Arcjet vs dope.security

How do Arcjet and dope.security differ?

dope.security is an on-device secure web gateway (SWG). Its agent for Mac and Windows installs a dope.security root certificate authority (CA), decrypts web traffic on the laptop, and applies URL filtering, cloud application control, and Dopamine DLP, its data loss prevention for prompts and file uploads. Arcjet is an AI agent runtime security platform. Its endpoint agent for macOS and Windows records which signed app on a device reached which AI service, attributes each connection to a person, and blocks the providers you don't approve, without decrypting TLS or installing a root certificate. Arcjet also enforces one policy in the hooks of Claude Code, GitHub Copilot, Cursor, OpenAI Codex, and Muse Code, which decide a coding agent's tool calls before they run.

The key difference is decryption. dope.security reads the content of AI traffic, so it can classify a prompt and keep ChatGPT and Claude on your corporate tenant, and every app it inspects has to trust its certificate or go on a bypass list. Arcjet never reads the content of a connection, so pinned apps and CLI agents keep working, and it can't tell a personal account from a company account or read a prompt typed into a browser tab. Choose dope.security when you want one agent for web filtering, CASB, and prompt-level AI DLP with tenant restriction. Choose Arcjet for developer machines where TLS interception breaks tools, when you need each AI connection tied to a named person without decryption, or when you need policy on what coding agents do.

Arcjet publishes this comparison. Competitor details come from dope.security's public documentation and blog, reviewed on November 3, 2026. Products change, so check the linked sources before you decide.

Arcjet and dope.security at a glance

The following table compares dope.security and Arcjet across 13 areas, from how each one sees traffic to how each one is priced.

What is dope.security?

dope.security sells dope.swg, a secure web gateway that runs as a proxy on each laptop instead of in a vendor data center. dope.security calls the design Fly Direct. Its post on on-device SSL inspection describes dope.endpoint as "a native agent for Mac and Windows that ships through the MDM channel you already use." Traffic goes from the device to its destination without a stop at a cloud proxy.

Two products sit beside the gateway. CASB Neural scans Google and Microsoft 365 drives for sensitive files shared publicly or outside the organization. Dopamine DLP classifies uploads and AI prompts on the device. Its documentation describes LLM-based detection of personally identifiable information (PII), payment card (PCI) data, protected health information (PHI), and intellectual property (IP), with no regular expressions to write. Supported applications include ChatGPT, Claude, Gemini, Microsoft Copilot and Perplexity in the browser, Google Drive, and OneDrive. Block mode needs a Dopamine DLP license; without one, the agent notifies the user and logs the violation.

For shadow AI, the AI Usage view lists the AI applications that endpoints reach, with request counts, users, and data transferred over a rolling seven-day window. Cloud Application Control restricts apps such as Microsoft 365, Google, Slack, ChatGPT, Claude, and GitHub to the accounts you allow. For ChatGPT, you list Enterprise workspace IDs, and the control is limited to ChatGPT Enterprise customers. For Claude, you list organization IDs. dope.security's March 26, 2026 post says the agent injects Anthropic's anthropic-allowed-org-ids header into outbound Claude traffic, so Anthropic refuses sessions from any other organization.

Inspection depends on a root CA. The macOS installer ships dope.security.root.crt, which the page calls "the dope.security Root CA, required for SSL inspection," and the Windows installer ships its own copy. Without MDM, a Mac user approves the certificate, the network extension, and web filtering by hand, so for a fleet dope.security says it highly recommends, and requires, an MDM profile. The profile carries the following five payloads:

• A root certificate payload that makes the operating system trust the on-device inspection.
• A system extension policy for the agent's security.dope.DopeSecurityApp.Redirector and security.dope.DopeSecurityApp.PacketFilter extensions.
• A VPN payload that routes traffic to the on-device proxy.
• A privacy preferences payload that grants the app Full Disk Access (SystemPolicyAllFiles), which dope.security lists for anti-tampering.
• A service management payload for its login and background items.

On Windows, the agent's trusted process list includes a driver at C:\Windows\system32\drivers\DopeRedirector.sys. The documentation covers macOS 14, 15, 26, and 27 and Windows 10 and 11, with deployment guides for Jamf, Kandji, and Intune on Mac and for Intune on Windows. When you turn on endpoint authentication, each user signs in once with a Microsoft 365 or Google account, and web traffic is blocked until they do, except for bypassed destinations. dope.security's shadow AI tools post says unmanaged BYOD and mobile devices need another layer.

The pricing page lists four plans and no prices. The SWG plan has a free trial that starts with a Microsoft 365 or Google sign-in and needs no payment method. The DLP and CASB upgrades go through a demo, and the full SSE+ plan goes through sales with volume pricing.

What is Arcjet?

Arcjet is an AI agent runtime security platform. It finds the AI services and agents that people in your organization use, enforces policy on the actions those agents take, and keeps a record of each decision.

On employee devices, the Arcjet endpoint agent for macOS and Windows records each connection to an AI service, identifies the signed app that made it, and attributes it to the person behind the local account at that moment. On macOS, it's a Network Extension content filter with a root launchd service that owns reporting and credentials, and a menu bar app that reads status over XPC. Closing the app or logging out doesn't stop managed reporting. On Windows, it's a service that runs as LocalSystem from boot. The service reads the destination server name from the TLS ClientHello through Windows' built-in Packet Monitor API, and correlates kernel network and process events from Event Tracing for Windows (ETW) to identify the process and the user. There's no kernel driver. A tray app runs unelevated, only reads from the service, and can't stop collection. When the owner of a connection is ambiguous, the agent reports it as unknown instead of guessing.

Neither version decrypts TLS, installs a root certificate, or reads prompts. You deploy the agent through your MDM, including Jamf, and devices enroll with short-lived tokens or device credentials. An administrator maps each local account to a person: an Arcjet team member, an existing person, or a Jamf user.

In the Arcjet Console, Discovery leads from people to their devices to their AI usage, and a Providers view shows which people, devices, and apps reach each service. Counts are connections, not prompts or tokens. Detection rules ship as a reviewed manifest that updates without a new agent release. Endpoint provider policies set Allow or Block for each provider on a group of devices. The agent blocks the connection on the device, and each decision appears in Arcjet Activity with the person, device, app, and provider.

For coding agents, Arcjet enforces one policy through the hooks that Claude Code, GitHub Copilot, Cursor, OpenAI Codex, and Muse Code already fire. You install the hooks through managed settings, MDM, or an organization lock. A hook decides each tool call before it runs, and also a prompt or a model switch on the agents that fire those hooks. Starter policies include MCP allowlists, egress allowlists, model allowlists, credential access, and sensitive information, and evaluation runs at the edge. The Claude Compliance API and OpenTelemetry add observe-only records of agent sessions. For custom agents, the JavaScript, TypeScript, Python, and Go SDKs provide guard() and protect().

For endpoint agent pricing and availability, book a demo. The platform plans on Arcjet's pricing page are Individual at $25 per month, Startup at $299 per month, and custom Enterprise pricing.

Key differences between Arcjet and dope.security

Arcjet and dope.security both put an agent on the laptop, and both can block an AI service there. They differ on whether that agent decrypts traffic, and most of the differences in the following sections follow from that choice.

Decryption on the device compared with connection metadata

dope.security terminates TLS on the laptop. The operating system trusts the dope.security root CA, so the agent can open a request to chatgpt.com, classify the prompt inside it, and add a header before the request leaves the device. Prompt DLP and tenant restriction both come from that one capability, and neither needs a round trip through a cloud proxy.

Arcjet's agent works with what a connection shows without decryption: the server name, the process that opened the connection, that process's code signature, and the local account. That's enough to record that the Claude desktop app on a named person's MacBook reached claude.ai at 2:02 PM, and to refuse the connection if Anthropic is blocked for that device group. It isn't enough to say what the person typed, or which Claude account they used.

Pinned apps, developer tools, and bypass lists

An app that pins certificates, or carries its own trust store, rejects a certificate issued by the dope.security root. dope.security documents how it handles this. Its SSL errors view reports each app and URL that fails inspection on a device, and an administrator can bypass that app or domain for all policies from the same view. The default bypass list already skips the npm registry (*.npmjs.org), PyPI (*.pypi.org and *.pythonhosted.org), Docker Desktop, and kubectl, among many others. dope.security's post on AI coding assistants states the trade-off: a bypass keeps destination-level visibility but loses content inspection for that app.

The AI apps need their own steps. The ChatGPT desktop app for macOS pins its certificates and shows an error until you deploy an MDM profile for com.openai.chat that adds the dope.security root CA's hash to com.openai.pinned_cert_hash_list. For Claude, the SSL certificate workaround sets NODE_EXTRA_CA_CERTS and SSL_CERT_FILE to the dope.security root certificate. On macOS, the page notes that a variable set in ~/.zshrc reaches only processes launched from a shell, so a fleet rollout needs a system-level profile or login script and a restart. On November 3, 2026, the same page listed a known issue: DLP detection didn't trigger for the affected application's integrations even after the certificate was trusted.

Arcjet skips this work because it intercepts nothing. git, npm, pip, Docker, the ChatGPT and Claude desktop apps, and claude in a terminal keep their own trust stores and connect as they would without the agent. The cost is content: every app looks to Arcjet the way a bypassed app looks to dope.security, as a destination with no payload. Arcjet adds the signed app and the person to that destination, and can block it. For more information about how pinning affects inspection products, see certificate pinning and inspection bypass lists.

Personal ChatGPT and Claude accounts

dope.security can keep ChatGPT and Claude on your tenant, and Arcjet's endpoint agent can't. Personal and enterprise accounts use the same domains, such as chatgpt.com and claude.ai, so neither a hostname nor an app identity separates them. The vendors read a tenant identifier on the request instead, and only a gateway that decrypts the traffic can set it.

Check the plan requirements on both sides. dope.security documents its Claude control for Team and Enterprise plans, while Anthropic's tenant restrictions article lists Enterprise plans and Console organizations. Anthropic's restriction also covers API key and OAuth token authentication, so it can apply to a CLI agent, but only to traffic that the gateway decrypts. dope.security's tenant documentation names the Claude web and desktop apps, and doesn't mention Claude Code.

With Arcjet, you apply the vendor controls through whatever can set them: a TLS-inspecting gateway for the Claude and ChatGPT headers, local requirements for Codex sign-in, and MDM for Cursor's AllowedTeamId. The guide to blocking personal AI accounts on work laptops covers each control. Arcjet then shows which person and app reached each provider, and its hooks govern the approved sessions.

Prompt and upload inspection

Dopamine DLP reads the text of a prompt and the content of an uploaded file, then monitors or blocks. For browser and desktop AI use, that's the main reason to choose dope.security. Arcjet's endpoint agent reads no prompts. If a person pastes a customer list into ChatGPT in Chrome, Arcjet records that Chrome on their device reached chatgpt.com, and nothing about the paste.

For coding agents, coverage is narrower on the dope.security side. Its September 23, 2026 post on coding assistants says Dopamine DLP doesn't cover prompts sent from Cursor, Copilot, or CLI agents. Its DLP documentation lists Claude's CLI, VS Code, and Cursor integrations, behind the certificate workaround and its known issue. Arcjet reaches coding-agent prompts from inside the agent. In Claude Code, Cursor, Codex, and Muse Code, a prompt hook passes the prompt to the Arcjet policy before the agent sends it, so a sensitive-information policy can refuse it without decryption.

Policy on coding-agent actions

A web gateway sees requests, and many coding-agent actions never make one. When Claude Code reads ~/.aws/credentials, runs a destructive shell command, or starts a local MCP server over stdio, nothing crosses the network for a gateway to inspect. When an agent does make a request, the request doesn't say which tool call produced it. dope.security's documentation doesn't describe policy on coding-agent tool calls.

Arcjet's hooks decide each tool call before it runs, with the tool name, command, paths, MCP server, and destination as inputs. A starter policy can refuse an MCP server outside your allowlist, a model outside your allowlist, a read of a credential file, or a request to a host you haven't approved. Arcjet records each decision with the session, so you can see what the agent tried and which rule refused it. For more information about what each source of evidence proves on a developer laptop, see shadow AI coding agents.

Identity and attribution

dope.security identifies users by sign-in. With endpoint authentication on, each user signs in with Microsoft 365 or Google, multi-factor authentication applies if you require it, and the agent applies that user's group policy. Imported users and groups drive custom policies and the Shadow IT view.

Arcjet attributes each connection to the local account that opened it, then to the person an administrator mapped that account to. A person with a laptop and a desktop rolls up to one record. An account on a shared lab Mac, a system account, or an account nobody has mapped appears as Unknown user, instead of being credited to whoever owns the device.

Where dope.security goes further

dope.security does several jobs that Arcjet doesn't attempt. Beyond the prompt DLP and tenant restriction covered earlier, it filters the whole web with URL categories, anti-malware, and block pages. CASB Neural scans Google Drive and Microsoft 365 for sensitive files shared publicly and can make them private. Its SSL error reporting turns pinning breakage into a bypass an administrator can apply from the console. If you want one agent to replace a cloud SWG and add AI DLP, dope.security covers more of that job.

Arcjet's own limits belong in the same comparison. A model that runs locally with no network traffic makes no connection for the agent to see. Devices without the agent are out of scope, which includes personal phones, and dope.security draws the same line for BYOD. A connection from an AI app isn't proof of an AI request, because it can be an update check.

When to choose dope.security

Choose dope.security when you want an on-device web gateway that also inspects AI prompts and uploads. dope.security fits when any of the following apply:

• You want one agent to replace a cloud SWG and add CASB and AI data loss prevention.
• You need prompt and upload inspection for ChatGPT, Claude, Gemini, and other AI apps in browsers and desktop apps.
• You need ChatGPT Enterprise or Claude tenant restriction applied on the device, whether or not it's on the corporate network.
• Most of your devices belong to people who work in browsers and office apps, where a root CA and a bypass list are routine.
• You want to try the gateway free before you talk to sales.

When to choose Arcjet

Choose Arcjet when you need to see and control AI use on developer machines without decrypting traffic, and to govern what coding agents do. Arcjet fits when any of the following apply:

• Your engineers run Claude Code, Codex, package managers, and pinned desktop apps, and TLS interception breaks them or grows a bypass list.
• You need each AI connection tied to a named person, device, and signed app, without a root certificate on the device.
• You want to block AI providers for a group of devices and see each blocked attempt with the person and app.
• You want policy on what coding agents do, such as tool calls, MCP servers, models, credential reads, and destinations, decided before the action runs.
• Some devices can't run a TLS-inspecting agent for privacy or legal reasons.
• You also build custom agents and want the same policies in your code through the Arcjet SDKs.

Can you use dope.security and Arcjet together?

Yes. The two products answer different questions, and a company can run both. dope.security can be the inspecting gateway that sets the Claude and ChatGPT tenant controls and runs prompt DLP in browsers. Arcjet can attribute AI connections to people, including traffic on dope.security's bypass list, and enforce policy in coding-agent hooks, which a gateway doesn't see.

Both agents install network extensions on macOS, so pilot them together on a few devices before a fleet rollout. Confirm that Arcjet still reports the app and server name for traffic that dope.security proxies, and that a block from either product stops the connection. Some companies split the fleet instead, with dope.security on business devices and Arcjet on engineering devices where TLS interception breaks tools.

What are the alternatives to dope.security?

Alternatives to dope.security fall into three groups: cloud security service edge (SSE) products that decrypt traffic in a data center, browser extensions that read prompts after the browser decrypts them, and endpoint agents that don't decrypt. The following products are common alternatives:

• Arcjet attributes AI connections to people and blocks providers on macOS and Windows without decryption, and enforces policy in coding-agent hooks.
• Zscaler offers generative AI security with prompt visibility and DLP from its cloud. Its guide to SSL inspection in developer environments has you add its certificate to git, npm, pip, and Java.
• Netskope separates corporate from public instances of ChatGPT and Gemini with app instance awareness.
• Harmonic Security's browser extension identifies the account and plan behind each AI session and can warn, ask for a justification, redirect, or block, without a root certificate.
• Prompt Security, part of SentinelOne, governs employee AI use and data leakage. For more information, see Arcjet vs Prompt Security.

For the wider category, including Microsoft, Jamf, Nudge Security, and Cyberhaven, see shadow AI detection tools.