# Takumi Agent for Endpoint {#takumi-agent}

**Takumi Agent for Endpoint** protects your organization's Macs with Takumi Guard. It works through **Takumi Agent**, an endpoint agent installed on each Mac. The agent enrolls each Mac in your Shisho Cloud organization, reports the device's protection state to the console, and updates itself. Its first capability is [Takumi Guard](/docs/t/guard/index.md): the agent captures traffic to the supported public package registries at the network layer and sends it through Takumi Guard, whichever tool sent it and however that tool is configured.

:::info Paid Feature
Takumi Agent for Endpoint requires an active Takumi subscription with the Guard protection feature enabled. See [Pricing & Billing](/docs/t/endpoint/billing/index.md) for details.
:::

## What the agent does {#what-it-does}

Besides running Takumi Guard, the agent handles the device itself:

- **[Enrollment](/docs/t/endpoint/quickstart.md#enroll-key)**: an enrollment key registers the Mac as a device in your organization.
- **[State reporting](/docs/t/endpoint/features/states.md)**: the Mac reports whether it is protected, shown in the menu bar and in the console.
- **[Updates](/docs/t/endpoint/features/managing-devices.md#updates)**: new releases install in the background on every device.
- **[Diagnostics](/docs/t/endpoint/features/managing-devices.md#diagnostics)**: the user can copy diagnostics or send them to your organization for an administrator to read in the console.
- **[Tamper evidence](/docs/t/endpoint/features/managing-devices.md#tamper)**: when the device's own health reporting is interfered with, the evidence stays until an administrator acknowledges it.

## What is covered {#coverage}

Takumi Agent covers all five Guard ecosystems by capturing their public registries:

| Ecosystem                | Registries                                                                               |
| ------------------------ | ---------------------------------------------------------------------------------------- |
| **npm** (incl. Yarn)     | `registry.npmjs.org`, `registry.npmjs.com`, `registry.yarnpkg.com`                       |
| **PyPI**                 | `pypi.org`, `files.pythonhosted.org`                                                     |
| **RubyGems**             | `rubygems.org`, `index.rubygems.org`                                                     |
| **Go modules**           | `proxy.golang.org`                                                                       |
| **Packagist (Composer)** | `repo.packagist.org`, `packagist.org`, and the `packagist.jp` and `packagist.kr` mirrors |

Connections to other hosts pass through untouched: private registries and other mirrors, Git and tarball URLs, and Go modules fetched straight from version control (`GOPROXY=direct`, `GOPRIVATE`).

Takumi Agent inspects only connections to the supported registries. Every other connection passes through and is never decrypted. Blocklists and policy stay in Takumi Guard, so the Mac makes no security decisions of its own. [How Takumi Agent works](/docs/t/endpoint/architecture/how-it-works.md) explains the design.