Deployment Guides

Deploy Thoth MCP Proxy across enterprise environments with rollout and verification workflows.

For administrators

These guides cover configured enterprise environments. For the developer trial, start with Your first governed agent. Confirm enabled integrations and release artifacts before using a fleet runbook.

Use these Deployment Guides to install, configure, and validate Thoth MCP Proxy (thoth) in managed environments.

Fleet deployment entry points

Release pathways

Path	Primary audience	Start here
Homebrew tap (`atensecurity/tap`)	Developer endpoints + admin bootstrap	Release Channels + Verification
Notarized PKG (`thoth-macos-universal.pkg`)	MDM-managed macOS fleets	Release Channels + Verification
Signed Windows MSI (`Thoth-x64.msi`)	Intune and Windows endpoint engineering teams	Windows Enterprise Release Platform
Direct binaries from GitHub Releases	Linux/Windows packaging automation	Release Channels + Verification

Enterprise trust artifacts

Every thoth/v* binary release includes checksums, Sigstore keyless signatures, SBOMs (CycloneDX + SPDX), provenance, and Santa metadata.

Jamf onboarding

If you need to...	Start here
Understand Jamf onboarding flow end-to-end	Jamf Onboarding Overview
Configure Jamf policy parameters and rollout sequencing	Jamf macOS Runbook
Review macOS deployment/runtime reference details	macOS Deployment Reference (Jamf)

Intune onboarding

If you need to...	Start here
Understand Intune onboarding flow end-to-end	Intune Onboarding Overview
Roll out to employee Macs	Intune macOS Runbook
Roll out to employee Linux workstations	Intune Linux Runbook
Roll out to employee Windows workstations	Intune Windows Runbook
Automate script updates with Microsoft Graph	Intune Graph API Automation

Credentials and IDs

Keep onboarding values out of source control. Distinguish thoth tenant identifiers from Azure tenant identifiers in all deployment pipelines.

Operations follow-up

After deployment, use these operations guides for day-2 workflows: