Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.runlayer.com/llms.txt

Use this file to discover all available pages before exploring further.

This guide requires Jamf Pro. Jamf Now and Jamf School have different script deployment capabilities.

​
Prerequisites

  • Jamf Pro admin access
  • Runlayer dashboard admin access (requires Manage Org Settings capability)

​
Deployment Steps

1

Get Deployment Artifacts

In the Runlayer dashboard, go to Settings → Shadow MCPs. Under the Enforce section, click Configure and select Jamf Pro. This opens a setup dialog that auto-generates an enrollment key and renders the deployment script.
The enrollment key is embedded in the generated script and will not be shown again after you close the dialog. Copy or download the script before closing.
2

Upload to Jamf Pro

  • Navigate to Settings > Computer Management > Scripts
  • Click New
  • Enter a display name (e.g., “Runlayer AI Watch Enforce”)
  • Paste the generated script contents
  • Set Priority to “After” (runs after other policies)
  • Save
3

Create a Policy

  • Navigate to Computers > Policies
  • Click New
  • Configure the policy:
    • General: Name it (e.g., “Deploy Runlayer Enforce”)
    • Scripts: Add your uploaded script
    • Scope: Select target computers or groups
    • Trigger: Recurring Check-in or Login
    • Frequency: Set to Once per computer for initial deployment
4

Save and Deploy

Save the policy to begin deployment to target devices.
Users must restart their AI client (Cursor, Claude Code, or Codex) after Enforce is installed for the hooks to take effect.

​
Verification

1

Check Policy Status

Verify policy execution status in Jamf Pro under the policy’s Logs tab.
2

Verify in Runlayer

Navigate to Settings → Shadow MCPs and confirm your Enforce configuration card is active. View intercepted tool calls on the Shadow page.
3

Test Interception

Have a user trigger a shadow MCP tool call and verify it appears in Audit Logs.

​
Log Locations

PlatformLog Location
macOS/var/log/runlayer/ai_watch_enforce.log
macOS (fallback)/tmp/runlayer-ai_watch_enforce.log
The fallback log location is used when the primary path (/var/log/runlayer/) cannot be written to due to permissions.

​
Exit Codes

CodeMeaning
0Success
1General failure (no user logged in, missing config, enrollment failed)
2Network failure (cannot reach PyPI)
3Installation failure (uv or CLI install failed, hooks install failed)