Get Started: JumpCloud MCP Server for Admins

JumpCloud’s Model Context Protocol (MCP) Server for admins lets you connect compatible AI tools to JumpCloud and interact with your organization’s data and administrative capabilities. With MCP, you can view, edit, and modify many aspects of your JumpCloud org directly within your existing AI tools like code editors, large language models (LLMs), and AI agents.

Understanding the Benefits:

JumpCloud's MCP server helps integrate your organization's data with your existing AI tools:

• Find and view JumpCloud objects: Users, admins, devices, groups, SSO applications, Directory Insights (DI) events and more.
• Modify objects: Grant or revoke user access, reset passwords and MFA, send device security commands, modify group memberships and SSO application access.
• Perform bulk actions: Manage multiple users, devices, groups, and SSO applications in bulk.

Prerequisites:

• JumpCloud Administrator account with API access. See JumpCloud APIs to learn more.

Known Issues and Limitations:

• MCP servers typically support three elements: resources, tools, and prompts. JumpCloud’s MCP server currently supports tools only. 
• JumpCloud’s MCP server currently supports Streamable HTTP only as the transport mechanism. Stdio is not supported.

Supported Clients

JumpCloud's MCP server currently supports the following AI tools:

• AI Tools
  • Claude
• Code Editors
  • Cursor
  • Visual Studio Code (VS Code)

Enabling the MCP Server

To enable JumpCloud MCP:

1. Log in to the JumpCloud Admin Portal.

2. In the left menu, click on Settings. 
3. Go to the JumpCloud AI tab.
4. Toggle MCP Server for admins to On.

Using the MCP Server

The JumpCloud MCP server endpoint differs depending on your datacenter region:

• US: https://mcp.jumpcloud.com/v1
• EU: https://mcp.eu.jumpcloud.com/v1

The MCP server currently supports API key and OAuth authentication. The MCP server doesn’t support the entirety of JumpCloud’s APIs. Instead, it offers structured tools specifically designed for AI clients, focusing on the following key areas:

• User and device management
• Directory Insights (DI) events and related information
• Applications and user groups

If you are a Managed Service Provider (MSP) using the Multi-Tenant Portal (MTP) to manage multiple organizations, you'll need to append the MCP server URL with the organization ID of the specific child org you want to connect to. See Manage Organizations in the MTP to learn more. Replace {orgId} with the child org's ID:

• US: https://mcp.jumpcloud.com/v1?organizationId={orgId}
• EU: https://mcp.eu.jumpcloud.com/v1?organizationId={orgId}

API Authentication

This method transmits the API key to public API endpoints, mirroring your exact permissions in JumpCloud.

OAuth Authentication

This method uses browser-based authentication to JumpCloud to generate a token and enable MCP with the client. After configuring the MCP server in the client, you’ll be redirected to JumpCloud to authenticate via OAuth. Successful admin authentication activates the integration.

Connecting with Claude

To integrate JumpCloud's MCP server with Claude:

1. In Claude, at the bottom left, click your account details and go to Settings.
2. Under Settings, go to Connectors. 
3. At the bottom of the Connectors list, click Add custom connector. 
4. In the Add custom connector modal:
   1. Enter a Name for the connector, for example JumpCloud.
   2. Under Remote MCP server URL, enter the JumpCloud MCP Server URL depending on your datacenter region:
      • US: https://mcp.jumpcloud.com/v1
      • EU: https://mcp.eu.jumpcloud.com/v1
      • Note: For MSPs, Claude doesn't support appending the specific child org's ID to the MCP server URL. You cannot use your provider admin account and instead must connect to the MCP server using an administrator account directly within the child org.
   3. Click Add.
5. To the right of the new connector, click Connect.
6. Authenticate using your JumpCloud administrator credentials.

JumpCloud is now connected to Claude, and you can ask or perform supported JumpCloud operations directly in your chats.  

Connecting with Cursor

To integrate JumpCloud's MCP server with Cursor:

1. In Cursor, go to Cursor Settings.
2. In Tools & Integrations, under MCP Tools, click New MCP Server. 
3. In the mcp.json file, enter the following configuration examples depending on your preferred authentication type.

To use OAuth:

1. In the mcp.json file, enter the configuration using the following example. Ensure you use the correct MCP server URL for your datacenter region:
   • US: https://mcp.jumpcloud.com/v1
   • EU: https://mcp.eu.jumpcloud.com/v1
   • Note: For MSPs, append the specific child org's ID to the URL. For example: https://mcp.jumpcloud.com/v1?organizationId={orgId}

2. Go back to Cursor Settings.
3. Under Installed MCP Servers, click Connect next to jumpcloud-mcp.
4. You'll be redirected to your browser to authenticate to the Admin Portal.
5. When finished, click Open Cursor in your browser to return to the app and complete authentication.

To use API authentication:

1. In the mcp.json file, enter the configuration using the following example format, replacing YOUR_JUMPCLOUD_API_KEY with your JumpCloud API Key, and using the correct MCP server URL for you datacenter region:
   • US: https://mcp.jumpcloud.com/v1
   • EU: https://mcp.eu.jumpcloud.com/v1
   • Note: For MSPs, append the specific child org's ID to the URL. For example: https://mcp.jumpcloud.com/v1?organizationId={orgId}

After adding the configuration, you can use Cursor to start a session and ask questions and perform operations related to JumpCloud. For example “How many Windows devices are in my JumpCloud account?”

See Cursor - Model Context Protocol (MCP) documentation to learn more.

Connecting with Visual Studio Code

To add JumpCloud's MCP server to VS Code using the Commands Palette:

1. In VS Code, go to Settings > Command Palette.
2. Enter mcp and select MCP: Add Server.
3. Under Choose the type of MCP server to add, select HTTP.
4. Under Enter Server URL, enter the JumpCloud MCP Server URL for your datacenter region:
   • US: https://mcp.jumpcloud.com/v1
   • EU: https://mcp.eu.jumpcloud.com/v1
   • Note: For MSPs, append the specific child org's ID to the URL. For example: https://mcp.jumpcloud.com/v1?organizationId={orgId}
5. Under Enter Server ID, enter a name for the server, for example JumpCloud MCP.
6. The entry will be added to your mcp.json file and prompt you to authenticate.
7. Connect to the JumpCloud MCP server by providing an API key or signing into your JumpCloud account when prompted.

To manually add JumpCloud's MCP to VS Code using the mcp.json file:

1. In VS Code, go to File > New File and create an mcp.json file by entering the following in the search bar: .vscode/mcp.json
2. Paste the following into the file, replacing jca_**** with your API key:

3. Save the file, and then click Start above the server name.
4. Under The MCP Server Definition wants to authenticate to mcp.jumpcloud.com, click Allow.
5. Connect to the JumpCloud MCP server by providing an API key or signing into your JumpCloud account when prompted.

You can now interact with your JumpCloud org's data using MCP.

Managing Connected OAuth Sessions

You can view and manage third-party MCP OAuth clients that have active sessions with your JumpCloud organization.

To monitor and manage connected OAuth clients:

1. From the JumpCloud Admin Portal, go to Settings > JumpCloud AI.
2. Under MCP Server for admins > Connected OAuth clients, click Manage.
   • Note: The UI displays the current number of active sessions, such as 5 Connected OAuth clients.
3. In the Connected sessions page, a list of active MCP server connections displays with the following information:
   • Client name - The name of the connected third-party application or client.
   • Client ID - The unique identifier for the OAuth client session.
   • Redirect URI - The callback URL used during the OAuth authentication process.
   • User - The JumpCloud administrator account that authorized the connection.
   • Connected - The date and time when the session was initially authenticated.
   • Last used - The date and time when the client last interacted with the JumpCloud MCP server.
   • Auto-revokes - The date and time when the session will automatically expire and require re-authentication.
4. (Optional) To immediately terminate an active connection, click Revoke next to the specific client session.
   
   

Configuring Auto Revoke Access

Set how long each session stays active after the initial connection. Expired sessions are automatically revoked and the client must reconnect.

To configure auto revoke access:

1. From the JumpCloud Admin Portal, go to Settings > JumpCloud AI.
2. Under MCP Server for admins > Auto revoke access, select the timeframe from the drop-down menu (for example, 30 days).

Supported JumpCloud Tools

FAQ