Roll out with MDM

​

How valar runs under MDM

• Proxy setup runs as root, for a selected user. valar proxy enable needs administrator access: it sets the network proxy and installs the proxy services. Run it from a root policy with SUDO_USER set to the target account. valar does the user’s part of the setup as that user.
• Everything else runs as the user. valar configure, valar upgrade, and valar <harness> on|off need no administrator access. Run them as the signed-in user, either through your MDM’s option to run as the signed-in user or by switching to that user from a root script (see the example). Run valar upgrade this way, not through SUDO_USER.

​

Choose a lane

• A root certificate your MDM trusts. See Set up the proxy from a root policy.
• Each engineer signed in to Claude Code with their Claude account. Without it, Claude Code stops at “Not logged in”.

​

Deploy

1. Install the CLI at a path the user can run, such as /usr/local/bin/valar. See Install the CLI.
2. Give each engineer a coding key. Create keys in the dashboard or with key automation. Store each key as that user with valar configure --api-key <key>, or provide it through a protected VALAR_API_KEY environment variable. Keep keys out of policy arguments and logs.
3. Upgrade existing installs, as the user: valar upgrade --force. Finish this before setting up the proxy.
4. Set up the proxy, from a root policy (proxy lane only, see below).
5. Turn on each harness, as the user:
   valar claude-desktop on --force
   valar claude on --force
   valar cursor on --force   # macOS and Linux; add --valar-only for Valar only
   
6. Verify the proxy lane with valar <harness> status --verify after the user sends a request through that harness. On the direct lane, use valar <harness> status.
7. Keep it current. Whenever your MDM installs a new valar binary, run valar upgrade --force as the user. Until it runs, most commands refuse (V1A-1903).

​

Set up the proxy from a root policy

1. Deliver your root CA as an MDM configuration profile with a Certificate payload. Until it arrives, valar proxy enable stops with V1A-1106.
2. Put a leaf certificate for api.anthropic.com and its key on the Mac, readable by root. See Create an organization-managed certificate.

#!/bin/bash
set -euo pipefail

TARGET_USER="jdoe"
VALAR_BIN="/usr/local/bin/valar"

if [ "$(id -u)" -ne 0 ]; then
  echo "Run this policy as root." >&2
  exit 1
fi
if ! TARGET_UID="$(id -u "$TARGET_USER" 2>/dev/null)" || [ "$TARGET_UID" -eq 0 ]; then
  echo "Select an existing, non-root user." >&2
  exit 1
fi

SUDO_USER="$TARGET_USER" "$VALAR_BIN" proxy enable \
  --cert /absolute/path/leaf-bundle.pem --key /absolute/path/leaf.key

​

Restarts

• Claude Desktop quits and reopens in the background.
• Cursor quits and reopens.
• Claude Code closes interactive sessions and restarts background agents. Users reopen conversations with claude --resume.

​

Example: run as the signed-in user

#!/bin/bash
set -e

user=$(stat -f %Su /dev/console)
if [ "$user" = root ]; then
  echo "No user is signed in; retry later." >&2
  exit 1
fi
uid=$(id -u "$user")

as_user() {
  launchctl asuser "$uid" sudo -u "$user" -H /usr/local/bin/valar "$@"
}

as_user upgrade --force
as_user claude-desktop on --force
as_user claude on --force

​

Windows

1. Trust your organization’s root on each device: an Intune trusted certificate profile or Group Policy that installs it in the computer’s Trusted Root Certification Authorities store. See Trust and distribute.
2. Deliver each device’s leaf bundle and key to a location only the signed-in user can read. Setup copies both into its own protected folder.
3. Install the CLI. The installer places it at %USERPROFILE%\.local\bin\valar.exe.
4. Run the setup as the signed-in user:

$ErrorActionPreference = "Stop"
$valar = Join-Path $env:USERPROFILE ".local\bin\valar.exe"

function Invoke-Valar {
  & $valar @args
  if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
}

Invoke-Valar upgrade --force
Invoke-Valar proxy enable --cert C:\path\to\leaf-bundle.pem --key C:\path\to\leaf.key
Invoke-Valar claude-desktop on --force
Invoke-Valar claude on --force

​

Update older policies

• Selecting the user: root policies that relied only on HOME must set SUDO_USER or run as the user.
• Old command names: valar claude-desktop proxy still works as an alias for valar proxy. On proxy enable, --force, --no-restart, and --off are accepted and ignored with a warning. Put --force on the harness command instead, and use the harness’s off to stop routing.