Reference

What the agent does on the endpoint

What runs, what it talks to, and how often — so you can get the agent through a client's change control and egress filtering without guessing.

Outbound allowlist

The agent makes outbound HTTPS connections to exactly two hosts. It never accepts an inbound connection, so no firewall rule is needed in that direction.

Required outbound destinations
HostPortPurpose
api.snitchos.comTCP 443Enrollment, activity and screenshot upload, configuration
cdn.snitchos.comTCP 443Update manifest and signed installer downloads

Both are plain HTTPS, so an inspecting proxy works provided it does not strip the certificate chain the agent uses to verify updates. If the client blocks by category rather than host, allow both by name — the IPs are not stable.

Blocking api.snitchos.com does not make the agent fail quietly — the device stops reporting and shows as offline on the tenant overview.

What runs

  • SnitchOSAgent — a Windows service running as LocalSystem. Visible in Task Manager and in services.msc; a local administrator can stop or uninstall it.
  • A per-session helper — the service cannot see a user's desktop from session 0, so it launches one helper process inside each interactive session. That is what captures screenshots and window activity.

How often it samples

Default sampling intervals
Activity samplingEvery 10 seconds
ScreenshotsEvery 60 seconds when enabled; visually-identical frames are discarded rather than uploaded
UploadBatched every 60 seconds

Events are buffered locally when the network is unavailable and sent when it returns, so a laptop offline for a meeting does not lose its day.

What it does not send

Input is counted, never captured — keystroke, mouse-click and mouse-distance totals only. Browser URLs are reduced to scheme, host and path; query strings and fragments are stripped before anything leaves the machine, because they routinely carry SSO tokens. See data handling for the full boundary.

Verify the binary before you deploy

The installer and service are code-signed. Confirm the publisher yourself rather than taking our word for it — the expected subject is CN=Shield Management Inc. The command and expected output are on the security page.

Uninstall

Removal is deliberately possible for a local administrator, because MSPs need it for support. The uninstall and repair commands live in deploying with your RMM so there is one copy to keep correct.

Resource footprint and per-device storage growth are not published yet — we would rather omit them than publish an estimate you size a client's storage against. Ask on a ticket if you need figures for a specific fleet.