- Endpoint
- Enforces policy
Qastel Desktop Agent
See AI used in every app on a Windows device, and apply your policies before a request leaves it.
Why the desktop is the gap the browser leaves
Some AI never touches a browser: Claude Desktop, a coding assistant in an editor, a local model, a script calling an API. The Qastel desktop agent runs on managed Windows devices, recognises the AI services each app connects to, and (for the services it supports) applies your policies to what is sent, before it leaves the machine.
The browser extension sees AI used in a tab. It cannot see the desktop app someone installed, the assistant built into their editor, or the SDK a script calls. That work is still AI, still on a device you manage, and still carrying your data.
Discovery, without the contents
The agent watches outbound connections and matches them against Qastel's catalogue, attributing each AI service to the device's user and to the app that made the call: its name, location, file hash and publisher. On this path it reads no page contents, no full URLs and no prompt text, and the catalogue never sits on the device in plain text.
What you get
Discover, assess, control, comply.
What the Qastel Desktop Agent adds, at each of the four stages.
Discover
AI used in native apps, editors and scripts on managed Windows devices, attributed to the app and the person.
Assess
Each AI connection tied to the program behind it, with its publisher signature and file hash.
Control
Your policies applied on the device itself (allow, redact, warn or block) before a request is sent.
Comply
Every enforcement decision recorded on the policy's activity, beside those from the browser and the MCP gateway.
Enforcement where the request starts
For the AI services Qastel supports for enforcement, ChatGPT and Claude among them, the agent inspects each request and applies your policies' decision: let it through, redact the sensitive parts, ask the person to confirm, or block it with your message. Apps that pin their own certificates are listed by name, so you know exactly what sits outside enforcement and why.
What Qastel reads
From Qastel Desktop Agent
- AI connections from every process
- The app behind each one, and its signature
- Requests to supported AI services
Your policies decide what passes, in and out. Every decision is recorded.
Deploy the Qastel Desktop Agent
Installs as an MSI through the deployment tool you already use, and enrols itself with an install code from Qastel. To enforce, it installs a root certificate restricted to the AI services it inspects, makes Firefox trust it, and blocks HTTP/3 so those requests fall back to a connection it can inspect, so brief your security team, and allow-list it in your EDR, before you deploy.
What you need before you start
- Managed Windows 10 or 11 devices, and administrator rights to install on them
- The installer, from Qastel Support, and an EDR exclusion for its install folder
In Qastel, open Sources, choose Desktop Agent, and create an install code capped at your fleet size.
Push the MSI with that code and each user's work email through Intune, Configuration Manager or Group Policy. Each device enrols, reports and updates itself from then on.
See what your AI is doing, wherever it runs.
Your policies, applied where the AI runs. Every decision recorded.