Desktop Protection

Enroll the Orthalon desktop controller, protect compatible model clients through the loopback agent, and inventory local MCP configurations.

Plan requirement: Desktop discovery is available for evaluation. Active desktop policy enforcement requires Protect or higher. Return-path inspection requires Business or Enterprise.

Orthalon desktop protection has two parts:

the desktop controller, a Tauri tray application that manages enrollment, stores credentials in the OS keychain, synchronizes policy, inventories supported MCP client configurations, and supervises the packaged Desktop agent;
the desktop agent, a Desktop-scoped loopback proxy on 127.0.0.1:4110 for model clients that support a custom OpenAI, Anthropic, or Gemini-compatible endpoint.

The controller verifies the packaged runtime, bundle, target, and manifest before launch. It supplies enrollment material through a one-shot local bootstrap and requires an authenticated status response before reporting the agent as running. MCP uses a separate MCP-scoped runtime. The AI gateway is hosted and is not installed as a local service.

The graphical application does not silently intercept every native application. Fixed vendor backends and pinned-TLS applications remain discovery-only unless an exact, signed application adapter has passed release acceptance.

Desktop controller availability

Download the current desktop controller for macOS on Apple silicon or Intel, Windows x64, Debian or Ubuntu x64, or another supported x64 Linux distribution. GitHub Actions builds every platform package before publishing the complete release to Cloudflare R2.

The direct-download packages are for controlled evaluation while Apple notarization and Microsoft publisher signing are pending. Complete clean-machine installation, upgrade, rollback, and uninstall acceptance before a broad rollout. Do not suppress Gatekeeper, SmartScreen, or package-signing controls across production endpoints.

Enrollment status

Orthalon's control plane supports system-browser authorization with PKCE and a device public key. The callback contains a five-minute, one-time authorization code rather than a sensor key. After enrollment, the device signs management requests for separately scoped Desktop, MCP, or gateway bearer credentials through a prepare, secure-store, and activate lifecycle. Binding every service request to the device with DPoP or mTLS remains a release-hardening requirement.

The Tauri first-run experience implements this browser flow. It keeps the device private key and PKCE verifier in the OS credential store, stores the one-time Desktop grant before activation, resumes interrupted provisioning, and launches the Desktop sidecar only after activation and policy verification. Disconnect sends a signed self-revoke request and retains local credentials if server revocation cannot be confirmed.

Enroll a source build during qualification

Start browser enrollment

Choose Connect with browser in the desktop application. Sign in through the system browser, review the endpoint name, operating system, requested Desktop service, and public-key thumbprint, then authorize an organization where you can manage endpoints. The callback contains only a one-time code and PKCE state.

Start the controller

For local development against local ingest:

ORTHALON_DESKTOP_INGEST_URL=http://127.0.0.1:4000 \
  pnpm --filter @repo/desktop-app dev

Production builds use https://ingest.orthalon.com unless the build pipeline supplies an approved self-hosted origin.

Verify activation

After the callback, confirm the app reports the Desktop sidecar as running and shows a real policy version. Interrupt the network once between authorization and grant preparation, restart the app, and confirm it resumes provisioning without another browser authorization. A raw Desktop-key form appears only in a build compiled with the explicit legacy enrollment flag; it is not the default customer flow.

Configure compatible clients

Start the controller. After it verifies and starts the packaged Desktop sidecar, configure a compatible client to use the loopback endpoint.

export OPENAI_BASE_URL="http://127.0.0.1:4110/v1"
export OPENAI_API_KEY="your-upstream-provider-key"

export ANTHROPIC_BASE_URL="http://127.0.0.1:4110"
export ANTHROPIC_API_KEY="your-upstream-provider-key"

Only clients that honor these custom endpoints are inline-protected. Validate each client and version before adding it to an enforced deployment group.

Local DLP preview boundary

The controller includes a local text preview for qualification. It does not monitor or rewrite the system clipboard and is not a background enforcement surface. It does not cover typed text, context-menu paste, drag-and-drop, files, images, dictation, or every application update.

MCP inventory boundary

The controller can inventory server name, sanitized executable name, transport origin, client, and scope from supported Cursor, Claude Desktop, Windsurf, VS Code, Claude Code, and Codex configuration files. It strips URL credentials and queries and does not read server environment variables or arguments.

Inventory is not tool-call enforcement. Use the separately enrolled MCP agent for allowlisted stdio policy. HTTP and SSE MCP connections remain discovery-only.

Managed enrollment

The current application reads a strict managed.json from the system Orthalon directory. See apps/desktop-app/distribution/mdm/README.md in the deployment source. On macOS and Linux the file must be mode 0600; symlinks, oversized files, unsafe URLs, malformed credentials, and unknown properties are rejected.

The present managed-file contract uses a scoped Desktop key and must set the explicit legacy-managed flag. Rotate it regularly. Interactive Tauri enrollment uses browser PKCE; a one-time zero-touch device bootstrap that removes raw bearer keys from managed files remains a production fleet release gate.

What this does not provide

The Desktop package is not a transparent secure web gateway. It does not install a root certificate, decrypt arbitrary TLS, or inspect every native application. The Tauri supervisor runs in the user's session and is not tamper resistance; production enforcement also needs signed installers, MDM/UEM configuration, and platform application control.

Desktop Protection

On this page