Takumi Agent protects the packages you install

Takumi Agent routes your package-manager downloads — npm, pip, gem, go, composer — through Takumi Guard, so a package your organisation has blocked never reaches this Mac.

Setting it up takes several approvals. On a first install macOS asks for them in this order, and every one of them is this installer's doing:

1. An administrator password, to install. Asked by this installer before it copies anything.
2. Permission to send you notifications. Asked once, and only if you have never answered it for Takumi Agent, so the app can tell you if this Mac stops being protected.
3. An administrator password again, to trust this Mac's device certificate. The installer has no way to make that change itself, so the setup window asks for it.
4. Allow the Takumi Guard system extension. macOS holds the extension until you allow it in System Settings; the setup window has a button that takes you to the right pane.
5. Allow Takumi Agent to add a proxy configuration. This is the approval that starts capturing your installs.
6. A second, different approval — to filter network content — for the egress lock. It follows the one above within seconds and is expected: a second thing being switched on, not the prompt before it coming back because something failed. The egress lock is what denies an install that tries to reach a registry around Takumi Guard.

If your organisation manages this Mac, it may have approved some of these already, and those prompts will not appear.

Nothing is captured until you allow the proxy configuration, and the ways around Takumi Guard stay open until you allow the content filter as well. Upgrading an installed Takumi Agent needs no further approval — the agent restarts on the new version by itself.

The installer also:

• installs Takumi Agent into /Applications on this startup disk — the only place macOS will load its system extension from;
• starts a background service that keeps protection running after you log out.

Requires an Apple silicon Mac running macOS 13 (Ventura) or later. You can turn the network filter off again at any time in System Settings.