MCP 服务器

Desktop Management MCP Server

MCP server for managing devices via JAMF Pro and Microsoft Intune APIs, enabling AI assistants to query and control device management tasks.

README

Desktop Management MCP Server

Standalone Model Context Protocol (MCP) servers for JAMF Pro and Microsoft Intune. AI assistants (Claude Code, Gemini CLI, OpenCode, etc.) connect over HTTP and call device-management tools.

Architecture

MCP Client  ──HTTP──▶  jamf-server (port 3001)  ──▶  JAMF Pro REST API
MCP Client  ──HTTP──▶  intune-server (port 3002) ──▶  Microsoft Graph API

Each server is a stateless Express app using @modelcontextprotocol/sdk. Every POST to /mcp creates a fresh StreamableHTTPServerTransport. Secrets are injected at runtime by Bitwarden Secrets Manager — no credentials are stored in the repo.

Prerequisites

Node.js 24+
BWS CLI (bws in PATH)
A Bitwarden Secrets Manager project with the secrets listed in bws-secrets.map
JAMF Pro API client credentials (OAuth2)
Azure AD app registration with Microsoft Graph permissions (for Intune)

Quick Start

# Install dependencies and build
npm install && npm run build

# Set your BWS machine account access token
export BWS_ACCESS_TOKEN="<your-token>"

# Start whichever server(s) you need
./start-jamf.sh    # JAMF MCP on http://localhost:3001/mcp
./start-intune.sh  # Intune MCP on http://localhost:3002/mcp

See bws-secrets.map for the secret names to create in your BWS project.

Environment Variables

Injected by bws run from your BWS project (see bws-secrets.map):

JAMF Pro:

JAMF_URL — e.g. https://yourorg.jamfcloud.com
JAMF_CLIENT_ID, JAMF_CLIENT_SECRET

Microsoft Intune:

AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET

Azure AD Graph Permissions

The Intune app registration needs these Application permissions (with admin consent):

Device.Read.All
DeviceManagementManagedDevices.Read.All
DeviceManagementApps.Read.All
DeviceManagementConfiguration.Read.All
Group.Read.All
User.Read.All

Client Configuration

Claude Code (`~/.claude/claude_desktop_config.json` or MCP settings)

{
  "mcpServers": {
    "jamf": {
      "type": "http",
      "url": "http://localhost:3001/mcp"
    },
    "intune": {
      "type": "http",
      "url": "http://localhost:3002/mcp"
    }
  }
}

Gemini CLI (`~/.gemini/settings.json`)

{
  "mcpServers": {
    "jamf": { "httpUrl": "http://localhost:3001/mcp" },
    "intune": { "httpUrl": "http://localhost:3002/mcp" }
  }
}

OpenCode (`~/.config/opencode/opencode.json`)

{
  "mcp": {
    "jamf":   { "type": "remote", "url": "http://localhost:3001/mcp", "enabled": true },
    "intune": { "type": "remote", "url": "http://localhost:3002/mcp", "enabled": true }
  }
}

MCP Tools Reference

JAMF Pro Tools

Tool	Description	Parameters
`jamf_get_computer`	Computer details by name	`computerName`
`jamf_get_computer_by_serial`	Computer details by serial number	`serialNumber`
`jamf_get_computers_by_user`	Macs by username / name / email	`userIdentifier`
`jamf_get_mobile_device`	Mobile device details by name	`deviceName`
`jamf_list_smart_groups`	List smart groups	`type` (`"computer"` or `"mobile_device"`)
`jamf_get_smart_group_members`	Members of a smart group	`groupId`
`jamf_list_sites`	All JAMF sites	—
`jamf_list_scripts`	Scripts (with optional filter/pagination)	`name?`, `page?`, `pageSize?`
`jamf_list_packages`	Packages (with optional filter/pagination)	`name?`, `page?`, `pageSize?`
`jamf_list_inventory_preload`	Inventory preload records	`page?`, `pageSize?`
`jamf_list_prestage_configs`	Computer prestage assignments	—
`jamf_list_static_groups`	Static computer groups	—
`jamf_list_policies`	Policies list	—
`jamf_get_policy`	Policy details	`policyId`
`jamf_list_configuration_profiles`	Configuration profiles	—
`jamf_list_patch_policies`	Patch policies	—
`jamf_list_categories`	Categories	—
`jamf_list_departments`	Departments	—
`jamf_get_filevault_status`	FileVault encryption status	`computerName`
`jamf_send_mdm_command`	Send MDM command to a device	`deviceId`, `command`
`jamf_update_computer`	Update computer inventory fields	`computerId`, `fields`
`jamf_flush_mdm_commands`	Flush pending MDM commands	`deviceId`

Microsoft Intune Tools

Tool	Description	Parameters
`intune_get_autopilot_status`	Autopilot profile & status	`serialNumber?`, `deviceName?`
`intune_get_device_by_name`	Managed device by name	`deviceName`
`intune_get_device_by_serial`	Managed device by serial number	`serialNumber`
`intune_get_devices_by_user`	All devices for a user	`userIdentifier`
`intune_get_device_groups`	Device group memberships	`deviceName?`, `deviceId?`, `serialNumber?`
`intune_get_device_apps`	Detected & assigned apps	`deviceName?`, `deviceId?`, `serialNumber?`
`intune_list_configuration_policies`	Configuration policies (classic + settings catalog)	`policyName?`, `platform?`
`intune_troubleshoot_device_policies`	Device-level policy deployment diagnostics	`deviceName?`, `deviceId?`, `serialNumber?`
`intune_get_policy_assignments`	Assignment targets for a policy	`policyId`, `source?`
`intune_troubleshoot_policy`	Correlates policy assignment + device state	`policyId`, `deviceName?`, `deviceId?`, `serialNumber?`, `source?`
`intune_list_app_deployments`	Intune app deployments	`appName?`, `publisher?`, `platform?`
`intune_get_app_assignments`	Assignment targets for an app	`appId`
`intune_troubleshoot_app`	Correlates app assignment + device app status	`appId`, `deviceName?`, `deviceId?`, `serialNumber?`

Running Tests

Tests are live integration tests against a real JAMF Pro instance:

export BWS_ACCESS_TOKEN="<your-token>"
bws run --access-token "$BWS_ACCESS_TOKEN" -- \
  TEST_COMPUTER_NAME="<name>" \
  TEST_COMPUTER_SERIAL="<serial>" \
  TEST_USER_EMAIL="<email>" \
  npm test

Add JAMF_TEST_WRITE=1 to enable destructive write tests (MDM commands, inventory updates).

Project Structure

├── src/
│   ├── mcp/
│   │   ├── jamf-server.ts      # JAMF standalone MCP server (port 3001)
│   │   └── intune-server.ts    # Intune standalone MCP server (port 3002)
│   ├── jamf/
│   │   └── jamf-api.ts         # JAMF Pro REST + Classic API client
│   ├── intune/
│   │   └── graph-api.ts        # Microsoft Graph / Intune client
│   └── utils/
│       └── logger.ts           # Output formatting helpers
├── start-jamf.sh               # BWS-wrapped launcher for JAMF server
├── start-intune.sh             # BWS-wrapped launcher for Intune server
└── bws-secrets.map             # Required BWS secret names and descriptions