> ## Documentation Index
> Fetch the complete documentation index at: https://docs.guardway.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# macOS (.pkg)

> Install the Guardway agent on Macs with the universal .pkg — by MDM or by hand — grant Full Disk Access, choose the install mode and verify it runs.

## What this is for

The macOS installer is one universal `.pkg` for Apple Silicon and Intel. It lays down `gw-cli`, the
bundled SkillSpector scanning engine and the **Glass Bar** menu-bar app, and starts the agent for
every user at sign-in. Install it with Jamf, Kandji, Intune, Mosyle, Workspace ONE, Addigy or any
tool that runs `installer`, or by hand on one Mac.

Download: `https://api.guardway.ai/v1/downloads/gw-cli/latest/guardway-gw-cli-macos-universal.pkg`
(a versioned copy sits under `.../gw-cli/<version>/`). Verify it against `SHA256SUMS` in the same
folder.

## What the package installs

| Item | Path |
| - | - |
| Agent and scanning engine | `/usr/local/bin/gw-cli`, `/usr/local/bin/skillspector` |
| Glass Bar menu-bar app | `/Applications/Guardway Glass Bar.app`, launched at login |
| Uninstaller | `/usr/local/bin/guardway-uninstall` |
| Agent updater | LaunchDaemon `ai.guardway.gw-cli.updater`, every 15 minutes |
| Full Disk Access profile template | `/Library/Application Support/Guardway/Guardway-FullDiskAccess.mobileconfig` |
| Machine-wide data (managed mode) | `/Library/Application Support/Guardway` |
| Per-user data (observe mode) | `~/.guardway` for each user |

## How to install

<Tabs>
  <Tab title="MDM">
    <Steps>
      <Step title="Upload the package">
        Add `guardway-gw-cli-macos-universal.pkg` to your MDM as a package to install on devices. No pre-install script is needed.
      </Step>

      <Step title="Push the Full Disk Access profile">
        Deploy a PPPC (Privacy Preferences Policy Control) configuration profile granting **Full Disk Access** to `/usr/local/bin/gw-cli`. The template in the package payload is a starting point. Apple honours this grant only from an MDM, never from a profile a user double-clicks. See [Full Disk Access](#full-disk-access).
      </Step>

      <Step title="Set the install mode (optional)">
        To install the **managed** mode fleet-wide, push a configuration profile for the preference domain `ai.guardway.agent` with `InstallMode` set to `managed` **before** the package. Without it the package installs **Observe**. See [Install modes](/endpoint-ai-risk/connect/activate#install-modes).
      </Step>

      <Step title="Scope and deploy">
        Scope to a pilot group first. The package installs at the next check-in; nobody has to be signed in.
      </Step>
    </Steps>
  </Tab>

  <Tab title="By hand">
    ```sh theme={null}
    sudo installer -pkg guardway-gw-cli-macos-universal.pkg -target /
    ```

    Double-clicking the package works too. The package is signed with Guardway's identity but not yet notarized by Apple, so Gatekeeper may ask you to confirm: right-click the file, choose **Open**, then **Open** again, or allow it under **System Settings › Privacy & Security › Open Anyway**. The command above never prompts.

    To install the managed mode on one Mac, set the preference first:

    ```sh theme={null}
    sudo defaults write /Library/Preferences/ai.guardway.agent InstallMode managed
    sudo installer -pkg guardway-gw-cli-macos-universal.pkg -target /
    ```
  </Tab>
</Tabs>

## After the install

Within a few seconds a **Guardway shield** appears in the menu bar of every signed-in user. In
Observe mode the agent runs as that user, watches their AI tools' own session files, and reads
Claude Code's transcripts; nothing is proxied. Verify on the machine:

```sh theme={null}
gw-cli hook --installed-mode     # prints: observe | managed | none
gw-cli hook --status             # what is installed and whether it is running
gw-cli doctor                    # engine, SkillSpector and environment checks
```

Then [enroll the machine](/endpoint-ai-risk/connect/activate) so it reports to the console.

## Full Disk Access

macOS privacy protection keeps even root out of `~/Desktop`, `~/Documents` and `~/Downloads`.
Without Full Disk Access, skills and MCP configurations in those folders are reported as
**unreachable**, never as clean, so a Mac can look clear when it is not. The managed-mode agent and
the updater need it.

* **Fleet:** push a PPPC profile from your MDM. It takes effect with no user interaction.
* **One Mac:** **System Settings › Privacy & Security › Full Disk Access**, add `/usr/local/bin/gw-cli`, then restart the agent with `sudo launchctl kickstart -k system/com.guardway.gw-cli.tap` (managed mode) or sign out and in (observe mode).

<Note>
  The profile's code requirement must match the signature on `gw-cli`. The package ships binaries
  signed with a stable Guardway identity, so the grant survives updates. If your MDM requires a
  Developer ID requirement string, ask Guardway support for the current one.
</Note>

## Upgrading

Install the new package over the old one. An upgrade keeps the machine's install mode, its
enrollment and its data, and the agent restarts on the new version. With the update policy on
**Auto-install**, machines upgrade themselves; see [Agent updates](/endpoint-ai-risk/connect/updates).

## Removing

Run the installed uninstaller, which gives back any held skill before it removes anything:

```sh theme={null}
sudo /usr/local/bin/guardway-uninstall --yes
```

Do not delete `/Library/Application Support/Guardway` by hand: it is where
[skill custody](/endpoint-ai-risk/agent/skill-custody) keeps held skills. The full procedure and
the recovery notes are on [Uninstall & Recovery](/endpoint-ai-risk/agent/uninstall).

## Limits

* One `.pkg` for both chips; there is no separate Intel package.
* Claude Desktop routing through your gateway needs the managed mode and an Enforce policy with a gateway. The agent writes Desktop's managed preferences itself; if you already manage Claude Desktop with a profile, add Guardway's values to that profile instead.
* A home folder on an external or network volume needs Full Disk Access for the updater as well.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.