Uninstall and rollback

Separate normal rollback from full removal. Rollback keeps AgentKeeper deployed but returns the endpoint to a previous approved package. Uninstall removes the runtime and AgentKeeper-owned hook blocks.

Roll back a package

1. Deploy the previous approved Windows MSI/IntuneWin, macOS PKG, or signed Linux RPM through the same managed package channel.
2. Confirm Windows service, macOS LaunchDaemon, or Linux systemd startup.
3. Confirm status reports the previous package/runtime version.
4. Confirm credential and policy fetch remain healthy.
5. Restart the selected AI agent and confirm one live event.

For Linux, pin the previous signed NEVRA from the signed AgentKeeper repository (which retains prior releases) and run:

sudo dnf downgrade agentkeeper-runtime-<version>-<release>.ak.x86_64
sudo systemctl restart agentkeeper-runtime.service
sudo agentkeeper reconcile --source rollback --json
sudo agentkeeper doctor

The rollback reconciler restores only AgentKeeper-owned entries. It does not replace customer configuration with an older copy.

Rotate a credential

1. Revoke the affected per-device credential. If the deployment-scoped enrollment token was exposed or the deployment is ending, revoke that token too and create a replacement with the intended provider and deployment ID.
2. Keep the non-secret macOS metadata profile in place and deliver the current token with the provider's root After-install script. Never put the token in managed preferences or a command argument.
3. Run the package-matched remediation helper or restart the runtime service.
4. Confirm the workstation reports a fresh per-device credential.

Remove AgentKeeper runtime

Linux: preserve enrollment for reinstall

Normal RPM removal deletes the runtime and AgentKeeper-owned integrations but retains local enrollment state:

sudo dnf remove agentkeeper-runtime

Linux: remove all local AgentKeeper state

Purge while the binary is still installed, then remove the package and repository bootstrap files:

sudo agentkeeper purge --local
sudo dnf remove agentkeeper-runtime
sudo rm -f /etc/yum.repos.d/agentkeeper.repo
rpm -qa 'gpg-pubkey*' | grep -i c563a3be | xargs -r sudo rpm -e

This removes local identity, credentials, evidence markers, AgentKeeper-created backups, reconciliation links, and owned integrations before package removal. Server-side Activity and workstation history remain available for audit.

The RPM refuses final removal if an owned hook or managed MCP Gateway route cannot be removed safely. Repair the malformed or inaccessible customer configuration, run sudo agentkeeper uninstall-integrations --json, and retry dnf remove.

macOS

Before full removal, unassign the package policy and token-bearing After-install script. Remove the com.agentkeeper.runtime profile when the device should no longer be eligible to enroll. An MDM-owned profile remains until the MDM removes it; the local uninstall helper cannot remove it.

Use the uninstall helper from the installed release:

sudo "/Library/Application Support/AgentKeeper/helpers/uninstall.sh"

This removes AgentKeeper-owned integrations first, unloads com.agentkeeper.runtime, removes package-owned binaries and helpers, and forgets the dev.agentkeeper.runtime receipt while preserving local enrollment state for rollback. Add --purge-state only when the operator explicitly intends to erase local credential and install-marker state:

sudo "/Library/Application Support/AgentKeeper/helpers/uninstall.sh" --purge-state

After removal, verify the package, daemon, and package-owned files are absent:

pkgutil --pkg-info dev.agentkeeper.runtime >/dev/null 2>&1 || echo package-absent
sudo launchctl print system/com.agentkeeper.runtime >/dev/null 2>&1 || echo daemon-absent
test ! -e "/Library/Application Support/AgentKeeper/bin/agentkeeper" && echo runtime-absent

Quit and reopen the selected AI agent before reinstalling. Server-side Workstation and Activity history remains available for audit.

Windows

Use the bundled helper from the same IntuneWin release:

%SystemRoot%\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\uninstall.ps1

For Windows Intune, use the uninstall_command from the pinned package-metadata.json. The helper removes AgentKeeper-owned IDE hook blocks, the AgentKeeperRuntime service, runtime and MCP Gateway binaries, and package state. When -IdeTargets is omitted, it reads the exact target set persisted by the successful install. Claude Code cleanup starts with the machine-managed base file at C:\Program Files\ClaudeCode\managed-settings.json; a trusted persisted target is used only for Antigravity and legacy %USERPROFILE%\.claude\settings.json cleanup.

Do not use agentkeeper.exe uninstall-service --json as the normal Windows fleet uninstall command. That command is a service-only fallback for support; by itself it does not run the bundled all-IDE hook cleanup and does not remove the MCP gateway binary or packaged runtime files.

If an Intune Uninstall assignment reports the app absent while an earlier AgentKeeper release remains on the endpoint, use the temporary emergency file detection rule so Intune runs the packaged uninstall command.

If using provider helpers, use the helper generated from the same deployment bundle. Do not use developer interactive installers or browser/device approval flows as fleet uninstall mechanisms.

What uninstall removes

• AgentKeeper runtime binary and service/LaunchDaemon.
• AgentKeeper MCP gateway binary on Windows when present.
• AgentKeeper-owned hook forwarders.
• AgentKeeper-owned hook blocks in supported agent config files.
• Runtime state that belongs to Windows/macOS removal helpers. Linux RPM removal intentionally retains local enrollment state unless the operator purges it first.

What uninstall preserves

• Customer-owned Claude Code, Codex, Cursor, Windsurf, Copilot, Gemini, Cowork, and MCP configuration.
• Non-AgentKeeper hooks.
• Customer project files.
• Server-side historical Activity, investigations, and workstation records unless an admin explicitly deletes them through product/admin workflows.

Uninstall must preserve unrelated hook configuration. If a config file is malformed or contains non-AgentKeeper custom hooks, stop and capture a support bundle instead of replacing the whole file.

Verify Linux removal

After full local removal, these checks should all print absent:

rpm -q agentkeeper-runtime >/dev/null 2>&1 || echo package-absent
test ! -e /usr/bin/agentkeeper && echo runtime-absent
test ! -e /usr/bin/agentkeeper-mcp-gateway && echo gateway-absent
systemctl list-unit-files --no-legend 2>/dev/null | grep -qi agentkeeper || echo units-absent
test ! -e /etc/yum.repos.d/agentkeeper.repo && echo repository-absent
rpm -qa 'gpg-pubkey*' | grep -qi c563a3be || echo signing-key-absent

The reserved agentkeeper system account may remain under standard Linux package conventions. Remove it only on a retired endpoint after confirming it owns no files. DNF transaction history, system journal history, and server-side Activity are audit records and are not deleted by local package removal.