Uninstall the agent

There are two flavours of uninstall depending on how the agent was deployed:

• Direct install — the user (or admin) downloaded the pkg and ran it. Run the commands below on the Mac.
• MDM deployment — Jamf Pro / Iru / Intune / Addigy / Mosyle pushed the pkg. Remove via the same MDM and unscope the enrollment config profile; see MDM deployment below.

Single Mac (direct install)

Run these commands in Terminal. They’re idempotent — safe to re-run after a partial uninstall.

First the system-level bits (require sudo):

# Stop and remove the privileged helper.
sudo launchctl bootout system /Library/LaunchDaemons/com.mngd.helper.plist 2>/dev/null || true
sudo rm -f  /Library/LaunchDaemons/com.mngd.helper.plist
sudo rm -f  /Library/PrivilegedHelperTools/com.mngd.helper

# Remove the app bundle.
sudo pkill -x mngd 2>/dev/null || true
sudo rm -rf /Applications/mngd.app

# Remove helper logs.
sudo rm -f /var/log/com.mngd.helper.log /var/log/com.mngd.helper.error.log

Then the per-user state, as the user who ran the agent (no sudo):

# Keychain entry holding the device bearer token.
security delete-generic-password -s "com.mngd.device-credentials" 2>/dev/null || true

# User preferences — both domains the agent writes to.
#   com.mngd        — operational settings (DisplayMode, delivery window)
#   com.mngd.agent  — enrollment settings pushed via managed preferences
defaults delete com.mngd       2>/dev/null || true
defaults delete com.mngd.agent 2>/dev/null || true
rm -f ~/Library/Preferences/com.mngd.plist ~/Library/Preferences/com.mngd.agent.plist

# Caches, logs, application support.
rm -rf ~/Library/Caches/com.mngd ~/Library/Caches/com.mngd.agent
rm -rf ~/Library/Logs/mngd "$HOME/Library/Application Support/mngd"

It does not touch MDM-pushed config profiles (those live outside the agent’s control) or the server-side device record (delete it from the web app under Devices → {device} → Delete if you want it gone from the portal too).

Just the privileged helper

If the agent itself is fine but the privileged helper is misbehaving (stuck LaunchDaemon, repeated admin prompts), reset just the helper and let the next pkg install drop a fresh copy:

sudo launchctl bootout system /Library/LaunchDaemons/com.mngd.helper.plist 2>/dev/null || true
sudo rm -f /Library/LaunchDaemons/com.mngd.helper.plist
sudo rm -f /Library/PrivilegedHelperTools/com.mngd.helper
sudo rm -f /var/log/com.mngd.helper.log /var/log/com.mngd.helper.error.log

# Re-run the installer — its postinstall step drops the helper back
# into /Library/PrivilegedHelperTools/.
open https://cdn.mngd.app/agent/mngd-agent-latest.pkg

MDM deployment

Three things need to be removed, in this order, to avoid the enrollment profile re-populating com.mngd.agent prefs after the pkg is gone:

1. Unscope the enrollment config profile from the target devices in your MDM. Without this step, the profile re-writes EnrollmentToken into com.mngd.agent on every check-in even after the pkg is uninstalled.
2. Deploy an uninstall script via your MDM’s script runner with “Run once per device” semantics. Copy the system-level block above into a script (the user-level block too, with $HOME adjusted for the logged-in user — most MDM runners expose a CURRENT_USER variable you can substitute for ~).
3. (Optional) Delete the server-side device records from the web app so they stop counting against your device total.

Verification

On a target device after uninstall:

# Everything below should be absent or empty.
ls /Applications/mngd.app                            2>/dev/null
ls /Library/PrivilegedHelperTools/com.mngd.helper    2>/dev/null
ls /Library/LaunchDaemons/com.mngd.helper.plist      2>/dev/null
defaults read com.mngd.agent                         2>/dev/null
security find-generic-password -s com.mngd.device-credentials 2>/dev/null

Every command above should produce no output. If anything lingers, it was likely created by a config profile that’s still deployed — check profiles status -type configuration for leftover mngd payloads.