Skip to main content
Deploy Enforce using any MDM that supports script execution.
If your MDM has a dedicated guide (SimpleMDM, Jamf Pro, Mosyle, or Kandji), use that instead for provider-specific instructions.

​
Prerequisites

  • Admin access to your MDM solution
  • Enforce deployment script and enrollment key from the Runlayer dashboard
  • Your MDM must support running shell scripts on managed devices

​
Deployment Steps

1

Get Deployment Artifacts

In the Runlayer dashboard, go to Settings → Shadow MCPs and open or create an Enforce configuration to copy the generated script and enrollment key.
2

Deploy the Script

Use your MDM’s script or command execution feature to deploy the generated script:
  1. Create a new script/command in your MDM console
  2. Paste the generated script contents
  3. Configure the execution frequency
  4. Assign to target devices
  5. Save and deploy
MDM scripts typically run as root. The generated script handles this by detecting and running operations as the logged-in user where needed.

​
Verification

1

Check Analytics

Navigate to Analytics in the Runlayer dashboard
2

Verify Devices

Confirm that devices are appearing with Enforce installed
3

Test Interception

Have a user trigger a shadow MCP tool call and verify it appears in audit logs

​
Log Locations

PlatformLog Location
macOS/var/log/runlayer/ai_watch_enforce.log

​
Exit Codes

CodeMeaning
0Success
1General failure (missing config, enrollment failed)
2Network failure
3Installation failure