Skip to main content
Removing Shadow AI undoes everything the agent set up: the local proxy, the trusted certificate, and the local event data. On macOS one command handles it; manual fallback steps are below in case you need them.

​
macOS — one command

pgshadow uninstall
This:
  • Removes the PAC proxy from all network services (Wi-Fi, Ethernet, and any others) so traffic stops routing through the local proxy.
  • Removes CA trust — the agent’s certificate is deleted from the keychain, so nothing on the machine continues to trust it.
  • Deletes local config and event data, including the SQLite event log.
Keep the local event log (for example, to hand to security before wiping a device) by passing --keep-data:
pgshadow uninstall --keep-data

​
Manual fallback (macOS)

If the CLI isn’t available — for example the binary was already removed — undo the two system changes by hand:
1

Remove the proxy

System Settings → Network → your active service → Details… → Proxies, and turn off the automatic proxy configuration (PAC) the agent added. Repeat for every network service.
2

Untrust the certificate

Open Keychain Access, search for the PromptGuard CA certificate, and delete it. Confirm no app still trusts it.
3

Delete local data

Remove the agent’s local config and event-log directory. Contact support@promptguard.co if you need the exact path for your build.
Windows and Linux uninstall flows ship alongside those agents, which are currently in private preview. Until then, contact support@promptguard.co for offboarding steps on those platforms.

​
Offboarding a fleet device

For managed fleets, you don’t need access to the machine to cut it off. Revoking a device from the dashboard (Fleet → Devices → Revoke) is immediate:
  • The device’s scoped credential is invalidated — its next request to the engine is rejected.
  • The agent stops reporting activity to your dashboard.
  • The rest of the fleet is unaffected — revocation is per device.
Revocation invalidates the credential but does not by itself remove the proxy or certificate from the machine. To fully clean a device, also run pgshadow uninstall (or push it through your MDM). For a device you no longer control, pair revocation with your MDM’s app-removal and certificate-removal profile.

​
Next steps

Fleet enrollment & revocation

How per-device credentials are issued and revoked.

Privacy & data handling

What’s stored locally and what you can export or delete.