Fleet-scale Homebrew management, open source.

A control plane for the Homebrew installs across your Macs. Run it on your own infrastructure; nothing leaves it.

Fleet view 6 of 248 devices

Hostname	Assigned user	macOS	Outdated pkgs	Last check-in	Compliance
mac-eng-0142	D. OkaforEngineering	15.4	0	2m	OK
mac-eng-0155	T. BrennanEngineering	14.7	11	18m	WARNopenssl 3.1 EOL
mac-des-0209	M. IyerDesign	15.3	7	1h 12m	WARNFileVault off
mac-eng-0161	J. KowalskiEngineering	13.6	24	3d 04h	FAILUnmanaged taps
mac-sup-0311	A. NwosuSupport	15.4	0	1m	OK
mac-fin-0402	H. MbekiFinance	14.6	14	2h 41m	WARNCasks unsigned

What BrewMDM does

Three jobs, on hardware you already own. BrewMDM keeps a live picture of the Homebrew packages installed across a fleet of Macs, decides when those packages move, and does both from a control plane you run yourself.

01

One view of every Mac

Inventory every formula and cask across the fleet, and see what drifted.

02

Updates on your schedule

Roll updates out when you choose, not whenever someone runs brew upgrade.

03

Yours end to end

Multi-tenant, built for Apple Silicon, and self-hosted end to end.

How it works

A control plane you host, an agent on each Mac, and a versioned protocol between them. Nothing about your fleet is sent anywhere else, because there is nowhere else for it to go.

Why it exists

Homebrew has no fleet story. Every machine upgrades whatever is newest, whenever someone runs brew upgrade. The alternatives are an MDM suite that treats Homebrew as an afterthought, or a pile of scripts nobody owns. BrewMDM is the narrow tool. One job, on infrastructure you already run.

Step 01

You run the control plane

The server and its console are yours to deploy: a container and a Postgres database on infrastructure you already operate. It is multi-tenant, so one deployment can hold several estates apart. There is no hosted tier to sign up for, no licence check to phone home, and no telemetry: the software has nothing to report back to us, so a fleet inventory never leaves the network you put it on.

Step 02

An agent enrols each Mac

A signed daemon runs on every managed Mac, reports the formulae and casks Homebrew has actually installed, and applies the changes the control plane asks for. It is built for Apple Silicon and for machines that come and go. A laptop that has been shut in a bag for a fortnight reconciles when it reappears rather than falling out of the picture.

Step 03

Updates move when you say so

Homebrew upgrades whatever is newest whenever somebody runs it, which is fine for one machine and unworkable for a hundred. BrewMDM puts a schedule and an approval in front of that: choose which packages move, choose when, and see which Macs have drifted from what you asked for. Cask installs and upgrades fail closed, so a package that cannot be applied cleanly is reported rather than half-applied.