Skip to main content

Prerequisites

  • Kandji admin access
  • Enforce deployment script and enrollment key from the Runlayer dashboard
  • At least one Blueprint configured with enrolled devices

Deployment Steps

1

Get Deployment Artifacts

In the Runlayer dashboard, go to SettingsShadow MCPs and open or create an Enforce configuration to copy the generated script and enrollment key.
2

Add a Custom Script Library Item

  1. Navigate to the Library section in Kandji
  2. Click Add NewCustom ScriptAdd & Configure
  3. Provide a Name (e.g., “Runlayer Enforce”)
  4. Assign to your target Blueprint(s)
  5. Set Execution Frequency to Run once per device
  6. Paste the generated script into the Audit Script field
  7. Click Save

Verification

1

Check Script Status

Check the Custom Script’s Status tab in Kandji for execution results. You can force an immediate check-in on a test Mac by running sudo kandji checkin in Terminal.
2

Verify in Runlayer

Confirm devices appear in Runlayer Analytics
3

Test Interception

Have a user trigger a shadow MCP tool call and verify it appears in audit logs

Log Locations

PlatformLog Location
macOS/var/log/runlayer/ai_watch_enforce.log

Exit Codes

CodeMeaning
0Success
1General failure (missing config, enrollment failed)
2Network failure
3Installation failure