Executive Technical Overview
AI coding assistants and agents run inside the trust boundary of the developer workstation, with the same filesystem, shell, and clipboard access as the developer — which makes them a data-exfiltration surface that network-perimeter and cloud-relay DLP cannot reach. See Threat Model & Problem Statement for the risk classes this addresses.
What Techcatalyst Guard is
Techcatalyst Guard is a workstation-resident AI data-loss-prevention (AI-DLP) system. It detects, masks, and blocks sensitive data — credentials, private keys, tokens, and personal data — before that data reaches an AI coding tool, an AI agent, an MCP server, or the system clipboard. Detection and enforcement execute on the workstation, in a compiled binary, with no dependency on cooperation from the AI tool vendor. The product does not proxy or terminate TLS, does not require the AI vendor to implement a webhook or API, and does not depend on the AI tool being "well-behaved" — it mediates the interception points that exist regardless of which AI tool a developer is using: the shell, the clipboard, the local filesystem, and the local MCP transport.
A companion on-premise control plane distributes signed policy to the fleet and receives an audited, deliberately impoverished telemetry stream — hashes, counts, and classifications. See Zero-Knowledge Telemetry & Control Plane.
Five non-negotiable design properties
A change proposal that weakens one of these is rejected by default, regardless of the feature it would enable.
| Property | What it means in practice |
|---|---|
| Fail-closed | When policy integrity, a required kernel component, or a signature cannot be established, the system denies. A timeout, a missing file, a degraded health check, or an unresolvable process always resolves to deny. |
| Zero-knowledge telemetry | Outbound events carry hashes, lengths, and classifications. See Zero-Knowledge Telemetry. |
| Compiled enforcement core | Every decision that masks or blocks data executes inside a compiled binary (Go, machine code); no interpreted runtime sits in the decision path. See Kernel-Level Enforcement. |
| Local decisioning | The agent evaluates a locally cached, signed policy snapshot; no synchronous round-trip to a server on the enforcement hot path. Air-gapped operation is first-class for the workstation agent. |
| Auditable | Every enforcement decision produces a security event carrying the policy snapshot ID and fingerprint that produced it. |
Component map
%%{init: {"theme": "base", "themeVariables": {"fontFamily": "-apple-system, Segoe UI, Helvetica, Arial, sans-serif", "primaryColor": "#eef2f7", "primaryTextColor": "#0b0b0b", "primaryBorderColor": "#5b6b7c", "lineColor": "#5b6b7c", "secondaryColor": "#eef4ff", "tertiaryColor": "#f4f3f0", "clusterBkg": "#f9f9f7", "clusterBorder": "#c3c2b7", "edgeLabelBackground": "#fcfcfb", "actorBkg": "#eef2f7", "actorBorder": "#5b6b7c", "actorTextColor": "#0b0b0b", "actorLineColor": "#5b6b7c", "signalColor": "#52514e", "signalTextColor": "#0b0b0b", "labelBoxBkgColor": "#eef4ff", "labelBoxBorderColor": "#5b6b7c", "labelTextColor": "#0b0b0b", "loopTextColor": "#0b0b0b", "noteBkgColor": "#fdf3d9", "noteBorderColor": "#c98500", "noteTextColor": "#3d2f00", "activationBorderColor": "#5b6b7c", "activationBkgColor": "#eef4ff", "sequenceNumberColor": "#ffffff"}}}%%
flowchart TB
subgraph WS["Developer Workstation"]
direction TB
SA["station-agent<br/>(compiled Go binary)"]
CLI["enrollment CLI<br/>(orchestration only)"]
CLI -.invokes for enforcement.-> SA
end
subgraph CP["Control Plane (on-prem / air-gapped)"]
direction TB
API["Policy & Event API"]
DB[("PostgreSQL")]
IDP["OIDC / Keycloak-compatible IdP"]
UI["Admin UI (operator console)"]
API --> DB
API --> IDP
UI --> API
end
SA -- "signed policy snapshot\n(pull)" --> API
SA -- "redacted heartbeat + events\n(hashes/counts only)" --> API
SA -- "raw secrets never cross this line" --- CP
style SA fill:#2a78d6,stroke:#184f95,color:#ffffff,stroke-width:2px
The workstation agent operates correctly, indefinitely, with the control plane completely unreachable, using its last-known signed policy. The control plane cannot issue a real-time command that the agent executes synchronously — there is no such channel. See ADR: Local-First Compiled Enforcement Core.
Continue to Threat Model & Problem Statement.