Deploy the collector

Every machine needs the shield360 CLI, enrolled once with your organisation’s install key. The install scripts are served by your own Shield360 platform, so machines download the CLI from the same server they report to. No public release channel is involved.

1. Get the install key

In Shield360, open Visibility → Setup and create an install key. An organisation can hold several keys, for example one per rollout wave. Revoking a key stops new enrolments and leaves machines that are already enrolled untouched.

Note

The install key is used only to enrol. Each machine exchanges it for its own collector token and the key isn’t stored on the machine. The platform keeps only SHA-256 hashes of both the key and the tokens. No developer machine holds a general API key, and your OTLP port doesn’t need to be exposed.

2. Install on a machine

Replace https://app.shield360.ai with your Shield360 address if you self-host.

curl -fsSL https://app.shield360.ai/api/cli/install.sh | SHIELD360_INSTALL_KEY=<key> sh

$env:SHIELD360_INSTALL_KEY = "<key>"
iwr -useb https://app.shield360.ai/api/cli/install.ps1 | iex

The script:

1. Downloads the CLI for this OS and architecture from /api/cli/download/<target> and installs it to ~/.shield360/bin (%USERPROFILE%\.shield360\bin on Windows). It needs no administrator rights.
2. Runs shield360 collector enroll, which exchanges the install key for this machine’s token and sends a first heartbeat to prove the machine can report.
3. Runs shield360 collector install to report automatically in the background.
4. Runs shield360 coding install to add hooks for whichever coding agents are on the machine. Where the collector runs as watch (the macOS default), it re-checks hourly and adds hooks for agents installed later.

The install key is passed in the environment, never as an argument, so it stays out of the process table and shell history.

Manual install

Download a binary from Visibility → Setup, or from https://<your-shield360>/api/cli/download/<target>:

Target	Platform
shield360-darwin-arm64	macOS, Apple silicon
shield360-darwin-amd64	macOS, Intel
shield360-macos.pkg	macOS signed installer (when your deployment’s release pipeline built it)
shield360-linux-amd64	Linux, x86-64
shield360-linux-arm64	Linux, arm64
shield360-windows-amd64.exe	Windows, x86-64
shield360-windows-arm64.exe	Windows, arm64

Caution

Apple silicon refuses to run an unsigned arm64 binary. On macOS, use the signed .pkg, or a binary your deployment built and signed on a Mac.

Then enrol and install:

SHIELD360_INSTALL_KEY=<key> shield360 collector enroll --url https://app.shield360.ai
shield360 collector install
shield360 coding install

enroll reads the key from --install-key-file, from SHIELD360_INSTALL_KEY, or from a prompt. It never takes the key as an argument. The machine’s URL, collector ID and token are written to the CLI config file with owner-only permissions.

Deploy with an MDM

Jamf, Intune, Kandji, Workspace ONE, Ansible and similar tools all run a script as part of a policy. Pass the key through the environment:

export SHIELD360_INSTALL_KEY="<key>"
export SHIELD360_URL="https://app.shield360.ai"
curl -fsSL "$SHIELD360_URL/api/cli/install.sh" | sh

Variable	Purpose	Default
SHIELD360_INSTALL_KEY	Organisation install key (required)	none
SHIELD360_URL	Shield360 server the script downloads from and enrols with	The server that served the script
SHIELD360_INSTALL_DIR	Where the binary goes	~/.shield360/bin

A script run by an MDM usually runs as root or SYSTEM. See Multi-user machines for how the collector behaves when it runs elevated.

What gets scheduled

shield360 collector install registers a background job for the current user:

OS	Mechanism	Runs
macOS	LaunchAgent ai.thinkfleet.shield360-collector, kept alive	shield360 collector watch: AI usage every --every-minutes, plus continuous application time and machine state
Linux	systemd --user timer shield360-collector.timer, falling back to cron where systemd isn’t available	shield360 collector run every --every-minutes
Windows	Task Scheduler task registered with schtasks	shield360 collector run every --every-minutes

The default interval is 60 minutes. Logs go to collector.log and collector.err.log in the CLI’s log directory.

Tip

collector run reports AI usage only. To also collect application time and machine state on Linux or Windows, run shield360 collector watch as a long-lived process under your own service manager.

Verify

shield360 collector status

Server       https://app.shield360.ai
Collector    col_8f2c...
Policy       browsing=domains netobserve=false fingerprint-keys=false
Scheduled    yes (/Users/alex/Library/LaunchAgents/ai.thinkfleet.shield360-collector.plist)
Last report  Thu, 17 Sep 2026 14:02:11 EDT — alex

The machine appears under Visibility → Fleet after its first heartbeat.

To see what would be sent without sending anything:

shield360 collector run --dry-run --verbose

Remove

shield360 collector uninstall   # stop background reporting; enrolment is kept
shield360 coding uninstall      # remove coding-agent hooks
rm ~/.shield360/bin/shield360   # remove the binary

To cut a machine off from the server side, revoke it under Visibility → Fleet. Its token stops being accepted immediately.