Flowstate Agent

The Flowstate Agent runs on each developer machine. It captures AI traffic, forwards it to the cloud proxy at proxy.flowstate.inc, and from there into your Flowstate tenant for attribution, spend reconciliation, and (optionally) policy enforcement.

The agent is the ground-truth source for everything in AI Governance — Insights. One agent, one ledger.

How the agent ships

A single Go binary (flowstate) plus a per-platform daemon supervisor:

• macOS — FlowstateAgent.app ships a menubar app plus a NETransparentProxy system extension. The extension is a pure HTTPS CONNECT-forwarder: it peeks the TLS SNI of each outbound flow and tunnels covered AI hosts to proxy.flowstate.inc, splicing every other flow straight through. There is no on-device TLS termination on this path — no local CA, no leaf certificates. The agent authenticates to the proxy as the device's user, from the device's email and your organisation token (see telemetry keys), and auto-updates silently. Deploy it fleet-wide with the MDM deployment guide.
• Windows — A Windows service called FlowstateAgent, installed under C:\Program Files\Flowstate\. Capture uses WinDivert for kernel-level diversion of outbound TCP/443.
• Linux — A systemd unit, PAC mode only.

Roll it out via your MDM. The MDM deployment guide covers end-to-end recipes for Kandji, Mosyle, Intune, and Apple Business Manager on macOS; the install pages carry Windows (Intune + Group Policy) and Linux (Ansible + Puppet) guidance.

Install

Pick your operating system:

• Install on macOS — NETransparentProxy system extension, silent auto-update. For a fleet, use the MDM deployment guide.
• Install on Windows — WinDivert + Windows service.
• Install on Linux — systemd + PAC.

Every platform has the same one-shot install UX:

sudo flowstate install --key="<org-key>" --user="<user-email>"

— and the same one-shot uninstall:

sudo flowstate uninstall

Provision the org token once at https://app.flowstate.inc/settings/ai/cloud-proxy and embed it in your MDM payload. See telemetry keys for the token model and rotation flow.

Two pathways

The agent supports two operating postures, chosen per organisation in Settings → AI → Agent Policy:

• Telemetry — usage metadata only. No prompt capture. Works whether your engineers are on consumer or enterprise AI plans.
• Enterprise — full capture, prompt-quality scoring, policy enforcement, and authoritative usage reconciliation. The one you want if you're on Claude for Enterprise, ChatGPT for Enterprise, or anything else with a real admin contract.

Compare the two pathways →

Configure + operate

After install, work through the configure + operate sections in order:

1. Telemetry keys — issue the org token used by every device in the fleet, and rotate it.
2. Agent policy — capture mode, enforcement, per-platform overrides.
3. Corporate proxies — co-existence with Zscaler, Netskope, Forcepoint, Palo Alto, Cisco Umbrella, Cloudflare Zero Trust. Includes the SWG hostname allow-list.
4. Auto-updates — silent Sparkle updates on macOS; AutoUpdate=false in managed config opts a fleet out.
5. Enforcement — turn the agent from observer to gate.

Reference material: environment variables and troubleshooting.