Deploy the Desktop Agent on macOS (Jamf / MDM)

The ZeusLock agent runs in the user’s interactive desktop session as a tray app plus a local inspection proxy on 127.0.0.1:9876. Because it lives in the logged-in session, it cannot protect a Mac that has nobody signed in.

The installer you download from the dashboard (Agents → Deployment) is generic — it carries no credentials. A Mac is only bound to your organization once you deliver its configuration separately: the ServerUrl (your tenant API URL, e.g. https://api.zeuslock.ai) and the LicenseKey (the zl_... org API key from Settings → API Keys). Which activities block versus alert is your policy, which lives in the dashboard and is fetched using the LicenseKey — you never configure policy on the endpoint.

Prerequisites

• An MDM that can push packages and configuration profiles (Jamf, Mosyle, Kandji, or Intune).

• The macOS installer (.pkg, or the .app inside the .dmg) from Agents → Deployment.

• Your ServerUrl and a LicenseKey (zl_...) from Settings → API Keys.

• Each Mac has a user who logs in interactively — the agent runs in that session.

Step 1 — Deploy the app

Upload the .pkg to your MDM and scope it to the target Macs. In Jamf, add the package to a policy (or a PreStage) and let it install; Mosyle, Kandji, and Intune all accept the same signed .pkg as a managed app. No credentials are baked into this package — it is the same installer for every organization.

Step 2 — Deliver the configuration

Bind each Mac to your org using either of the following. A managed-preferences profile is the recommended path because MDM keeps it in place and users cannot remove it.

Option A — Managed preferences profile (recommended). Push a configuration profile for the preference domain com.zeuslock.agent with two string keys, ServerUrl and LicenseKey. The payload looks like this:

{
  "ServerUrl": "https://api.zeuslock.ai",
  "LicenseKey": "zl_xxxxxxxxxxxxxxxxxxxx"
}

In Jamf, create an Application & Custom Settings payload for com.zeuslock.agent; Mosyle, Kandji, and Intune offer an equivalent custom / preference-file payload.

Option B — JSON file. Deliver a UTF-8 file (no BOM) to /Library/Application Support/ZeusLockDLP/config.json containing:

{
  "ServerUrl": "https://api.zeuslock.ai",
  "LicenseKey": "zl_xxxxxxxxxxxxxxxxxxxx"
}

In JSON files the legacy aliases apiUrl and apiKey are still accepted, but prefer ServerUrl and LicenseKey. Do not use api_url, api_key, or any monitor_* keys — the agent ignores them.

Step 3 — Approve the login item and proxy trust

Because the agent starts in the user session and inspects traffic through the local proxy, it needs two approvals that you should pre-authorize via MDM so users are not prompted:

• Allow the agent as a login item so the tray app launches at sign-in.

• Trust the agent’s certificate / proxy so inspected TLS traffic is not warned on. Deploy the certificate payload with your configuration profile.

Install on a single Mac by hand

For one machine, open the downloaded .dmg and drag the .app to /Applications (or double-click the .pkg), then create the JSON config yourself:

sudo mkdir -p "/Library/Application Support/ZeusLockDLP"
sudo tee "/Library/Application Support/ZeusLockDLP/config.json" >/dev/null <<'JSON'
{
  "ServerUrl": "https://api.zeuslock.ai",
  "LicenseKey": "zl_xxxxxxxxxxxxxxxxxxxx"
}
JSON

Launch the app once and approve the login-item and proxy-trust prompts.

Verify

1. Confirm the profile applied — read the managed preferences:

sudo defaults read /Library/Managed\ Preferences/com.zeuslock.agent

1. Sign in as a normal user and confirm the tray app is running.

2. Run a live test: paste a test card number into chatgpt.com and confirm an incident appears in the dashboard.

For the full step-by-step guide with ready-made scripts, profile templates, and JSON examples, see https://github.com/Zeuslock-ORG/zeuslock-agent-deployment.