# ManageEngine Endpoint Central Distribution

Deploy Capsule Security hooks for AI coding assistants across your fleet using **ManageEngine Endpoint Central** (formerly Desktop Central). This guide covers deployment for Cursor, GitHub Copilot, Claude Code, Devin (Windsurf), and Codex on both Windows and macOS using Endpoint Central **Configurations**.

## Prerequisites

- Access to the **Endpoint Central** console with administrative privileges
- Endpoint Central **agent** installed on target devices
- A **Capsule Security** account with admin access
- Target endpoints managed by Endpoint Central (Windows and/or macOS)


## Cursor

Deploy the Cursor hooks configuration using an Endpoint Central [**File Folder Operation**](https://www.manageengine.com/products/desktop-central/help/configuration-management/managing_windows_computer_files_folders.html) configuration.

### Step 1: Download the Configuration

1. Log in to the **Capsule Security** portal
2. Navigate to **Settings > Integrations**
3. Locate the **Cursor** integration
4. Download the `hooks.json` file


### Windows Deployment

1. Log in to the **Endpoint Central** console
2. Navigate to **Configurations > Configurations > Add Configuration > Windows > File Folder Operation**
3. Configure the operation:
  - **Name**: Capsule Security – Cursor Hooks (Windows)
  - **Description**: Deploys Capsule Security hooks configuration for Cursor
  - **Operation Type**: Copy
  - **Source File**: Upload the `hooks.json` file
  - **Destination Folder**: `C:\ProgramData\Cursor\`
  - **Overwrite if file exists**: Yes
  - **Create destination folder if it does not exist**: Yes
4. Define the [**Target**](https://www.manageengine.com/products/desktop-central/help/general/defining_targets.html):
  - Choose **Custom Group**, **Department**, or **Remote Office**
  - Select the appropriate Windows endpoints
5. Set the [**Execution Settings**](https://www.manageengine.com/products/desktop-central/help/configuration-management/configuring_execution_settings.html):
  - **Retry Options**: Retry on failure
  - **Execution Time**: Immediate (or schedule a maintenance window)
6. Click **Deploy**


### macOS Deployment

1. Navigate to **Configurations > Configurations > Add Configuration > Mac > File Folder Operation**
2. Configure the operation:
  - **Name**: Capsule Security – Cursor Hooks (macOS)
  - **Description**: Deploys Capsule Security hooks configuration for Cursor on macOS
  - **Operation Type**: Copy
  - **Source File**: Upload the `hooks.json` file
  - **Destination Folder**: `/Library/Application Support/Cursor/`
  - **File Permissions**: `644`
  - **Overwrite if file exists**: Yes
  - **Create destination folder if it does not exist**: Yes
3. Target the appropriate **Custom Group** of macOS endpoints
4. Click **Deploy**


### Verification

After deployment, restart Cursor on target devices, then:

1. Open Cursor Settings
2. Navigate to the **Hooks** tab
3. Confirm the hooks are listed and enabled


## GitHub Copilot

Deploy the GitHub Copilot hooks configuration using an Endpoint Central **Custom Script** configuration ([Windows](https://www.manageengine.com/products/desktop-central/help/configuration-management/executing_custom_scripts-computer.html), [macOS](https://www.manageengine.com/products/desktop-central/help/configuration-management/executing_custom_scripts_for_computer-mac.html)). GitHub Copilot stores its hooks under each user's profile, so the deployment iterates over local user profiles on the endpoint.

### Step 1: Download the Configuration

1. Log in to the **Capsule Security** portal
2. Navigate to **Settings > Integrations**
3. Locate the **GitHub Copilot** integration
4. Download the `capsule-hooks.json` file


### Windows Deployment

1. Log in to the **Endpoint Central** console
2. Navigate to **Configurations > Configurations > Add Configuration > Windows > Custom Script**
3. Configure the script:
  - **Name**: Capsule Security – GitHub Copilot Hooks (Windows)
  - **Description**: Deploys Capsule Security hooks configuration for GitHub Copilot in VS Code
  - **Script Type**: PowerShell
  - **Run As**: System
  - **Dependency File**: Upload the `capsule-hooks.json` file
4. Paste the following script:

```powershell
$hooksSource = Join-Path $PSScriptRoot "capsule-hooks.json"
$userProfiles = Get-ChildItem "C:\Users" -Directory | Where-Object { $_.Name -notin @('Public', 'Default', 'Default User', 'All Users') }

foreach ($profile in $userProfiles) {
    $hooksDir = Join-Path $profile.FullName "AppData\Roaming\Code\User\hooks"
    if (-not (Test-Path $hooksDir)) {
        New-Item -ItemType Directory -Path $hooksDir -Force | Out-Null
    }
    Copy-Item -Path $hooksSource -Destination (Join-Path $hooksDir "capsule-hooks.json") -Force
}

Write-Output "Capsule hooks configuration deployed successfully."
exit 0
```
5. Target the appropriate **Custom Group** of Windows endpoints
6. Click **Deploy**


### macOS Deployment

1. Navigate to **Configurations > Configurations > Add Configuration > Mac > Custom Script**
2. Configure the script:
  - **Name**: Capsule Security – GitHub Copilot Hooks (macOS)
  - **Description**: Deploys Capsule Security hooks configuration for GitHub Copilot on macOS
  - **Script Type**: Shell
  - **Run As**: Root
  - **Dependency File**: Upload the `capsule-hooks.json` file
3. Paste the following script:

```bash
#!/bin/bash
SOURCE="$(dirname "$0")/capsule-hooks.json"

for USER_HOME in /Users/*/; do
    USERNAME=$(basename "$USER_HOME")
    if [ "$USERNAME" = "Shared" ] || [ "$USERNAME" = ".localized" ]; then
        continue
    fi
    HOOKS_DIR="$USER_HOME/Library/Application Support/Code/User/hooks"
    mkdir -p "$HOOKS_DIR"
    cp "$SOURCE" "$HOOKS_DIR/capsule-hooks.json"
    chmod 644 "$HOOKS_DIR/capsule-hooks.json"
    chown "$USERNAME" "$HOOKS_DIR/capsule-hooks.json"
done
exit 0
```
4. Target the appropriate **Custom Group** of macOS endpoints
5. Click **Deploy**


### Verification

After deployment, restart VS Code on target devices, then:

1. Right-click in the **Chat** view and select **Diagnostics**
2. Confirm the hooks are loaded and enabled


## Claude Code

Deploy the Claude Code managed settings configuration using an Endpoint Central [**File Folder Operation**](https://www.manageengine.com/products/desktop-central/help/configuration-management/managing_windows_computer_files_folders.html) configuration.

### Step 1: Download the Configuration

1. Log in to the **Capsule Security** portal
2. Navigate to **Settings > Integrations**
3. Locate the **Claude Code** integration
4. Click **Install** and select your target platform
5. Download the `managed-settings.json` file


### Windows Deployment

1. Log in to the **Endpoint Central** console
2. Navigate to **Configurations > Configurations > Add Configuration > Windows > File Folder Operation**
3. Configure the operation:
  - **Name**: Capsule Security – Claude Code Hooks (Windows)
  - **Description**: Deploys Capsule Security managed settings for Claude Code
  - **Operation Type**: Copy
  - **Source File**: Upload the `managed-settings.json` file
  - **Destination Folder**: `C:\Program Files\ClaudeCode\`
  - **Overwrite if file exists**: Yes
  - **Create destination folder if it does not exist**: Yes
4. Target the appropriate **Custom Group** of Windows endpoints
5. Click **Deploy**


### macOS Deployment

1. Navigate to **Configurations > Configurations > Add Configuration > Mac > File Folder Operation**
2. Configure the operation:
  - **Name**: Capsule Security – Claude Code Hooks (macOS)
  - **Description**: Deploys Capsule Security managed settings for Claude Code on macOS
  - **Operation Type**: Copy
  - **Source File**: Upload the `managed-settings.json` file
  - **Destination Folder**: `/Library/Application Support/ClaudeCode/`
  - **File Permissions**: `644`
  - **Overwrite if file exists**: Yes
  - **Create destination folder if it does not exist**: Yes
3. Target the appropriate **Custom Group** of macOS endpoints
4. Click **Deploy**


### Verification

After deployment, restart Claude Code on target devices, then:

1. Run `/hooks` in Claude Code to confirm all hooks are listed
2. Start a session and verify events appear in the Capsule Security portal


## Devin (Windsurf)

Deploy the Devin (Windsurf) hooks configuration using Endpoint Central [**File Folder Operation**](https://www.manageengine.com/products/desktop-central/help/configuration-management/managing_windows_computer_files_folders.html) configurations. Cascade merges hook configurations from the system, user, and workspace levels, so deploying to the system-level path applies the Capsule hooks to every user on the device, and they cannot be disabled by end users.

### Step 1: Download the Configuration

1. Log in to the **Capsule Security** portal
2. Navigate to **Settings > Integrations**
3. Locate the **Devin (Windsurf)** integration
4. Choose **MDM** as the deployment method
5. For Windows endpoints, select **Windows** and extract the downloaded `capsule-windsurf-managed.zip` (contains `hooks.json` and the `CapsuleWindsurfHook.ps1` companion script)
6. For macOS endpoints, select **Mac** and download the `hooks.json` file


### Windows Deployment

First deploy the hooks configuration with a **File Folder Operation**:

1. Log in to the **Endpoint Central** console
2. Navigate to **Configurations > Configurations > Add Configuration > Windows > File Folder Operation**
3. Configure the operation:
  - **Name**: Capsule Security – Devin (Windsurf) Hooks (Windows)
  - **Description**: Deploys Capsule Security hooks configuration for Devin (Windsurf)
  - **Operation Type**: Copy
  - **Source File**: Upload the `hooks.json` file
  - **Destination Folder**: `C:\ProgramData\Windsurf\`
  - **Overwrite if file exists**: Yes
  - **Create destination folder if it does not exist**: Yes
4. Target the appropriate **Custom Group** of Windows endpoints and click **Deploy**


Then deploy the companion script with a second **File Folder Operation**:

1. Navigate to **Configurations > Configurations > Add Configuration > Windows > File Folder Operation**
2. Configure the operation:
  - **Name**: Capsule Security – Devin (Windsurf) Hook Script (Windows)
  - **Description**: Deploys the Capsule Security hook script for Devin (Windsurf)
  - **Operation Type**: Copy
  - **Source File**: Upload the `CapsuleWindsurfHook.ps1` file
  - **Destination Folder**: `C:\ProgramData\Capsule\WindsurfHooks\`
  - **Overwrite if file exists**: Yes
  - **Create destination folder if it does not exist**: Yes
3. Target the same **Custom Group** of Windows endpoints and click **Deploy**


> The `hooks.json` invokes the companion script from `C:\ProgramData\Capsule\WindsurfHooks\`, so both configurations must be deployed.


### macOS Deployment

1. Navigate to **Configurations > Configurations > Add Configuration > Mac > File Folder Operation**
2. Configure the operation:
  - **Name**: Capsule Security – Devin (Windsurf) Hooks (macOS)
  - **Description**: Deploys Capsule Security hooks configuration for Devin (Windsurf) on macOS
  - **Operation Type**: Copy
  - **Source File**: Upload the `hooks.json` file
  - **Destination Folder**: `/Library/Application Support/Windsurf/`
  - **File Permissions**: `644`
  - **Overwrite if file exists**: Yes
  - **Create destination folder if it does not exist**: Yes
3. Target the appropriate **Custom Group** of macOS endpoints
4. Click **Deploy**


### Verification

Hooks are loaded at application start, so after deployment, close Devin Desktop completely on target devices and reopen it, then:

1. Start a **Cascade** session and run a simple task to generate activity
2. In the Capsule portal, navigate to **Inventory > Agents** and confirm the agent appears


## Codex

Deploy the Codex [managed configuration](https://developers.openai.com/codex/enterprise/managed-configuration) using Endpoint Central [**File Folder Operation**](https://www.manageengine.com/products/desktop-central/help/configuration-management/managing_windows_computer_files_folders.html) configurations. Codex reads a managed `requirements.toml` from `/etc/codex/requirements.toml` (macOS) or `%ProgramData%\OpenAI\Codex\requirements.toml` (Windows); because the configuration is managed, the Capsule hooks are trusted by policy, apply to every user on the device (including users created later), and cannot be overridden or removed by users. No per-user trust approval is required.

### Step 1: Download the Configuration

1. Log in to the **Capsule Security** portal
2. Navigate to **Settings > Integrations**
3. Locate the **Codex** integration
4. Choose **MDM** as the deployment method
5. For Windows endpoints, select **Windows** and extract the downloaded `capsule-codex-managed.zip` (contains `requirements.toml` and the `CapsuleCodexHook.ps1` companion script)
6. For macOS endpoints, select **Mac** and download the `requirements.toml` file


### Windows Deployment

First deploy the managed configuration with a **File Folder Operation**:

1. Log in to the **Endpoint Central** console
2. Navigate to **Configurations > Configurations > Add Configuration > Windows > File Folder Operation**
3. Configure the operation:
  - **Name**: Capsule Security – Codex Managed Configuration (Windows)
  - **Description**: Deploys the Capsule Security managed configuration for Codex
  - **Operation Type**: Copy
  - **Source File**: Upload the `requirements.toml` file
  - **Destination Folder**: `C:\ProgramData\OpenAI\Codex\`
  - **Overwrite if file exists**: Yes
  - **Create destination folder if it does not exist**: Yes
4. Target the appropriate **Custom Group** of Windows endpoints and click **Deploy**


Then deploy the companion script with a second **File Folder Operation**:

1. Navigate to **Configurations > Configurations > Add Configuration > Windows > File Folder Operation**
2. Configure the operation:
  - **Name**: Capsule Security – Codex Hook Script (Windows)
  - **Description**: Deploys the Capsule Security hook script for Codex
  - **Operation Type**: Copy
  - **Source File**: Upload the `CapsuleCodexHook.ps1` file
  - **Destination Folder**: `C:\ProgramData\Capsule\CodexHooks\`
  - **Overwrite if file exists**: Yes
  - **Create destination folder if it does not exist**: Yes
3. Target the same **Custom Group** of Windows endpoints and click **Deploy**


> The managed configuration invokes the companion script from `C:\ProgramData\Capsule\CodexHooks\`, so both configurations must be deployed.


### macOS Deployment

1. Navigate to **Configurations > Configurations > Add Configuration > Mac > File Folder Operation**
2. Configure the operation:
  - **Name**: Capsule Security – Codex Managed Configuration (macOS)
  - **Description**: Deploys the Capsule Security managed configuration for Codex on macOS
  - **Operation Type**: Copy
  - **Source File**: Upload the `requirements.toml` file
  - **Destination Folder**: `/etc/codex/`
  - **File Permissions**: `644`
  - **Overwrite if file exists**: Yes
  - **Create destination folder if it does not exist**: Yes
3. Target the appropriate **Custom Group** of macOS endpoints
4. Click **Deploy**


### Verification

After deployment, close any running Codex CLI sessions on target devices, then:

1. Start a new Codex CLI session so the managed configuration is loaded
2. In the Capsule portal, navigate to **Inventory > Agents** and confirm the Codex agent appears


## Monitoring Deployments

After publishing configurations, monitor status in the Endpoint Central console ([Managing Configurations and Collections](https://www.manageengine.com/products/desktop-central/help/configuration-management/managing_configurations_collections.html)):

1. Navigate to **Configurations > Configurations**
2. Open the relevant configuration
3. Review the deployment status under the **Deployment Status** tab:
  - **Success**: Configuration applied to the endpoint
  - **In Progress**: Awaiting agent check-in
  - **Failed / Retry in Progress**: Inspect the agent log or **Action Log Viewer**
4. For an inventory-level view, use **Inventory > Files & Folders** to verify the deployed configuration files exist on target endpoints


## Key Considerations

- Endpoint Central runs File Folder Operations and Custom Scripts as **SYSTEM** (Windows) or **root** (macOS) by default
- **Cursor**, **Claude Code**, **Devin (Windsurf)**, and **Codex** use system-level paths - deploy to **device** Custom Groups
- **GitHub Copilot** uses user-level paths - the deployment scripts iterate over each local user profile on the endpoint to cover every user; redeploy (or rely on the agent refresh cycle) to cover users created later
- **Codex** uses a managed configuration (`requirements.toml`) enforced by policy - it applies to all users on the device (including users created later) and cannot be overridden by user-level configuration
- **Devin (Windsurf)** merges system, user, and workspace hook configurations, so the system-level deployment coexists with any per-user hooks and cannot be disabled by end users
- For GitHub Copilot CLI users, create an additional configuration targeting `%USERPROFILE%\.copilot\hooks\capsule-hooks.json` (Windows) or `~/.copilot/hooks/capsule-hooks.json` (macOS)
- To update configurations, edit the source file in the existing configuration and redeploy - Endpoint Central will re-execute on the next agent refresh cycle
- Use [**Custom Groups**](https://www.manageengine.com/products/desktop-central/help/general/defining_targets.html) to target specific OS versions, departments, or Remote Offices for staged rollouts
- All five integrations can be deployed as separate configurations and assigned independently
- Restart each application on target devices after deployment for hooks to take effect


## Support

For help with deployment:

- **Email**: support@capsule.security
- **Include**: Your organization ID, Endpoint Central environment details, and any error messages


## References

- [Endpoint Central - Configurations Overview](https://www.manageengine.com/products/desktop-central/help/configuration-management/configurations.html)
- [Endpoint Central - File Folder Operation Configuration](https://www.manageengine.com/products/desktop-central/help/configuration-management/managing_windows_computer_files_folders.html)
- [Endpoint Central - Custom Script Configuration (Windows)](https://www.manageengine.com/products/desktop-central/help/configuration-management/executing_custom_scripts-computer.html)
- [Endpoint Central - Custom Script Configuration (macOS)](https://www.manageengine.com/products/desktop-central/help/configuration-management/executing_custom_scripts_for_computer-mac.html)
- [Endpoint Central - Mac Computer Configurations](https://www.manageengine.com/products/desktop-central/help/configuration-management/mac_computer_configuration.html)
- [Endpoint Central - Defining Targets](https://www.manageengine.com/products/desktop-central/help/general/defining_targets.html)
- [Endpoint Central - Defining Execution Settings](https://www.manageengine.com/products/desktop-central/help/configuration-management/configuring_execution_settings.html)
- [Endpoint Central - Managing Configurations and Collections](https://www.manageengine.com/products/desktop-central/help/configuration-management/managing_configurations_collections.html)
- [Codex Hooks](https://developers.openai.com/codex/hooks)
- [Codex Managed Configuration](https://developers.openai.com/codex/enterprise/managed-configuration)