> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enfors.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# The Enfors watcher

> A one-step installer that captures Claude Code and Claude Desktop by tailing their transcripts — no proxy, no CA. macOS and Windows.

The Enfors **watcher** captures Claude Code (CLI) and Claude Desktop, on macOS or Windows.
A single installer sets up a local Python process that reads their session transcripts and
streams completed turns to Enfors, signed in with your account. (Agent SDKs like the
OpenAI SDK integrate separately, by calling the Enfors gateway `llm.enfors.ai` directly.)

## Install

<Tabs>
  <Tab title="macOS">
    ```bash theme={null}
    curl -fsSL https://get.enfors.ai/install.sh | zsh
    ```
  </Tab>

  <Tab title="Windows (PowerShell)">
    ```powershell theme={null}
    irm https://get.enfors.ai/install.ps1 | iex
    ```
  </Tab>
</Tabs>

<Info>
  **Requirements** — macOS or Windows, and Python 3 (installed automatically if missing —
  via [Homebrew](https://brew.sh) on macOS, via winget on Windows). The watcher is a single
  file with **no third-party dependencies**. The installer is idempotent, and detects and
  supersedes any earlier proxy-based install. On macOS, the optional
  [menu bar indicator](#the-menu-bar-and-tray-indicator) additionally needs the Xcode Command Line
  Tools — without them it is skipped and the watcher installs normally. On Windows, the
  tray indicator compiles unconditionally (the .NET Framework compiler ships with Windows).
</Info>

## What it does

<Steps>
  <Step title="Installs Python 3">
    Detected, or installed automatically if missing (Homebrew on macOS, winget on
    Windows).
  </Step>

  <Step title="Installs the watcher">
    `enfors_watcher.py` is installed to `~/.enfors/hooks/` and registered to run at
    login — a LaunchAgent (`ai.enfors.watcher`) on macOS, a Scheduled Task
    (`EnforsWatcher`) on Windows — restarting only on a crash, never on a clean stop.
  </Step>

  <Step title="Signs you in with SSO">
    A browser-based Cognito OAuth2 + PKCE flow (callback on `localhost:8765`). Tokens are
    cached to `~/.enfors/hooks/tokens.json` and refreshed automatically.
  </Step>

  <Step title="Registers the Enfors MCP">
    Adds the Enfors MCP server to Claude Code and Claude Desktop.
  </Step>

  <Step title="Compiles the menu bar / tray indicator">
    A small app that shows the Enfors mark while monitoring is active.

    <Tabs>
      <Tab title="macOS">
        Built locally with `swiftc` when the Xcode Command Line Tools are present;
        skipped with a warning otherwise (re-run the installer after
        `xcode-select --install` to add it).
      </Tab>

      <Tab title="Windows">
        Compiled locally from C# (WinForms) via the .NET Framework compiler, which ships
        with Windows — no extra toolchain to install.
      </Tab>
    </Tabs>
  </Step>
</Steps>

<Frame caption="Installer — SSO sign-in step">
  <img src="https://mintcdn.com/enfors/Klv0sMKyL34AsmTT/images/installer-sso.svg?fit=max&auto=format&n=Klv0sMKyL34AsmTT&q=85&s=ffe3dfcacfb3fa155ea733141f7476ba" alt="Installer SSO step" width="1200" height="750" data-path="images/installer-sso.svg" />
</Frame>

## The `enfors` CLI

The installer adds an `enfors` command for managing the watcher — identical on macOS and
Windows:

```bash theme={null}
enfors login     # sign in with SSO (opens browser; caches token)
enfors check     # is the watcher running?
enfors start     # start it (and re-enable it at login)
enfors stop      # stop it (and disable it at login, until you start it again)
enfors logs      # tail ~/.enfors/hooks/watcher.log
enfors errors    # tail the watcher error log
enfors version   # installed watcher version
```

See [Managing credentials](/admin/credentials) for details.

## The menu bar and tray indicator

The installer sets up a **disclosure indicator** — the Enfors mark in the macOS menu bar
or the Windows system tray, visible exactly while monitoring is active. Clicking it shows
*"enfors workforce intelligence is active"* (macOS) or a matching context menu (Windows)
listing what's currently being captured.

The indicator is spawned and owned by the watcher itself — there is no separate
LaunchAgent or Scheduled Task for it. If the watcher stops (`enfors stop`, crash,
logout), the icon disappears within seconds; when the watcher runs again, it comes back.
**Icon on screen ⇔ transcripts are being captured** — it cannot show a stale state.

<Note>
  On macOS, compiling the indicator requires the **Xcode Command Line Tools**. On machines
  without them the installer prints a warning and skips it — monitoring itself is
  unaffected. Install them with `xcode-select --install` and re-run the installer to add
  the indicator. On Windows, the tray indicator compiles unconditionally — there's nothing
  extra to install.
</Note>

## Files it touches

| Path                                                            | Purpose                                 |
| --------------------------------------------------------------- | --------------------------------------- |
| `~/.enfors/hooks/enfors_watcher.py`                             | The watcher (single file, stdlib only). |
| `~/.enfors/hooks/watcher.env`                                   | Data API URL + Cognito settings.        |
| `~/.enfors/hooks/tokens.json`                                   | Cached SSO tokens (auto-refreshed).     |
| `~/.enfors/hooks/watcher.log` / `watcher.stderr.log`            | Watcher logs.                           |
| `~/.enfors/bin/enfors-indicator` (+ `.swift` source) — macOS    | Menu bar indicator, compiled locally.   |
| `~/.enfors/bin/enfors-indicator.exe` (+ `.cs` source) — Windows | Tray indicator, compiled locally.       |
| `~/Library/LaunchAgents/ai.enfors.watcher.plist` — macOS        | LaunchAgent (starts on login).          |
| Scheduled Task `EnforsWatcher` — Windows                        | Runs at login, restarts only on crash.  |

## Security

The watcher **reads** Claude Code and Claude Desktop's local transcripts and uploads completed turns over
HTTPS — there is no proxy, no TLS interception, and no root certificate installed. See
[Deployment & Security](/security/overview) for the full IT/CISO detail.

## Uninstall

<Tabs>
  <Tab title="macOS">
    ```bash theme={null}
    enfors-uninstall.sh
    ```
  </Tab>

  <Tab title="Windows (PowerShell)">
    ```powershell theme={null}
    irm https://get.enfors.ai/uninstall.ps1 | iex
    ```
  </Tab>
</Tabs>

See [Uninstall](/admin/uninstall).