Skip to main content

Install AI DLP via Homebrew

This guide shows you how to install AI DLP on a single Mac with Homebrew. It is intended for testing and evaluation — trying AI DLP on your own machine or a handful of test Macs before a wider rollout.

For fleet deployments, use your MDM

To deploy AI DLP across your organization, use the Jamf Pro, Iru, or Microsoft Intune guide instead. Only MDM deployments update themselves automatically.

How this differs from an MDM deployment​

Homebrew installs the same AI DLP agent as an MDM deployment, with the same coverage and the same findings in the portal. Only the delivery differs:

  • No automatic updates. An MDM deployment installs the Anzenna Update agent, which keeps AI DLP current daily. Homebrew installs AI DLP only, so the Mac stays on the version you installed until you

    update it yourself

    .

  • Apple Silicon Macs only. Intel Macs and Windows are not supported by the Homebrew install.

  • One Mac at a time. You run the install on each Mac by hand, as an administrator.

Prerequisites​

  • An Apple Silicon Mac

  • Homebrew

    installed

  • Administrator rights on the Mac — the install runs under sudo

  • Your Anzenna domain and its Client Token (see

    Finding your Client Token

    )

The Mac must already be known to Anzenna

AI DLP enrolls a Mac only if a connected MDM or EDR integration has already reported it to Anzenna by serial number. A personal Mac that no connected integration manages installs AI DLP but never registers, and no findings appear. See Devices must already be known to Anzenna.

Step-by-Step Instructions​

1. Install the Homebrew package​

Add the Anzenna tap and install the pharos formula. This runs as your normal user, without sudo:

brew tap anzenna-labs/tap
brew install anzenna-labs/tap/pharos

This places the anzenna-pharos-setup installer on your PATH. Nothing is enrolled or running yet.

2. Load your Client Token into the environment​

Read the token into an environment variable rather than typing it into a command:

read -rs ANZENNA_CLIENT_TOKEN
export ANZENNA_CLIENT_TOKEN

After the first line, paste your Client Token and press Return. Nothing is echoed to the screen — that is expected.

Why not pass the token as an argument

A command-line argument is visible to every process on the Mac for as long as the installer runs, and a typed command is saved in your shell history. Reading the token this way keeps it out of both. For the same reason, do not write it as sudo ANZENNA_CLIENT_TOKEN=… anzenna-pharos-setup — that form puts the token back into a command's arguments.

3. Run the installer​

Run the installer with sudo, passing the token through and replacing YOUR_DOMAIN with your Anzenna domain:

sudo --preserve-env=ANZENNA_CLIENT_TOKEN anzenna-pharos-setup \
  --portal-url https://feed.anzenna.ai \
  --domain YOUR_DOMAIN

The installer enrolls the Mac with your Anzenna domain, stores a per-device signing key in the macOS keychain, and wires AI DLP into the AI tools on the machine. Running it again on an enrolled Mac is safe; it keeps the existing enrollment.

Use feed.anzenna.ai, not app.anzenna.ai

The portal URL for the installer is https://feed.anzenna.ai. It is a different host from the app.anzenna.ai address you use to sign in to the portal.

4. Clear the token from your shell​

unset ANZENNA_CLIENT_TOKEN

Verifying the Install​

AI DLP includes a health check that walks each stage of the install — configuration, AI tool registration, the background service, the signing key, and portal reachability — and reports which, if any, is broken. Run it as your normal user, without sudo:

AGENT="/Library/Application Support/Anzenna/Pharos/anzenna-pharos-agent"
CONF="/Library/Application Support/Anzenna/Pharos/anzenna-settings-for-pharos.json"

"$AGENT" --doctor --config "$CONF"

Then use a monitored AI tool as normal. Findings appear in the Anzenna portal alongside your other detections.

Updating​

A Homebrew install does not update itself. Updating takes two steps: upgrade the package, then re-run the installer so it applies the new version.

brew update
brew upgrade pharos

Then repeat

steps 2 through 4

. Upgrading the package alone is not enough — the running agent stays on the old version until the installer is re-run.

Moving to an MDM deployment​

When you are ready to roll out AI DLP more widely, deploy it through your MDM as described in the

Jamf Pro

or

Iru

guide. You do not need to uninstall the Homebrew version from your test Macs first; the MDM deployment takes over.

Once the MDM deployment has reached a Mac, remove the Homebrew package with brew uninstall pharos. Do not run anzenna-pharos-setup --uninstall on that Mac — it would remove the AI DLP agent your MDM just installed.

Uninstalling​

Run the uninstall before removing the Homebrew package, since the package provides the uninstaller:

sudo anzenna-pharos-setup --uninstall
brew uninstall pharos

The first command removes AI DLP from the Mac — its configuration, its background services, its registration with your AI tools, and the device's signing key. The second removes the installer itself. To remove the Anzenna tap as well, run brew untap anzenna-labs/tap.

Troubleshooting​

Homebrew refuses to install the formula​

The formula installs only on Apple Silicon. On an Intel Mac, Homebrew reports an architecture requirement and stops. Use a different Mac for testing.

The installer prompts for the Client Token​

The token did not reach the installer. Check that you ran export ANZENNA_CLIENT_TOKEN in the same terminal window, and that the sudo command includes --preserve-env=ANZENNA_CLIENT_TOKEN. You can also paste the token at the prompt — it is not echoed.

The install finished but the Mac did not register​

From the Mac, these two causes look the same:

  • The Client Token or domain is wrong.

    Re-check the token in the portal

    and run the installer again.

  • No connected MDM or EDR integration has reported this Mac to Anzenna yet. Once one does, the Mac registers on its own; you do not need to reinstall.

I used an AI tool but nothing shows up​

  • Run the

    health check

    and fix the stage it reports as broken. Adding --fix repairs local permission problems.

  • For Claude Code, confirm the version meets the

    minimum requirement

    . Older versions produce no findings and no error.

Need help? Contact

Anzenna Support

for assistance.