Skip to content
GT Arsenals Docs

Deploying on macOS

Supports macOS on both Intel and Apple Silicon.

Install with the installer package

Section titled “Install with the installer package”

Download the macOS installer package (.pkg) from Deploy Agent in the dashboard. It contains both the Intel and Apple Silicon builds and installs the right one.

To enroll during installation (for example from an MDM tool), place a file called enroll.env in the agent’s data folder before the package runs. The package reads it once and deletes it:

Terminal window
sudo mkdir -p "/Library/Application Support/GTGuardian"
printf 'GT_ENROLLMENT_TOKEN=<your-token>\nGT_HUB_URL=https://guardian.example.com\n' | sudo tee "/Library/Application Support/GTGuardian/enroll.env" >/dev/null
sudo installer -pkg gt-guardian-agent.pkg -target /

Or enroll afterwards:

Terminal window
sudo /usr/local/bin/gt-guardian-agent configure --secure --token <your-token> --hub-url https://guardian.example.com
sudo launchctl kickstart -k system/com.gtguardian.agent

The package registers a launchd daemon (com.gtguardian.agent) that starts on boot and is restarted automatically if the process is ended.

Install with the one-line script

Section titled “Install with the one-line script”
  1. Go to Deploy Agent in the dashboard and select the Linux / macOS tab.
  2. Copy the command shown, and run it in Terminal with sudo:
Terminal window
curl -fsSL https://downloads.gtarsenals.com/install.sh?token=<your-token> | sudo bash

The script detects macOS automatically and installs the right build for your chip. It downloads the agent to /usr/local/bin/gt-guardian-agent, writes its configuration to /Library/Application Support/GTGuardian/config.json (readable by root only), and registers the launchd daemon.

Verify it worked

Section titled “Verify it worked”

Check Agents in the dashboard. The new machine should appear within about 30 seconds. On the machine itself:

Terminal window
sudo launchctl list | grep gtguardian

It should show the com.gtguardian.agent job running.

Uninstalling

Section titled “Uninstalling”

From the dashboard, use Agents → (device) → Remove, or run on the machine:

Terminal window
sudo /usr/local/bin/gt-guardian-agent configure --planned-stop uninstall
sudo launchctl unload /Library/LaunchDaemons/com.gtguardian.agent.plist
sudo rm -f /Library/LaunchDaemons/com.gtguardian.agent.plist
sudo rm -rf "/Library/Application Support/GTGuardian"
sudo rm -f /usr/local/bin/gt-guardian-agent

The first line tells the hub the stop is deliberate, so it does not raise a “service was stopped” alert.