Content
# JumpCloud MCP — Unofficial
[](https://github.com/francobee/jumpcloud-mcp-unofficial/releases/latest)
[](LICENSE)
[](#platform-support)
Control JumpCloud with plain English through Claude. Manage users, devices, groups, apps, commands, events, and policies — without opening the admin console.
> **Unofficial.** Not affiliated with or endorsed by JumpCloud, Inc.
---
## What you can do
```
"Reset MFA for alice@company.com — she got a new phone"
"Which Windows devices haven't checked in for 30 days?"
"Provision bob@company.com to the GitHub and Jira SSO apps"
"Suspend user abc123 — they just left the company"
"Show all failed logins from yesterday"
"Add all MacBooks to the MDM-Enforced device group"
```
33 tools across 7 categories: **Users · Devices · Groups · Apps · Commands · Events · Policies**
---
## Getting your API key
1. Log in to the [JumpCloud Admin Console](https://console.jumpcloud.com)
2. Click your **name** in the top-right corner
3. Select **My API Key**
4. Click **Generate New API Key** — copy it immediately, it's only shown once
---
## Installation
### Option A — Claude Desktop · All platforms · Recommended
1. Download `jumpcloud-unofficial-X.Y.Z.mcpb` from the [latest release](https://github.com/francobee/jumpcloud-mcp-unofficial/releases/latest)
2. Drag and drop the `.mcpb` onto Claude Desktop
3. Enter your API key when prompted
Your key is stored in the **OS keychain** (macOS Keychain / Windows Credential Manager / Linux Secret Service) — never on disk as plaintext.
---
### Option B — Claude Code CLI
```bash
# 1. Clone and build
git clone https://github.com/francobee/jumpcloud-mcp-unofficial.git
cd jumpcloud-mcp-unofficial
npm install && npm run build
# 2. Store your API key in the OS keychain (one-time)
node dist/index.js --setup
# 3. Register with Claude Code
claude mcp add jumpcloud --scope user -- node "$(pwd)/dist/index.js"
```
Restart Claude Code — the tools are ready.
> **Key management**
> ```bash
> node dist/index.js --setup # rotate key
> node dist/index.js --clear-key # remove key
> ```
---
## Platform support
| | Option A (Claude Desktop) | Option B (CLI) |
|---|---|---|
| macOS | ✅ | ✅ Keychain via `security(1)` |
| Windows | ✅ | ✅ DPAPI-encrypted file in `%APPDATA%` |
| Linux | ✅ | ✅ Secret Service via `secret-tool`* |
*Linux requires `libsecret-tools`: `sudo apt install libsecret-tools`
---
## Tools reference
<details>
<summary><strong>👤 Users (10 tools)</strong></summary>
| Tool | Description |
|------|-------------|
| `jc_users_list` | List users. Filter by name, email, or username |
| `jc_users_get` | Get full details for a user by ID or email |
| `jc_users_create` | Create a new user account |
| `jc_users_update` | Update user attributes (name, email, manager, etc.) |
| `jc_users_suspend` | Suspend a user — revokes all sessions, blocks login |
| `jc_users_reactivate` | Reactivate a suspended account |
| `jc_users_unlock` | Unlock an account locked by failed login attempts |
| `jc_users_reset_mfa` | Reset MFA enrollment — user re-enrolls on next login |
| `jc_users_set_password` | Set a new password, with optional force-reset |
| `jc_users_delete` | ⚠️ Permanently delete a user — irreversible |
**Example prompts**
- *"List all suspended users"*
- *"Reset MFA for alice@company.com — she got a new phone"*
- *"Create an account for Jane Doe, jane.doe@company.com, send activation email"*
- *"Unlock the account for user abc123 — they're locked out"*
</details>
<details>
<summary><strong>💻 Devices (8 tools)</strong></summary>
| Tool | Description |
|------|-------------|
| `jc_devices_list` | List devices. Filter by hostname or OS |
| `jc_devices_get` | Get full details for a device by system ID |
| `jc_devices_update` | Update device attributes (display name, tags, etc.) |
| `jc_devices_lock` | Remotely lock a device |
| `jc_devices_restart` | Send a restart command |
| `jc_devices_shutdown` | Send a shutdown command |
| `jc_devices_erase` | ⚠️ Remote wipe — all data erased on next check-in |
| `jc_devices_get_users` | List users bound to a device |
**Example prompts**
- *"List all Windows devices"*
- *"Which devices haven't checked in since May 1st?"*
- *"Lock device sys123 — it was left unattended"*
- *"Remote wipe sys123 — it's been reported stolen"*
</details>
<details>
<summary><strong>👥 Groups (8 tools)</strong></summary>
| Tool | Description |
|------|-------------|
| `jc_groups_list_user` | List all user groups |
| `jc_groups_list_device` | List all device groups |
| `jc_groups_get_members` | List all members of a group |
| `jc_groups_get_user` | Get all groups a user belongs to |
| `jc_groups_add_user` | Add a user to a user group |
| `jc_groups_remove_user` | Remove a user from a user group |
| `jc_groups_add_device` | Add a device to a device group |
| `jc_groups_remove_device` | Remove a device from a device group |
**Example prompts**
- *"Which groups is alice@company.com a member of?"*
- *"Add all new MacBooks to the MDM-Enforced group"*
- *"Remove user abc123 from the Contractors group"*
</details>
<details>
<summary><strong>📦 Apps (5 tools)</strong></summary>
| Tool | Description |
|------|-------------|
| `jc_apps_list` | List all SSO/SAML applications |
| `jc_apps_get_user` | List all apps a user is provisioned to |
| `jc_apps_get_users` | List all users provisioned to an app |
| `jc_apps_provision_user` | Grant a user access to an SSO application |
| `jc_apps_deprovision_user` | Remove a user's access to an SSO application |
**Example prompts**
- *"What apps does bob@company.com have access to?"*
- *"Provision alice to the GitHub and Jira SSO apps"*
- *"Remove the contractor from all SSO apps"*
</details>
<details>
<summary><strong>⚡ Commands (4 tools)</strong></summary>
| Tool | Description |
|------|-------------|
| `jc_commands_list` | List all saved commands |
| `jc_commands_get` | Get command details including script body |
| `jc_commands_run` | Trigger a command on its associated devices |
| `jc_commands_list_results` | Check command execution output |
**Example prompts**
- *"Run the 'Clear Browser Cache' command"*
- *"Did command cmd123 succeed on all devices?"*
</details>
<details>
<summary><strong>📋 Events (2 tools)</strong></summary>
| Tool | Description |
|------|-------------|
| `jc_events_get` | Query audit events — filter by service, user, or date |
| `jc_events_get_user` | Get recent audit events for a specific user |
Services: `all` · `directory` · `ldap` · `mdm` · `password_manager` · `radius` · `sso` · `systems`
**Example prompts**
- *"Show all failed SSO logins from yesterday"*
- *"What has alice@company.com been doing in JumpCloud this month?"*
- *"Pull all MDM events for the last 7 days"*
</details>
<details>
<summary><strong>🔒 Policies (3 tools)</strong></summary>
| Tool | Description |
|------|-------------|
| `jc_policies_list` | List all policies (MDM, config profiles, password policies) |
| `jc_policies_get` | Get full policy details including configuration values |
| `jc_policies_get_results` | Check compliance status across all targeted devices |
**Example prompts**
- *"Which devices are non-compliant with the FileVault policy?"*
- *"List all MDM policies"*
</details>
---
## Security
- **API key never touches `~/.claude.json`** — stored exclusively in the OS keychain
- **In-memory only at runtime** — key is read from keychain into process memory, never written anywhere
- **Use a dedicated key** — generate one via **My API Key** in the Admin Console; don't reuse your personal admin key
- **Rotate regularly** — generate a new key in JumpCloud and re-run `--setup`
- **Destructive tools are labelled** — `jc_users_delete` and `jc_devices_erase` carry ⚠️ warnings; Claude will ask for confirmation
---
## Development
```bash
npm install
npm run dev # run directly with tsx (no build step)
npm run build # compile TypeScript → dist/
# Build + pack MCPB bundle
npx esbuild src/index.ts --bundle --platform=node --format=esm \
--outfile=server/index.js \
--banner:js="import { createRequire } from 'module'; const require = createRequire(import.meta.url);"
npx @anthropic-ai/mcpb pack . dist/jumpcloud.mcpb
```
**Releasing a new version:**
```bash
npm version patch # or minor / major
git push --follow-tags
```
GitHub Actions builds the bundle, packs the MCPB, and attaches it to the release automatically.
---
## Disclaimer
This project is not affiliated with, maintained by, or endorsed by JumpCloud, Inc. JumpCloud is a trademark of JumpCloud, Inc.
## License
[MIT](LICENSE)
