> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coderabbit.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Deploy CodeRabbit CLI with Jamf Pro

> Deploy and update a shared CodeRabbit CLI installation on managed Macs while keeping authentication per user.

This guide is for Jamf Pro administrators deploying CodeRabbit CLI across organization-managed Macs.

<Info>
  This script-based reference policy provides install and upgrade automation. It is not a signed package and does not include inventory, compliance reporting, or uninstall automation. Each employee authenticates with their own CodeRabbit account.
</Info>

## Before you start

* macOS 13 or later on Apple Silicon or Intel
* A Jamf Pro computer policy that runs scripts as `root`
* Outbound HTTPS access to `cli.coderabbit.ai`
* An approved CodeRabbit CLI version and its versioned Jamf release assets
* No existing CodeRabbit installation that shadows `/usr/local/bin/coderabbit` or `/usr/local/bin/cr`

<Warning>
  Intel Macs with Homebrew-owned `/usr/local` are outside this reference policy. Remove an existing CodeRabbit installation through its original installation method. Do not change Homebrew directory ownership or permissions to make the policy pass.
</Warning>

## Download the release assets

Set `version` to the release approved by your organization. Download the policy and checksum manifest from that exact version; do not use `latest`.

```bash theme={null}
version="<approved-version>"

curl --disable --fail --location --proto '=https' --tlsv1.2 \
  --output coderabbit-jamf-install.sh \
  "https://cli.coderabbit.ai/releases/${version}/coderabbit-jamf-install.sh"

curl --disable --fail --location --proto '=https' --tlsv1.2 \
  --output coderabbit-jamf-SHA256SUMS \
  "https://cli.coderabbit.ai/releases/${version}/coderabbit-jamf-SHA256SUMS"

grep 'coderabbit-jamf-install.sh$' coderabbit-jamf-SHA256SUMS | shasum -a 256 -c -
```

The final command must report `coderabbit-jamf-install.sh: OK`. Read the two archive hashes for the Jamf parameters:

```bash theme={null}
awk '$2 == "coderabbit-darwin-arm64.zip" { print $1 }' coderabbit-jamf-SHA256SUMS
awk '$2 == "coderabbit-darwin-x64.zip" { print $1 }' coderabbit-jamf-SHA256SUMS
```

## Configure the Jamf policy

<Steps>
  <Step title="Add the install script">
    Add `coderabbit-jamf-install.sh` to Jamf Pro as a computer-management script.
  </Step>

  <Step title="Set the release parameters">
    Label and set all three custom parameters from the same release.

    | Parameter | Value                                    |
    | --------- | ---------------------------------------- |
    | 4         | Exact CodeRabbit CLI version             |
    | 5         | SHA-256 of `coderabbit-darwin-arm64.zip` |
    | 6         | SHA-256 of `coderabbit-darwin-x64.zip`   |

    Never combine a version with hashes from another release.
  </Step>

  <Step title="Create the policy">
    Attach the script to a Jamf policy and start with a narrow pilot scope. Jamf runs computer policies as `root`; employees must not run this script themselves.
  </Step>
</Steps>

The policy verifies the selected archive hash, archive contents, and CodeRabbit Apple signature before replacing a managed command or payload. It installs the signed payload at `/usr/local/libexec/coderabbit/coderabbit` and exposes `/usr/local/bin/coderabbit` and `/usr/local/bin/cr` through a root-owned launcher. The expected Apple Team ID is `47UZS55279`.

## Verify the pilot

Pilot every hardware architecture present in your fleet before broad deployment. In an employee terminal, verify the managed command and approved version:

```bash theme={null}
command -v coderabbit
coderabbit --version
```

The first command must report `/usr/local/bin/coderabbit`. The managed installation disables self-updates. When a newer version is available, the CLI directs employees to contact IT instead of running `coderabbit update`.

## Share with employees

> CodeRabbit CLI is available through Jamf.
>
> 1. Install CodeRabbit CLI from Jamf Self Service if it is not already installed.
> 2. Open Terminal and run `cr auth login`.
> 3. For the EU region, run `cr auth login --region eu` instead.
> 4. Complete sign-in in your browser.
>
> IT manages CLI updates. If the CLI reports that a newer version is available, contact IT; do not run `coderabbit update`.

The Jamf policy does not authenticate as `root`, modify user Keychain entries, or remove `~/.coderabbit` data.

## Update or roll back

| Action   | Jamf change                                                                                                           |
| -------- | --------------------------------------------------------------------------------------------------------------------- |
| Upgrade  | Replace parameters 4–6 with the new approved version and both matching hashes, pilot it, then widen the policy scope. |
| Rollback | Restore the previously approved version-and-hash tuple and rerun the same policy.                                     |

Employee authentication remains unchanged. If the policy reports partial or untrusted managed paths, stop and inspect the Mac; the reference policy does not guess which unexpected files are safe to remove.

## What's next

<CardGroup cols={1}>
  <Card title="Command-Line Review Tool" href="/cli" icon="square-terminal" horizontal>
    Learn how employees authenticate and run local reviews
  </Card>

  <Card title="CLI command reference" href="/cli/reference" icon="terminal" horizontal>
    Review available CLI commands and options
  </Card>
</CardGroup>