Proctored is a single binary for macOS, Windows and Linux that governs AI use for every browser, every desktop AI app, command-line tools and MCP servers, and reports to a console the MSP runs for all its clients. Here is what it does, with the screens that do it.
A catalog of 162 AI apps, embedded AI features and web channels, each Approved, Unapproved, Blocked or Not managed per client: chat, coding, agents, image and voice, meeting recorders, legal and clinical AI, browser AI extensions, enterprise model APIs and local runtimes. Proctored tells Claude from Claude Code and ChatGPT from Codex by client signature, even on shared domains, so each has its own status and its own evidence. Installed desktop apps, running processes and local LLM runtimes are inventoried on every check-in.
The agent learns which account each AI app is signed in to, from the app's own session, and classifies it against the client's work domains. An app set to "Work accounts only" refuses prompts from a personal account and tells the user to switch.
Rules combine detectors, severity, channels and app status with an action: monitor, warn with a business reason, redact in place, or block. The MSP baseline applies to every client; each client adds its own; the strongest action wins.
An employee who hits a block asks for a temporary exception from the block page or the device panel, with a business reason and a duration: an hour, four, a day, a week. The request raises an alert, lands in your PSA like any other, and is decided under Exceptions: approve for the requested time or another, deny with a note, revoke later. The user gets a notification and sends the message again.
Approvals are grants signed for that one device and re-checked by the console on every message sent under them; a claim from another device is refused and raised. Rules nobody should get around, such as secrets and prompt injection, never admit exceptions. Records hold the data types found and the reason, never the content.
Model Context Protocol servers give AI clients their hands: repositories, databases, CRMs, payment systems, the local filesystem. Proctored reads the servers configured in Claude Code, Claude Desktop, Cursor, VS Code and Windsurf from the clients' own files (nothing is executed; secrets are masked on the device), labels them from a catalog with what each can reach, and alerts on first sighting.
Remote servers are approved or blocked per client. Blocked ones are refused at connect time. Approved ones are decrypted and every tool call is checked with the client's rules, so a card number pushed into a CRM by an agent is stopped, with the tool named on the event. Local servers run on the device and are inventoried and flagged.
Allow, read-only or block, with serial-number exceptions. Files copied to USB are inspected and can be stopped; the drive, its serial and the user are on the event.
Monitor, warn, redact in place or clear when sensitive data is copied. The same detectors, the same rules.
Scheduled discovery of user folders for sensitive documents: paths and categories only, never content. Evidence for HIPAA media controls, PCI 9.4 and CMMC MP.L2-3.8.7.
Internal apps published by name through a connector that dials out from the client's network; access by SSO user and group, device posture and agent version; every session logged. No VPN, no inbound ports.
A printable AI Governance Report per client: usage, protection, shadow AI, personal accounts, coverage, policy changes and control evidence mapped to HIPAA, PCI DSS, CMMC, SOC 2, ISO/IEC 42001, NIST AI RMF, GDPR and GLBA. Monthly snapshots are frozen with a SHA-256 digest; the audit log is hash-chained and verifiable in the console; evidence bundles and CSVs go to the client's own auditor; a read-only, cursor-paged API feeds your SIEM.
Coverage is evidence too: every app shows what real devices have seen, and when an app that was inspected starts going by uninspected, which is what a vendor wire-format change looks like, you get a coverage alert before a user reports a bypass. A browser self-test proves the path from every installed browser in one click.
A tray icon shows protection status, the client and the MSP, today's checks and blocks, which AI tools are approved, the data rules that apply, recent activity, exception requests and their status, and a "check before you send" box that tests text on the device without recording it. The help contact is the MSP's own.
When something is blocked, the page says what was found, which approved tools the person can use instead, and how to ask for an exception. No mystery errors.
A real block, a real exception approved, the MCP page, and the report, on a test device with you watching.