How do IT teams deploy APort across developer machines?

APort provides self-contained deploy, enforce, and uninstall scripts that can be reviewed, copied into device-management tooling, and configured with a template passport, framework, and enrollment key.

Does reinstalling create duplicate passports?

No. The enterprise deploy and enforce scripts reuse an existing device passport instance for the same template, framework, user, and device when one is already present.

Can device information collection be disabled?

Yes. Set DISABLE_DEVICE_INFO=1 when device metadata collection is not desired.

Enterprise Device Deployment

Roll out AI agent guardrails across developer machines.

APort gives IT and security teams self-contained deploy, enforce, and uninstall scripts for Claude Code, Cursor, and supported agent runtimes. Start with one developer machine, then expand when signed decisions prove the controls work.

See Enterprise pricing Review deployment docs

Unix deploy command

deploy.sh

export APORT_API_KEY="apk_..."
export APORT_TEMPLATE_ID="ap_..."
export APORT_FRAMEWORK="claude-code"
curl -fsSL "https://api.aport.io/enterprise/scripts/deploy" | sudo -E bash

IT can review the full script at the same URL, paste it into an MDM or device-management tool, and change only the variables at the top of the script.

Scripts default to the latest released guardrail package assets unless a version is explicitly pinned.

The org enrollment key is used to create setup material and is not retained as the runtime key.

Device metadata collection can be disabled with DISABLE_DEVICE_INFO=1.

Instance passports inherit from the selected template passport and are reused by device, user, framework, and template.

Script set

Deploy. Enforce. Remove.

The public endpoints serve the latest released bundled scripts from the APort guardrails release assets. Pin versions only when your IT change-management process requires it.

Deploy

Creates or reuses a device passport instance, mints a narrow runtime key, and installs the framework guardrail.

deploy.sh

export APORT_API_KEY="apk_..."
export APORT_TEMPLATE_ID="ap_..."
export APORT_FRAMEWORK="claude-code"
curl -fsSL "https://api.aport.io/enterprise/scripts/deploy" | sudo -E bash

View script source

Enforce

Checks whether APort is still installed and configured. If not, it repairs the install without creating a duplicate passport.

enforce.sh

export APORT_API_KEY="apk_..."
export APORT_TEMPLATE_ID="ap_..."
export APORT_FRAMEWORK="claude-code"
curl -fsSL "https://api.aport.io/enterprise/scripts/enforce" | sudo -E bash

View script source

Uninstall

Removes the local guardrail configuration and device state during an approved admin removal.

uninstall.sh

export APORT_FRAMEWORK="claude-code"
curl -fsSL "https://api.aport.io/enterprise/scripts/uninstall" | sudo -E bash

View script source

Windows support

PowerShell variants are served from the same endpoint family for Windows device-management tools.

PowerShell

Invoke-WebRequest -Uri "https://api.aport.io/enterprise/scripts/deploy.ps1" -OutFile "$env:TEMP\aport-device.ps1"

PowerShell

Invoke-WebRequest -Uri "https://api.aport.io/enterprise/scripts/enforce.ps1" -OutFile "$env:TEMP\aport-device.ps1"

PowerShell

Invoke-WebRequest -Uri "https://api.aport.io/enterprise/scripts/uninstall.ps1" -OutFile "$env:TEMP\aport-device.ps1"

What Enterprise adds

Hosted signed decisions and organization audit.
Template passport to device instance passport rollout.
GitHub Repository Guard setup across repositories.
Multi-region and private deployment options by agreement.
Security review, rollout planning, and support terms.

Enterprise starts at $4,990/month.

Team starts at $499/month when you only need one team, one repo, or one coding-agent runtime.