Jamf Python Installer

Overview

Works on any Mac with Python 3, including Macs older than macOS 13.

On macOS, /usr/bin/python3 does not work until the Xcode Command Line Tools are installed. Deploy the Command Line Tools or the python.org package. Or use the binary runtime, which is self-contained.

Allow HTTPS to getunbound.ai, raw.githubusercontent.com, github.com and your organization’s backend and gateway hosts. They follow --backend-url and --gateway-url in your install command.

1. Copy your install command

Open Configure in Unbound. On a dedicated deployment, use your own dashboard address.

Choose scope

Select My org (MDM).

Choose what to install

Keep Govern coding agent actions on. Keep Seed events from past activity on if you want past Claude Code, Codex and GitHub Copilot sessions imported.

Run the install command

Select the macOS tab and copy the command. If it starts with sudo bash, copy from the Linux tab instead. The Python command is the same on both.

The command looks like this, with your own key and URLs:

sudo python3 -c "$(curl -fsSL https://getunbound.ai/setup/mdm/onboard)" --api-key YOUR_ADMIN_API_KEY --gateway-url https://api.getunbound.ai --frontend-url https://gateway.getunbound.ai --backend-url https://backend.getunbound.ai --backfill

The value after --api-key is your admin API key. One key covers the whole fleet, and each Mac uses it to fetch its own device key. Keep the command exactly as copied. You paste it into the policy in step 3.

2. Create the script

Go to Settings → Computer Management → Scripts → New. Name it Unbound daily onboard and paste this into the Script tab:

#!/bin/bash
CMD=$(printf '%s' "$4" | tr '\n\r\t' '   ')
arg() { printf '%s\n' "$CMD" | sed -n "s/.*$1 \([^ ]*\).*/\1/p"; }
API_KEY=$(arg --api-key)
BACKEND_URL=$(arg --backend-url)
GATEWAY_URL=$(arg --gateway-url)
FRONTEND_URL=$(arg --frontend-url)
BACKFILL=""
case " $CMD " in *" --backfill "*) BACKFILL="--backfill" ;; esac
case "${CMD%%--api-key*}" in *onboard.sh*) echo "Parameter 4 holds the binary runtime command. Copy the Python command from the Linux tab in Configure."; exit 1 ;; esac
for U in "$BACKEND_URL" "$GATEWAY_URL" "$FRONTEND_URL"; do
    case "$U" in https://?*) ;; *) API_KEY="" ;; esac
done
[ -n "$API_KEY" ] || { echo "Parameter 4 must hold the Python install command copied from Configure."; exit 1; }

for P in /usr/bin/python3 /Library/Frameworks/Python.framework/Versions/Current/bin/python3; do
    "$P" -c '' 2>/dev/null && PY="$P" && break
done
[ -n "$PY" ] || { echo "No usable python3. Deploy the Xcode Command Line Tools or the python.org package."; exit 1; }

INSTALLER=$(mktemp)
trap 'rm -f "$INSTALLER"' EXIT
curl -fsSL --max-time 120 -o "$INSTALLER" https://getunbound.ai/setup/mdm/onboard \
    || { echo "Could not download the installer."; exit 1; }

"$PY" "$INSTALLER" --api-key "$API_KEY" \
    --gateway-url "$GATEWAY_URL" \
    --frontend-url "$FRONTEND_URL" \
    --backend-url "$BACKEND_URL" $BACKFILL
CODE=$?

MARKER="/Library/Application Support/Unbound/last-success.txt"
if [ $CODE -eq 0 ]; then
    mkdir -p "$(dirname "$MARKER")" && date -u +%Y-%m-%dT%H:%M:%SZ > "$MARKER" \
        || { echo "Installed, but could not write $MARKER."; exit 1; }
fi
exit $CODE

The script never runs the command you paste. It reads your key and your organization’s URLs from it, and imports past sessions only if the command has --backfill. Daily runs never import a session twice. On the Options tab, label Parameter 4 Install command. This label replaces “Parameter 4” on the policy in step 3. Jamf reserves $1 to $3, which is why the script reads $4. The script only uses root-owned interpreters. A Homebrew or /usr/local python can be replaced by the logged-in user, and this script runs as root.

3. Create the policy

Go to Computers → Policies → New.

General

Name it Unbound daily onboard. Set Trigger to Recurring Check-in and Execution Frequency to Once every day.

Scripts

Select Configure, then Add next to Unbound daily onboard. Under Parameter Values, paste the whole command from step 1 into Install command.

Scope

Add one test Mac for now, then save.

Run the policy on the test Mac and check the result as described in Verify. When it passes, change the policy’s scope to your developer Mac group.

Troubleshooting

Symptom	Fix
`Parameter 4 must hold the Python install command`	Install command on the policy is empty, holds only a key, or is missing a URL. Paste the whole command from Configure, as in step 3.
`Parameter 4 holds the binary runtime command`	You pasted the `sudo bash` command. In Configure, copy the command from the Linux tab, which starts with `sudo python3`.
`No usable python3`	Install the Xcode Command Line Tools or the python.org package, then run the policy again.
`Could not download the installer`	Egress to `getunbound.ai` is blocked. Check your allow-list, including any TLS-inspecting proxy.
Policy shows Failed	Open Computers → Policies → Unbound daily onboard → Logs and read the output. It names the step that failed.

Remove Unbound

First disable the Unbound daily onboard policy or remove the Macs from its scope. If you skip this, the next check-in installs Unbound again. Then run:

sudo python3 -c "$(curl -fsSL https://getunbound.ai/setup/mdm/onboard)" --clear

This removes the managed configuration for every supported tool. The scan on this path is one-shot, so there is no schedule to tear down. Then delete /Library/Application Support/Unbound. Two things are left on purpose. Each user’s own ~/.unbound/config.json stays, so a developer who set Unbound up themselves is not logged out by a fleet rollback — delete that file, or run unbound nuke as that user, to remove it. And the inventory already reported for the device stays in the dashboard: clearing a device stops new reports rather than erasing old ones. Seven days after its last report the device is marked Stale on AI Tools Discovery and counted on the Stale Devices card on the dashboard home.

Getting Started

CLI

Policies

Analytics

Integrations

MDM Integrations

Connections

Support & Troubleshooting

Overview

1. Copy your install command

2. Create the script

3. Create the policy

Troubleshooting

Remove Unbound

​Overview

​1. Copy your install command

​2. Create the script

​3. Create the policy

​Troubleshooting

​Remove Unbound

Overview

1. Copy your install command

2. Create the script

3. Create the policy

Troubleshooting

Remove Unbound