ManageEngine Endpoint Central Distribution

Deploy Capsule Security hooks for AI coding assistants across your fleet using ManageEngine Endpoint Central (formerly Desktop Central). This guide covers deployment for Cursor, GitHub Copilot, Claude Code, Devin (Windsurf), and Codex on both Windows and macOS using Endpoint Central Configurations.

• Access to the Endpoint Central console with administrative privileges
• Endpoint Central agent installed on target devices
• A Capsule Security account with admin access
• Target endpoints managed by Endpoint Central (Windows and/or macOS)

Deploy the Cursor hooks configuration using an Endpoint Central File Folder Operation configuration.

1. Log in to the Capsule Security portal
2. Navigate to Settings > Integrations
3. Locate the Cursor integration
4. Download the hooks.json file

1. Log in to the Endpoint Central console
2. Navigate to Configurations > Configurations > Add Configuration > Windows > File Folder Operation
3. Configure the operation:
   • Name: Capsule Security – Cursor Hooks (Windows)
   • Description: Deploys Capsule Security hooks configuration for Cursor
   • Operation Type: Copy
   • Source File: Upload the hooks.json file
   • Destination Folder: C:\ProgramData\Cursor\
   • Overwrite if file exists: Yes
   • Create destination folder if it does not exist: Yes
4. Define the Target:
   • Choose Custom Group, Department, or Remote Office
   • Select the appropriate Windows endpoints
5. Set the Execution Settings:
   • Retry Options: Retry on failure
   • Execution Time: Immediate (or schedule a maintenance window)
6. Click Deploy

1. Navigate to Configurations > Configurations > Add Configuration > Mac > File Folder Operation
2. Configure the operation:
   • Name: Capsule Security – Cursor Hooks (macOS)
   • Description: Deploys Capsule Security hooks configuration for Cursor on macOS
   • Operation Type: Copy
   • Source File: Upload the hooks.json file
   • Destination Folder: /Library/Application Support/Cursor/
   • File Permissions: 644
   • Overwrite if file exists: Yes
   • Create destination folder if it does not exist: Yes
3. Target the appropriate Custom Group of macOS endpoints
4. Click Deploy

After deployment, restart Cursor on target devices, then:

1. Open Cursor Settings
2. Navigate to the Hooks tab
3. Confirm the hooks are listed and enabled

Deploy the GitHub Copilot hooks configuration using an Endpoint Central Custom Script configuration. GitHub Copilot stores its hooks under each user's profile, so the deployment iterates over local user profiles on the endpoint.

1. Log in to the Capsule Security portal
2. Navigate to Settings > Integrations
3. Locate the GitHub Copilot integration
4. Download the hooks.json file

1. Log in to the Endpoint Central console

2. Navigate to Configurations > Configurations > Add Configuration > Windows > Custom Script

3. Configure the script:

   • Name: Capsule Security – GitHub Copilot Hooks (Windows)
   • Description: Deploys Capsule Security hooks configuration for GitHub Copilot in VS Code
   • Script Type: PowerShell
   • Run As: System
   • Dependency File: Upload the hooks.json file

4. Paste the following script:

   $hooksSource = Join-Path $PSScriptRoot "hooks.json"
   $userProfiles = Get-ChildItem "C:\Users" -Directory | Where-Object { $_.Name -notin @('Public', 'Default', 'Default User', 'All Users') }
   
   foreach ($profile in $userProfiles) {
       $hooksDir = Join-Path $profile.FullName "AppData\Roaming\Code\User\hooks"
       if (-not (Test-Path $hooksDir)) {
           New-Item -ItemType Directory -Path $hooksDir -Force | Out-Null
       }
       Copy-Item -Path $hooksSource -Destination (Join-Path $hooksDir "hooks.json") -Force
   }
   
   Write-Output "Capsule hooks configuration deployed successfully."
   exit 0

5. Target the appropriate Custom Group of Windows endpoints

6. Click Deploy

1. Navigate to Configurations > Configurations > Add Configuration > Mac > Custom Script

2. Configure the script:

   • Name: Capsule Security – GitHub Copilot Hooks (macOS)
   • Description: Deploys Capsule Security hooks configuration for GitHub Copilot on macOS
   • Script Type: Shell
   • Run As: Root
   • Dependency File: Upload the hooks.json file

3. Paste the following script:

   #!/bin/bash
   SOURCE="$(dirname "$0")/hooks.json"
   
   for USER_HOME in /Users/*/; do
       USERNAME=$(basename "$USER_HOME")
       if [ "$USERNAME" = "Shared" ] || [ "$USERNAME" = ".localized" ]; then
           continue
       fi
       HOOKS_DIR="$USER_HOME/Library/Application Support/Code/User/hooks"
       mkdir -p "$HOOKS_DIR"
       cp "$SOURCE" "$HOOKS_DIR/hooks.json"
       chmod 644 "$HOOKS_DIR/hooks.json"
       chown "$USERNAME" "$HOOKS_DIR/hooks.json"
   done
   exit 0

4. Target the appropriate Custom Group of macOS endpoints

5. Click Deploy

After deployment, restart VS Code on target devices, then:

1. Right-click in the Chat view and select Diagnostics
2. Confirm the hooks are loaded and enabled

Deploy the Claude Code managed settings configuration using an Endpoint Central File Folder Operation configuration.

1. Log in to the Capsule Security portal
2. Navigate to Settings > Integrations
3. Locate the Claude Code integration
4. Click Install and select your target platform
5. Download the managed-settings.json file

1. Log in to the Endpoint Central console
2. Navigate to Configurations > Configurations > Add Configuration > Windows > File Folder Operation
3. Configure the operation:
   • Name: Capsule Security – Claude Code Hooks (Windows)
   • Description: Deploys Capsule Security managed settings for Claude Code
   • Operation Type: Copy
   • Source File: Upload the managed-settings.json file
   • Destination Folder: C:\Program Files\ClaudeCode\
   • Overwrite if file exists: Yes
   • Create destination folder if it does not exist: Yes
4. Target the appropriate Custom Group of Windows endpoints
5. Click Deploy

1. Navigate to Configurations > Configurations > Add Configuration > Mac > File Folder Operation
2. Configure the operation:
   • Name: Capsule Security – Claude Code Hooks (macOS)
   • Description: Deploys Capsule Security managed settings for Claude Code on macOS
   • Operation Type: Copy
   • Source File: Upload the managed-settings.json file
   • Destination Folder: /Library/Application Support/ClaudeCode/
   • File Permissions: 644
   • Overwrite if file exists: Yes
   • Create destination folder if it does not exist: Yes
3. Target the appropriate Custom Group of macOS endpoints
4. Click Deploy

After deployment, restart Claude Code on target devices, then:

1. Run /hooks in Claude Code to confirm all hooks are listed
2. Start a session and verify events appear in the Capsule Security portal

Deploy the Devin (Windsurf) hooks configuration using Endpoint Central File Folder Operation configurations. Cascade merges hook configurations from the system, user, and workspace levels, so deploying to the system-level path applies the Capsule hooks to every user on the device, and they cannot be disabled by end users.

1. Log in to the Capsule Security portal
2. Navigate to Settings > Integrations
3. Locate the Devin (Windsurf) integration
4. Choose MDM as the deployment method
5. For Windows endpoints, select Windows and extract the downloaded capsule-windsurf-managed.zip (contains hooks.json and the CapsuleWindsurfHook.ps1 companion script)
6. For macOS endpoints, select Mac and download the hooks.json file

First deploy the hooks configuration with a File Folder Operation:

1. Log in to the Endpoint Central console
2. Navigate to Configurations > Configurations > Add Configuration > Windows > File Folder Operation
3. Configure the operation:
   • Name: Capsule Security – Devin (Windsurf) Hooks (Windows)
   • Description: Deploys Capsule Security hooks configuration for Devin (Windsurf)
   • Operation Type: Copy
   • Source File: Upload the hooks.json file
   • Destination Folder: C:\ProgramData\Windsurf\
   • Overwrite if file exists: Yes
   • Create destination folder if it does not exist: Yes
4. Target the appropriate Custom Group of Windows endpoints and click Deploy

Then deploy the companion script with a second File Folder Operation:

1. Navigate to Configurations > Configurations > Add Configuration > Windows > File Folder Operation
2. Configure the operation:
   • Name: Capsule Security – Devin (Windsurf) Hook Script (Windows)
   • Description: Deploys the Capsule Security hook script for Devin (Windsurf)
   • Operation Type: Copy
   • Source File: Upload the CapsuleWindsurfHook.ps1 file
   • Destination Folder: C:\ProgramData\Capsule\WindsurfHooks\
   • Overwrite if file exists: Yes
   • Create destination folder if it does not exist: Yes
3. Target the same Custom Group of Windows endpoints and click Deploy

The hooks.json invokes the companion script from C:\ProgramData\Capsule\WindsurfHooks\, so both configurations must be deployed.

1. Navigate to Configurations > Configurations > Add Configuration > Mac > File Folder Operation
2. Configure the operation:
   • Name: Capsule Security – Devin (Windsurf) Hooks (macOS)
   • Description: Deploys Capsule Security hooks configuration for Devin (Windsurf) on macOS
   • Operation Type: Copy
   • Source File: Upload the hooks.json file
   • Destination Folder: /Library/Application Support/Windsurf/
   • File Permissions: 644
   • Overwrite if file exists: Yes
   • Create destination folder if it does not exist: Yes
3. Target the appropriate Custom Group of macOS endpoints
4. Click Deploy

Hooks are loaded at application start, so after deployment, close Devin Desktop completely on target devices and reopen it, then:

1. Start a Cascade session and run a simple task to generate activity
2. In the Capsule portal, navigate to Inventory > Agents and confirm the agent appears

Deploy the Codex managed configuration using Endpoint Central File Folder Operation configurations. Codex reads a managed requirements.toml from /etc/codex/requirements.toml (macOS) or %ProgramData%\OpenAI\Codex\requirements.toml (Windows); because the configuration is managed, the Capsule hooks are trusted by policy, apply to every user on the device (including users created later), and cannot be overridden or removed by users. No per-user trust approval is required.

1. Log in to the Capsule Security portal
2. Navigate to Settings > Integrations
3. Locate the Codex integration
4. Choose MDM as the deployment method
5. For Windows endpoints, select Windows and extract the downloaded capsule-codex-managed.zip (contains requirements.toml and the CapsuleCodexHook.ps1 companion script)
6. For macOS endpoints, select Mac and download the requirements.toml file

First deploy the managed configuration with a File Folder Operation:

1. Log in to the Endpoint Central console
2. Navigate to Configurations > Configurations > Add Configuration > Windows > File Folder Operation
3. Configure the operation:
   • Name: Capsule Security – Codex Managed Configuration (Windows)
   • Description: Deploys the Capsule Security managed configuration for Codex
   • Operation Type: Copy
   • Source File: Upload the requirements.toml file
   • Destination Folder: C:\ProgramData\OpenAI\Codex\
   • Overwrite if file exists: Yes
   • Create destination folder if it does not exist: Yes
4. Target the appropriate Custom Group of Windows endpoints and click Deploy

Then deploy the companion script with a second File Folder Operation:

1. Navigate to Configurations > Configurations > Add Configuration > Windows > File Folder Operation
2. Configure the operation:
   • Name: Capsule Security – Codex Hook Script (Windows)
   • Description: Deploys the Capsule Security hook script for Codex
   • Operation Type: Copy
   • Source File: Upload the CapsuleCodexHook.ps1 file
   • Destination Folder: C:\ProgramData\Capsule\CodexHooks\
   • Overwrite if file exists: Yes
   • Create destination folder if it does not exist: Yes
3. Target the same Custom Group of Windows endpoints and click Deploy

The managed configuration invokes the companion script from C:\ProgramData\Capsule\CodexHooks\, so both configurations must be deployed.

1. Navigate to Configurations > Configurations > Add Configuration > Mac > File Folder Operation
2. Configure the operation:
   • Name: Capsule Security – Codex Managed Configuration (macOS)
   • Description: Deploys the Capsule Security managed configuration for Codex on macOS
   • Operation Type: Copy
   • Source File: Upload the requirements.toml file
   • Destination Folder: /etc/codex/
   • File Permissions: 644
   • Overwrite if file exists: Yes
   • Create destination folder if it does not exist: Yes
3. Target the appropriate Custom Group of macOS endpoints
4. Click Deploy

After deployment, close any running Codex CLI sessions on target devices, then:

1. Start a new Codex CLI session so the managed configuration is loaded
2. In the Capsule portal, navigate to Inventory > Agents and confirm the Codex agent appears

After publishing configurations, monitor status in the Endpoint Central console:

1. Navigate to Configurations > Configurations
2. Open the relevant configuration
3. Review the deployment status under the Deployment Status tab:
   • Success: Configuration applied to the endpoint
   • In Progress: Awaiting agent check-in
   • Failed / Retry in Progress: Inspect the agent log or Action Log Viewer
4. For an inventory-level view, use Inventory > Files & Folders to verify the deployed configuration files exist on target endpoints

• Endpoint Central runs File Folder Operations and Custom Scripts as SYSTEM (Windows) or root (macOS) by default
• Cursor, Claude Code, Devin (Windsurf), and Codex use system-level paths - deploy to device Custom Groups
• GitHub Copilot uses user-level paths - the deployment scripts iterate over each local user profile on the endpoint to cover every user; redeploy (or rely on the agent refresh cycle) to cover users created later
• Codex uses a managed configuration (requirements.toml) enforced by policy - it applies to all users on the device (including users created later) and cannot be overridden by user-level configuration
• Devin (Windsurf) merges system, user, and workspace hook configurations, so the system-level deployment coexists with any per-user hooks and cannot be disabled by end users
• For GitHub Copilot CLI users, create an additional configuration targeting %USERPROFILE%\.github\hooks\hooks.json (Windows) or ~/.github/hooks/hooks.json (macOS)
• To update configurations, edit the source file in the existing configuration and redeploy - Endpoint Central will re-execute on the next agent refresh cycle
• Use Custom Groups to target specific OS versions, departments, or Remote Offices for staged rollouts
• All five integrations can be deployed as separate configurations and assigned independently
• Restart each application on target devices after deployment for hooks to take effect

For help with deployment:

• Email: support@capsule.security
• Include: Your organization ID, Endpoint Central environment details, and any error messages

• Endpoint Central – File Folder Operation Configuration
• Endpoint Central – Custom Script Configuration
• Endpoint Central – macOS Configurations
• Codex Hooks
• Codex Managed Configuration