Labsco
MCP SERVER

Jamf Pro MCP Server

by dbankscard ↗

Ask about your Apple fleet in Jamf Pro — compliance, encryption, policy runs, LAPS passwords — and send MDM commands when you need to.

Network, Endpoint & Fleet Management
Summary
The compound tools answer fleet questions in one call; code mode answers the ones that need a join.

getFleetOverview and getSecurityPosture exist because the underlying API makes you fetch a list and then detail every item — they do that behind the scenes. Code mode goes further: the agent writes JavaScript against the API client, so cross-resource questions like OS version by department become one call instead of a sequence the model has to hold together. Destructive commands sit behind explicit confirmation in both modes.

What it is

A Jamf Pro server covering both the modern and Classic APIs. It ships in two shapes: a classic mode with one tool per operation, and a code mode that exposes a search tool and a sandboxed JavaScript runtime over the same API client.

What you get
  • getFleetOverview — inventory counts, compliance rates and mobile device status in a single call
  • getDeviceFullProfile — a device resolved by name, serial or id, with details, policy logs and history fetched in parallel
  • getSecurityPosture — FileVault encryption rates, compliance status and OS version currency across the fleet
  • getPolicyAnalysis — a policy's configuration, scope, compliance and performance, resolved by id or name
  • searchDevices, getDeviceDetails, getDevicesBatch, checkDeviceCompliance, updateInventory — find devices and force an inventory update
  • getComputerHistory, getComputerPolicyLogs, getComputerMDMCommandHistory — what ran on a machine and whether it worked
  • sendComputerMDMCommand and flushMDMCommands — lock, wipe, restart or shut down a Mac, or clear stuck commands; both require confirmation
  • listPolicies, searchPolicies, getPolicyDetails, executePolicy, createPolicy, updatePolicy — policy management, with writes behind a confirmation
  • jamf_search and jamf_execute — the code mode pair: discover API methods, then run JavaScript against the typed client in a sandboxed vm
  • Code mode safety rails: a plan mode that previews writes, declared capabilities such as read:computers or command:mdm, call-count budgets, and an approval token for wipe, lock and delete
Requirements

A Jamf Pro instance and an API client: JAMF_URL, JAMF_CLIENT_ID and JAMF_CLIENT_SECRET. Node.js 18.0.0 or newer — clone, npm install and npm run build, then point the client at dist/index-main.js for classic mode or dist/index-code.js for code mode. JAMF_MAX_CONCURRENCY tunes the concurrency limiter that keeps you under Jamf's rate limits.