> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oriant.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect a macOS machine | Oriant

> Install the Oriant Agent on one macOS machine and verify Shadow AI traffic is reporting.

Use this path to verify Oriant on one Mac before a managed rollout.

## Before you begin

* You need access to your Oriant organization.
* The target machine must run macOS and have `curl`, `python3`, and an
  administrator account that can approve the install's `sudo` steps.
* Run the command in a terminal on the machine you are connecting.

## Install the Agent

1. In Oriant, open **Settings → Deployment** or choose **Add machines → Single
   machine**.
2. Select **Connect a machine**.
3. Copy the generated command and run it on the target machine.

```sh theme={null}
curl -fsSL https://api.oriant.app/connect | sh -s -- --code <your-code>
```

The enrollment code is single-use and expires after 10 minutes. The installer
redeems it for an organization-scoped collector token, downloads and verifies
the Agent, installs the Agent and its fail-open watchdog, then enables the
macOS system proxy only after the Agent has successfully fetched its config.

<Note>
  The installer stamps every report with one identity. Append
  `--email you@company.com` to set it explicitly. Without that flag, it uses
  `ORIANT_EMAIL`, then `git config user.email`, then the local `$USER` value.
</Note>

## Confirm it is working

The deployment dialog updates when the machine claims its enrollment code and
again after its first report arrives. You can find the enrolled machine in
**Assets** and its attributed activity in **Users**.

To check the local Agent directly:

```sh theme={null}
curl --noproxy '*' http://127.0.0.1:8080/healthz
```

The response is JSON. `status: "ok"` means the Agent has fetched config and
is healthy. `status: "degraded"` means it remains running while delivery is
retrying. `starting` and `down` return HTTP 503 and mean the system proxy is
not ready.

<Warning>
  The Agent covers applications that use the macOS system proxy. Applications
  that bypass the system proxy, and non-macOS devices, are outside this rollout.
</Warning>

## Remove the Agent

Run the installer with `--uninstall` on the connected machine:

```sh theme={null}
curl -fsSL https://api.oriant.app/connect | sh -s -- --uninstall
```

Uninstalling removes the local Agent and proxy configuration. It does not
revoke the organization-scoped collector token; revoke that token in **Settings
→ API Keys → Collector Tokens** when decommissioning a machine or fleet.