Install on macOS

The Flowstate Agent for macOS ships as a signed, notarised installer package (FlowstateAgent.pkg). It installs a menubar app and a NETransparentProxy system extension that measure your organisation's AI usage and forward it to the Flowstate cloud proxy at proxy.flowstate.inc. The extension is a pure HTTPS CONNECT-forwarder — it terminates no TLS on the device, so there is no local certificate authority and nothing to wire up by hand.

There are two ways to roll it out:

• Managed (MDM) — recommended for a fleet. The agent installs and activates silently; users see nothing.
• Direct install — for a single Mac or a team without MDM. The user installs the package, signs in, and approves two macOS prompts.

Get the installer

Download FlowstateAgent.pkg from Settings → AI → Cloud Proxy — the same page where you provision your org token. For a fleet, the release also publishes each signed build at a stable URL (https://binaries.flowstate.inc/macos/stable/FlowstateAgent-VERSION.pkg); the MDM deployment guide uses that URL directly.

Prerequisites

• macOS 13 Ventura or newer (Apple Silicon or Intel).
• Your org token, from Settings → AI → Cloud Proxy. Issue it once at the org level; the same token is used on every device.
• The user's email — this attributes captured usage to a person.

Managed rollout (MDM)

Two things: deploy the package, then push a configuration profile.

1. Deploy FlowstateAgent.pkg through your MDM's standard app/package workflow — Kandji Custom App, Jamf Pro package, Intune line-of-business app, or Mosyle pkg.

2. Push the configuration profile below. It does two things: silently approves the agent's system extension (so the user is never prompted) and configures the agent with your org token and the user's email.

The easiest way to get an accurate profile is to let Flowstate generate it: Settings → AI → Cloud Proxy → Generate MDM profile downloads a ready-to- upload .mobileconfig with your org token already embedded and the user email left as the $EMAIL placeholder. Upload it to your MDM as a custom profile. The MDM deployment guide walks Kandji, Mosyle, Intune, and Apple Business Manager end to end, including the exact per-MDM variable to substitute for $EMAIL.

If you prefer to build the profile by hand, use the template below. Replace the two placeholders before uploading:

• __ORG_TOKEN__ → your org token from Settings → AI → Cloud Proxy.
• $EMAIL → the assigned user's email. Every MDM exposes a per-device variable for this so a single profile serves the whole fleet; substitute your platform's token (Kandji/Jamf $EMAIL, Mosyle %Email%, Intune ). See the MDM deployment guide.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>PayloadType</key><string>Configuration</string>
  <key>PayloadVersion</key><integer>1</integer>
  <key>PayloadIdentifier</key><string>inc.flowstate.agent.mdm</string>
  <key>PayloadUUID</key><string>F1005741-0000-4000-A000-FLOWSTATE001</string>
  <key>PayloadDisplayName</key><string>Flowstate Agent</string>
  <key>PayloadOrganization</key><string>Flowstate</string>
  <key>PayloadScope</key><string>System</string>
  <key>PayloadContent</key>
  <array>
    <!-- Silently approve the Flowstate system extension. -->
    <dict>
      <key>PayloadType</key><string>com.apple.system-extension-policy</string>
      <key>PayloadIdentifier</key><string>inc.flowstate.agent.sysext-allow</string>
      <key>PayloadUUID</key><string>F1005741-0000-4000-A000-FLOWSTATE002</string>
      <key>PayloadVersion</key><integer>1</integer>
      <key>PayloadDisplayName</key><string>Flowstate — System Extension Allowlist</string>
      <key>AllowUserOverrides</key><true/>
      <key>AllowedTeamIdentifiers</key>
      <array><string>VC94Q6RPKS</string></array>
      <key>AllowedSystemExtensions</key>
      <dict>
        <key>VC94Q6RPKS</key>
        <array><string>inc.flowstate.agent.netproxy</string></array>
      </dict>
    </dict>
    <!-- Configure the agent: tenant, proxy, org token + user email. -->
    <dict>
      <key>PayloadType</key><string>com.apple.ManagedClient.preferences</string>
      <key>PayloadIdentifier</key><string>inc.flowstate.agent.prefs</string>
      <key>PayloadUUID</key><string>F1005741-0000-4000-A000-FLOWSTATE003</string>
      <key>PayloadVersion</key><integer>1</integer>
      <key>PayloadDisplayName</key><string>Flowstate — Managed Preferences</string>
      <key>PayloadContent</key>
      <dict>
        <key>inc.flowstate.agent</key>
        <dict>
          <key>Forced</key>
          <array>
            <dict>
              <key>mcx_preference_settings</key>
              <dict>
                <key>Tenant</key><string>acme.flowstate.inc</string>
                <key>ProxyUrl</key><string>https://proxy.flowstate.inc</string>
                <key>UserEmail</key><string>$EMAIL</string>
                <key>UserToken</key><string>__ORG_TOKEN__</string>
              </dict>
            </dict>
          </array>
        </dict>
      </dict>
    </dict>
  </array>
</dict>
</plist>

Set Tenant to your own tenant host (e.g. acme.flowstate.inc) and leave ProxyUrl as https://proxy.flowstate.inc unless you have been given a regional or dedicated endpoint. Optional keys — HiddenMode, UserCannotDisable, AutoUpdate, UpdateChannel — are documented in environment variables; omit them and the agent uses its defaults.

Once both payloads are delivered, the extension activates silently and the agent begins measuring on the device's next check-in — no user interaction. The agent authenticates as the device's user from UserEmail + UserToken; there is no client certificate to provision.

Direct install (no MDM)

For a single Mac, or a team without an MDM:

1. Open FlowstateAgent.pkg and follow the installer.
2. Launch Flowstate from the menubar and sign in with your work email.
3. Approve the two macOS prompts when they appear — Allow the system extension, and Allow the background item. There is no certificate-trust prompt: the agent terminates no TLS on the device.

That's it. The menubar shows capture running.

Verify

Open Claude Desktop, ChatGPT, Cursor, or claude.ai and use them as you normally would. Sessions appear under Settings → AI → Cloud Proxy within a few minutes.

Uninstall

Choose Disable agent from the Flowstate menubar, or remove the package components:

sudo /usr/local/bin/flowstate uninstall

macOS still requires the user to remove the system extension from System Settings → General → Login Items & Extensions — an OS guardrail that cannot be bypassed programmatically.

Troubleshooting

See troubleshooting for the full triage flow. The quickest checks if sessions aren't appearing:

• Is the menubar showing Capture: running?
• Is the org token the one you provisioned in Settings → AI → Cloud Proxy? (A 401 from the cloud proxy means a wrong or revoked token.)
• On a managed Mac, has the configuration profile been delivered? (System Settings → General → Device Management.) Confirm the system extension is loaded with systemextensionsctl list.