The desktop agent · version 0.3.1
Put it on the desk. The day writes itself down.
The WorkMonitor agent records time, activity and application use on Windows, macOS and Linux, then sends it to one ledger a manager can read. It sets up in under a minute without an administrator, and it never hides that it is running.
- Setup time
- Under a minute
- Admin rights
- Not needed
- Keystroke content
- Never captured
- Version
- 0.3.1
- File
- .msix · Intel · 72 MB
- Publisher
- Digital Socket, LLC
- SHA-256
Windows 10 version 2004 or later, or Windows 11. 64-bit.
Released 10 September 2026.
Every build
One release. Every desk in the building.
All three systems ship from the same release, so no two machines in your company end up on versions that disagree. Every row below names the exact file you get, its size, who signed it, and the checksum to hold it against.
| System | File | Size | Signed by | Checksum |
|---|---|---|---|---|
| Linuxx64 | .appimage | 35 MB | Signing pending | 83156d83f13d… |
| macOSuniversal | .dmg | 4.4 MB | Signing pending | 72b27a56a0c3… |
| Windowsx64 | .msix | 72 MB | Digital Socket, LLC | f26ef8f7a5bd… |
| Windowsx64 | .zip | 73 MB | Digital Socket, LLC | 1f3c3be72234… |
Do not take our word for it
Check the signature before you run it.
You are about to install software that watches a computer. That is exactly the category where being asked to trust the vendor should not be enough. Every command below ships with the operating system — nothing to install, nothing to take on faith.
Windows
Get-AuthenticodeSignature .\WorkMonitorAgent.msix |
Format-List Status, SignerCertificateA Valid status, signed by Digital Socket, LLC.
macOS
codesign --verify --deep --strict \
--verbose=2 /Applications/WorkMonitor.appPrints “satisfies its Designated Requirement” for a build that has not been altered.
Any platform
shasum -a 256 WorkMonitorAgent.dmg
certutil -hashfile WorkMonitorAgent.msix SHA256Compare with the checksum beside the download. If they differ, do not run the file.
The Windows package chains to the Microsoft Identity Verification Root Certificate Authority 2020 and carries a trusted timestamp, so its signature keeps verifying long after the certificate that made it expires. The checksum works everywhere, on every build, and needs no certificate at all — it is the check nobody can take away from you.
On the machine
What it does once it is running.
Time, without a timer
It reads idle time from the operating system and classifies each stretch as work, a meeting, a break or idle. Nobody has to remember to start anything, so nobody forgets.
The application in front
The foreground app and window title, sampled every few seconds. That is what turns a working day into a readable account of where it actually went.
Screenshots, only if you enable them
Off unless your organisation turns them on, and refused by the server when policy says no. The cadence is randomised, so the timing cannot be learned and worked around.
Counts, never content
Keystrokes and clicks are counted and mouse travel measured. The hook increments a number without reading the key, so what was typed is never available to send.
A dropped connection is not a gap
Samples buffer to disk and replay oldest-first when the network returns. The server removes duplicates on arrival, so an outage costs no hours.
It says that it is there
A permanent tray indicator reads "You are monitored by workmonitor.ai". No plan, setting or deployment flag removes it, on any of the three systems.
For a team
Installing it across a company.
One person is a download. A whole company is a deployment, and the two need different things.
Talk to us about a rollout- 01
Push it silently with your MDM
The Windows package is a signed MSIX, which Intune and any MDM that handles line-of-business apps deploy without a prompt. Because the certificate is publicly trusted, you do not have to push a certificate to your machines first.
- 02
Or let people set it up themselves
The agent needs no administrator rights. Send the link, and the person signs in with their own WorkMonitor account — the machine enrols itself, with no token to copy and paste.
- 03
Decide what it captures, centrally
Screenshots, blur mode and the private-app deny list are organisation settings, not client ones. The agent asks the server what it may do, and the server refuses anything outside that.
The rest of the estate
Work that never touches the desktop.
Plenty of a working day happens in a browser tab. The extension records that side of it and reports to the same ledger as the agent, on the same release.
- Download
Chrome
.zip · 358 KB · 6ceddc7209f1…
- Download
Edge
.zip · 358 KB · 6ceddc7209f1…
- Download
Firefox
.zip · 358 KB · 6186d7321288…
Open your browser’s extensions page, switch on developer mode and load the unpacked folder — or push it to the whole company by policy, which is how most IT teams deploy an extension in any case.
On a phonePlanned
A mobile app for deskless teams is planned. It will land here the day it ships, with the same publisher and checksum printed beside it as everything else on this page.
Before you ask
The questions people actually ask.
- Do employees know it is running?
- Yes, permanently. The agent puts an indicator in the system tray reading "You are monitored by workmonitor.ai", and no setting, plan or deployment flag removes it. Closing the window hides the window, not the indicator.
- Does it record what people type?
- No. It counts keystrokes and clicks and measures mouse travel, and that is all that crosses the wire. The keyboard hook increments a counter without reading the key code, so there is no code path that could retain what was typed.
- Why does Windows still warn me about an app you have signed?
- That is SmartScreen reputation, which is separate from the signature. The certificate proves who published the file; SmartScreen tracks how often Microsoft has seen it before. A new build starts with no history, and the prompt fades as more people install it. Choose More info, then Run anyway.
- What does it need to run?
- Windows 10 version 2004 or later, or Windows 11, on 64-bit hardware. macOS 13 Ventura or later, on Apple silicon or Intel. On Linux, a 64-bit desktop session with FUSE, under X11 or Wayland.
- What happens when the machine goes offline?
- Activity samples queue on disk and replay oldest-first when the connection returns, and the server removes duplicates as they arrive. A network drop costs you nothing. Screenshots are not queued.
- Can someone uninstall it?
- On their own machine, yes — it installs per user and needs no administrator rights, which is the trade for installing without one. On managed hardware, make it a required app in your MDM so removing it reinstates it.