Windows Manual Installation

The FireTail Endpoint Agent is available for Windows as a .msi, which can be distributed to users and installed by following an installation wizard, or deployed at scale using Microsoft Intune.

You will need a FireTail project token to configure the agent.

Download for Windows

The log file for the FireTail Endpoint Agent is located at C:\Windows\Temp\FireTail.

Traffic interception modes

On Windows the FireTail Endpoint Agent can intercept traffic in one of two modes, chosen at install time.

Transparent mode routes all outbound traffic through the agent's virtual adapter, but only connections whose TLS SNI matches a monitored AI provider are decrypted and inspected. All other connections are passed straight through to the network untouched.

Two things to be aware of when running in transparent mode:

• QUIC is blocked. The agent drops outbound UDP on port 443 so that browsers fall back to TCP, where traffic can be inspected. This is expected behaviour and browsers handle it transparently.
• It falls back automatically. If the virtual adapter cannot be created - for example because a VPN client has claimed the default route - the agent logs an error and reverts to proxy mode, so the device is never left unmonitored.

In proxy mode, WSL subnets are explicitly added to the system proxy bypass list, so WSL traffic is not captured at all. If you need to monitor AI usage from WSL, Claude Code, or other command-line tooling, you need transparent mode. See Trusting the FireTail CA in WSL and developer tools for the additional setup those tools require.

Transparent mode is currently beta, and is available on Windows only. The macOS agent runs in proxy mode.

Installation via wizard

The FireTail Endpoint Agent can be installed on Windows using an installation wizard. Click "Next".

Accept the terms in the license agreement and click "Next".

Input the Project Token into the installation wizard. The FireTail platform and region are derived from the token, so there is nothing else you need to select.

You can also customise:

• The port of the FireTail Endpoint Agent's proxy server,
• The port of the FireTail Endpoint Agent's API,
• Whether the installation wizard should install the FireTail Endpoint Agent's root CA certificate,
• Whether the installation wizard should overwrite any existing certificates from previous installations of the FireTail Endpoint Agent, and
• The traffic interception mode - "Proxy" (the default) or "Transparent (beta)".

Once you have inputted your desired configuration, click "Next".

Click "Install" to begin the installation process.

Once the installation process is complete, the following information should appear.

Click "Finish" to close the installation wizard.

Installation via CLI

The FireTail Endpoint Agent can be installed on Windows via CLI. Download the .msi and then use msiexec:

msiexec /i "<downloaded-file>.msi" TOKEN=YOUR_TOKEN PROXY_PORT=8081 API_PORT=8085 /L*v install.log

To install in transparent mode, pass INTERCEPT_MODE=transparent. The property accepts proxy (the default) or transparent:

msiexec /i "<downloaded-file>.msi" TOKEN=YOUR_TOKEN INTERCEPT_MODE=transparent /qn /L*v install.log

Replace <downloaded-file>.msi with the filename you downloaded, including its version. Verify the download against the SHA-256 checksum shown in the Windows release details. Compare the output below with the checksum for the same release:

Get-FileHash "<downloaded-file>.msi" -Algorithm SHA256

For more information about how to customise the installation using msiexec can be found here.

Deploying at scale

To deploy the FireTail Endpoint Agent across a Windows fleet with Microsoft Intune, see the Intune deployment guide.

Trusting the FireTail CA in WSL and developer tools

Transparent mode captures traffic from WSL and command-line tooling, but capturing the traffic is only half the job - the client also has to trust the FireTail Endpoint Agent's root CA, otherwise every HTTPS request fails with a certificate error.

The installer adds the CA to the Windows LocalMachine trust store, which covers browsers and most Windows applications. It does not cover:

• WSL distributions, which have their own Linux trust store.
• Node.js applications, including Claude Code, which ship their own bundled CA list and ignore the operating system trust store entirely.
• Electron applications, including Visual Studio Code, for the same reason.

The CA is written to C:\ProgramData\FireTail\ca-cert.pem in PEM format, ready to be distributed to the tools below. If you need to export it from the Windows trust store instead - for example on a device where the CA was provisioned by MDM - you can do so with PowerShell:

$cert = Get-ChildItem Cert:\LocalMachine\Root | Where-Object { $_.Subject -like "*FireTail*" }
$pem = "-----BEGIN CERTIFICATE-----`n" +
       [Convert]::ToBase64String($cert.RawData, 'InsertLineBreaks') +
       "`n-----END CERTIFICATE-----"
Set-Content -Path C:\ProgramData\FireTail\ca-cert.pem -Value $pem -Encoding ascii

WSL

Copy the CA into the distribution's trust store and rebuild the bundle. Note that update-ca-certificates only picks up files with a .crt extension:

sudo cp /mnt/c/ProgramData/FireTail/ca-cert.pem /usr/local/share/ca-certificates/firetail.crt
sudo update-ca-certificates

Verify it worked:

curl -sS -o /dev/null -w '%{http_code}\n' https://api.anthropic.com/

A 4xx response means TLS negotiated successfully and the certificate was accepted. A curl: (60) SSL certificate problem means the CA is not yet trusted.

Claude Code and other Node.js tools

Node.js does not read the Linux or Windows trust store, so trusting the CA at the OS level is not enough. Point Node at the certificate with NODE_EXTRA_CA_CERTS, which appends it to Node's built-in CA list.

Inside WSL, add it to your shell profile so it applies to every session:

echo 'export NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/firetail.crt' >> ~/.bashrc
source ~/.bashrc

On Windows, set it as a machine-wide environment variable so it applies to Claude Code, npm, and any other Node tooling:

[Environment]::SetEnvironmentVariable(
  'NODE_EXTRA_CA_CERTS',
  'C:\ProgramData\FireTail\ca-cert.pem',
  'Machine'
)

Restart your terminal for the change to take effect, then confirm Claude Code can reach the API:

claude --version && claude -p "hello"

Do not work around certificate errors by setting NODE_TLS_REJECT_UNAUTHORIZED=0. It disables certificate validation for all TLS connections from that process, not just those the agent intercepts.

Visual Studio Code

Visual Studio Code runs on Electron, so its extension host has the same limitation as Node.js - extensions that make their own HTTPS requests will fail certificate validation even though Windows trusts the CA.

• VS Code running on Windows: install the win-ca extension. It reads the Windows root store - including the FireTail CA - and injects those certificates into the VS Code Node runtime, so extensions pick them up with no further configuration.
• VS Code connected to WSL (Remote - WSL): the extension host runs inside the distribution, so win-ca does not apply. Follow the WSL and Node.js steps above instead. Environment variables set in ~/.bashrc are not always inherited by the remote extension host, so it is more reliable to set NODE_EXTRA_CA_CERTS in VS Code's remote.WSL.env setting, or in /etc/environment inside the distribution.

Other command-line tools

Tools with their own CA bundles need to be pointed at the certificate individually. The most common ones:

For a fleet rollout, distribute the CA and these environment variables through your MDM software rather than asking users to configure each device by hand. The Intune deployment guide covers doing this with Microsoft Intune.