Skip to main content
Every AI tool the desktop agent knows, on each operating system, is Captured, Partial (captured except in the cases its reason names) or Not captured. Each one also says which agent release someone last saw it hold on a real device; not yet verified means it follows from how the agent captures that operating system, and nobody has checked it on a device yet. This page describes the next release after 0.9.0. On 0.9.0 itself, every operating system captures only what follows the system proxy, plus Claude Code through its own settings on Windows and macOS: the macOS Network Extension, the Linux steering service, the Codex route and the browser extension’s check with the agent all arrived after it.

​
Desktop apps

On macOS the Network Extension hands every connection to an AI host to the agent, from any app; if macOS will not run it, the system proxy is used instead. On Windows, apps that follow the system proxy are captured; the WFP driver that captures every app is not yet production-signed. An app that pins its own certificate is never captured on any operating system. Why a tool is partial or not captured:
  • Microsoft Copilot app, Windows (partial): Installed from the Microsoft Store, it may run in an AppContainer, whose traffic never reaches the agent without a loopback exemption an admin grants (deploy/mdm/windows/README.md). pgshadow doctor reports it.
  • Cursor, Linux (partial): Captured by address: a connection to an AI address the agent has not learned from the machine’s DNS goes direct, as does one whose handshake names no host.
  • GitHub Copilot in VS Code and JetBrains, Linux (partial): Captured by address: a connection to an AI address the agent has not learned from the machine’s DNS goes direct, as does one whose handshake names no host.
  • Codex app and IDE extension, Windows (partial): Routed through Codex’s own config while the Codex switch is on. Not captured where that config turns the system proxy off, an admin requirements.toml pins it off, the Codex build is too old to know the setting, or the session started before the route was set.
  • Codex app and IDE extension, Linux (not captured): The agent does not route Codex on Linux.
Vendors in this section: ChatGPT, Claude, Codex, Copilot, Cursor, Perplexity.

​
Command-line tools and scripts

Command-line tools read no system proxy. On macOS the Network Extension captures them anyway; on Linux the steering service does, by address; on Windows only Claude Code and Codex are routed, through their own settings, until the WFP driver is production-signed. Why a tool is partial or not captured:
  • Claude Code, Windows (partial): Routed through HTTPS_PROXY in Claude Code’s own settings while the Claude Code switch is on. Not captured where someone else’s proxy is already set there, managed settings set a proxy or a NO_PROXY covering api.anthropic.com, or the session started before the route was set.
  • Claude Code, Linux (not captured): Without root, the agent’s certificate is trusted only by browsers, so Claude Code is not routed on Linux.
  • Codex CLI, Windows (partial): Routed through Codex’s own config while the Codex switch is on. Not captured where that config turns the system proxy off, an admin requirements.toml pins it off, the Codex build is too old to know the setting, or the session started before the route was set.
  • Codex CLI, Linux (not captured): The agent does not route Codex on Linux.
  • Scripts, SDKs and other command-line tools, macOS (partial): Captured by the Network Extension, but a client that brings its own certificate list (Python’s certifi, Node without its system-certificate option) refuses the agent’s certificate, so its requests fail until it is pointed at the system store.
  • Scripts, SDKs and other command-line tools, Windows (not captured): They read no system proxy, and the WFP driver that would capture them is not yet production-signed. A tool that honours HTTPS_PROXY can be pointed at the agent by hand.
  • Scripts, SDKs and other command-line tools, Linux (partial): Captured by address. A connection to an AI address the agent has not learned (the client does its own DNS-over-HTTPS, or the answer predates the service) goes direct, as does one whose handshake names no host; a client with its own certificate list refuses the agent’s certificate.
Vendors in this section: Claude Code, Codex, Cohere, DeepSeek, Gemini, Groq, Hugging Face, Mistral, OpenAI API, OpenRouter, Perplexity, xAI.

​
In the browser

With the PromptGuard browser extension (Chrome, Edge, Firefox; force-installable by MDM), each prompt is checked on the page before it is sent, whatever the browser does with it next. Without it, only the network path applies, and the QUIC and WebSocket gaps below apply. Why a tool is partial or not captured:
  • AI web apps, without the extension (and Safari), macOS (partial): Text an app sends over a WebSocket is not read, and a browser that uses QUIC (Chrome, for Gemini) can go around the agent; turn QUIC off by browser policy (QuicAllowed=false).
  • AI web apps, without the extension (and Safari), Windows (partial): Text an app sends over a WebSocket is not read, and a browser that uses QUIC (Chrome, for Gemini) can go around the agent; turn QUIC off by browser policy (QuicAllowed=false).
  • AI web apps, without the extension (and Safari), Linux (partial): Text an app sends over a WebSocket is not read. QUIC to an AI address is refused, so the browser falls back to HTTPS, but a browser that does its own DNS-over-HTTPS reaches addresses the agent never learned.
Vendors in this section: ChatGPT, Claude, Copilot, DeepSeek, Gemini, Hugging Face, Meta AI, Mistral, OpenRouter, Perplexity, Poe, xAI.

​
What is never captured

Some traffic is out of reach on every platform: apps that pin their own certificates, QUIC/HTTP-3, and messages sent over a WebSocket. See Known limitations for each one and its workaround.