mit-agent
Know your endpoints.
Manage the work they do.
Your access determines which devices and actions are available.
Explore this pull request with synthetic fleet data. Preview access is read-only.
Checking sign-in mode…
mit-agent
Status comes from the agent's last check-in: active within 5 minutes, quiet within 24 hours, silent longer, revoked. It does not show the device's own state.
Earlier page boundaries were discarded after 256 pages. Previous stops at the oldest retained page. Refresh to return to the beginning with a new cohort.
| Status | Hostname | Platform | Last seen | Agent | Can run |
|---|
Create an enrollment token and move the downloaded file to the endpoint. With the agent installed, run:
The device appears here after its first check-in. Tokens expire and enroll exactly one device.
Create enrollment token
Compliance comes from bounded native package checks, independently of inventory and last seen.
Users of companions paired with this device request entitled catalog revisions. Installs still need this agent to advertise and locally enable the package manager.
Leave blank for all devices. Device pages link to their task history. This list shows metadata; open a task for details allowed by your token.
Only the latest 256 page boundaries are retained. Refresh to return to the newest tasks.
| State | Type | Device | Created | Updated | Task |
|---|
Output was cut at the 64 KiB cap.
Open a known ID directly, including applications beyond the current page. Leave revision blank for the latest revision; review pins the returned revision.
Each row is a summary of the latest observed revision. Open an application to review its exact packages and device compatibility. Revisions are immutable; publish new ones with mit-ctl catalog create.
Earlier page boundaries were discarded after 256 pages. Previous stops at the oldest retained page. Refresh starts a new cohort.
| Application | Platforms | Variants | Revision | Action |
|---|
Earlier page boundaries were discarded after 256 pages. Previous stops at the oldest retained page. Refresh to return to the beginning with a new cohort.
| When | Actor | Action | Resource | Detail |
|---|
An enrollment token lets one endpoint register once before it expires. The console offers the token as a single private download and then forgets it.
Metadata only; token secrets cannot be retrieved. Revoke an unused token to prevent enrollment. For a used token, revoke the enrolled device instead.
.token file to the device over a private channel and delete your copy. On Unix, restrict it with chmod 600 <file>; macOS also requires no extended ACL.mit-agent enroll --server <this server> --token-file <file> --state-dir <private dir>. Non-loopback servers require HTTPS.mit-agent run --state-dir <private dir>. Add --allow-exec /absolute/program on Linux or macOS to permit specific commands, --allow-package-manager apt|dnf|dnf5|brew to permit catalog application installs, and --file-root ALIAS=/absolute/directory to permit file configuration below an existing directory.Windows agents report inventory only. For Android or iOS/iPadOS, use the native companion app for foreground inventory; the desktop agent commands above do not apply.