Skip to main content

​
Prerequisites

  • Kandji admin access
  • At least one Blueprint configured with enrolled devices
  • Devices enrolled via Automated Device Enrollment (for Full Disk Access)

​
Deployment Steps

1

Deploy PPPC Profile

Detect needs to read MCP config files in TCC-protected directories (Desktop, Documents, Application Support). Without a PPPC profile, macOS shows a permission dialog on every scan.
The profile targets a dedicated runlayer-scan wrapper binary so that Full Disk Access is scoped to the scan process only — not to general-purpose tools like uvx.
Download the PPPC profile from the Detect configuration page in the Runlayer dashboard (Settings → Shadow MCPs), or use the button below:
  1. Navigate to Library in Kandji
  2. Click Add New → General → Custom Profile → Add & Configure
  3. Upload the downloaded .mobileconfig file
  4. Assign to your target Blueprint(s)
  5. Click Save
2

Get Deployment Artifacts

In the Runlayer dashboard, go to Settings → Shadow MCPs and open or create a Detect configuration to copy the generated script and API key.
3

Add a Custom Script Library Item

  1. Navigate to the Library section in Kandji
  2. Click Add New → Custom Script → Add & Configure
  3. Provide a Name (e.g., “Runlayer Detect”)
  4. Assign to your target Blueprint(s)
  5. Set Execution Frequency to Run daily (recommended) or Run every 15 minutes for more frequent scans
  6. Paste the generated script into the Audit Script field
  7. Click Save

​
Verification

1

Verify PPPC Profile

On a target device, verify the profile is installed:
profiles show -type configuration | grep -i runlayer
2

Verify Wrapper Binary

Check that the wrapper binary is installed and signed correctly:
ls -la /usr/local/bin/runlayer-scan
codesign -dv /usr/local/bin/runlayer-scan
3

Check Script Status

Check the Custom Script’s Status tab in Kandji for execution results. You can force an immediate check-in on a test Mac by running sudo kandji checkin in Terminal.
4

Verify in Runlayer

Confirm devices appear in Runlayer Analytics

​
Log Locations

PlatformLog Location
macOS/var/log/runlayer/ai_watch_detect.log

​
Exit Codes

CodeMeaning
0Success
1General failure (missing config)
2Network failure
3Installation failure