Techcatalyst Guard CLI

Techcatalyst Guard CLI is the npm-distributed workstation client for enterprise AI security deployments.

It enrolls a workstation into the Techcatalyst Guard control plane, validates local readiness, applies local sensitive-data controls, guards macOS clipboard workflows, and sends privacy-preserving telemetry to the Admin UI.

Install

npm install -g techcatalyst-guard-cli

Verify the installed CLI:

tcg-guard --version
tcg-guard --help

Requirements:

• Node.js 18 or newer
• Linux or macOS
• macOS for clipboard masking commands that use pbpaste and pbcopy

Quick Start

Run a local-only readiness check:

tcg-guard doctor --no-sync

Enroll the workstation and validate control-plane connectivity:

tcg-guard doctor --register \
  --server <control-plane-url> \
  --organization <organization-id>

Run the guided pilot flow:

tcg-guard pilot \
  --server <control-plane-url> \
  --organization <organization-id>

If your environment requires an enrollment token:

TCG_AGENT_ENROLLMENT_TOKEN="<token>" \
tcg-guard doctor --register \
  --server <control-plane-url> \
  --organization <organization-id>

After enrollment, the workstation appears in the Techcatalyst Guard Admin UI. Security findings, masking events, heartbeats, and detector metrics are synchronized without sending raw secrets or full raw AI input payloads.

What It Does

| Capability | Command | Notes | | --- | --- | --- | | Workstation enrollment | tcg-guard register | Creates/reuses local workstation identity. | | Health and readiness checks | tcg-guard doctor | Checks Node.js, local state, server health, registration, policy fetch, heartbeat, event queue, and clipboard helpers. | | Guided pilot validation | tcg-guard pilot | Runs readiness checks, then emits redacted security and masking events. | | AI input risk checks | tcg-guard scan-prompt | Detects English and Russian instruction override, system context extraction, secret exfiltration, and bypass attempts. | | Local sensitive-data masking | tcg-guard mask | Masks secrets, private keys, AWS-style keys, emails, Russian phone/passport/SNILS/person-name patterns. | | Clipboard protection on macOS | tcg-guard mask-clipboard, tcg-guard watch-clipboard | Replaces detected secrets/PII in the clipboard before paste. | | Offline event retry | tcg-guard flush | Replays locally queued redacted events after connectivity is restored. | | Local status | tcg-guard status | Shows the current state file and known workstation identity. |

Common Workflows

Check AI input before sending it to an AI tool:

tcg-guard scan-prompt --text "<ai-input-text>"

Mask sensitive data from stdin:

printf '[email protected] password=secret' | tcg-guard mask --stdin

Clean the macOS clipboard before paste:

tcg-guard mask-clipboard

Run resident clipboard protection while working:

tcg-guard watch-clipboard \
  --server <control-plane-url> \
  --organization <organization-id>

When a server is configured, watch-clipboard also sends periodic heartbeats so the workstation remains visible as online in the Admin UI.

Configuration

Every option can be supplied by CLI flag or environment variable.

| Setting | Flag | Environment | | --- | --- | --- | | Control-plane URL | --server | TCG_SERVER_URL | | Organization ID | --organization | TCG_ORGANIZATION_ID | | Enrollment token | --enrollment-token | TCG_AGENT_ENROLLMENT_TOKEN | | Local state path | --state | TCG_STATE_PATH |

Default local state:

~/.techcatalyst-guard/npm-agent-state.json

Queued events when the control plane is unavailable:

~/.techcatalyst-guard/pending-events.jsonl

Privacy Boundary

The CLI is designed for local-first inspection. It synchronizes event metadata, not raw sensitive payloads.

Synchronized telemetry can include:

• input hashes and byte lengths
• detector IDs and finding categories
• placeholder types and counts
• confidence buckets
• workstation and agent identity
• policy metadata

Synchronized telemetry does not include:

• raw secret values
• private key material
• full raw AI input payloads
• raw clipboard contents

Enterprise Boundary

This npm package is the fast workstation onboarding and LLM workflow protection client for Linux/macOS environments where Node.js is already available.

For OS-level file access mediation, signed native packages, MDM/SCCM rollout, notarized macOS deployment, Windows service deployment, or tender-grade native enforcement claims, use the compiled Techcatalyst Guard workstation agent and the managed enterprise deployment track.

Release Channels

Stable releases are published on latest:

npm install -g techcatalyst-guard-cli@latest

Version-pinned installs are recommended for enterprise rollout scripts:

npm install -g [email protected]

Command Reference

tcg-guard register --server <control-plane-url> --organization <organization-id>
tcg-guard heartbeat
tcg-guard status
tcg-guard doctor --server <control-plane-url> --organization <organization-id>
tcg-guard doctor --no-sync
tcg-guard pilot --server <control-plane-url> --organization <organization-id>
tcg-guard scan-prompt --text "<ai-input-text>"
tcg-guard mask --stdin
tcg-guard mask-clipboard
tcg-guard watch-clipboard
tcg-guard flush

License

Techcatalyst Guard CLI is proprietary commercial software. Use is governed by a written agreement with Pillar Development or an authorized Techcatalyst Guard evaluation, pilot, or enterprise subscription. See LICENSE.

Operational Notes

• The package has no runtime npm dependencies.
• It runs on Node.js 18+.
• Linux and macOS are the supported npm CLI platforms.
• Clipboard commands are macOS-only because they use native pbpaste and pbcopy.
• Failed event delivery is queued locally and can be retried with tcg-guard flush.
• Use tcg-guard doctor --json for machine-readable diagnostics in support scripts.