Skip to main content

Install on One Machine (No MDM)

This guide installs the Waxell desktop agent on one machine, by yourself — no MDM, no admin/IT involvement. It's the fastest way to try Waxell on your own laptop before rolling it out to a fleet.

Once installed, the agent discovers which apps on your machine talk to AI services (Claude Desktop, Cursor, Claude Code, Copilot, browsers…) and reports that activity to your workspace under Governance → Connect → AI Endpoints.

Deploying to a whole fleet instead?

Don't install machine-by-machine — use the one-profile MDM flow. It pushes silently to every managed device. This page is only for single-machine, hands-on installs.

Capture is OFF by default

Installing the app turns on discovery and metadata only — which apps are talking to which AI services. Nothing is intercepted or decrypted. Payload capture stays off until an admin enables it for a specific host on the Guard cascade.

macOS​

Requirements: macOS 12 (Monterey) or later. The app is signed and Apple-notarized, so it opens without any "unidentified developer" warning.

1. Download​

⬇ Download for Mac (Apple Silicon)

This is the Apple Silicon (M1/M2/M3/M4) build. Not sure which Mac you have? Click → About This Mac — if the Chip line says "Apple", this is the right one.

Intel Macs

A direct download for older Intel Macs is coming soon. In the meantime, ask your Waxell contact for the Intel build.

2. Install​

  1. Open the downloaded WaxellSetup-arm64.dmg.
  2. Drag Waxell Setup onto the Applications folder.
  3. Open Applications and double-click Waxell Setup to launch it.
Always run it from Applications

The network monitor only loads when the app runs from /Applications. If you launch it from the disk image or Downloads, macOS will block the monitor. Drag it to Applications first.

3. Sign in​

  1. Click Sign in with browser.
  2. Your default browser opens to the Waxell sign-in page. Log in.
  3. Click Allow this Mac.
  4. The app flips to "Signed in as <your-email>". No API key to paste.

4. Approve the network monitor​

  1. macOS shows that a system extension was blocked, or the app says "Approve in System Settings."
  2. Open System Settings → General → Login Items & Extensions.
  3. Under Network Extensions, find Waxell and turn it on.
  4. If macOS shows a "Waxell would like to filter network content" dialog, click Allow. Enter your Mac password if prompted.

5. Verify​

  • In Waxell Setup, the Network Monitor tab shows the service running (green).
  • In your workspace, Governance → Connect → AI Endpoints → AI Apps lists your machine and its AI apps within a minute or two.

✅ Done. Use your AI tools normally; discovered activity flows into your workspace.

Uninstall (macOS)​

  1. Quit Waxell Setup and drag /Applications/Waxell Setup.app to the Trash.
  2. System Settings → General → Login Items & Extensions → Network Extensions → Waxell → off.

Windows​

Preview build — unsigned for now

The Windows installer is pre-release and not yet code-signed (EV certificate in verification). Until it's signed, you'll get it directly from your Waxell contact rather than a public link, and Windows will show an "unknown publisher" prompt. The bundled team-install.ps1 script smooths over the rough edges; signed builds will install with no warnings.

Requirements: Windows 10 (1809+) or Windows 11.

1. Get the files​

Your Waxell contact sends you two files — save them to the same folder:

Waxell-<version>.msi
team-install.ps1

2. Install​

  1. Right-click team-install.ps1 → Run with PowerShell.
  2. Approve the UAC prompt ("Verified publisher: Unknown" is expected for the preview → Yes).
  3. Wait ~30 seconds. The script adds a Microsoft Defender exclusion for C:\Program Files\Waxell\, runs the MSI, and confirms the WaxellNetworkMonitor service is running.

3. Sign in​

  1. Open Waxell Setup from the Start Menu.
  2. Click Sign in with browser → log in → Allow this PC.
  3. The app flips to "Signed in as <your-email>".

4. Verify​

  • The Network Monitor tab shows the service running.
  • Governance → Connect → AI Endpoints → AI Apps lists your PC within a minute or two.

✅ Done.

Uninstall (Windows)​

Use the bundled team-uninstall.ps1 (right-click → Run with PowerShell → approve UAC). It stops the service, removes the binaries, and removes the Defender exclusion. To clear sign-in: click Sign out in the app, or remove dev.waxell.setup:connect from Control Panel → Credential Manager.

Hitting a snag?​

See Troubleshooting & Diagnostics for fixes to the common issues (system-extension approval, SmartScreen, Defender, browser sign-in), and What gets installed for the full component list.