Install an endpoint

Supported endpoints

Recursift supports one endpoint profile in this release: a Mac with Apple silicon, installed from the Recursift Mac installer. The agent runs as a background service for the user who is signed in at the Mac, in observe-only mode. It records what it would do and never blocks, kills, quarantines or changes firewall rules.

Before you start

You need a Recursift console account at https://recursift.app, administrator rights on the Mac to run an installer, and a user signed in at the Mac while the installer runs. The installer registers the service for that signed-in user; if nobody is signed in at the screen, it installs files but registers nothing. The Mac needs outbound HTTPS to recursift.app and updates.recursift.app.

1. Create the endpoint in the console

Open the Agents page at https://recursift.app/dashboard and choose Create agent. Give it a name or leave it blank; a blank name is replaced by the Mac's hostname when it enrolls. The dialog shows an enrollment command with a token that starts with rcs_. The token is shown once, works once, and expires after 24 hours. Copy only the token for the next steps.

2. Install the package

Use Download for Mac in the same dialog, or download from https://updates.recursift.app/download/mac. Open the package and follow the installer. It places Recursift in /Applications/Recursift, keeps its state in ~/Library/Application Support/Recursift, and starts two services for the signed-in user: com.recursift.agent, the background agent, and com.recursift.app, the menu bar app. Reinstalling keeps existing settings and state.

/Applications/Recursift/recursift-agent version

Success prints recursift-agent, a version number, and observe_only.

3. Enroll the endpoint

Enroll with the installed binary and point it at the service's state folder. Reading the token from standard input keeps it out of your shell history: paste the token, press Return, then press Control-D.

export RECURSIFT_AGENT_HOME="$HOME/Library/Application Support/Recursift/native-agent"
/Applications/Recursift/recursift-agent enroll --server https://recursift.app --token-stdin

Success prints Enrolled agent followed by the agent ID, and a console link to that agent. The command refuses to replace an existing enrollment unless you add --force.

4. Restart the background service

The service reads its enrollment when it starts, so restart it once after enrolling.

launchctl kickstart -k "gui/$(id -u)/com.recursift.agent"
launchctl print "gui/$(id -u)/com.recursift.agent" | grep -E "state|pid"

Success shows state = running and a process ID.

5. Verify the first heartbeat

export RECURSIFT_AGENT_HOME="$HOME/Library/Application Support/Recursift/native-agent"
/Applications/Recursift/recursift-agent status

The JSON output should show mode observe_only, the server_url you enrolled with, and an agent_id matching the console. It never prints the agent key. credential_store names where the key is kept.

In the console, the endpoint's presence dot turns green (online) once a heartbeat arrives within twice the poll interval plus ten seconds. With the default ten-second poll interval that is 30 seconds. The list also shows the agent version and last-seen time. If the dot stays gray, work through Triage health and incidents.

Uninstall

First revoke the endpoint in the console (agent page, menu, Revoke agent) so its key stops working. Then, signed in as the same user on the Mac:

launchctl bootout "gui/$(id -u)/com.recursift.agent"
launchctl bootout "gui/$(id -u)/com.recursift.app"
rm -f ~/Library/LaunchAgents/com.recursift.agent.plist ~/Library/LaunchAgents/com.recursift.app.plist
sudo rm -rf /Applications/Recursift
rm -rf "$HOME/Library/Application Support/Recursift"
security delete-generic-password -s recursift-agent -a agent-identity
security delete-generic-password -s app.recursift.agent.evidence-kek -a kek-v1

Success: launchctl print for either service reports that it cannot find the service, and /Applications/Recursift no longer exists. The last two commands remove the enrollment credential and the evidence key from the login keychain; each reports an error if the item was never created, which is safe to ignore.