Uninstall AgentKeeper

Quit Claude Desktop and Claude Code before uninstalling. Choose the exact installation track first: Windows package, universal macOS PKG, managed Linux RPM, or legacy standalone shell install. Do not run the standalone shell uninstaller on an RPM-managed host or a Mac managed by the universal PKG.

Windows

Run these from PowerShell. Use the unified package command plus the separate Cowork command for a clean reinstall when the workstation has both coverage paths.

Unified runtime, Claude Code, gateway, and Windows hooks

Use uninstall.ps1 bundled with the same IntuneWin release. It removes the Windows service and gateway, C:\ProgramData\AgentKeeper hook forwarders and proof markers, selected IDE configs, and AgentKeeper-owned Claude Code hook blocks from the machine-managed base file C:\Program Files\ClaudeCode\managed-settings.json.

%SystemRoot%\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\uninstall.ps1

The helper reads the exact IDE target set from the successful install marker. Do not add -IdeTargets all to the normal package or Intune uninstall command.

Claude Code is machine-scoped on Windows and does not need a target developer. The helper uses a trusted persisted target for Antigravity and for cleanup of AgentKeeper entries left by older installers in %USERPROFILE%\.claude\settings.json. If that state is unavailable and either cleanup is required, pass the developer explicitly:

%SystemRoot%\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\uninstall.ps1 -IdeTargets all -TargetUser "DOMAIN\developer"
%SystemRoot%\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\uninstall.ps1 -IdeTargets all -TargetUserUpn "developer@example.com"

The current installer writes Claude Code hooks to the base machine-managed file, not C:\ProgramData\ClaudeCode, managed-settings.d, or user settings. During upgrade, legacy user-hook cleanup happens only after the managed repair succeeds and verifies. During uninstall, the machine-managed file is handled first and only AgentKeeper-owned legacy entries are removed afterward. See Claude Code's configuration reference for the vendor-managed Windows path.

Claude Desktop / Cowork only

Removes the AgentKeeper Cowork local plugin from each %APPDATA%\Claude\local-agent-mode-sessions\...\cowork_plugins workspace and removes the local Cowork API key by default.

$scriptPath=Join-Path $env:TEMP 'cowork-windows-uninstall.ps1'; Invoke-WebRequest -UseBasicParsing 'https://www.agentkeeper.dev/cowork-windows-uninstall.ps1' -OutFile $scriptPath; & powershell.exe -NoProfile -ExecutionPolicy Bypass -File $scriptPath; if($LASTEXITCODE -ne 0){throw ('AgentKeeper Cowork uninstaller exited with code ' + $LASTEXITCODE)}

Keep the local Cowork API key when you plan to reinstall immediately:

& powershell.exe -NoProfile -ExecutionPolicy Bypass -File (Join-Path $env:TEMP 'cowork-windows-uninstall.ps1') -KeepApiKey

If you are running Cowork cleanup from an elevated or system-context shell, pass the developer profile explicitly:

& powershell.exe -NoProfile -ExecutionPolicy Bypass -File (Join-Path $env:TEMP 'cowork-windows-uninstall.ps1') -TargetUser "DOMAIN\developer"
& powershell.exe -NoProfile -ExecutionPolicy Bypass -File (Join-Path $env:TEMP 'cowork-windows-uninstall.ps1') -TargetUserUpn "developer@example.com" -KeepApiKey

After either uninstall path, fully quit and relaunch Claude Desktop and Claude Code before reinstalling or running status checks.

Linux Universal RPM

Normal RPM removal cleans AgentKeeper-owned integrations and package files while retaining local enrollment state for rollback:

sudo dnf remove agentkeeper-runtime

The RPM refuses final removal when an owned hook or Gateway route cannot be removed safely. Repair the reported config, run sudo agentkeeper uninstall-integrations --json, and retry. Run sudo agentkeeper purge --local before package removal only when the operator explicitly intends to erase local identity, credentials, evidence markers, AgentKeeper-created safety backups, user reconciliation links, and owned entries. Purge disables reconciliation before cleanup so managed files cannot be recreated during removal. See Uninstall and rollback for the full enterprise procedure and endpoint-retirement checks.

Universal macOS PKG

Use this path when pkgutil --pkg-info dev.agentkeeper.runtime finds the AgentKeeper package. Before removal, unassign the package policy and its token-bearing After/Post-install script. Remove the com.agentkeeper.runtime profile when the Mac should no longer be eligible to enroll; only the MDM can remove an MDM-owned profile.

Run the package-matched helper as root:

sudo "/Library/Application Support/AgentKeeper/helpers/uninstall.sh"

The helper removes AgentKeeper-owned integrations, unloads the LaunchDaemon, removes package files and helpers, and forgets the package receipt. It uses the runtime's recorded reconciliation state. It does not require or read an MDM user assignment, accept a username, or scan /Users.

Add --purge-state only when you intend to erase local credentials and install state instead of preserving them for reinstall or rollback:

sudo "/Library/Application Support/AgentKeeper/helpers/uninstall.sh" --purge-state

For Jamf, deploy the first command in a computer policy. For Iru/Kandji, deploy it as a root Custom Script assigned to the device Blueprint or Assignment Map. For Intune, deploy it as a macOS Platform Script with Run script as signed-in user set to No. No provider requires a user field in the AgentKeeper payload for install or uninstall.

After removal, these checks should print package-absent, daemon-absent, and runtime-absent:

pkgutil --pkg-info dev.agentkeeper.runtime >/dev/null 2>&1 || echo package-absent
sudo launchctl print system/com.agentkeeper.runtime >/dev/null 2>&1 || echo daemon-absent
test ! -e "/Library/Application Support/AgentKeeper/bin/agentkeeper" && echo runtime-absent

The universal PKG does not remove a separately assigned Cowork plugin or organization-level MCP Gateway assignment.

Legacy standalone shell install

Use this section only for an older macOS or standalone Linux shell install. Do not use it when the macOS package receipt or Linux RPM is present.

The standalone uninstaller removes legacy files from the current user session:

• LaunchAgent / systemd timer + running agentkeeper.sh processes
• Legacy CLI binary (~/.local/bin/agentkeeper.sh) and the gum helper if present
• Legacy AgentKeeper Claude Code hooks in ~/.claude/settings.json when present (leaves other vendors' hooks untouched)
• Claude Code plugin cache + installed_plugins.json entries
• Cursor / Copilot / Windsurf adapter hooks in the current project
• Cowork local plugin/hook registration and legacy Cowork MCP registration
• State directories (~/.agentkeeper, ~/.agentkeeper-plugin)
• Shell profile PATH entries added by the installer
• macOS Keychain entries (best-effort)

It's idempotent, safe to run twice, and writes a timestamped backup of ~/.claude/settings.json before modifying it.

One-liner (individual machine)

curl -fsSL https://www.agentkeeper.dev/uninstall.sh | bash

Preview what would be removed without changing anything:

curl -fsSL https://www.agentkeeper.dev/uninstall.sh | bash -s -- --dry-run

Keep your local config/api-key (useful if you plan to reinstall):

curl -fsSL https://www.agentkeeper.dev/uninstall.sh | bash -s -- --keep-data

Quiet mode for legacy automation logs:

curl -fsSL https://www.agentkeeper.dev/uninstall.sh | bash -s -- --quiet

Run this legacy script from the user session whose standalone files should be removed. Do not convert it into the universal PKG's MDM uninstall path.

Intune (Windows)

Windows: use the unified Win32 app uninstall command from the same package:

%SystemRoot%\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\uninstall.ps1

For Windows Cowork-only cleanup through Intune, run cowork-windows-uninstall.ps1 in system context after resolving the target developer profile:

Invoke-WebRequest -UseBasicParsing https://www.agentkeeper.dev/cowork-windows-uninstall.ps1 -OutFile cowork-windows-uninstall.ps1
powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\cowork-windows-uninstall.ps1 -TargetUser "DOMAIN\developer"
powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\cowork-windows-uninstall.ps1 -TargetUserUpn "developer@example.com"

Manual / offline use

If you can't curl from the endpoint, save the script locally and run it. The legacy standalone shell script is self-contained, with no runtime dependencies beyond bash, python3, and standard POSIX utilities. The Windows scripts require Windows PowerShell and do not require Python. The universal macOS PKG and managed Linux RPM carry package-matched offline uninstall lifecycles and must not use the standalone script.

What gets preserved

• Repo-level hooks committed in a project's .claude/settings.json. The Windows unified uninstaller removes only AgentKeeper-owned entries from the machine-managed base file and eligible legacy user settings; the macOS/standalone helper touches only user settings. Repo hooks have to be removed from the repo itself.
• The agentkeeper-security connector if you added it at the Claude Enterprise org level. That's a web console setting, not an endpoint artifact.
• Your device record in the AgentKeeper dashboard. Revoke it manually at www.agentkeeper.dev/workstations when you're ready.

Exit codes

For the legacy standalone shell script:

• 0, success (including "nothing to remove").
• 1, the current user session could not be resolved.

Source

The legacy and Windows scripts are open and available at /uninstall.sh, /mdm/intune/agentkeeper-windows-uninstall.ps1, and /cowork-windows-uninstall.ps1. The hosted agentkeeper-windows-uninstall.ps1 is retained for the older standalone Windows track; unified runtime deployments use the signed uninstall.ps1 inside the matching Intune package. The universal macOS helper ships inside the signed PKG and is matched to that release. Review the applicable helper before deploying it to a fleet.