Skip to main content
This guide requires Jamf Pro. Jamf Now and Jamf School have different script deployment capabilities.

​
Prerequisites

  • Jamf Pro admin access
  • Devices enrolled via User-Approved MDM or Automated Device Enrollment (for Full Disk Access)

​
Deployment Steps

1

Deploy PPPC Profile

Detect needs to read MCP config files in TCC-protected directories (Desktop, Documents, Application Support). Without a PPPC profile, macOS shows a permission dialog on every scan.
The profile targets a dedicated runlayer-scan wrapper binary so that Full Disk Access is scoped to the scan process only — not to general-purpose tools like uvx.
Download the PPPC profile from the Detect configuration page in the Runlayer dashboard (Settings → Shadow MCPs), or use the button below:
  1. Navigate to Computers > Configuration Profiles
  2. Click New and upload the downloaded .mobileconfig file
  3. Scope to target computers/groups
  4. Save and deploy
2

Get Deployment Artifacts

In the Runlayer dashboard, go to Settings → Shadow MCPs and open or create a Detect configuration to copy the generated script and API key.
3

Upload to Jamf Pro

  • Navigate to Settings > Computer Management > Scripts
  • Click New
  • Enter a display name (e.g., “Runlayer Detect”)
  • Paste the generated script contents
  • Set Priority to “After” (runs after other policies)
  • Save
4

Create a Policy

  • Navigate to Computers > Policies
  • Click New
  • Configure the policy:
    • General: Name it (e.g., “Deploy Runlayer Detect”)
    • Scripts: Add your uploaded script
    • Scope: Select target computers or groups
    • Trigger: Recurring Check-in
    • Frequency: Set to Ongoing for repeated execution
5

Save and Deploy

Save the policy to begin deployment to target devices

​
Verification

1

Verify PPPC Profile

On a target device, verify the profile is installed:
profiles show -type configuration | grep -i runlayer
2

Verify Wrapper Binary

Check that the wrapper binary is installed and signed correctly:
ls -la /usr/local/bin/runlayer-scan
codesign -dv /usr/local/bin/runlayer-scan
3

Check Policy Status

Verify policy execution status in Jamf Pro
4

Verify in Runlayer

Confirm devices appear in Runlayer Analytics

​
Log Locations

PlatformLog Location
macOS/var/log/runlayer/ai_watch_detect.log

​
Exit Codes

CodeMeaning
0Success
1General failure (missing config)
2Network failure
3Installation failure