Skip to main content
This guide is for Jamf Pro administrators deploying CodeRabbit CLI across organization-managed Macs.
This script-based reference policy provides install and upgrade automation. It is not a signed package and does not include inventory, compliance reporting, or uninstall automation. Each employee authenticates with their own CodeRabbit account.

​
Before you start

  • macOS 13 or later on Apple Silicon or Intel
  • A Jamf Pro computer policy that runs scripts as root
  • Outbound HTTPS access to cli.coderabbit.ai
  • An approved CodeRabbit CLI version and its versioned Jamf release assets
  • No existing CodeRabbit installation that shadows /usr/local/bin/coderabbit or /usr/local/bin/cr
Intel Macs with Homebrew-owned /usr/local are outside this reference policy. Remove an existing CodeRabbit installation through its original installation method. Do not change Homebrew directory ownership or permissions to make the policy pass.

​
Download the release assets

Set version to the release approved by your organization. Download the policy and checksum manifest from that exact version; do not use latest.
The final command must report coderabbit-jamf-install.sh: OK. Read the two archive hashes for the Jamf parameters:

​
Configure the Jamf policy

1

Add the install script

Add coderabbit-jamf-install.sh to Jamf Pro as a computer-management script.
2

Set the release parameters

Label and set all three custom parameters from the same release.Never combine a version with hashes from another release.
3

Create the policy

Attach the script to a Jamf policy and start with a narrow pilot scope. Jamf runs computer policies as root; employees must not run this script themselves.
The policy verifies the selected archive hash, archive contents, and CodeRabbit Apple signature before replacing a managed command or payload. It installs the signed payload at /usr/local/libexec/coderabbit/coderabbit and exposes /usr/local/bin/coderabbit and /usr/local/bin/cr through a root-owned launcher. The expected Apple Team ID is 47UZS55279.

​
Verify the pilot

Pilot every hardware architecture present in your fleet before broad deployment. In an employee terminal, verify the managed command and approved version:
The first command must report /usr/local/bin/coderabbit. The managed installation disables self-updates. When a newer version is available, the CLI directs employees to contact IT instead of running coderabbit update.

​
Share with employees

CodeRabbit CLI is available through Jamf.
  1. Install CodeRabbit CLI from Jamf Self Service if it is not already installed.
  2. Open Terminal and run cr auth login.
  3. For the EU region, run cr auth login --region eu instead.
  4. Complete sign-in in your browser.
IT manages CLI updates. If the CLI reports that a newer version is available, contact IT; do not run coderabbit update.
The Jamf policy does not authenticate as root, modify user Keychain entries, or remove ~/.coderabbit data.

​
Update or roll back

Employee authentication remains unchanged. If the policy reports partial or untrusted managed paths, stop and inspect the Mac; the reference policy does not guess which unexpected files are safe to remove.

​
What’s next

Command-Line Review Tool

Learn how employees authenticate and run local reviews

CLI command reference

Review available CLI commands and options