Skip to main content
Use your MDM to install, update, and remove vet across managed macOS and Linux endpoints. After vet is in place, you can add a separate MDM task to collect endpoint inventory and sync it to SafeDep Cloud. This guide works with any MDM that can deploy a package or run shell commands, such as Jamf, Intune, JumpCloud, Mosyle, or Kandji. Use this guide for two jobs:
  1. Make vet available on each managed endpoint.
  2. Run optional endpoint inventory on a schedule.
Installing vet does not require a SafeDep account. SafeDep Cloud credentials are required only when you want endpoint inventory in SafeDep Cloud.

​
Before you start

You need:
  • An MDM policy that can run a shell command, or deploy a package.
  • Administrator access on the target endpoints.
  • A small test device group for the first deployment.
  • A selected install method: Homebrew, npm, or a pre-built binary.
Use the same install method for installation, updates, and removal. Do not mix package managers on the same endpoint. If you plan to run scheduled inventory as root, install vet in a system path or make sure the MDM job can resolve vet from PATH. The pre-built binary is the most predictable option for this case.

​
Install vet

Choose the method that matches the software already managed on your endpoints.
Use this for the most predictable MDM deployment.Download the archive for each operating system and architecture from vet releases. Verify it with the published checksums.txt file, then add the extracted vet binary to your MDM package.Install the binary in a system path:

​
Verify the install

Assign the install policy to your test group first. After the policy runs, verify the installation:
The first command must return the managed vet path. The second command must return the installed version.

​
Update vet

Update vet through the same MDM policy and install method:
Download and verify the required release, then replace the managed vet binary in your MDM package. Re-run the install policy to replace /usr/local/bin/vet on macOS and Linux.
Run vet version after the update and confirm that it reports the expected version.

​
Uninstall vet

Disable any MDM tasks that run vet before you remove the CLI. Then use the uninstall command that matches the install method.
Run command -v vet after removal. It must not return a path.

​
Run endpoint inventory with your MDM

Installing vet makes the CLI available, but it does not schedule scans. Deploy endpoint inventory as a separate MDM task. This keeps installation, credentials, and schedules independent. The current fleet script is vet_endpoint_scan.sh. It supports macOS and Linux. The script runs vet endpoint scan and collects AI tools, coding agents, MCP servers, and agent skills.
1

Deploy the script

Download the script from the vet repository and deploy it to a managed path on each endpoint. Make the file executable.
The script expects vet to already be installed on the endpoint.
2

Choose local-only or cloud sync

Run the script with no credentials for local-only inventory:
For SafeDep Cloud sync, create an API key and get your Tenant ID from SafeDep Cloud settings. Store both values in your MDM secret store, then pass them as environment variables:
Cloud sync starts only when both variables are set. If neither variable is set, the script runs local-only. Do not set only one variable.
3

Choose the execution context

Run the script as root to scan every local human account on the machine. Use this mode for shared devices or when you want endpoint-wide coverage.Run the script as the logged-in user to scan only that user. Use this mode when you want the user’s full PATH, especially for CLI tool discovery on macOS.
4

Add optional scan flags

Pass extra flags at the end when you want to narrow the inventory or reduce output. The script forwards them to vet endpoint scan.
5

Assign a schedule

Assign the inventory policy to your test group first. Then choose the schedule that matches how often you want the inventory refreshed.Keep this policy separate from the install policy. The script continues to the next user if one user scan fails and reports the final result in the MDM job output.
6

Verify the result

Review the MDM job output and confirm that the script found vet and scanned the expected users.If Cloud sync is enabled, open SafeDep Cloud, select Endpoints, open the endpoint, and select the Inventory tab. Confirm that the endpoint and its discovered items appear.
To remove this inventory task, disable the MDM policy and remove the managed script. This does not uninstall vet.

vet installation options

Source of truth for supported installation methods.

vet MDM scripts

Source of truth for current macOS and Linux fleet scripts.

Endpoints inventory

Configure inventory sync and review discovered items.