# Jamf MCP connector The Jamf connector brings your Macs, iPhones, iPads, users and admin accounts into Claude, ChatGPT, Cursor and any MCP client, so your team can look up, enroll and update managed devices in plain language. Source: https://elaichi.ai/connectors/jamf/ ## Facts | | | | --- | --- | | Application | Jamf | | Category | Device Management | | AI tools | 25 | | Authentication | App credentials | | Needs your own OAuth app | No | | MCP endpoint | https://api.elaichi.ai/mcp | | Works with | Claude, ChatGPT, Cursor, any MCP client, and the Elaichi Agent | | Tools advertised by name | Yes | ## What you can ask once Jamf is connected - List all Jamf mobile devices enrolled this month. - Which Jamf users have no assigned mobile device? - Show Jamf accounts with administrator privileges. ## Connect Jamf in Elaichi This happens once for the organization, before any client is involved. 1. Open Connections, choose Add connection, and pick Jamf. 2. Optionally set Share with, then press Connect. 3. Paste your Jamf app credentials. Jamf authenticates the app rather than a person. One person supplies the credentials once, and everyone else works through Share with. Credentials are vaulted and nobody, including the AI, reads them back. The connection becomes a toolbox immediately, so you can curate which Jamf tools are exposed, rename them, or freeze arguments before anyone points a client at it. ## Connect Jamf to Claude Endpoint: https://api.elaichi.ai/mcp 1. Open Customize, then Connectors. 2. Press Add. 3. Name it, paste the MCP server URL, then Continue. 4. Sign in and approve. On Team and Enterprise, an Owner adds it once. Everyone else turns it on for themselves. ## Connect Jamf to ChatGPT Endpoint: https://api.elaichi.ai/mcp 1. Open Plugins, then press the + button. 2. Name it and paste the endpoint into Server URL. 3. Leave Authentication on OAuth, then tick the risk acknowledgement. 4. Press Create, then sign in and approve. Works on the web today. The plugin directory lives at chatgpt.com/plugins. ## Connect Jamf to Cursor Endpoint: https://api.elaichi.ai/mcp 1. Open `~/.cursor/mcp.json`. 2. Add the endpoint under `mcpServers`. 3. Reload Cursor, then sign in and approve. Set up per machine, so repeat it on each computer you work from. ## Connect Jamf to any MCP client Endpoint: https://api.elaichi.ai/mcp 1. Add the endpoint as a remote MCP server. 2. Sign in and approve. The Elaichi Agent already has these tools, with nothing to set up. ## What the consent screen decides Only Read is granted by default, which is not enough to call a Jamf tool. Over MCP there is no trusted place to confirm a write in the moment, so the consent screen is the standing approval rather than a formality. Grant Read and Run tools. Think hard before granting Delete, which reaches into connected apps and cannot be undone. ## What teams do with Jamf through Elaichi ### Find every Mac that has gone quiet IT. Ask which computers in Jamf inventory have not checked in recently, then update the record once the machine is found or written off. ### Look up a device while the ticket is open Support. Pull the serial number, assigned user and installed apps for a colleague's iPhone or MacBook from Jamf without leaving the conversation. ### Spot phones still carrying an old app Security. List the mobile device applications in Jamf, find the versions that should be gone, and update or remove the entries that no longer belong. ### Set up a new hire on day one People. Create the person's Jamf user record, assign their laptop and phone, and confirm everything shows up before they walk in. ### Reconcile the hardware list before a refresh Operations. Compare what Jamf computer inventory says you own against what is on desks, then correct locations, models and owners in one pass. ### Review who holds a Jamf admin account IT. List every Jamf account, check who still needs elevated access, and remove or update the ones that should have gone months ago. ## Frequently asked questions ### How do I connect Jamf to Claude? Open Elaichi, choose Jamf from the connector catalog, and sign in with your Jamf app credentials. There is no OAuth application to register and no client ID or secret to generate. Then in Claude go to Customize, then Connectors, then Add, and paste https://api.elaichi.ai/mcp as the endpoint. Claude will ask you to sign in to Elaichi as yourself, and your Jamf devices, users and accounts are available from then on. ### Does Jamf work with ChatGPT and Cursor as well as Claude? Yes. Once Jamf is connected in Elaichi, the same endpoint, https://api.elaichi.ai/mcp, works in Claude, ChatGPT, Cursor, any other MCP client and the Elaichi Agent. You connect Jamf once and every client you use picks it up. ### What can an AI agent actually do with my Jamf data? With Jamf connected, an agent can list and search your managed Macs, iPhones and iPads, look up a single device by its ID, and update inventory details like owner or location. It can also create and update Jamf users, review which apps are deployed to mobile devices, and manage the admin accounts that sign in to Jamf itself. In practice that means asking questions like which devices a person has, or which machines have not reported in, and getting an answer from live Jamf records. ### Does connecting Jamf give the AI access to every device in my Jamf instance? No. Every call to Jamf runs inside the access of the person who signed in, so an agent can only see and change the devices, users and accounts that person could already reach in Jamf. Elaichi can narrow that further, for example to read-only or to a subset of actions, but it can never widen it beyond what Jamf itself allows that person. ### Can my team share one Jamf connection? Yes. One administrator connects Jamf in Elaichi and shares the connection with a team, and nobody else ever handles the Jamf app credentials. Each teammate still signs in to Elaichi as themselves, so when someone updates a device record or removes a user, the audit log names that person rather than the shared connection. ### Can I stop an agent from deleting or changing things in Jamf? Yes. Restrictions in Elaichi work per action, so you can allow looking up devices and users in Jamf while blocking deletes or edits entirely. A blocked action is never shown to Claude, ChatGPT, Cursor or any other client, so no prompt, however worded, can reach it. ### What happens to a Jamf connection when someone leaves? Offboarding a person in Elaichi ends their access to Jamf through every client at once, with no separate step in Claude, ChatGPT or Cursor. If they were using a shared Jamf connection, it keeps working for everyone else on the team. If you ever want Jamf gone completely, disconnecting it once in Elaichi removes it from every client at the same time. ## All 25 Jamf tools Every tool below is callable through https://api.elaichi.ai/mcp once Jamf is connected, subject to the toolbox it is in and the restrictions on the caller. - **List all Jamf accounts** (List). List all account users or admin users in Jamf. Returns an array of account objects containing id and name fields for each account. - **Get single Jamf account by ID** (Get). Get details of a specific account user or admin user in Jamf by id. Returns id, name, email, enabled status, access_level, privilege_set, site, and privileges related to JSS objects, settings, actions, and tools. - **Delete a Jamf account by ID** (Delete). Delete a specific account user or admin user in Jamf using its id. Returns a 200 OK response when the account is successfully deleted. - **Update a Jamf account by ID** (Update). Update an existing account user or admin user in Jamf using the specified id. Returns updated fields including name, email_address, access_level, privilege_set, and enabled status. - **Create a Jamf account** (Create). Create a new account in Jamf using id. Requires id. Returns details such as name, email, full_name, access_level, and privilege_set in the response. - **List all Jamf users** (List). List all users in Jamf. Returns an array where each item includes size and user details such as id and name. - **Get single Jamf user by ID** (Get). Get a specific user in Jamf by id. Returns fields such as id, name, full_name, email, phone_number, position, ldap_server, extension_attributes, sites, and links with related assets. - **Delete a Jamf user by ID** (Delete). Delete a user in Jamf by id. Requires id. Returns a confirmation of successful deletion. - **Update a Jamf user by ID** (Update). Update an existing user in Jamf using id. This operation cannot be used to add computers, mobile devices, peripherals, or VPP assignments. Returns updated user details such as name, full_name, email, and phone_number. - **Create a Jamf user** (Create). Create a new user in Jamf by id. Requires id. The response includes created user details such as name, full_name, email, phone_number, and position. Cannot be used to add computers, mobile devices, peripherals, or VPP assignments. - **List all Jamf mobile devices** (List). List all mobile-devices in Jamf. Returns id, name, serialNumber, wifiMacAddress, udid, phoneNumber, model, modelIdentifier, username, type, managementId, and softwareUpdateDeviceId for each device. - **Get single Jamf mobile device by ID** (Get). Get details for a specific mobile device in Jamf by id. Returns key fields including display_name, device_name, serial_number, model, and os_version. - **Create a Jamf mobile device** (Create). Create a new mobile device in Jamf using id. Returns fields such as model_identifier for device type and os_name derived from API level for Android devices. id is required. - **Update a Jamf mobile device by ID** (Update). Update an existing mobile device in Jamf using id. Returns updated device details including general information, location, purchasing data, and extension attributes. The os_name field in android is derived from the API level and cannot be set. - **Delete a Jamf mobile device by ID** (Delete). Delete a mobile device in Jamf by id. Requires id. Returns a success message on successful deletion. - **List all Jamf search mobile devices** (List). Search mobile devices in Jamf that match the provided match parameter. Requires match. Returns fields such as id, name, serial_number, os_version, model, managed, and location details in the response. - **List all Jamf mobile device applications** (List). List all mobile device applications in Jamf. Returns each application's id, name, display_name, bundle_id, version, and internal_app fields. - **Get single Jamf mobile device application by ID** (Get). Get details of a specific mobile-device-application in Jamf using id. Returns key fields such as name, bundle_id, version, category, icon, and deployment_type for the application. - **Delete a Jamf mobile device application by ID** (Delete). Delete a mobile device application in Jamf by id. Requires id. Returns a confirmation upon successful deletion. - **Update a Jamf mobile device application by ID** (Update). Update an existing mobile device application in Jamf using id. Requires id. Returns updated fields including general details, scope, self_service configuration, VPP settings, and app_configuration preferences (must use character entities). - **Create a Jamf mobile device application** (Create). Create a new mobile device application in Jamf using id. Returns details such as name, bundle_id, display_name, version, and configuration preferences. App configuration preferences must be listed using character entities. - **List all Jamf computer inventory** (List). List paginated Computer Inventory records in Jamf. Returns key fields such as id, udid, general.name, general.platform, and hardware.model for each device. - **Create a Jamf computer inventory** (Create). Create a new Computer Inventory record in Jamf. Returns id and href of the created record in the response. - **Update a Jamf computer inventory by ID** (Update). Update specific fields on a computer in Jamf using id. Returns the updated computer object including fields such as general, purchasing, userAndLocation, hardware, and operatingSystem details. - **Delete a Jamf computer inventory by ID** (Delete). Delete a specific computer record in Jamf using id. Returns a 204 status when the computer is successfully removed or a 404 error if the computer id does not exist.