Skip to main content
Waxell
InsightsObserveAnalyzeImprovePromptsDeployGovernMCP GatewayEndpoints
DashboardWorkspacesActivityInboxChannelsFilesSubscriptionsSetup
SettingsBillingOrganization
GovernSetup
DashboardConversationsExecutions
Connect
Getting Started
Endpoints
ObserveActivityDashboardFlowCapturesAI AppsCatalogHealthAttention
GovernGuardPolicy LookupSimulatorDecisionsDiagnostic
FleetDevicesAll AgentsAgent Groups
DeploySetup

Setup — MDM deployment

Push one profile from your MDM and every managed device enrolls, trusts the tenant CA, and reports its AI apps — zero end-user action.

Download your profile

Generated for your tenant with a dedicated, revocable enrollment key embedded — no terminal, no API key to paste. Capture stays OFF until you enable a host on the Guard tab.

Push four files. Touch zero devices.

Everything after the push is silent — each Mac enrolls, trusts your CA, activates its extensions, and starts reporting AI activity on its own. Steps 1–2 are governance (required); 3–4 add capture (optional). Deploy in order — base first, it approves the extensions the others need.

1
Configuration profilewaxell.mobileconfig
→ MDM · Configuration

Trusts your tenant CA, approves the Waxell system extensions, and carries a revocable enrollment key — generated for your tenant. Drop it into your MDM's custom-profile slot.

Download profile
↳On the device: enrolls headless and flips to managed — the key never touches a person.
2
Agent appWaxellSetup-arm64.pkg
→ MDM · Apps

The agent itself — one signed & notarized build for everyone, no key inside. Deploy as an Enterprise App; profile 1 makes it activate with no user prompt.

Download .pkg
↳On the device: installs, wires the AI hooks, extensions come up silently — no click.
3
Capture profilewaxell-capture.mobileconfig
→ MDM · Configuration

Adds on-device TLS capture (the transparent proxy) and the passive network filter. A separate profile so a capture-payload failure can't take governance down. Capture only runs for the hosts you enable on the Guard tab.

Download capture
↳On the device: captures native-app + API AI traffic, DLP-redacted on-device before upload.
4
Browser AIwaxell-browser.mobileconfig
→ MDM · Configuration

Force-installs the Waxell extension in Chrome + Edge. It reads browser AI chats (ChatGPT, Claude) from inside the page — no TLS interception, no ECH fight — and hands them to the agent's local bridge, which device-stamps + DLP-redacts before upload.

Download browser
↳On the device: captures browser AI conversations from the front door — past ECH, no cert games.

Only the profiles carry a secret (your tenant key) — keep them inside your MDM, don't email them around. The .pkg is public. Browser AI also has a network-level DNS-proxy profile as an advanced fallback — the extension is the default.

Just trying it out? Test on one machine — no MDM

The same agent, as a signed & notarized download you run yourself — no fleet, no IT. Install it, paste your tenant key in the app, and it starts reporting AI apps. Good for a single machine before you roll it out fleet-wide.

Download for Mac (Apple Silicon)
  • Signed & Apple-notarized — opens cleanly, no Gatekeeper warning.
  • One-time approval: macOS asks you to Allow the network extension in System Settings (the MDM profile is what makes that silent).
  • Capture stays OFF — same default as the fleet path.
  • Intel Macs & a direct Windows download are coming once those installers finish signing — use the MDM flow above for Windows today.
Step-by-step install guide →

What the profile installs

Tenant CA trust

A per-tenant root CA, trusted fleet-wide via the universal cert-trust payload — works with any MDM, no SCEP.

System-extension allow

Pre-approves the Waxell network extension by Team ID, so it activates without a user prompt.

Managed config

The enrollment URL + tenant key + capture scope. The app reads it and configures the extension.

Deploy in 4 steps (Hexnode / Jamf / Kandji / Intune)

1

Download the profile

Use the Download button above (or curl with a tenant key + ?hosts=… to pre-enable capture).
2

Upload to your MDM

  • Hexnode — Policies → macOS → Custom Configuration → upload each .mobileconfig as its own policy (base, and the capture one if used)
  • Jamf Pro — Configuration Profiles → Upload → Custom Settings
  • Intune — Devices → macOS → Configuration → Templates → Custom
  • Kandji — Library → Add → Custom Profile
3

Deploy the agent app

Upload the Waxell Setup .pkg (downloaded above) as an Enterprise App (Apps), then assign both the profile and the .pkg to your Mac device group.
4

Verify

Within minutes each Mac enrolls + scans. Watch the AI Apps tab fill in.

Privacy & safety

  • Interception is default-OFF — nothing is terminated until an admin enables capture per host on the Guard tab.
  • TLS is terminated only for catalog AI hosts — never banking, health, or mail.
  • Secrets & PII are DLP-redacted on-device — raw payloads never leave the machine.