Setup — MDM deployment
Push one profile from your MDM and every managed device enrolls, trusts the tenant CA, and reports its AI apps — zero end-user action.
Download your profile
Generated for your tenant with a dedicated, revocable enrollment key embedded — no terminal, no API key to paste. Capture stays OFF until you enable a host on the Guard tab.
Push four files. Touch zero devices.
Everything after the push is silent — each Mac enrolls, trusts your CA, activates its extensions, and starts reporting AI activity on its own. Steps 1–2 are governance (required); 3–4 add capture (optional). Deploy in order — base first, it approves the extensions the others need.
Trusts your tenant CA, approves the Waxell system extensions, and carries a revocable enrollment key — generated for your tenant. Drop it into your MDM's custom-profile slot.
The agent itself — one signed & notarized build for everyone, no key inside. Deploy as an Enterprise App; profile 1 makes it activate with no user prompt.
Adds on-device TLS capture (the transparent proxy) and the passive network filter. A separate profile so a capture-payload failure can't take governance down. Capture only runs for the hosts you enable on the Guard tab.
Force-installs the Waxell extension in Chrome + Edge. It reads browser AI chats (ChatGPT, Claude) from inside the page — no TLS interception, no ECH fight — and hands them to the agent's local bridge, which device-stamps + DLP-redacts before upload.
Only the profiles carry a secret (your tenant key) — keep them inside your MDM, don't email them around. The .pkg is public. Browser AI also has a network-level DNS-proxy profile as an advanced fallback — the extension is the default.
Just this machine — no MDM required
The same signed & notarized agent, installed by hand in about five minutes. No keys to paste — you sign in with your browser and the device enrolls itself. Good for your own machine before the fleet rollout.
- Open the download and drag Waxell to /Applications — that exact location is required for the network monitor to load.
- Launch it and choose Sign in with browser, then Allow this Mac — the device gets its own certificate and token; no tenant key ever touches the disk.
- Approve the network extension when macOS asks (System Settings → General → Login Items & Extensions). One time — the MDM profile is what makes this silent at fleet scale.
- Signed & Apple-notarized — opens cleanly, no Gatekeeper warning.
- Capture stays OFF — same default as the fleet path.
- Intel Macs: the direct build is still in signing — use the MDM flow for those. Windows has its own direct download — switch the platform toggle above.
What the profile installs
Tenant CA trust
A per-tenant root CA, trusted fleet-wide via the universal cert-trust payload — works with any MDM, no SCEP.
System-extension allow
Pre-approves the Waxell network extension by Team ID, so it activates without a user prompt.
Managed config
The enrollment URL + tenant key + capture scope. The app reads it and configures the extension.
Deploy in 4 steps (Hexnode / Jamf / Kandji / Intune)
Download the profile
?hosts=… to pre-enable capture).Upload to your MDM
- Hexnode — Policies → macOS → Custom Configuration → upload each .mobileconfig as its own policy (base, and the capture one if used)
- Jamf Pro — Configuration Profiles → Upload → Custom Settings
- Intune — Devices → macOS → Configuration → Templates → Custom
- Kandji — Library → Add → Custom Profile
Deploy the agent app
Verify
Privacy & safety
- Interception is default-OFF — nothing is terminated until an admin enables capture per host on the Guard tab.
- TLS is terminated only for catalog AI hosts — never banking, health, or mail.
- Secrets & PII are DLP-redacted on-device — raw payloads never leave the machine.