Skip to main content
AI Watch ships as one signed package per operating system. Deploy it once, then use package configuration to decide which features run.

​
Features

Detect is always enabled after AI Watch is installed. Enforce and Sessions are controlled by package configuration, and one organization API key authenticates scanning, enforcement, and sessions; no enrollment keys are required.
FeatureConfigurationWhat it does
DetectAlways onDiscovers shadow MCP servers, skills, and plugins through scheduled scans
EnforceEnforcement / AIWATCH_ENFORCEMENTInstalls client hooks that block unmanaged MCP sources and policy-check local tool activity
SessionsSessions / AIWATCH_SESSIONSInstalls the full event hook set for Sessions telemetry
  • Enforce is disabled by default. Set Enforcement=true (macOS) or AIWATCH_ENFORCEMENT=1 (Windows) to block unmanaged MCP sources and policy-check local tool activity.
  • Sessions is enabled by default. Set Sessions=false (macOS) or AIWATCH_SESSIONS=0 (Windows) to skip the full event/session hook set.
Hook installation follows the combined capability state: AI Watch installs hook configs when either Enforce or Sessions is enabled. Detect-only requires explicitly setting Sessions=false or AIWATCH_SESSIONS=0; omitting Sessions uses the default enabled state and installs hooks for monitoring-only telemetry.

​
Package configuration

Use Settings → MDM Configuration to create or edit an AI Watch configuration. The wizard picks your MDM, mints a single organization API key, and bakes the Enforce and Sessions values into the downloaded artifacts. Changing Enforcement or Sessions does not require reinstalling the package. Re-push the configuration profile or MSI command/registry values; AI Watch picks up the new settings on the next bootstrap or hook execution.

​
macOS artifacts

The macOS package is a signed and notarized .pkg plus three MDM Configuration Profiles:
FilePurpose
aiwatch-<version>-macos-arm64.pkgInstalls the aiwatch binary, scan LaunchAgent, and hook bootstrap
com.runlayer.aiwatch.config.mobileconfigTenant host, organization API key, Enforcement, and Sessions
com.runlayer.aiwatch.pppc.mobileconfigFull Disk Access / TCC grants
com.runlayer.aiwatch.loginitems.mobileconfigPre-approves bundled LaunchAgents on macOS 13+
Deploy the three Configuration Profiles before the .pkg so tenant config and TCC grants are present before the first scan tick. If you need multiple configurations, deploy one com.runlayer.aiwatch.config.mobileconfig per group. The .pkg, PPPC profile, and Login Items profile are universal and can be reused unchanged across all configurations.

Jamf Pro

Upload Configuration Profiles and the .pkg via Policy.

Workspace ONE

Use Custom Attributes for tenant host and organization API key.

Iru / Kandji

Edit the tenant profile and deploy through Blueprints.

SimpleMDM

Upload profiles and package through device groups.

Mosyle

Deploy profiles and package through Mosyle device groups.

Other macOS MDM

Use any MDM with Custom App and Custom Profile support.
Migrating from the legacy script-based macOS Detect rollout? Run Legacy macOS Detect Cleanup before rolling out the .pkg.

​
Windows artifacts

The Windows package is a signed MSI wrapped for Intune. The MSI writes tenant config to HKLM\Software\Runlayer\AIWatch.
FilePurpose
aiwatch-<version>-win-x64.intunewinApp package for Intune upload
scan-on-detect/detect.ps1Runs aiwatch.exe scan from Intune detection
scheduled/detect.ps1 + scheduled/remediate.ps1Schedules recurring scans through Intune Remediations
assert/detect.ps1 + assert/remediate.ps1Asserts hook configs when Enforce or Sessions is enabled

Intune

Deploy the MSI, configure capability properties, schedule Detect scans, and assert hook configs.

​
Manual and custom workflows

For individual test devices, use the feature pages:

Run Detect manually

Install the Runlayer CLI and run runlayer scan.

Install Enforce manually

Install client hooks with runlayer setup hooks.

User and Identity Mapping

Understand how device usernames map to Runlayer users.

Remove AI Watch

Remove package-based and legacy script-based deployments.
For custom fleet integrations outside a supported MDM, use the same package configuration model: install AI Watch once, provide host and organization API key, leave Detect running, and set Enforcement / Sessions to the desired values.