Jamf Pro MCP Server

Interact with Jamf Pro for Apple device management tasks.

A comprehensive MCP (Model Context Protocol) server that enables AI assistants to interact with Jamf Pro for complete Apple device management. Works with Claude Desktop andChatGPT(via MCP Connectors).

Two modes: Classic Mode (115 individual tools) orCode Mode(2 tools + sandboxed JavaScript SDK)

- Code Mode— a new execution model that exposes just 2 MCP tools (jamf_search+jamf_execute) instead of 115 individual tools. The agent writes JavaScript that runs in a sandboxednode:vmcontext with a typed Jamf API client, enabling complex multi-step workflows in a single tool call. Includes capability-based access control, budget tracking, plan/apply workflow, and an approval gate for high-impact commands.
- Concurrency limiting— semaphore-styleConcurrencyLimiter(default 5, configurable viaJAMF_MAX_CONCURRENCY) prevents 429 rate-limit errors. Applied to both the core API client and Code Mode sandbox.
- Policy caching—getPolicyDetailsresults are now cached to avoid redundant API calls, with automatic invalidation on policy writes.
- Static computer group XML fix—createStaticComputerGroupandupdateStaticComputerGroupnow use proper XML viaXmlBuilder(with escaping) instead of broken JSON or raw template literals.

- 115 tools(up from 56) — expanded coverage across the full Jamf Pro API and Classic API
- 12 resources— all returning live data including compliance, storage, OS versions, encryption, and patch reports
- 12 workflow prompts— guided templates for common admin tasks like onboarding, offboarding, security audits, and staged rollouts
- Compound tools— single-call operations likegetFleetOverview,getDeviceFullProfile,getSecurityPosture, andgetPolicyAnalysisthat combine multiple API calls behind the scenes
- Bearer Token authentication on Classic API— full OAuth2 Client Credentials support without needing a username/password
- Parallel API calls— batch operations and compound tools run requests concurrently for faster results
- Correct Jamf terminology— all documentation and tool descriptions align with official Jamf developer documentation

git clone https://github.com/dbankscard/jamf-mcp-server.git cd jamf-mcp-server npm install npm run build

Configure your credentials in Claude Desktop (seeConfigurationbelow).

git clone https://github.com/dbankscard/jamf-mcp-server.git cd jamf-mcp-server ./chatgpt/start-chatgpt-poc.sh

See ourChatGPT Quick Start Guidefor 5-minute setup.

Why Code Mode?This implementation is inspired byCloudflare's Code Mode pattern, which addresses a fundamental tension in MCP: agents need many tools to do useful work, but every tool definition consumes context window tokens. Cloudflare found that exposing their full API as individual MCP tools would consume over 1 million tokens — more than the entire context window of most models. Their solution: collapse everything into asearch+executepattern where agents discover APIs on demand and write code against a typed SDK, reducing token usage by up to 99.9%.

{ "mcpServers": { "jamf-code": { "command": "node", "args": ["/absolute/path/to/jamf-mcp-server/dist/index-code.js"], "env": { "JAMF_URL": "https://your-instance.jamfcloud.com", "JAMF_CLIENT_ID": "your-api-client-id", "JAMF_CLIENT_SECRET": "your-api-client-secret" } } } }

// Find all computers not checked in for 30 days const computers = await jamf.getAllComputers(200); const stale = computers.filter(c => helpers.daysSince(c.lastContactTime) > 30); log(Found ${stale.length} stale computers); return stale.map(c => ({ id: c.id, name: c.name, lastContact: c.lastContactTime }));

Real numbers from a live Jamf Pro instance (npm run benchmark):

Every conversation loads all tool definitions into the LLM's context window. Fewer tools = more room for actual work.

Code Mode uses28x fewer tokensjust for tool definitions.

10 scenarios covering baseline parity, cross-domain joins, multi-source audits, and workflows that are impossible in Classic Mode:

Code Mode: 10/10 completable. Classic Mode: 8/10.

- Tool definition overhead: Classic Mode consumes ~14K tokens of context window just for tool definitions — before any work begins. Code Mode uses ~500 tokens.
- Impossible workflows: Scenarios 5 and 10 require cross-resource joins (OS version × department, group members × FileVault × OS filter) that Classic Mode simply cannot express in bounded tool calls.
- Multi-step workflows: Security audit (S6) drops from 4 sequential LLM round-trips to 1. Policy comparison (S7) drops from 2 to 1. Each saved round-trip eliminates seconds of LLM inference latency.
- Cross-domain joins: Orphaned scripts (S3), group-scoped policies (S4), and package dependencies (S9) each require fetching a list, then detail-fetching N items — a pattern that forces Classic Mode into N sequential LLM calls. Code Mode does it in 1.
- Simple lookups: Roughly equivalent. Classic's purpose-built tools have slightly less overhead for single-call operations.
- Scaling note: These results are from a small Jamf instance. On a production fleet with hundreds of policies and devices, Classic Mode trip counts for S3/S4/S8/S9 would reach 10–20+, pushing the average LLM round-trip reduction well above 80%.

npm run benchmark # all 10 scenarios npm run benchmark -- --scenarios 1,5,10 # run a subset # requires JAMF_URL, JAMF_CLIENT_ID, JAMF_CLIENT_SECRET

Ask natural language questions about your Jamf fleet:

- "How is my fleet doing?" — usesgetFleetOverviewfor a single-call summary
- "Tell me about LAPTOP-001" — usesgetDeviceFullProfileto resolve by name, serial, or ID
- "What's our security posture?" — usesgetSecurityPosturefor encryption and compliance analysis
- "How is the Software Install policy performing?" — usesgetPolicyAnalysiswith auto-resolve by name
- "Find all devices that haven't checked in for 30 days"
- "Deploy software updates to the marketing team"
- "Retrieve the LAPS password for this device"
- "Show me patch compliance across the fleet"

These combine multiple API calls into a single operation:

- getFleetOverview: Comprehensive fleet summary — inventory counts, compliance rates, and mobile device status in one call
- getDeviceFullProfile: Complete device profile by name, serial, or ID — resolves automatically and fetches details, policy logs, and history in parallel
- getSecurityPosture: Fleet security analysis — FileVault encryption rates, compliance status, and OS version currency
- getPolicyAnalysis: Policy analysis by ID or name — configuration, scope, compliance, and performance

- searchDevices: Find devices by name, serial number, IP address, or username
- getDeviceDetails: Detailed device information by ID
- checkDeviceCompliance: Find devices that haven't reported in X days
- getDevicesBatch: Get details for multiple devices in a single request
- updateInventory: Force inventory update on a device

- getComputerHistory: Full computer history — policy logs, MDM commands, audit events, screen sharing, user/location changes
- getComputerPolicyLogs: Policy execution logs showing success/failure per device
- getComputerMDMCommandHistory: MDM command history with status and timestamps
- sendComputerMDMCommand: Send MDM commands to macOS — lock, wipe, restart, shutdown, remote desktop (requires confirmation)
- flushMDMCommands: Clear pending/failed MDM commands to unstick devices (requires confirmation)

- listPolicies: List all policies with optional category filter
- getPolicyDetails: Detailed policy info including scope, scripts, and packages
- searchPolicies: Search policies by name
- executePolicy: Run a policy on specific devices (requires confirmation)
- createPolicy: Create a new policy with full configuration (requires confirmation)
- updatePolicy: Update an existing policy (requires confirmation)
- clonePolicy: Clone a policy with a new name (requires confirmation)
- setPolicyEnabled: Enable or disable a policy (requires confirmation)
- updatePolicyScope: Add/remove computers and groups from policy scope (requires confirmation)
- deletePolicy: Delete a policy (requires confirmation)

- listScripts: List all scripts
- searchScripts: Search scripts by name
- getScriptDetails: Full script content, parameters, and metadata
- deployScript: Execute a script on devices (requires confirmation)
- createScript: Create a new script (requires confirmation)
- updateScript: Update an existing script (requires confirmation)
- deleteScript: Delete a script (requires confirmation)

- listConfigurationProfiles: List profiles (computer or mobile device)
- getConfigurationProfileDetails: Detailed profile information
- searchConfigurationProfiles: Search profiles by name
- deployConfigurationProfile: Deploy a profile to devices (requires confirmation)
- removeConfigurationProfile: Remove a profile from devices (requires confirmation)
- deleteConfigurationProfile: Delete a configuration profile (requires confirmation)

- listPackages: List all packages
- searchPackages: Search packages by name
- getPackageDetails: Detailed package information
- getPackageDeploymentHistory: Deployment history via policy analysis
- getPoliciesUsingPackage: Find all policies using a specific package
- getPackageDeploymentStats: Deployment statistics and scope analysis

- listComputerGroups: List groups (smart, static, or all)
- getComputerGroupDetails: Group details including membership and smart group criteria
- searchComputerGroups: Search groups by name
- getComputerGroupMembers: List all members of a group
- createStaticComputerGroup: Create a static group (requires confirmation)
- updateStaticComputerGroup: Update group membership (requires confirmation)
- deleteComputerGroup: Delete a group (requires confirmation)

- listAdvancedComputerSearches: List all saved advanced searches
- getAdvancedComputerSearchDetails: Get search configuration and results
- createAdvancedComputerSearch: Create a new advanced search (requires confirmation)
- deleteAdvancedComputerSearch: Delete a saved search (requires confirmation)

- searchMobileDevices: Search mobile devices by name, serial, or UDID
- getMobileDeviceDetails: Detailed mobile device information
- listMobileDevices: List all mobile devices
- listMobileDeviceApplications: List mobile device applications configured for delivery
- getMobileDeviceApplicationDetails: Get a delivered mobile application definition and scope details
- updateMobileDeviceInventory: Force inventory update on a mobile device
- sendMDMCommand: Send MDM commands — lock, wipe, clear passcode, lost mode, settings (requires confirmation)
- listMobileDeviceGroups: List mobile device groups
- getMobileDeviceGroupDetails: Group details including membership

- getInventorySummary: Fleet inventory summary — device counts, OS distribution, model distribution
- getDeviceComplianceSummary: Compliance summary — check-in rates, failed policies, missing software
- getPolicyComplianceReport: Policy compliance — success/failure rates, scope coverage
- getSoftwareVersionReport: Software version distribution across devices

- listBuildings/getBuildingDetails: Organizational buildings for multi-site scoping
- listDepartments/getDepartmentDetails: Departments for scoping and reporting
- listCategories/getCategoryDetails: Categories for organizing policies, scripts, and profiles

Local Administrator Password Solution (LAPS)

- getLocalAdminPassword: Retrieve the current LAPS password for a device (requires confirmation)
- getLocalAdminPasswordAudit: Audit trail of password views and rotations
- getLocalAdminPasswordAccounts: List LAPS-managed accounts on a device

- listPatchSoftwareTitles: List patch software title configurations
- getPatchSoftwareTitleDetails: Patch title details with versions and definitions
- listPatchPolicies: List patch policies with deployment status
- getPatchPolicyDashboard: Patch compliance dashboard — latest version, pending, failed

- listComputerExtensionAttributes: List all custom extension attributes
- getComputerExtensionAttributeDetails: Full EA details including script content
- createComputerExtensionAttribute: Create a new extension attribute (requires confirmation)
- updateComputerExtensionAttribute: Update an extension attribute (requires confirmation)
- deleteComputerExtensionAttribute: Delete an extension attribute (requires confirmation)

- listSoftwareUpdatePlans: List active and completed OS update plans
- createSoftwareUpdatePlan: Create an OS update plan for specific devices (requires confirmation)
- getSoftwareUpdatePlanDetails: Update plan status and device progress

- listComputerPrestages/getComputerPrestageDetails/getComputerPrestageScope: Computer PreStage Enrollment configuration and device assignments
- listMobilePrestages/getMobilePrestageDetails: Mobile device PreStage Enrollments

- listNetworkSegments: List network segments for location-based management
- getNetworkSegmentDetails: Segment details including IP ranges and building assignment

- listAccounts/getAccountDetails/getAccountGroupDetails: Jamf Pro admin accounts and groups with privileges
- listUsers/getUserDetails/searchUsers: End-user records (not admin accounts)

- listAppInstallers: List Jamf App Catalog titles
- getAppInstallerDetails: Detailed app installer information

- listRestrictedSoftware: List restricted software entries
- getRestrictedSoftwareDetails: Restricted software configuration details
- createRestrictedSoftware: Create a new restricted software entry (requires confirmation)
- updateRestrictedSoftware: Update an existing restricted software entry (requires confirmation)
- deleteRestrictedSoftware: Delete a restricted software entry (requires confirmation)

- listWebhooks: List configured webhooks
- getWebhookDetails: Webhook configuration details

Advanced multi-step operations for the ChatGPT connector:

- skill_device_search: Intelligent device search with natural language processing
- skill_find_outdated_devices: Identify devices not checking in
- skill_batch_inventory_update: Update multiple devices efficiently
- skill_deploy_policy_by_criteria: Deploy policies based on device criteria
- skill_scheduled_compliance_check: Automated compliance reporting
- In Jamf Pro, go toSettings>System>API Roles and Clients
- Create a new API Role with necessary permissions
- Create a new API Client — note the Client ID and generate a Client Secret

- macOS:~/Library/Application Support/Claude/claude_desktop_config.json
- Windows:%APPDATA%\Claude\claude_desktop_config.json

{ "mcpServers": { "jamf-pro": { "command": "node", "args": ["/absolute/path/to/jamf-mcp-server/dist/index-main.js"], "env": { "JAMF_URL": "https://your-instance.jamfcloud.com", "JAMF_CLIENT_ID": "your-api-client-id", "JAMF_CLIENT_SECRET": "your-api-client-secret" } } } }

SeeChatGPT Connector Setupfor detailed instructions.

{ "env": { "JAMF_USE_ENHANCED_MODE": "true", "JAMF_MAX_CONCURRENCY": "5", "JAMF_MAX_RETRIES": "3", "JAMF_RETRY_DELAY": "1000", "JAMF_RETRY_MAX_DELAY": "10000", "JAMF_DEBUG_MODE": "false", "JAMF_ENABLE_RETRY": "true", "JAMF_ENABLE_RATE_LIMITING": "false", "JAMF_ENABLE_CIRCUIT_BREAKER": "false", "JAMF_READ_ONLY": "false" } }

git clone https://github.com/dbankscard/jamf-mcp-server.git cd jamf-mcp-server npm install npm run build

npm run dev # Run in development mode npm run build:force # Build without tests npm test # Run tests

┌─ Classic Mode (110 tools) ──┐ Claude Desktop ──> │ MCP Server (stdio) │──> Jamf Pro API ├─ Code Mode (2 tools) ────────┤ │ jamf_search + jamf_execute │──> (sandboxed VM) ──> Jamf Pro API └──────────────────────────────┘ ChatGPT ──> Tunnel (Cloudflare) ──> MCP Server (HTTP) ──> Jamf Pro API

- Model Context Protocol Documentation
- Jamf Pro API Documentation
- ChatGPT MCP Connectors
- Claude Desktop MCP Servers

- Create an Issue
- View Documentation
- Fork this Repository

A RESTful API to programmatically interact with the Opal Security platform.