jamf-cli

Unified CLI for Jamf Platform API Gateway, Jamf Pro, Jamf Protect, and Jamf School. 1,200+ commands. Full API coverage. Zero clicks.

Documentation Wiki — full guides, configuration reference, and workflow recipes.

Command Explorer — interactive showcase of every command, searchable and filterable. Press ⌘K (or Ctrl+K) for a fuzzy command palette. Auto-updated on every merge.

Installation

Homebrew (macOS and Linux)

brew install Jamf-Concepts/tap/jamf-cli

Binary releases

Download from GitHub Releases.

From source

Requires Go 1.27 or newer — go.mod declares go 1.27.4, and the default GOTOOLCHAIN=auto fetches that toolchain if your local one is older.

go install github.com/Jamf-Concepts/jamf-cli/cmd/jamf-cli@latest

Quick Start

For interactive use, jamf-cli pro setup prompts for credentials so nothing is leaked to shell history, and stores them in the system keychain. Environment variables (JAMF_CLIENT_ID, JAMF_CLIENT_SECRET, etc.) are intended for automation workflows only — avoid setting them in interactive shells.

Jamf Pro

pro setup takes credentials from either of two sources. It asks which at the first prompt, defaulting to an API client you already made:

# One-time setup: prompts for a client ID and secret, verifies them, and stores
# them in the system keychain
jamf-cli pro setup --url https://jamf.company.com

# Let jamf-cli create the API role and client for you, using a Jamf Pro account.
# Local and directory accounts are deprecated for cloud-hosted instances
# (estimated removal in the second half of 2027), so prefer the option above.
jamf-cli pro setup --url https://jamf.company.com --credentials create

# Multi-instance setup (MSPs): bootstrap credentials for many instances at once
jamf-cli pro setup --from-file instances.txt --credentials create --scope standard

# Instance health dashboard
jamf-cli pro overview

# List computers
jamf-cli pro comp list -o table

# Extract just the names
jamf-cli pro comp list --field name

# Export inventory
jamf-cli pro comp list -o csv --out-file inventory.csv

# Show the JSON template for creating a building
jamf-cli pro buildings create --scaffold

# Create or update a building by name (upsert)
echo '{"name":"HQ","streetAddress1":"1 Apple Park Way"}' | jamf-cli pro buildings apply

# Apply from a file without confirmation
jamf-cli pro buildings apply --from-file building.json --yes

# Delete a building by name
jamf-cli pro buildings delete --name "HQ" --yes

# Device actions by serial number
jamf-cli pro comp blank-push --serial C02X1234
jamf-cli pro comp redeploy-framework --serial C02X1234
jamf-cli pro comp erase --serial C02X1234 --yes

# Device actions targeting a group
jamf-cli pro comp blank-push --group "All Macs" --yes
jamf-cli pro md unmanage --group "Retired iPads" --yes --confirm-destructive

# Classic API MDM commands
jamf-cli pro comp lock --serial C02X1234 --yes --confirm-destructive
jamf-cli pro md update-inventory --id 42 --yes

# Device deep-dive
jamf-cli pro device C02X1234

# Fleet security report
jamf-cli pro report security -o table

# Run a command against multiple instances
jamf-cli multi --filter 'pro-*' -- pro buildings apply --from-file building.json --yes

# Shareable HTML fleet dashboard (add --full for patch, cleanup and org sections)
jamf-cli dashboard --out-file report.html

Jamf Platform (via Gateway)

# List blueprints (DDM-based config delivery)
jamf-cli pro blueprints list -o table

# Apply a blueprint by name (creates if new, replaces if existing)
jamf-cli pro blueprints apply --from-file passcode-policy.json

# Compliance benchmarks: list and check device-level compliance
jamf-cli pro compliance-benchmarks list -o table
jamf-cli pro compliance-benchmarks device-results --name "macOS CIS Level 1"

# Cross-product Platform device lookup (auto-detects serial vs UUID)
jamf-cli pro platform-devices get --serial C02X1234

See the Setup Guide for the full walkthrough.

Features

Jamf Pro

• Full API coverage — Modern API (OpenAPI-generated) and Classic API (/JSSResource/) commands
• overview — Instance dashboard with 37 parallel API calls: inventory, enrollment, MDM, alerts
• scope — View, add to, and remove from scope on policies, config profiles, restricted software, and apps — no XML editing required
• Device actions — Erase, remove MDM, redeploy framework, blank push, DDM sync, renew MDM, lock, enable/disable Remote Desktop (computers); erase, unmanage, restart, shutdown, update inventory (mobile devices). Target by serial number, name, ID, group, or file. Destructive bulk operations require --confirm-destructive
• device — Aggregated device deep-dive: identity, hardware, OS, security posture, user info, MDM command history, policy logs
• report security — Fleet security posture: FileVault, Gatekeeper, SIP, firewall rates, OS version distribution, flagged devices
• JCDS file ops — Upload, download, sync, and list files on the Jamf Cloud Distribution Service: jamf-cli pro packages upload, pro jamf-cloud-distribution-service download, pro jamf-cloud-distribution-service sync, pro jamf-cloud-distribution-service-files list. pro packages upload --distribution-point <name> writes to an SMB file share distribution point instead

This is the beginning of the README. Read the rest at the original. Read the full README ↗