mg Desktop

Moftgate Desktop is the graphical counterpart of the mg CLI. It is a standalone application for Windows and macOS that talks to your Center over the same API, so the operations an engineer performs in the terminal are available to an operator who prefers a window: listing devices, triaging alerts, running scripts, and following automation runs.

The two tools are not separate worlds. Moftgate Desktop reuses the CLI’s own client: the same profile definitions, the same token store, and the same browser approval flow. A profile created with mg profile create shows up in the application, and signing in from either side covers both.

Close image

1. 1
   Install the application

   On Windows run the setup executable (an MSI is published alongside it for GPO or Intune deployment). On macOS open the .dmg and drag Moftgate Desktop into Applications. No agent or extra service is installed — this is an operator tool for a management workstation.

2. 2
   Add a profile for your Center

   Open Profiles & Auth and click New profile. Enter a name and your Center URL, for example https://center.example.local. Tick Skip TLS certificate verification only for an on-premises Center that still uses a self-signed certificate.

3. 3
   Sign in through the browser

   Click Sign in on the profile card. The browser opens the same approval page the CLI uses; after you approve, the token is stored locally and the card shows Token stored.

4. 4
   Start working

   The left menu opens Devices, Alerts, Scripts, and Automation Runs. The profile selector in the header switches between Centers without signing out.

A profile is one Center: a name, a URL, and its own token. Profiles & Auth is where you add them, choose which one is the default, sign in, and sign out. The profile selector in the header switches the whole application between Centers.

Close image

Sign in opens the browser approval page and waits. Approve it as the Center user whose permissions the session should carry; the application stores the issued token and the header shows who is signed in. If the browser does not open by itself, the dialog shows the approval link and the verification code so you can open it manually.

Close image

Devices is the inventory view: the endpoints that report to the selected Center, with the filters and the detail record you would otherwise assemble from mg device list and mg device inspect.

• Search runs on the server against hostname and IP, so a large fleet is filtered before anything is drawn.
• Status and operating system filters use the same values the console does; the OS column shows an icon instead of a text label.
• Hostname, Last Seen, and Compliance are sortable, and paging is server-side.
• Clicking a row opens the full device record — groups, tags, agent profile, agent version — with a Copy JSON button.
• Export CSV applies the active filters and asks where to save the file, then reports how many devices were written.

Close image

Alerts opens on the active ones. Filter by status or by device, open a row to read the full alert with its evidence, and resolve it from the detail. Resolving asks for confirmation first and is written to the Center audit log against your user.

Close image

Scripts lists the script library and is where execution starts. You can run a saved script or type an ad-hoc command, and target a single device, an endpoint group, or a tag.

1. 1
   Pick what to run

   Click a row in the script list to run a saved script, or use Run command for an ad-hoc command. For an ad-hoc command you can leave the language empty and let the target operating system decide, or pin it to shell or powershell.

2. 2
   Choose the target

   Select Device, Endpoint group, or Tag and enter the identifier, then set the timeout and decide whether the run should wait for endpoints that are currently offline.

3. 3
   Confirm before it runs

   Review & run opens a confirmation that spells out what will execute and where. Because this executes code on endpoints, you have to type RUN to enable the button.

4. 4
   Follow the result

   The toast reports how many targets received the job. Open Automation Runs to watch each endpoint report success or failure.

Close image

Every execution — a script you started here, or an automation the Center triggered — produces a run. This screen is the record of what ran, where, and how it ended. Filter by status or device, open a run to see its per-action detail, cancel one that is still going, or retry one that failed.

Close image

• The desktop app has no separate credential store: it reads and writes the same profile file and token file the mg CLI uses, and the token is created by the same browser approval flow.
• A token inherits the role of the user who approved it. Read-only users can list and inspect; resolving an alert, running a script, or cancelling a run needs write permission.
• Every write action is recorded in the Center audit log against the approving user, exactly as it is when the same action is taken from the CLI.
• Resolving an alert, cancelling or retrying a run, deleting a profile, and running a script all require an explicit confirmation; script runs and profile deletion ask you to type a confirmation word.
• The application itself may only write the CSV file you choose in the save dialog. It has no other file system or shell access.
• Skip TLS certificate verification exists for on-premises Centers with self-signed certificates during setup. Leave it off in production — a client that skips verification can be pointed at an attacker’s server and hand it a valid token.

mg profile list
mg auth status
mg auth logout

The commands above inspect or end the same session the desktop application uses, which is useful when you want to confirm from a terminal which profile is active and who the stored token belongs to.