Ferentin for Endpoints
by Ferentin, Inc.
Why Ferentin
AI coding agents, assistants and MCP servers are already on your Macs, sending data you cannot see, under no policy you set. Ferentin for Endpoints is a managed macOS agent for AI governance. It inventories the AI tools on each Mac, attributes where they send data to the process that sent it, and enforces a signed policy that keeps working when the device is offline. It never collects prompts, conversations or file contents.
How it works with Jamf Pro
Give Ferentin a Jamf Pro API client whose role holds twelve privileges and nothing more. When you click Publish, Ferentin:
- uploads the signed, notarized agent package and its removal package
- registers the extension attributes
- mints a single-use bootstrap token on the server and uploads it inside the enrollment profile, so it never touches your disk
- creates the install policy and scopes it to a smart computer group you pick from Jamf Pro
Ferentin checks the privileges when you connect, so a missing one shows up on screen instead of failing halfway through an upload. Scoping is always the last step, so a publish that stops early leaves nothing live. The signed security profiles are the one hand upload, because Jamf Pro's API does not accept signed profiles.
Who benefits
Security teams get an AI tool inventory and enforceable policy on every Mac. Endpoint teams deploy it the way they already deploy security agents, through rings, smart groups and Patch Management, without a user-facing installer.
Get started
Requires Jamf Pro 11.9.1 or later, and Apple silicon Macs on macOS 15 or later. Follow the deployment guide, starting with a pilot smart group.
Links
Click Publish and Ferentin uploads the packages and extension attributes, mints the bootstrap token into the enrollment profile, then creates the install policy and scopes it to your smart group.
Connect Jamf Pro with an API client. Ferentin checks its privileges on connect, so a missing one is named here instead of failing halfway through an upload.
Build a deployment for Jamf Pro and pick the smart computer group from the list Ferentin reads from Jamf Pro.
Enter your Jamf Pro URL and the API client's credentials. The secret is write-only and never shown again.
In Jamf Pro, create an API role with exactly the twelve privileges Ferentin needs, and nothing more.
