Prerequisites

Everything that must be true before you touch an endpoint: a known tenant environment, supported operating systems, MDM admin access, an unblocked network path, and the verified install bundle.

1 · Quilr environment & install bundle

• Identify your tenant environment (for example US Prod or JP POC). This determines the base/DLP hosts below.
• Obtain your tenant ID from Quilr support — required by the installer to phone home.
• Download the platform-specific installer bundle.

Bundle download URLs

https://quilr-extensions.quilr.ai/endpoint-agent/prod/windows/installer/quilr-endpoint-agent-win-install-bundle.zip

https://quilr-extensions.quilr.ai/endpoint-agent/prod/mac/installer/quilr-endpoint-agent-install-bundle.zip

2 · Administrator access

Local administrator rights on the target device are required in every case — the installer writes to the system trust store, installs a system service/driver, and (macOS) loads a system extension. For a manual / technician install (Step 3) you sign in locally as an admin (macOS: an account with sudo; Windows: an elevated session). For an MDM rollout (Step 5) the management agent supplies the elevation, but you also need administrator credentials for your management platform:

3 · Supported operating systems

4 · Network requirements

• Endpoints must reach the Quilr backplane hosts on TCP 443 (outbound HTTPS).
• TLS-intercepting proxies (Zscaler, Netskope, Symantec, Forcepoint, iboss) must SSL-bypass every Quilr backplane host — otherwise the proxy re-signs the certificate and the agent’s trust chain fails.

Shared hosts — all environments (TCP/443)

Tenant-specific base & DLP hosts

Add the row that matches your environment:

URLs to allow for the selected environment

Allow every host below outbound on TCP 443, and SSL-bypass them on any TLS-intercepting proxy. The tenant base & DLP hosts update automatically with the Environment selector in the top bar.

# Shared — all environments
discover.quilrai.dev
log.quilrai.dev
quilr-extensions.quilr.ai

# Tenant base + DLP — selected environment
app.quilr.ai
dlpone.quilr.ai

File types the web filter must allow

If your SWG / web filter or download-control policy filters by file type or MIME type, allow the following so the agent bundle, updates, and configuration files download without being stripped or quarantined:

Coexisting with an existing SSL-inspection proxy (PAC)

The Quilr endpoint agent does its own SSL inspection locally (WinDivert driver on Windows, Network Extension on macOS). If you already run a web filter / SWG (Zscaler, Netskope, Forcepoint, Cisco Umbrella, Palo Alto…) that does SSL inspection and is published through a PAC file, two solutions would otherwise fight over the same TLS session. To let Quilr monitor AI sites cleanly you must:

1. Merge Quilr’s PAC logic into your existing PAC — route the monitored AI / collaboration hosts to the local Quilr listener, and keep your current routing for everything else.
2. SSL-bypass those same hosts on your SWG — so the upstream gateway does not re-decrypt and re-sign them.

Quilr-hosted PAC

Quilr publishes a ready PAC whose FindProxyForURL() sends monitored hosts to the local agent and everything else DIRECT. If you have no existing PAC, point your OS proxy settings straight at this URL; if you do, fetch it and merge:

# Hosted PAC (application/x-ns-proxy-autoconfig)
https://discover.quilrai.dev/pac/<TENANT-ID>

# Inspect it before merging
curl -fsSL https://discover.quilrai.dev/pac/<TENANT-ID> -o /tmp/quilr.pac
less /tmp/quilr.pac

Merge into your existing PAC

function FindProxyForURL(url, host) {
    // 1. Your existing corporate routing
    if (isPlainHostName(host))                  return "DIRECT";
    if (shExpMatch(host, "*.corp.example.com")) return "DIRECT";

    // 2. Quilr monitored AI / collaboration hosts -> local agent listener
    var quilrHosts = [
        "chatgpt.com", "*.oaiusercontent.com",
        "claude.ai", "api.anthropic.com",
        "*.openrouter.ai", "api.individual.githubcopilot.com",
        "*.deepseek.com", "kimi.com",
        "api.groq.com",
        "graph.meta.ai", "meta.ai",
        "gemini.google.com",
        "substrate.office.com", "substrate.svc.cloud.microsoft",
        "*.slack.com", "files.slack.com",
        "teams.microsoft.com", "teams.cloud.microsoft"
    ];
    for (var i = 0; i < quilrHosts.length; i++) {
        if (shExpMatch(host, quilrHosts[i])) {
            return "PROXY 127.0.0.1:<PORT>; DIRECT";
        }
    }

    // 3. Default: hand off to your upstream SWG
    return "PROXY swg.us.example.com:80; DIRECT";
}

SSL-bypass list (on your SWG)

Add these to the SWG’s Do Not Decrypt / SSL-bypass list:

• quilr-extensions.quilr.ai
• discover.quilrai.dev
• All monitored AI & collaboration hosts (the quilrHosts list above)

Validate the merged PAC (e.g. with Node.js) to confirm monitored hosts hit the local Quilr listener, internal hosts stay DIRECT, and other traffic still reaches your upstream proxy.

%ProgramFiles%\QuilrAI\

5 · Certificate trust chain

The agent’s leaf certificate chains to a Quilr root + intermediate that must land in the system trust store before the agent service starts. Each deployment method covers CA deployment as its first part — see Steps 3 and 5.

6 · Establish a pilot group

Create a small validation group (suggested naming Quilr-Pilot, e.g. WIN-Quilr-Pilot / MAC-Quilr-Pilot) and prove the full flow there before promoting to production assignment.