Deploy the AISPM Sensor to Your Endpoints

The AISPM sensor is a lightweight program that runs on your managed endpoints and reports which AI agents, tools, and MCP servers are present on each one. Those findings populate the AI posture page in MineOS, where your governance team can review agents, assess their risk, and act on issues. This guide walks an IT administrator through generating a deployment package, pushing it out through your MDM, and confirming that devices are reporting.

You deploy the sensor as a script, not as a signed installer or a repackaged app. There is no packaging tool to run and no bundle to convert — you request a package from the API, paste it into your MDM, and scope it to your fleet.

Before you start

• A MineOS API key for the workspace you want the devices to report into.
• An MDM that can run a shell script on macOS or Ubuntu, or a PowerShell script on Windows.
• Administrative access to that MDM, with a device group you can scope the deployment to.
• Outbound HTTPS from your endpoints to the MineOS AISPM endpoint (see Allow the sensor through your network).

Step 1 — Generate an API key

Create an API key in the workspace the devices should report into. Keys are scoped to a single account and a single workspace, so make sure you are in the right one before generating it. See Authentication for the full walkthrough, including which regional API endpoint to target.

Step 2 — Generate your MDM package

Call Generate an MDM package with the target you want. The package is generated per workspace and carries the enrollment token your devices use to register, so treat the response as a secret.

Two request fields shape what you get back: type of MDM and target OS. Generate a separate package for each operating system in your fleet.

Save the returned script as .sh for macOS and Ubuntu, or .ps1 for Windows.

Step 3 — Deploy the package through your MDM

Deployment is always two objects: the script itself, and the assignment that binds it to a set of devices and a trigger. A script with no assignment never runs, which makes it a safe way to stage the rollout before you're ready.

Both parts are pull-based. Endpoints pick up the script on their own check-in cycle rather than the moment you save it, so allow one cycle before you start investigating.

Jamf Pro — add the script under Settings → Computer Management → Scripts, then create a policy with a Scripts payload that targets it. The Jamf package reads the enrollment token from policy parameter 4, so paste the token into that field on the policy rather than into the script body. This keeps the script itself free of secrets and safe to share internally.

Microsoft Intune — upload the .ps1 under Devices → Scripts and remediations → Platform scripts, choose Windows 10 and later, and assign it to your device group. Intune platform scripts take no parameters, so the enrollment token is already baked into the package you generated.

Kandji, and any other MDM — use the generic package and deploy it through whatever script or custom-command mechanism your MDM provides.

Whichever MDM you use, three settings matter:

• Run with elevated privileges — root on macOS and Ubuntu, SYSTEM on Windows.
• Set the execution frequency deliberately. The sensor only needs to install once per device. A recurring frequency combined with a check-in trigger will re-run the script on every check-in indefinitely, and because each run reports success, nothing in the console will look wrong.
• Scope to a dynamic or smart group rather than a hand-picked list of machines, so devices added later are covered automatically instead of silently missing the deployment.

Allow the sensor through your network

Enrolled devices open outbound HTTPS connections to MineOS on port 443. Allow the domain for your MineOS tenant through your firewall, proxy, or any egress filtering you run:

These connections are outbound only — nothing needs to reach your endpoints from the internet. The sensor authenticates with a client certificate issued during enrollment, so if your proxy performs TLS inspection, add these domains to its bypass list. Intercepting the connection will break authentication and the device will stop reporting.

Confirm the deployment worked

Check in this order, and trust the earlier signals over the later ones:

1. Your MDM console. Confirm the script was delivered and exited successfully. A non-zero exit code marks the run as failed.
2. The AI posture page. In MineOS, go to Governance → AI posture and open the Agents tab. Once a device has completed its first scan, its agents appear here with the machine listed under Device name. Use the search box or filter by Connected tools to find a specific device.
3. The API. List enrolled devices returns every device enrolled in your workspace with its check-in details, which is the fastest way to confirm enrollment across a large fleet.
   A device appears as enrolled shortly after the script runs, but its agents only appear in AI posture after the first scan completes and uploads.

Troubleshooting