> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safedep.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Deploy vet with MDM

> Install, update, and remove vet across macOS and Linux fleets, then add optional visibility tasks through your MDM.

Use your MDM to install, update, and remove `vet` across managed macOS and Linux endpoints. After `vet` is in place, you can add a separate MDM task to collect endpoint inventory and sync it to SafeDep Cloud.

This guide works with any MDM that can deploy a package or run shell commands, such as Jamf, Intune, JumpCloud, Mosyle, or Kandji.

Use this guide for two jobs:

1. Make `vet` available on each managed endpoint.
2. Run optional endpoint inventory on a schedule.

<Note>
  Installing `vet` does not require a SafeDep account. SafeDep Cloud credentials are required only when you want endpoint inventory in SafeDep Cloud.
</Note>

## Before you start

You need:

* An MDM policy that can run a shell command, or deploy a package.
* Administrator access on the target endpoints.
* A small test device group for the first deployment.
* A selected install method: Homebrew, npm, or a pre-built binary.

Use the same install method for installation, updates, and removal. Do not mix package managers on the same endpoint.

If you plan to run scheduled inventory as root, install `vet` in a system path or make sure the MDM job can resolve `vet` from `PATH`. The pre-built binary is the most predictable option for this case.

## Install vet

Choose the method that matches the software already managed on your endpoints.

<Tabs>
  <Tab title="Pre-built binary">
    Use this for the most predictable MDM deployment.

    Download the archive for each operating system and architecture from [vet releases](https://github.com/safedep/vet/releases). Verify it with the published `checksums.txt` file, then add the extracted `vet` binary to your MDM package.

    Install the binary in a system path:

    <Tabs>
      <Tab title="macOS">
        ```sh theme={null}
        install -d -o root -g wheel -m 0755 /usr/local/bin
        install -o root -g wheel -m 0755 vet /usr/local/bin/vet
        ```
      </Tab>

      <Tab title="Linux">
        ```sh theme={null}
        install -d -o root -g root -m 0755 /usr/local/bin
        install -o root -g root -m 0755 vet /usr/local/bin/vet
        ```
      </Tab>
    </Tabs>
  </Tab>

  <Tab title="Homebrew (macOS and Linux)">
    Use this when Homebrew is already managed on the endpoint. Run the command in the user context that owns the Homebrew installation. Do not run Homebrew as root.

    ```sh theme={null}
    brew install safedep/tap/vet
    ```
  </Tab>

  <Tab title="npm">
    Use this when Node.js and npm are already managed on the endpoint.

    ```sh theme={null}
    npm install -g @safedep/vet
    ```
  </Tab>
</Tabs>

## Verify the install

Assign the install policy to your test group first. After the policy runs, verify the installation:

```sh theme={null}
command -v vet
vet version
```

The first command must return the managed `vet` path. The second command must return the installed version.

## Update vet

Update `vet` through the same MDM policy and install method:

<Tabs>
  <Tab title="Pre-built binary">
    Download and verify the required release, then replace the managed `vet` binary in your MDM package. Re-run the install policy to replace `/usr/local/bin/vet` on macOS and Linux.
  </Tab>

  <Tab title="Homebrew (macOS and Linux)">
    ```sh theme={null}
    brew upgrade safedep/tap/vet
    ```
  </Tab>

  <Tab title="npm">
    ```sh theme={null}
    npm install -g @safedep/vet@latest
    ```
  </Tab>
</Tabs>

Run `vet version` after the update and confirm that it reports the expected version.

## Uninstall vet

Disable any MDM tasks that run `vet` before you remove the CLI. Then use the uninstall command that matches the install method.

<Tabs>
  <Tab title="Pre-built binary">
    ```sh theme={null}
    rm -f /usr/local/bin/vet
    ```
  </Tab>

  <Tab title="Homebrew (macOS and Linux)">
    ```sh theme={null}
    brew uninstall safedep/tap/vet
    ```
  </Tab>

  <Tab title="npm">
    ```sh theme={null}
    npm uninstall -g @safedep/vet
    ```
  </Tab>
</Tabs>

Run `command -v vet` after removal. It must not return a path.

## Run endpoint inventory with your MDM

Installing `vet` makes the CLI available, but it does not schedule scans. Deploy endpoint inventory as a separate MDM task. This keeps installation, credentials, and schedules independent.

The current fleet script is [`vet_endpoint_scan.sh`](https://github.com/safedep/vet/blob/main/scripts/mdm/vet_endpoint_scan.sh). It supports macOS and Linux. The script runs `vet endpoint scan` and collects AI tools, coding agents, MCP servers, and agent skills.

<Steps>
  <Step title="Deploy the script">
    Download the script from the `vet` repository and deploy it to a managed path on each endpoint. Make the file executable.

    ```sh theme={null}
    chmod 0755 /path/to/vet_endpoint_scan.sh
    ```

    The script expects `vet` to already be installed on the endpoint.
  </Step>

  <Step title="Choose local-only or cloud sync">
    Run the script with no credentials for local-only inventory:

    ```sh theme={null}
    /path/to/vet_endpoint_scan.sh
    ```

    For SafeDep Cloud sync, create an API key and get your Tenant ID from [SafeDep Cloud settings](https://app.safedep.io/settings/api-keys). Store both values in your MDM secret store, then pass them as environment variables:

    ```sh theme={null}
    SAFEDEP_API_KEY="<api-key>" \
    SAFEDEP_TENANT_ID="<tenant-id>" \
    /path/to/vet_endpoint_scan.sh
    ```

    Cloud sync starts only when both variables are set. If neither variable is set, the script runs local-only. Do not set only one variable.
  </Step>

  <Step title="Choose the execution context">
    Run the script as root to scan every local human account on the machine. Use this mode for shared devices or when you want endpoint-wide coverage.

    Run the script as the logged-in user to scan only that user. Use this mode when you want the user's full `PATH`, especially for CLI tool discovery on macOS.
  </Step>

  <Step title="Add optional scan flags">
    Pass extra flags at the end when you want to narrow the inventory or reduce output. The script forwards them to `vet endpoint scan`.

    ```sh theme={null}
    /path/to/vet_endpoint_scan.sh --silent --kind ai-tool
    ```
  </Step>

  <Step title="Assign a schedule">
    Assign the inventory policy to your test group first. Then choose the schedule that matches how often you want the inventory refreshed.

    Keep this policy separate from the install policy. The script continues to the next user if one user scan fails and reports the final result in the MDM job output.
  </Step>

  <Step title="Verify the result">
    Review the MDM job output and confirm that the script found `vet` and scanned the expected users.

    If Cloud sync is enabled, open [SafeDep Cloud](https://app.safedep.io), select **Endpoints**, open the endpoint, and select the **Inventory** tab. Confirm that the endpoint and its discovered items appear.
  </Step>
</Steps>

To remove this inventory task, disable the MDM policy and remove the managed script. This does not uninstall `vet`.

<CardGroup cols={2}>
  <Card title="vet installation options" icon="github" href="https://github.com/safedep/vet#installation">
    Source of truth for supported installation methods.
  </Card>

  <Card title="vet MDM scripts" icon="code" href="https://github.com/safedep/vet/blob/main/scripts/mdm/README.md">
    Source of truth for current macOS and Linux fleet scripts.
  </Card>

  <Card title="Endpoints inventory" icon="server" href="/governance/cloud/endpoint-hub/inventory">
    Configure inventory sync and review discovered items.
  </Card>
</CardGroup>