Install cnspec on macOS

Install and configure cnspec on macOS using the automated installer, Homebrew, or the universal package.

cnspec runs natively on Intel and Apple silicon Macs. Pick whichever install method matches how you manage software on the rest of your fleet.

If you install cnspec on machines that can't download and install updates (because they're air-gapped or don't give cnspec write access), you must deploy cnspec providers. To learn more, read Manage cnspec Providers.

Quick start

Run the automated install script. It detects whether Homebrew is available and falls back to the signed .pkg installer otherwise.

Install cnspec

bash -c "$(curl -sSL https://install.mondoo.com/sh)"

To register cnspec with Mondoo Platform during the install, set a registration token first:

Install and register cnspec

export MONDOO_REGISTRATION_TOKEN="<your token from console.mondoo.com>"
bash -c "$(curl -sSL https://install.mondoo.com/sh)"

For Homebrew, the universal package, or a manual install, read on.

Prerequisites

Before installing, the Mac needs:

Outbound internet access from Terminal
Reachability to Mondoo Platform endpoints: install.mondoo.com, releases.mondoo.com, us.api.mondoo.com or eu.api.mondoo.com (depending on your region), and registry.api.mondoo.com
A clock synchronized via NTP (System Settings → General → Date & Time → Set time and date automatically)

Install with Homebrew

If you already use Homebrew, tap the Mondoo formula and install the mondoo package:

Tap and install

brew tap mondoohq/mondoo
brew install mondoo

To upgrade later, see Update cnspec.

Install with the universal package

Mondoo publishes a signed and notarized universal .pkg for both Intel and Apple silicon Macs at releases.mondoo.com. The package also drops a launchd configuration in place (without starting or enabling it), which makes it a good fit for MDM-driven deployments.

To install non-interactively from the command line:

Install the universal package

sudo installer -pkg ./mondoo_(version)_darwin_universal.pkg -target /Library

To start cnspec under launchd after installing, follow Run cnspec as a service.

Verify the install

Confirm cnspec is on your PATH:

Check the version

cnspec version

If you registered during install, confirm cnspec can reach Mondoo Platform:

Check the registration

cnspec status

The last two lines should read client is registered and client authenticated successfully. For other outcomes, see Validate registration.