Skip to main content

Browser extension

Planned

This collector is designed but not yet built. The endpoint agent's native-messaging host — its device-side half — already exists.

The browser is where workforce AI use actually happens: ChatGPT, Claude, Gemini and every SaaS AI feature run over TLS that a host agent cannot (reliably) open. The browser collector solves this from inside the browser, where the page content is already plaintext.

Design​

  • WebExtension Manifest V3 (Chrome, Edge, Firefox), deployed by managed browser policy — force-installed on managed machines, so it cannot be removed by the user.
  • Content scripts with per-provider adapters observe the prompt as it is typed and the response as it streams into the DOM — including the token-by-token rendering of a streamed answer.
  • Inline enforcement in the page: a Block rule stops the submit, a Redact rule rewrites the text before it is sent.
  • Native Messaging connects the extension to the endpoint agent when one is present, so verdicts come from the same local engine and policy as every other collector on the machine. Without an agent, the extension calls the cloud inline API directly.

Why not intercept at the host?​

Certificate pinning and HTTP/3 make transparent host-level TLS interception unreliable for consumer AI sites — QUIC is a browser problem, and the browser is exactly where this collector runs. Base-URL redirection (the endpoint proxy) covers developer tooling; the extension covers the browser; between them the two host-local collectors cover the machine.