Skip to main content

​
Prerequisites

  • SimpleMDM admin access
  • Devices enrolled via User-Approved MDM or Automated Device Enrollment (for Full Disk Access)

​
Deployment Steps

1

Deploy PPPC Profile

Detect needs to read MCP config files in TCC-protected directories (Desktop, Documents, Application Support). Without a PPPC profile, macOS shows a permission dialog on every scan.
The profile targets a dedicated runlayer-scan wrapper binary so that Full Disk Access is scoped to the scan process only — not to general-purpose tools like uvx.
Download the PPPC profile from the Detect configuration page in the Runlayer dashboard (Settings → Shadow MCPs), or use the button below:
  1. Go to Profiles in SimpleMDM
  2. Click Create Profile > Custom Configuration Profile
  3. Upload the downloaded .mobileconfig file
  4. Assign to the same devices/groups that will run the script
  5. Push the profile to devices
2

Get Deployment Artifacts

In the Runlayer dashboard, go to Settings → Shadow MCPs and open or create a Detect configuration to copy the generated script and API key.
3

Add the Script in SimpleMDM

  • Open Scripts in the SimpleMDM admin console
  • Click Add Script and paste the generated script
  • Name it (e.g., “Runlayer Detect”)
4

Assign and Deploy

  • Select the devices or device groups to deploy to
  • Configure execution schedule (daily recommended)
  • Save and monitor execution status

​
Verification

1

Verify PPPC Profile

On a target device, verify the profile is installed:
profiles show -type configuration | grep -i runlayer
2

Verify Wrapper Binary

Check that the wrapper binary is installed and signed correctly:
ls -la /usr/local/bin/runlayer-scan
codesign -dv /usr/local/bin/runlayer-scan
3

Check Analytics

Navigate to Analytics in the Runlayer dashboard
4

Verify Devices

Confirm that devices are appearing in Detect data

​
Log Locations

PlatformLog Location
macOS/var/log/runlayer/ai_watch_detect.log

​
Exit Codes

CodeMeaning
0Success
1General failure (missing config)
2Network failure
3Installation failure