Skip to main content

Deploy Agent Monitor with Microsoft Intune

Push managed hooks configuration through Microsoft Intune so macOS and Windows devices send AI coding agent activity to the MintMCP dashboard (no plugin required).

Requirements​

  • A MintMCP org key (see Find your org key).
  • Devices enrolled in Intune. macOS scripts also need the Intune management agent, which installs automatically the first time you assign a shell script. Windows scripts need the device to be Microsoft Entra joined or hybrid joined; the Intune Management Extension installs automatically the first time you assign a script.
  • No existing managed hooks file on devices — these scripts create it fresh and overwrite any prior version.

Find your org key​

Go to Agent Monitor setup. Your org key starts with llmorgkey_.

macOS​

Prepare the script​

Paste your org key from Agent Monitor setup — the script updates automatically so you can copy it ready to go.

#!/bin/bash
# Agent Monitor — Intune shell script (Claude Code, macOS)
# Writes managed-settings.json with native HTTP hooks for MintMCP.

set -euo pipefail

ORG_KEY="YOUR_ORG_KEY_HERE"

if [[ ! "$ORG_KEY" =~ ^llmorgkey_ ]]; then
echo "[AgentMonitor] ERROR: ORG_KEY not set. Edit the script and replace YOUR_ORG_KEY_HERE with your MintMCP org key."
exit 1
fi

TARGET_DIR="/Library/Application Support/ClaudeCode"
SETTINGS_FILE="${TARGET_DIR}/managed-settings.json"
mkdir -p "$TARGET_DIR"

cat > "$SETTINGS_FILE" <<JSON
{
"env": {
  "MINTMCP_ORG_KEY": "${ORG_KEY}"
},
"hooks": {
  "PreToolUse": [
    {
      "matcher": ".*",
      "hooks": [
        {
          "type": "http",
          "url": "https://app.mintmcp.com/hooks/claudecode",
          "headers": {
            "X-MINTMCP-ORG-KEY": "\$MINTMCP_ORG_KEY",
            "X-MINTMCP-USER": "\$USER"
          },
          "allowedEnvVars": [
            "MINTMCP_ORG_KEY",
            "USER"
          ]
        }
      ]
    }
  ],
  "PostToolUse": [
    {
      "matcher": ".*",
      "hooks": [
        {
          "type": "http",
          "url": "https://app.mintmcp.com/hooks/claudecode",
          "headers": {
            "X-MINTMCP-ORG-KEY": "\$MINTMCP_ORG_KEY",
            "X-MINTMCP-USER": "\$USER"
          },
          "allowedEnvVars": [
            "MINTMCP_ORG_KEY",
            "USER"
          ]
        }
      ]
    }
  ],
  "UserPromptSubmit": [
    {
      "hooks": [
        {
          "type": "http",
          "url": "https://app.mintmcp.com/hooks/claudecode",
          "headers": {
            "X-MINTMCP-ORG-KEY": "\$MINTMCP_ORG_KEY",
            "X-MINTMCP-USER": "\$USER"
          },
          "allowedEnvVars": [
            "MINTMCP_ORG_KEY",
            "USER"
          ]
        }
      ]
    }
  ]
}
}
JSON

/bin/chmod 0644 "$SETTINGS_FILE"
/usr/sbin/chown root:wheel "$SETTINGS_FILE"
echo "[AgentMonitor] Created ${SETTINGS_FILE} with MintMCP hooks enabled"

Add the script to Intune​

  1. In the Microsoft Intune admin center, go to Devices > Scripts and remediations > Platform scripts (you can also reach the same flow from Devices > By platform > macOS > Shell scripts).
  2. Click Add > macOS.
  3. Name it "MintMCP Agent Monitor Hooks (macOS)" and click Next.
  4. Paste the script (with your org key filled in) into the Script field, then set:
    • Run script as signed-in user: No — the script runs as root, which it needs to write to /Library/Application Support.
    • Script frequency: Not configured — runs once per device.
    • Max number of times to retry if script fails: 3 (optional).
  5. Assign it to the device groups running Claude Code or Cursor, then click Review + save.

Intune picks up the script on the agent's next check-in (roughly every 8 hours). The macOS device must be on macOS 12 or later.

Windows​

Prepare the script​

Paste your org key — the script updates automatically so you can copy it ready to go.

#Requires -Version 5
# Agent Monitor — Intune platform script (Claude Code, Windows)
# Writes managed-settings.json with native HTTP hooks for MintMCP.

$ErrorActionPreference = "Stop"

$OrgKey = "YOUR_ORG_KEY_HERE"

if ($OrgKey -notmatch '^llmorgkey_') {
Write-Error "[AgentMonitor] ORG_KEY not set. Edit the script and replace YOUR_ORG_KEY_HERE with your MintMCP org key."
exit 1
}

$TargetDir = "C:/Program Files/ClaudeCode"
$SettingsFile = "$TargetDir/managed-settings.json"
New-Item -ItemType Directory -Force -Path $TargetDir | Out-Null

$Settings = @'
{
"env": {
  "MINTMCP_ORG_KEY": "__ORG_KEY__"
},
"hooks": {
  "PreToolUse": [
    {
      "matcher": ".*",
      "hooks": [
        {
          "type": "http",
          "url": "https://app.mintmcp.com/hooks/claudecode",
          "headers": {
            "X-MINTMCP-ORG-KEY": "$MINTMCP_ORG_KEY",
            "X-MINTMCP-USER": "$USERNAME"
          },
          "allowedEnvVars": ["MINTMCP_ORG_KEY", "USERNAME"]
        }
      ]
    }
  ],
  "PostToolUse": [
    {
      "matcher": ".*",
      "hooks": [
        {
          "type": "http",
          "url": "https://app.mintmcp.com/hooks/claudecode",
          "headers": {
            "X-MINTMCP-ORG-KEY": "$MINTMCP_ORG_KEY",
            "X-MINTMCP-USER": "$USERNAME"
          },
          "allowedEnvVars": ["MINTMCP_ORG_KEY", "USERNAME"]
        }
      ]
    }
  ],
  "UserPromptSubmit": [
    {
      "hooks": [
        {
          "type": "http",
          "url": "https://app.mintmcp.com/hooks/claudecode",
          "headers": {
            "X-MINTMCP-ORG-KEY": "$MINTMCP_ORG_KEY",
            "X-MINTMCP-USER": "$USERNAME"
          },
          "allowedEnvVars": ["MINTMCP_ORG_KEY", "USERNAME"]
        }
      ]
    }
  ]
}
}
'@

$Settings = $Settings.Replace("__ORG_KEY__", $OrgKey)
[System.IO.File]::WriteAllText($SettingsFile, $Settings)
Write-Output "[AgentMonitor] Created $SettingsFile with MintMCP hooks enabled"

Add the script to Intune​

  1. In the Microsoft Intune admin center, go to Devices > Scripts and remediations > Platform scripts.
  2. Click Add > Windows 10 and later.
  3. Name it "MintMCP Agent Monitor Hooks (Windows)" and click Next.
  4. Paste the script (with your org key filled in) into the PowerShell script field, then set:
    • Run this script using the logged on credentials: No — the script runs as SYSTEM, which it needs to write to C:\Program Files and C:\ProgramData.
    • Enforce script signature check: No.
    • Run script in 64-bit PowerShell host: Yes.
  5. Assign it to the device groups running Claude Code or Cursor, then click Review + add.

The Intune Management Extension runs the script once on the next check-in. If it fails, the extension retries on the next three check-ins.

Keep the file enforced with Remediations​

A platform script runs once and doesn't re-apply if a user deletes the file. To enforce the configuration over time, repackage the same logic as a Remediation (Devices > Scripts and remediations > Create script package): a detection script that exits 1 when the file is missing or wrong, plus a remediation script that rewrites it, scheduled daily. Remediations require Windows Enterprise E3 or E5 (or Education A3/A5, or VDA) licensing.

Validate on a test device​

Confirm the files exist and contents look correct.

# Claude Code
cat "/Library/Application Support/ClaudeCode/managed-settings.json"

# Cursor
cat "/Library/Application Support/Cursor/hooks.json"
cat "/Library/Application Support/Cursor/mint.sh"

Launch the client and perform some actions. Verify activity appears in MintMCP Agent Monitor.

Hook events captured​

HookDescription
PreToolUseFired before any tool execution (Bash, Edit, Write, etc.)
PostToolUseFired after any tool execution completes
UserPromptSubmitFired when the user submits a prompt

Troubleshooting​

  • macOS script never runs: the Intune management agent installs on the first script assignment, then checks in roughly every 8 hours. Agent logs live in /Library/Logs/Microsoft/Intune.
  • Windows script never runs: confirm the device is Entra joined or hybrid joined — workplace-registered-only devices don't receive scripts.
  • Cursor activity missing on Windows: confirm mint.ps1 exists in C:\ProgramData\Cursor and check the Hooks Output panel in Cursor for errors.

Reach out to support@mintmcp.com if you have issues.