AI Policies machines run, the organization-wide AI Control switches and catalogs, and Access Profiles for gateway keys.

​
How the pieces fit

A machine starts in Observe: traffic is watched and reported, nothing is stopped and Claude Code is never in the agent’s data path. Moving a group of machines to Enforce is a policy change, not a reinstall.

​
Getting a machine in

1

Install the package for the OS

A universal .pkg for macOS, an .msi for Windows, a .deb or .rpm for Linux. Deploy it with your MDM or install it by hand. Installing the package is the whole install.
2

Issue an endpoint key in the console

Endpoint AI Risk › Fleet › Connect endpoint. Name the machine and generate a key. It enrolls one machine and is shown once.
3

Enroll the machine

Run the enroll command the console shows. The machine sends a first report and appears in Fleet within a minute.
Connect Endpoint walks through each step, with a page per operating system.

​
What leaves the machine

Only redacted findings and usage metadata: tool names, versions, risk scores, token counts, models, costs, policy state and the evidence behind a stop, redacted before it leaves. Prompts and replies stay on the machine, unless a machine is in Enforce, where model traffic goes to your gateway the same way it would without Guardway. Until a machine is enrolled, the agent contacts nothing except package vulnerability lookups during skill scans. The hosts are listed on Network Requirements.

Connect Endpoint

Install, enroll and verify a machine.

Agent

What the agent finds, how it scores, and every command.

Network Requirements

Hosts and ports to allow on each machine.

Privacy and Security

What Guardway stores and how it is protected.