Skip to main content
Deploy Detect using any MDM that supports custom configuration profiles and script execution.
If your MDM has a dedicated guide (SimpleMDM, Jamf Pro, Intune, Mosyle, or Kandji), use that instead for provider-specific instructions.

​
Prerequisites

  • Admin access to your MDM solution
  • Devices enrolled via User-Approved MDM or Automated Device Enrollment (for Full Disk Access)
  • Your MDM must support:
    • Deploying custom .mobileconfig configuration profiles
    • Running shell scripts on managed devices

​
Deployment Steps

1

Deploy PPPC Profile

Detect needs to read MCP config files in TCC-protected directories (Desktop, Documents, Application Support). Without a PPPC profile, macOS shows a permission dialog on every scan.
The profile targets a dedicated runlayer-scan wrapper binary so that Full Disk Access is scoped to the scan process only — not to general-purpose tools like uvx.
Download the PPPC profile from the Detect configuration page in the Runlayer dashboard (Settings → Shadow MCPs), or use the button below:
  • Upload the downloaded file as a custom configuration profile
  • Assign it to all devices that will run Detect
  • Push the profile to devices
2

Get Deployment Artifacts

In the Runlayer dashboard, go to Settings → Shadow MCPs and open or create a Detect configuration to copy the generated script and API key.
3

Deploy the Script

Use your MDM’s script or command execution feature to deploy the generated script:
  1. Create a new script/command in your MDM console
  2. Paste the generated script contents
  3. Configure a recurring execution schedule (at least daily recommended)
  4. Assign to the same devices that received the PPPC profile
  5. Save and deploy
MDM scripts typically run as root. The generated script handles this by detecting and running operations as the logged-in user where needed.

​
Verification

1

Verify PPPC Profile

On a target device, verify the profile is installed:
profiles show -type configuration | grep -i runlayer
2

Verify Wrapper Binary

Check that the wrapper binary is installed and signed correctly:
ls -la /usr/local/bin/runlayer-scan
codesign -dv /usr/local/bin/runlayer-scan
3

Check Analytics

Navigate to Analytics in the Runlayer dashboard
4

Verify Devices

Confirm that devices are appearing in Detect data

​
Log Locations

PlatformLog Location
macOS/var/log/runlayer/ai_watch_detect.log

​
Exit Codes

CodeMeaning
0Success
1General failure (missing config)
2Network failure
3Installation failure