Validate the Installation

Confirm two things: the agent installed correctly, and it is actively intercepting traffic. Each platform has five sequential checks — a failed check halts progression until you resolve it.

Console-side validation — the fastest check

If the agent successfully phoned home, the device shows up in the Quilr Console within seconds. Open Settings → Endpoint in your tenant Console and switch to the Deployment Status tab. Type the device’s hostname or the user’s email in the search box.

ls -ld /Applications/QuilrAIProxy.app && \
ls -ld "/Library/Application Support/QuilrAI" && \
defaults read /Applications/QuilrAIProxy.app/Contents/Info.plist CFBundleShortVersionString

sudo tail -n 200 /Library/Application\ Support/Sentinel/logs/sentinel-endpoint.log 2>/dev/null
sudo grep -i 'quilr\|sentinel' /var/log/install.log | tail -n 100

pgrep -lf 'quilrai|quilrai-proxy'
sudo launchctl print system/ai.quilr.sentinel       | grep -E 'state =|last exit'
sudo launchctl print system/ai.quilr.quilrai-proxy  | grep -E 'state =|last exit'

COUNT=$(security find-certificate -a /Library/Keychains/System.keychain | grep -ci quilr)
echo "Quilr certs in System keychain: $COUNT (expect: 2)"

systemextensionsctl list | grep -i quilr

sudo sqlite3 "/Library/Application Support/com.apple.TCC/TCC.db" \
"select client, allowed, auth_reason from access \
where service='kTCCServiceSystemPolicyAllFiles' and client like '%quilr%';"

Get-ChildItem `
  HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*, `
  HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* |
Get-ItemProperty | Where-Object DisplayName -like '*Quilr*' |
Select-Object DisplayName, DisplayVersion, Publisher, InstallDate

Get-Item "$env:ProgramFiles\QuilrAI" | Select-Object FullName, LastWriteTime

foreach ($p in @(
  "$env:TEMP\sentinel-msi-install.log",
  "C:\Windows\Temp\sentinel-msi-install.log",
  "C:\Users\$env:USERNAME\AppData\Local\Temp\sentinel-msi-install.log"
)) {
  if (Test-Path $p) { "==> $p"; Get-Content $p -Tail 200; break }
}

Get-Service | Where-Object { $_.Name -match 'quilrai|quilr' } |
Select-Object Name, Status, StartType

sc query WinDivert

certutil -store Root | Select-String -Pattern 'Quilr' -SimpleMatch
certutil -store CA   | Select-String -Pattern 'Quilr' -SimpleMatch

C:.
│   bootstrap.exe
│   cert.pem
│   dlp_content_extractor.json
│   email-discovery.exe
│   h2_disable_hosts.txt
│   ipc-light-broker.exe
│   key.pem
│   quilrai-diagnostics.exe
│   quilrai-endpoint.exe
│   quilrai-monitor-v2.exe
│   quilrai-proxy.exe
│   quilrai.exe
│   root.pem
│   template-engine.exe
│   templating-engine.exe
│   WinDivert.dll
│   WinDivert.lib
│   WinDivert64.sys
│
├───configs
│       oauth_config.json
│       redirector_config.toml
│
├───hooks
│   │   quilrai-claude-hook-client.exe
│   │   quilrai-codex-hook-client.exe
│   │   quilrai-copilotcli-hook-client.exe
│   │   quilrai-hook-client.exe
│   │
│   └───scripts
│       │   claude_code.lua
│       │   codex.lua
│       │   copilot.lua
│       │   cursor.lua
│       │   kiro.lua
│       │   lmstudio.lua
│       │   manifest.json
│       │   nemoclaw.lua
│       │   ollama.lua
│       │
│       └───lib
│               frontmatter.lua
│               mcp.lua
│               path.lua
│               risk.lua
│
├───icons
│       icon.ico
│       icon.png
│
├───installer
│       brand.json
│       certs-bundle.zip
│       install-launcher.exe
│       quilrai-tray.exe
│       uninstall-launcher.exe
│       update-launcher.exe
│       vc_redist.x64.exe
│
└───templates
    │   alert.html
    │   block.html
    │   index.html
    │   notification.html
    │   prompt.html
    │
    └───app-discovery
            alert.html
            block.html
            notification.html

C:.
│   quilrai-claude-hook-client.exe
│   quilrai-codex-hook-client.exe
│   quilrai-copilotcli-hook-client.exe
│   quilrai-hook-client.exe
│
├───logs
│       monitor.log.2026-06-14
│
├───scripts
│   │   claude_code.lua
│   │   codex.lua
│   │   copilot.lua
│   │   cursor.lua
│   │   kiro.lua
│   │   lmstudio.lua
│   │   manifest.json
│   │   nemoclaw.lua
│   │   ollama.lua
│   │
│   └───lib
│           frontmatter.lua
│           mcp.lua
│           path.lua
│           risk.lua
│
└───v2
        snapshot.json
        tenant-policy.json

Functional test — claude.ai interception

This proves the agent is actively decrypting and matching AI traffic in real time.

sudo log stream --predicate 'subsystem == "ai.quilr.endpoint"' --info \
| grep -iE 'matched|intercepted|claude'

Get-Content "$env:PROGRAMDATA\quilrai\logs\proxy.log.*" -Tail 0 -Wait |
Select-String -Pattern 'matched|claude' -SimpleMatch

Certificate-chain verification

Confirm the TLS issuer is rewritten to Quilr’s CA — the definitive proof of interception.

openssl s_client -connect claude.ai:443 -servername claude.ai </dev/null 2>/dev/null \
| openssl x509 -noout -issuer

$tcp = New-Object Net.Sockets.TcpClient('claude.ai', 443)
$ssl = New-Object Net.Security.SslStream($tcp.GetStream())
$ssl.AuthenticateAsClient('claude.ai')
$ssl.RemoteCertificate.Issuer

Browser padlock check

• Chrome / Edge: padlock → Connection is secure → Certificate is valid → Details
• Safari: padlock → Show Certificate
• Firefox: padlock → arrow → More information → View Certificate

Leaf certificate Issued By = Quilr CA confirms active interception. If it shows Anthropic’s real CA, the agent is not intercepting that browser’s flow.

Desktop-app DLP test — verify the agent intercepts native AI apps

The proxy + WinDivert / Network Extension stack should intercept TLS traffic from both browsers and native desktop AI apps (Claude Desktop, ChatGPT Desktop, Cursor, GitHub Copilot, …). This test confirms the desktop side with a synthetic-PII payload and the Quilr Security Alert popup.

1 — Confirm Guardrails are ON for the target apps

Open Settings → Endpoint → Detection configurations in the Quilr Console. The header should read “X/X active” (all detection configs enabled). For every app row you intend to test, confirm each category (Chat / File Upload / Codex / …) shows the green GUARDRAILS ON pill.

2 — Submit synthetic PII through a native AI app

Pick any app that shows DESKTOP APP MONITORED + GUARDRAILS ON in step 1 (Claude Desktop is the easiest). Launch it on the pilot device, paste the same synthetic-PII block used on the Browser Extension side, and submit:

First and Last Name    SSN            Date of Birth
Robert Aragon          489-36-8350    6/7/1981
Ashley Borden          514-14-8905    7/8/1981
Thomas Conley          690-05-5315    8/9/1981
Susan Davis            421-37-1396    9/10/1981
Christopher Diaz       458-02-6124    1/10/1975
Rick Edwards           612-20-6833    2/11/1975
Victor Faulkner        300-62-3266    3/12/1975
Lisa Garrison          660-03-8360    4/13/1975
Marjorie Green         213-46-8915    5/14/1975
Mark Hall              449-48-3135    6/14/1975
James Heard            559-81-1301    7/16/1975
Albert Iorio           322-84-2281    8/17/1975
Charles Jackson        646-44-9061    9/18/1975
Teresa Kaminski        465-73-5022    10/19/1975
Tim Lowe               044-34-6954    1/20/1991
Monte Mceachern        477-12-8344    2/21/1991

(Same publicly-circulated synthetic-PII test list from BE Step 4 Test 3; do not use real personal data.)

3 — What you should see

4 — Confirm a Finding was generated in the Console

Open Findings, switch to the Endpoint Agent Findings tab, and filter by the test user. A new finding should land within ~2 seconds with: