Jamf Pro MCP Server

A server for managing Apple devices through the Jamf Pro API.

A comprehensive MCP (Model Context Protocol) server that enables AI assistants to interact with Jamf Pro for complete Apple device management, including computers, mobile devices, policies, scripts, configuration profiles, packages, and reporting.

# Clone the repository git clone https://github.com/dbankscard/jamf-mcp-server.git cd jamf-mcp-server # Install dependencies npm install # Build the project npm run build

Configure your credentials in Claude Desktop (see Configuration section below).

- searchDevices: Find devices by name, serial number, IP address, or username (supports partial matching)
- getDeviceDetails: Retrieve comprehensive device information by ID or name
- checkDeviceCompliance: Find devices that haven't reported in X days (optimized for large fleets)
- getDevicesBatch: Get details for multiple devices efficiently
- updateInventory: Force inventory update on devices

- listPolicies: List all policies in Jamf Pro
- getPolicyDetails: Get detailed information about a specific policy by ID or name (includes scope, scripts with full content, and packages - you can see exactly what scripts and packages are attached to any policy)
- searchPolicies: Search for policies by name or ID (supports partial matching)
- executePolicy: Run policies on specific devices (policy and device can be specified by ID or name, requires confirmation)

- deployScript: Execute scripts for troubleshooting (with confirmation)
- getScriptDetails: Get full script content and metadata including parameters, notes, and OS requirements

- listConfigurationProfiles: List all configuration profiles (computer or mobile device)
- getConfigurationProfileDetails: Get detailed information about a specific configuration profile
- searchConfigurationProfiles: Search for configuration profiles by name
- deployConfigurationProfile: Deploy a configuration profile to one or more devices (with confirmation)
- removeConfigurationProfile: Remove a configuration profile from one or more devices (with confirmation)

- listPackages: List all packages with name, version, category, and size
- getPackageDetails: Get detailed package information including metadata, requirements, and notes
- searchPackages: Search packages by name, filename, or category
- getPackageDeploymentHistory: Get deployment history and statistics for a package
- getPoliciesUsingPackage: Find all policies that use a specific package

- listComputerGroups: List computer groups (smart groups, static groups, or all)
- getComputerGroupDetails: Get detailed information about a specific group including membership and smart group criteria
- searchComputerGroups: Search for computer groups by name
- getComputerGroupMembers: Get all members of a specific computer group
- createStaticComputerGroup: Create a new static computer group with specified members (with confirmation)
- updateStaticComputerGroup: Update the membership of a static computer group (with confirmation)
- deleteComputerGroup: Delete a computer group (with confirmation)

- searchMobileDevices: Search for mobile devices by name, serial number, UDID, or other criteria
- getMobileDeviceDetails: Get detailed information about a specific mobile device including hardware, OS, battery, and management status
- listMobileDevices: List all mobile devices in Jamf Pro with basic information
- updateMobileDeviceInventory: Force an inventory update on a specific mobile device
- sendMDMCommand: Send MDM commands to mobile devices (lock, wipe, clear passcode, etc.) with confirmation for destructive actions
- listMobileDeviceGroups: List mobile device groups (smart groups, static groups, or all)
- getMobileDeviceGroupDetails: Get detailed information about a specific mobile device group including membership and criteria

- jamf://inventory/computers: Paginated device list
- jamf://inventory/mobile-devices: Paginated mobile device list
- jamf://reports/compliance: Security and patch compliance report
- jamf://reports/mobile-device-compliance: Mobile device compliance report showing management status and issues
- jamf://reports/storage: Disk usage analytics
- jamf://reports/os-versions: OS version breakdown

- troubleshoot-device: Step-by-step device troubleshooting
- deploy-software: Software deployment workflow
- compliance-check: Comprehensive compliance reporting
- mass-update: Bulk device operations
- storage-cleanup: Disk space management
- Clone this repository
- Install dependencies:

cd jamf-mcp-server npm install

- In Jamf Pro, go toSettings>System>API Roles and Clients
- Create a new API Role with necessary permissions
- Create a new API Client:

- Assign the API Role you created
- Note the Client ID and generate a Client Secret

- macOS:~/Library/Application Support/Claude/claude_desktop_config.json
- Windows:%APPDATA%\Claude\claude_desktop_config.json

{ "mcpServers": { "jamf-pro": { "command": "node", "args": ["/absolute/path/to/jamf-mcp-server/dist/index.js"], "env": { "JAMF_URL": "https://your-instance.jamfcloud.com", "JAMF_CLIENT_ID": "your-api-client-id", "JAMF_CLIENT_SECRET": "your-api-client-secret", "JAMF_READ_ONLY": "false", "JAMF_USE_ENHANCED_MODE": "true", "JAMF_DEBUG_MODE": "false" } } } }

Note: Most tools support searching by both ID and name. When searching by name, partial matches are supported. For example, you can search for "Chrome" to find all items containing that word in their name.

Can you find John Smith's MacBook? Search for device GH-IT-0322 Find devices with "Marketing" in the name

Check Device Compliance (NEW - Optimized)

Show me all devices that haven't reported in 30 days

This will use the newcheckDeviceCompliancetool which efficiently processes all devices and provides:

- Summary statistics (compliant/non-compliant/unknown)
- Critical devices (90+ days)
- Warning devices (30-90 days)
- Optional detailed device list

Policy Analysis - See Scripts and Packages

What packages are deployed by the 'Software Install' policy?

Show me the scripts that run in the 'Weekly Maintenance' policy

Get full details for policy 'macOS Updates' including all scripts and packages

List all computer configuration profiles

Deploy configuration profile ID 5 to devices 123, 456, and 789

Remove mobile device configuration profile ID 10 from device 999

Get details for devices 123, 456, and 789

Install Slack on all marketing team Macs

Which devices have less than 10GB free space?

List all policies Show me all security-related policies Get details for policy ID 123 Search for policies containing "update" Get policy details with full script content

Get the content of script ID 42 Show me what script 123 does Get policy 456 details including the actual script code

List all packages Search for packages containing "Office" Get details for package ID 15 Show me the deployment history for package ID 20 Which policies use package ID 25? Find all policies that deploy Chrome

List all computer groups Show me only smart groups Search for groups containing "marketing" Get details for computer group ID 10 Show me all members of the "Executive Laptops" group Create a static group called "Project Alpha" with computers 123, 456, and 789 Update the "Deployment Test" group to include computers 111, 222, and 333 Delete computer group ID 99

Search for iPads List all mobile devices Get details for mobile device ID 456 Search for devices with serial number ABC123 Update inventory for mobile device 789 Lock mobile device 123 Wipe mobile device 456 (requires confirmation) Clear passcode for device 789 (requires confirmation) Enable Lost Mode on device 321 List all mobile device groups Get details for mobile device group ID 15 Show me smart mobile device groups

The following MDM commands are supported for mobile devices:

- DeviceLock: Lock the device immediately
- EraseDevice: Wipe the device (requires confirmation)
- ClearPasscode: Remove device passcode (requires confirmation)
- RestartDevice: Restart the device
- ShutDownDevice: Shut down the device
- EnableLostMode: Enable Lost Mode
- DisableLostMode: Disable Lost Mode
- PlayLostModeSound: Play sound on lost device
- UpdateInventory: Force inventory update
- ClearRestrictionsPassword: Clear restrictions password (requires confirmation)
- Settings Commands: Enable/disable Bluetooth, WiFi, Data Roaming, Voice Roaming, Personal Hotspot

- Read-Only Mode: SetJAMF_READ_ONLY=trueto prevent any modifications
- Confirmation Required: Destructive operations require explicit confirmation
- Error Handling: Comprehensive error messages and recovery
- Rate Limiting: Respects Jamf Pro API limits
- Audit Trail: All operations are logged

The server now includes comprehensive error handling and retry logic:

- Automatic Retry: Exponential backoff for transient failures
- Circuit Breaker: Prevents cascading failures
- Enhanced Error Messages: Detailed error information with actionable suggestions
- Request/Response Logging: Debug mode for troubleshooting
- Rate Limiting: Built-in rate limiter to prevent API throttling

Add these optional environment variables to your Claude Desktop config:

{ "env": { "JAMF_USE_ENHANCED_MODE": "true", // Enable enhanced features (default: false) "JAMF_MAX_RETRIES": "3", // Max retry attempts (default: 3) "JAMF_RETRY_DELAY": "1000", // Initial retry delay in ms (default: 1000) "JAMF_RETRY_MAX_DELAY": "10000", // Max retry delay in ms (default: 10000) "JAMF_DEBUG_MODE": "false", // Enable debug logging (default: false) "JAMF_ENABLE_RETRY": "true", // Enable automatic retries (default: true) "JAMF_ENABLE_RATE_LIMITING": "false", // Enable rate limiting (default: false) "JAMF_ENABLE_CIRCUIT_BREAKER": "false" // Enable circuit breaker (default: false) } }

The enhanced mode provides specific error types with helpful suggestions:

- JamfAPIError: General API errors with status codes and suggestions
- NetworkError: Connection issues with network troubleshooting tips
- AuthenticationError: Auth failures with credential verification steps
- RateLimitError: Rate limit errors with retry timing
- ValidationError: Input validation errors with field-specific feedback

Seedocs/ERROR_HANDLING.mdfor detailed documentation.

cp .env.example .env # Edit .env with your Jamf Pro credentials: # JAMF_URL=https://your-instance.jamfcloud.com # JAMF_CLIENT_ID=your-api-client-id # JAMF_CLIENT_SECRET=your-api-client-secret # JAMF_READ_ONLY=false

Agent-ready global image CDN that AI agents can install and operate through MCP.