Takumi Agent or the registry setup?
The English user guide is currently in beta preview. Most of the documents have been automatically translated from the Japanese version. Should you find any inaccuracies, please reach out to Flatt Security.
There are two ways to use Takumi Guard. The registry setup (see Quickstart and Admin Deployment) configures each package manager to use the Guard registry, for example through .npmrc. Takumi Agent needs no per-tool configuration because it captures the traffic itself. Both apply the same Takumi Guard verdicts. They differ in what they cover, who can switch protection off, and what they cost you day to day.
| Registry setup | Takumi Agent | |
|---|---|---|
| Runs on | macOS, Linux, Windows, CI | Apple silicon Macs, macOS 13 or later |
| Setup | A config file or variable per package manager | One installer and a few macOS approvals. Needs an administrator |
| How it gets switched off | Editing a config file, setting a variable, or passing --registry | Only by changing System Settings or uninstalling, and the console shows it |
| Tools covered | The package managers you configured | Every tool on the Mac that talks to a supported registry |
| Installs inside containers | Go to the public registry unless the container is configured | Blocked until the container trusts the device certificate |
| Certificates | None | Every runtime must trust a device certificate. Common tools on the Mac are set up automatically |
| Publishing, login and account operations | Go to the registry with your own token | Go to the registry with your own token. Guard only decides installs |
| Private packages on public registries | Installed by routing the scope, index or source directly to the registry with your own token, bypassing Guard (npm, PyPI, RubyGems, Go, Composer) | Not available. Guard uses your organization's token. Takumi Agent captures only the supported registry hostnames, so a tool pointed at any other host (a private registry, GitHub Packages, Artifactory, a scope pointed at a private registry) goes direct with your own credentials and is never blocked |
| If Guard cannot be reached | Installs fail. You can point the tool back at the public registry | Installs fail, and there is no way around it on the Mac |
| Visibility | Installation logs | Installation logs, plus each device's protection state in the console |
AI coding agents
AI coding agents install a lot of packages: in new projects, with tools nobody configured, inside new containers and shells. With the registry setup, every one of those tools has to point at Guard. One unconfigured tool or a stray --registry flag is enough to send downloads to the public registry, and nothing tells you it happened. With Takumi Agent there is nothing to keep configured. Every download from a supported registry goes through Takumi Guard, and a download that can't be checked fails loudly instead of going through unchecked.
This covers the supported public registries under all the hostnames they serve, plus the mirrors listed under What is covered. A tool pointed at any other host (another mirror, a private registry, a proxy outside the Mac) never talks to those registries, so Takumi Agent doesn't see it. Restricting those hosts is a job for your network's egress policy.
The cost is the device certificate. Tools that don't use the macOS keychain have to be told to trust it, and every container or VM has its own trust store. Takumi Agent configures the common tools on the Mac for you. Containers need a one-time setup per developer, and a few tools need their own setting. Developing with Takumi Agent covers each case.
Our recommendation
Use Takumi Agent on developer Macs, especially where AI coding agents run commands. Keep the registry setup for CI, Linux and Windows machines, cloud development environments, AI agents that run somewhere other than the Mac, and anywhere Takumi Agent can't be installed. The two work together: a package manager already pointed at the Guard registry keeps working unchanged on a Mac with Takumi Agent.