Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.runlayer.com/llms.txt

Use this file to discover all available pages before exploring further.

​
Prerequisites

  • Iru/Kandji admin access
  • Enforce deployment script and enrollment key from the Runlayer dashboard
  • At least one Blueprint configured with enrolled devices

​
Deployment Steps

1

Get Deployment Artifacts

In the Runlayer dashboard, go to Settings → Shadow MCPs. Under the Enforce section, click Configure and select your MDM platform. This opens a setup dialog that auto-generates an enrollment key and renders the deployment script.
The enrollment key is embedded in the generated script and will not be shown again after you close the dialog. Copy or download the script before closing.
2

Add a Custom Script Library Item

  1. Navigate to the Library section in Iru/Kandji
  2. Click Add New → Custom Script → Add & Configure
  3. Provide a Name (e.g., “AI Watch Enforce”)
  4. Assign to your target Blueprint(s)
  5. Set Execution Frequency to Install once per device
  6. Paste the generated script into the script field
  7. Click Save

​
Verification

1

Check Policy Status

Check the Custom Script’s Status tab in Iru/Kandji for execution results.
You can force an immediate check-in on a test Mac by running sudo kandji checkin in Terminal.
2

Verify in Runlayer

Navigate to Settings → Shadow MCPs and confirm your Enforce configuration card is active. View intercepted tool calls on the Shadow page.
3

Test Interception

Have a user trigger a shadow MCP tool call and verify it appears in Audit Logs.

​
Log Locations

PlatformLog Location
macOS/var/log/runlayer/ai_watch_enforce.log
macOS (fallback)/tmp/runlayer-ai_watch_enforce.log
The fallback log location is used when the primary path (/var/log/runlayer/) cannot be written to due to permissions.

​
Exit Codes

CodeMeaning
0Success
1General failure (no user logged in, missing config, enrollment failed)
2Network failure (cannot reach PyPI)
3Installation failure (uv or CLI install failed, hooks install failed)