Glossary

Here are some words and phrases that will help you better understand Workbrew.

Workbrew Agent#

The Workbrew Agent is an application that runs in the background on a Device. It reports the software installed on the Device from every source to the Workbrew Console, along with its brew usage and status. It operates in two modes:

• A wrapper around Homebrew to provide additional functionality and security.
• A background daemon that communicates with the Workbrew Console.

Analytics#

The Analytics page offers insights into Homebrew running on individual Devices, including the brew commands they have executed and when they were run.

brew#

brew is the command-line tool used to interact with Homebrew. With Workbrew, you can manage brew remotely using the Workbrew Console.

Commands#

Commands are operations you run remotely from the Workbrew Console on any combination of Devices, immediately or on a schedule. There are three types. A Brew Command runs any Homebrew brew command, such as install, uninstall or upgrade. An Npm Command upgrades or uninstalls a named npm package. A VS Code Command does the same for a VS Code extension. Every execution on a Device is logged as a Command Run.

Brew Configurations#

Brew Configurations are Homebrew environment variables that can be set remotely on your Devices to enforce one-off rules.

Workbrew Console#

The Workbrew Console is the web application for Workbrew. It provides a user interface for managing software across one or more Devices.

Dashboard#

The Dashboard provides an overview of your fleet, offering a centralized place to drill down into specific details.

Default Packages#

Default Packages allow you to install lists of packages on your Devices using a Brewfile. The brew bundle command installs these packages, with execution history viewable like any other Command. Every Workspace can set one list for all Devices. Business and Enterprise plans can set a different list for each Device Group.

Device#

A Device is a machine/endpoint that's capable of running brew (macOS, Linux, or WSL).

Device Groups#

Device Groups allow you to target Commands, Default Packages, Brew Configurations and Policies on a subset of your Devices. They are available on Business and Enterprise plans. Other Workspaces target all Devices or a single Device.

Homebrew#

Homebrew is an open-source package manager for macOS and Linux that developers love. It allows users to install, update, and manage applications and dependencies from the command line. Workbrew builds on top of Homebrew by providing centralised management and security features for teams and organisations. While Homebrew is designed for individual developers, Workbrew extends its capabilities for teams and enterprises. Homebrew is one of several sources Workbrew inventories.

Human User Account#

A Human User Account is a macOS user account that the Workbrew Agent identifies as belonging to a real person. The Agent excludes system service accounts, hidden accounts, the nobody account, and accounts with a UID of 500 or below, then selects only those with a Secure Token. When Managed brew access is enabled, Human User Accounts are added to the workbrew_users group.

Managed brew access#

Managed brew access grants Standard Users on managed Macs access to the brew CLI without requiring administrator privileges. The Workbrew Agent identifies Human User Accounts on each Device and adds them to the workbrew_users group. See the Managed brew access reference for details.

Workbrew Installer#

The Workbrew Installer is used to install the Workbrew Agent and Homebrew on each Device. It can be deployed by an MDM provider or installed manually.

Package Requests#

A Package Request is a Device user asking for a cask that a Cask Allowlist Policy blocks. Users send one from the Workbrew app or with brew workbrew request. Administrators review them under Policies → Package Requests, approving for all Devices, a Device Group or just the requesting Device, or denying with a reason. Requests can be turned off for the whole Workspace in Workspace settings. Available with the Governance upgrade and on Business and Enterprise plans.

Plans#

A Workspace is on exactly one plan: Team, Business, or Enterprise.

• Team is free, with no Device or User limits. It covers inventory, Default Packages, the software catalog, MDM integration, the API, and vulnerability detection. Two paid upgrades can be added to it.
• Business includes both upgrades and adds Device Groups, roles and permissions, automatic upgrades and uninstalls, Private Taps, activity logs and data export.
• Enterprise includes everything in Business and adds Sign in with SSO, custom terms and SLAs.

Workspaces that were on the former Pro plan moved to Team with the Governance upgrade, and kept their Device Group targeting.

Policies#

Policies are rules the Workbrew Agent enforces on your Devices, such as forbidding casks or formulae, allowlisting casks, automatically patching vulnerable packages, or scheduling automatic upgrades and uninstalls. Which Policies are available depends on your plan and upgrades.

Package#

A Package is a specific piece of software installed on a Device from a specific source, such as the Homebrew formula curl, the npm package typescript, or a VS Code extension. The Packages page in the Workbrew Console lists every Package installed across your fleet, with a filter for source.

Software catalog#

The software catalog is the browsable list of software that Workbrew can deliver to your Devices. It is available at workbrew.com/catalog and in the Workbrew Console.

Sources#

A source is where a Package on a Device came from. Workbrew inventories Homebrew formulae and casks, npm packages, VS Code extensions, and macOS applications, and detects vulnerabilities in all of them. Formulae, casks, npm packages and VS Code extensions can also be upgraded, patched and removed from the Workbrew Console. macOS applications are visibility only.

Upgrades#

Upgrades are paid additions to the free Team plan, priced per Device. There are two, and they are cumulative:

• Vulnerability Patching.
• Governance (which includes Vulnerability Patching).

Business and Enterprise plans include both.

Workbrew app#

The Workbrew app is the graphical application on a Device that lets people browse the software catalog, install software, and see what is outdated, without using the brew command line. Both routes are governed by the same Policies.

Workbrew Console User#

A User has an account with a unique ID (tied to a username and email address) that provides access to a Workspace. On Business and Enterprise plans, a User can be given a role that limits what they can do in the Workspace.

Workspace#

A Workspace is an organisation-owned instance of the Workbrew Console that administers Workbrew across a fleet of Devices. A Workspace supports multiple Users who can administer or view a Workspace they have access to. Every Workspace is on one of three plans: Team, Business, or Enterprise. A Team Workspace can add paid upgrades.

Email sign-in#

Email sign-in signs a User in to the Workbrew Console by emailing them a one-time login link. It needs no password and is available to every account. On the sign-in page it is the "Sign in or join with email" option.

Social sign-in#

Social sign-in signs a User in through a consumer account at Apple, GitHub, Google, or Microsoft. It confirms control of that account and nothing more, so it is not the same as Sign in with SSO. See Console login and SSO enforcement.

Sign in with SSO#

Sign in with SSO signs a User in through your organisation's identity provider over SAML or OIDC, connected to Workbrew through WorkOS. It is an Enterprise capability. Once a domain has SSO configured, sign-in for that domain can be restricted to SSO only, which is covered in Console login and SSO enforcement.

Customer adoption#

Customer adoption brings a customer's existing Workspace under a Workbrew MSP partner. Workbrew creates the management and billing relationships with the partner; nothing inside the Workspace changes. Distinct from cask adoption, which brings existing installed software under management.

Allowed Domain#

Allowed Domain is a Workspace setting that limits membership to a single email domain. When it is set, only Users whose email matches that domain can be invited or added, and it cannot be enabled while members from other domains already exist. See Console login and SSO enforcement for how it relates to sign-in.