> ## Documentation Index
> Fetch the complete documentation index at: https://quintsecurity.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Edge Architecture

> Everything that runs on the user's machine — proxy, extensions, daemon, and how they share a unified session model

# Edge Architecture

Quint's "edge" is the software running on the machine where an AI agent executes — a developer's laptop, a CI runner, a server. Five components work together:

| Component                                         | Role                                                         | Language |
| ------------------------------------------------- | ------------------------------------------------------------ | -------- |
| [Forward Proxy](/edge/forward-proxy)              | HTTP CONNECT + MITM TLS for explicit opt-in                  | Go       |
| [Network Extension (NE)](/edge/network-extension) | macOS transparent interception, zero-config                  | Swift    |
| [Endpoint Security (ES)](/edge/endpoint-security) | Kernel-level ground truth (procs + files)                    | Swift    |
| [Edge Daemon](/edge/daemon)                       | Unifies proxy + ES into one session model, forwards to cloud | Go       |
| `QuintAgent.app`                                  | Container app, holds NE/ES system extensions                 | Swift    |

## How traffic reaches the daemon

```mermaid theme={null}
flowchart LR
    AGENT["AI Agent"] -->|"HTTPS_PROXY"| FP["Forward Proxy<br/>(port 9090)"]
    AGENT -->|"transparent"| NE["NE Extension"]
    NE -->|"unix socket :9091"| RELAY["Daemon Relay"]
    FP --> MITM["serveMITMImpl<br/>(shared pipeline)"]
    RELAY --> MITM

    ES["ES Extension"] -->|"/var/lib/quint/es-events.sock"| DAEMON["Daemon"]
    MITM --> DAEMON

    DAEMON --> UT["unisession.Tracker<br/>(single source of truth)"]

    style MITM fill:#1a1a2e,stroke:#FF3C22,stroke-width:2px
    style UT fill:#1a1a2e,stroke:#58a6ff,stroke-width:2px
```

Two interception paths, one MITM pipeline. Any flow captured via `HTTP_PROXY` or the NE extension ends up in the same `serveMITMImpl` function — so request parsing, tool-call extraction, audit stamping, and session attribution are identical regardless of how the bytes arrived.

The ES extension runs in parallel and feeds process/file events directly to the daemon over a separate socket. The daemon merges both streams into `unisession.Tracker`, keyed by root PID, to produce one session per AI agent invocation.

## What stays on the machine

| Stays local                                | Goes to cloud                       |
| ------------------------------------------ | ----------------------------------- |
| Source code content                        | Structured action metadata          |
| Credentials, API keys, secrets             | Agent identity + platform           |
| Full LLM conversation bodies               | Session lifecycle events            |
| Tool input arguments (raw)                 | Tool name + capability + risk score |
| CA private key + Ed25519 audit signing key | Timestamps + session IDs            |

The [edge daemon](/edge/daemon) enforces this split. Raw bodies persist to the local signed audit log (`quint.db`) for forensic replay. Only normalized events flow to `api.quintai.dev`.

## Where to read next

* **Understanding the interception paths:** [Forward Proxy](/edge/forward-proxy) then [Network Extension](/edge/network-extension)
* **Understanding audit + sessions:** [Edge Daemon](/edge/daemon) → `Audit Log & Session Attribution` section
* **Installing on a new machine:** [Operations → Installation](/operations/installation)
* **When things break:** [Operations → Troubleshooting](/operations/troubleshooting)