agenshield is the signed command-line entry point — a single Apple-notarized
binary installed alongside the app.
Every command accepts --json for machine-readable output and --quiet to
suppress progress display, which is what you want in MDM scripts and CI.
Setup
Status and health
The status report ends in one verdict line:
✅ Healthy,
○ Running, not enrolled, ⚠ Degraded (with the reasons),
⛔ Boot-locked, or ✗ Not running.
Common issues covers what to do about each.
Working with agents
You do not need a command to launch or use an agent under AgenShield. Start it the way you always have — your organization’s policy is applied by the security extensions automatically, not by a wrapper command.Diagnostics
For a full support bundle, see
Collecting diagnostics.
Lifecycle
When something is wrong
1
agenshield status
The system report — the verdict line tells you whether anything needs
attention, and which section it is in.
2
agenshield doctor
Names the failing component. Most first-install issues are an ungranted
approval — see What gets installed.
3
agenshield logs
Reproduce the problem while this is streaming.
4
Collect a bundle
If the above did not resolve it — see
Collecting diagnostics.