macOS agent

Download the Synopt agent

The agent is the only thing that runs on an engineer’s machine. It is open source (Apache-2.0): you can read every line before installing it.

You need an enrollment token as well as this file. The agent reports into an organisation, and organisations are still created by us: self-serve · start in a minute. If you do not have a token yet, request a trial and we will send you one.

Current build

Looking up the current build…

macOS only. There is no Windows or Linux agent, see Security for why that is deliberate rather than pending.

Verify it before you run it

You are about to run a binary from a company you have not met. Each command below comes with the answer you should get, so you can compare rather than squint: a verification step with no known-good value to check against is not really a verification step.

The build we publish is signed with our Apple Developer ID, notarized by Apple, and has the notarization ticket stapled to the file. Stapled is the part worth knowing on a managed fleet: the ticket travels inside the download, so Gatekeeper clears it without calling Apple: it installs cleanly on a locked-down corporate Mac and with no network at all.

Our Team ID is 8VWWR546GA. If any check below disagrees with what is printed here, do not run the file: tell us instead.

Checksum the file you downloaded
shasum -a 256 ~/Downloads/<filename>
Expected
```
the SHA-256 shown above
```
That value is computed by our server from the bytes it just served you, not copied from a config file. It is also the checksum the agent's own auto-updater verifies against.
Check who signed it
codesign -dv --verbose=4 ~/Downloads/<filename>
Expected
```
Authority=Developer ID Application: CODEX LABS TECHNOLOGIES LLP (8VWWR546GA)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
TeamIdentifier=8VWWR546GA
Notarization Ticket=stapled
```
Among the output you should see these lines. The Team ID 8VWWR546GA is ours. If you see a different Team ID, a different authority chain, or "code object is not signed at all", do not run it: tell us instead.
Check macOS accepts it
spctl -a -t open --context context:primary-signature -vv ~/Downloads/<filename>
Expected
```
accepted
source=Notarized Developer ID
```
Gatekeeper's own verdict. 'Notarized Developer ID' means Apple has scanned this exact build and issued a ticket for it.
Check the notarization ticket is stapled to the file
xcrun stapler validate ~/Downloads/<filename>
Expected
```
The validate action worked!
```
A stapled ticket travels inside the file, so Gatekeeper can accept it without calling Apple. That is what makes it install cleanly on a locked-down or offline Mac.

Install

Open the downloaded .dmg and drag observability-agent.app into Applications.
Launch it. Because the build is notarized and the ticket is stapled, Gatekeeper clears it without a network round trip: macOS asks once to confirm you want to open an app downloaded from the internet, and nothing more.
Paste the enrollment token we sent you. That is what tells the agent which organisation and backend it belongs to.
Leave it running. Events appear in the dashboard the first time an AI coding tool runs after enrollment.

From then on the agent updates itself: it checks in with the same update channel this page reads from, so you should not need to come back here. The full README lives in the agent repository.

Anything unexpected during install, tell us: support@synopt.dev.