Home

jamf-cli

jamf-cli is a command-line interface for the Jamf platform, covering Jamf Pro, the Jamf Platform API, Jamf Protect, Jamf School and Jamf Security Cloud. That spans 200+ Jamf Pro API resources, Platform API resources (blueprints, compliance benchmarks, DDM reports), the Jamf Platform's own surfaces (AI Governance, Jamf Account, audit), Jamf Protect configuration management, Jamf School device and user administration, and Jamf Security Cloud risk, DNS, ZTNA and UEM Connect. You drive all of it from the terminal instead of writing REST calls by hand, and open takes you to the web interface for the work that belongs there.

Check these three before you upgrade.

• v1.30.0: the Classic scope subcommands take an id. scope get, scope add and scope remove on the nine scopeable Classic resources now read [<id>], with --name as the alternative. v1.29.0 took a bare name positional, so scope add "Deploy Chrome" --computer-group X exits 2 naming --name. See Jamf Pro Commands.
• v1.29.0 renamed the jamf-cli pro resource commands. 100 former names still work until 2027-03-09 and warn on stderr, 48 invocations refuse at exit 2, and three former leaves print help at exit 0 where they returned data. Check your pro scripts against Pro Command Renames.
• The Platform API reached general availability on 2026-09-03. Coming from the public beta, the gateway base URL, the credentials and the scoping model all changed. Read Platform API GA Migration before anything else.

Examples

One overview command reports on a Jamf Pro, Jamf Protect or Jamf School instance:

$ jamf-cli pro overview
$ jamf-cli protect overview
$ jamf-cli school overview

It covers instance health, inventory counts, enrollment status and alerts.

Other day-to-day commands:

# List all computers in Jamf Pro
jamf-cli pro computers list

# Export your fleet to CSV
jamf-cli pro computers list -o csv --out-file fleet.csv

# Get a specific computer by name
jamf-cli pro computers get --name "Neil's MacBook"

# Open the Jamf Pro web interface at a named section
jamf-cli pro open policies

# Print the URL for a section instead of launching a browser
jamf-cli pro open computers --field url

# List blueprints (Platform API)
jamf-cli pro blueprints list

# List compliance benchmarks
jamf-cli pro compliance-benchmarks list

# Check whether App Installers is enabled on this instance
jamf-cli pro app-installers get

# List AI Governance policies (Jamf Platform)
jamf-cli platform ai-policies list

# Read the platform audit event log
jamf-cli platform audit sources

# List Jamf Protect plans
jamf-cli protect plans list

# Export an analytic to YAML
jamf-cli protect analytics export "My Analytic"

# Back up a whole Jamf Protect tenant to disk
jamf-cli protect backup --output ./protect-backup

# Download the Jamf Protect installer
jamf-cli protect downloads installer

# List Jamf School devices
jamf-cli school devices list

# Get a School device by serial number
jamf-cli school devices get C02X1234

# List device risk status (Jamf Security Cloud)
jamf-cli security risk list

# List ZTNA applications (Jamf Security Cloud, via the platform gateway)
jamf-cli security ztna-apps list

# Get the SSE stream configuration (Jamf Security Cloud)
jamf-cli security stream get

Community Showcase

Community members have built AutoPkg integrations and reporting tools on jamf-cli. Three of the projects in the Community Showcase:

• JamfCLI-Runner by Graham Pugh: an AutoPkg processor that drives jamf-cli from AutoPkg recipes, bringing the CLI's API coverage into packaging workflows.
• jamf-reports-community by Tony Young: a Python-based reporting tool that generates multi-sheet Excel workbooks (fleet overview, patch compliance, EA coverage, security posture) from live Jamf Pro data via jamf-cli.
• JamfReport by Marco Devliegere: a bash script that produces a self-contained HTML snapshot of a Jamf Pro instance using jamf-cli, with security posture gauges, MDM failure tables, cleanup analysis, and an optional adoption timeline tracked across runs.

If you've built something with jamf-cli, open an issue or PR to get it featured.

Getting Started

The Setup Guide takes you from installation to your first command.

For Jamf Pro, platform gateway setup (jamf-cli platform setup) is the recommended path. It routes Pro API traffic through the Jamf Platform Gateway and enables the Platform API commands (blueprints, compliance benchmarks, DDM reports), the Jamf Platform namespace and the gateway-served half of Jamf Security Cloud. Two things to know before you commit to it:

• A gateway credential is created at one of three scope levels (organization, platform environment or tenant) and only works with the level it was created at. Prefer a platform environment. See Configuration & Profiles.
• Some Jamf Pro and Classic commands sit outside the gateway's published API and are refused on a gateway profile with exit code 8, including MDM device actions such as lock, restart and lost mode. Keep a second oauth2 profile against the instance for those. The full list and the reasoning are in Platform API GA Migration.

For installation and releases, see the GitHub repository.

Contents

Community

• Community Showcase: Projects, integrations, and write-ups from the Jamf community

Getting Started

• Setup Guide: Installation, interactive setup wizard, shell completion
• Platform API GA Migration: Moving a public-beta gateway profile to GA (base URL, credentials, scope levels, refused commands, exit code 8)
• Pro Command Renames: The v1.29.0 pro resource renames: the old-to-new tables, the 2027-03-09 window, the moved invocations, and the three that exit 0 with help text
• Claude Code Skills: Administer Jamf through natural language with the Claude Code skills plugin
• MCP Server: Expose the CLI to any MCP client (Claude Desktop, Cursor, custom agents) via mcp serve

CLI Reference

• CLI Patterns: Apply, scaffold, --set, pagination, patch, name lookup, dry-run and destructive ops, shared across all products
• Output Formats: Table, JSON, CSV, YAML, plain; status indicators, relative timestamps

Product Commands

• Jamf Pro Commands: Fleet inventory, device actions, App Installers, reports, audit, backup, bulk ops, Classic API, scope management
• Platform API Commands: Blueprints, compliance benchmarks, DDM reports, platform devices and groups
• Jamf Platform Commands: AI Governance, Jamf Account (licensing, partners, SSO) and platform audit, in the platform namespace rather than pro
• Jamf Protect Commands: Plans, analytics and overrides, detection sets, exception sets, USB control, alerts, insights, audit logs, downloads, tenant backup and restore
• Jamf School Commands: Devices, device groups, users, classes, apps, profiles, locations, iBeacons, DEP devices
• Jamf Security Cloud Commands: Device risk, device lifecycle, SSE; plus DNS, ZTNA, content categories, device groups, UEM Connect and enrollment through the platform gateway

Product Workflows

• Pro Workflows: Daily fleet checks, inventory exports, scope management, device actions, multi-instance operations
• Platform Workflows: Blueprint management, profile import, compliance benchmarks, DDM reports
• Protect Workflows: Community analytics import, severity overrides, detection sets, export/import round-trip, USB control, tenant backup and cross-tenant clone
• School Workflows: Device management, class administration, user management, DEP enrollment
• Security Cloud Workflows: Device risk reporting, risk overrides, device purge, SSE stream configuration, DNS and ZTNA setup, UEM Connect

Configuration

• Configuration & Profiles: Config file, auth methods, scope levels, profile management, global flags, environment variables
• Secrets & Keychain: Secret formats (env:, file:, keychain:), macOS Keychain integration, credential input policy

Reference

• Error Handling & Exit Codes: Exit codes, HTTP error mapping, permission vocabularies, structured JSON errors, retry logic
• CI/CD & Scripting: Non-interactive mode, GitHub Actions examples, Docker usage
• Architecture & Development: Project structure, code generation, Platform SDK, Protect SDK, contributing