jumpcloud-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| VAULT_ADDR | Yes | Vault server address | |
| POSTGRES_HOST | Yes | PostgreSQL host for configuration storage | |
| MCP_ADMIN_AUTH_KEY | No | Optional authorization key for mutating tools | |
| MCP_HTTP_AUTH_MODE | No | HTTP authentication mode: token, oauth2, or both | |
| MCP_CONFIG_DEFAULT_USER_ID | No | Default user ID for operations when userId is not provided |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| jumpcloud_connection_infoA | Read-only runtime metadata. Use when validating configured base URLs, OpenAPI source URLs, and persistence wiring. Do not use for API execution. Risk: low. |
| jumpcloud_scope_infoA | Read-only scope resolver. Use when you need the effective app/tenant/user scope and storage locations. Do not use for mutation. Risk: low. |
| jumpcloud_openapi_discoveryA | Read-only OpenAPI discovery. Use to search operationId/method/path/tag metadata before invocation. Do not use as an execution tool. Risk: low. |
| jumpcloud_tenant_listA | Read-only tenant discovery. Use to list tenant ids and optionally discover scoped users from Postgres and Vault token paths. Do not use for mutation. Risk: low. |
| jumpcloud_tenant_scope_validateB | Read-only tenant/user scope validation. Use to confirm token and config readiness before operational API calls. Risk: medium. |
| jumpcloud_tenant_bootstrap_defaultsB | Mutating tenant/user baseline config initializer. Use to write recommended non-secret defaults for a scope. Risk: high. |
| jumpcloud_tenant_policy_getA | Read-only tenant/user policy reader. Use to inspect effective policy guardrails for a scope. Risk: medium. |
| jumpcloud_tenant_policy_setB | Mutating tenant/user policy writer. Use to update scoped policy guardrails for API execution. Risk: high. |
| jumpcloud_query_suggestionB | Read-only planning helper. Use to choose safe tool order, discover likely operations, and retrieve tool usage schema details. Do not use for direct mutations. Risk: low. |
| jumpcloud_user_token_listA | Read-only token metadata listing. Use to inspect user-scoped token entries and active token selection. Do not use to rotate/update secrets. Risk: medium. |
| jumpcloud_user_token_upsertA | Mutating token create/update. Use to add or rotate JumpCloud user tokens in Vault. Do not use for read-only workflows. Risk: high. |
| jumpcloud_user_token_set_activeC | Mutating token selection. Use to change active token for a user. Do not use to create tokens. Risk: medium. |
| jumpcloud_user_token_deleteB | Mutating token deletion. Use when removing obsolete user tokens from Vault. Destructive. Risk: high. |
| jumpcloud_config_listA | Read-only Postgres config listing. Use to enumerate app/user scoped non-secret configuration values. Do not store secrets in config. Risk: low. |
| jumpcloud_config_getA | Read-only Postgres config getter. Use to fetch one user-scoped configuration key. Risk: low. |
| jumpcloud_config_setB | Mutating Postgres config setter. Use for non-secret runtime configuration. Do not store token values. Risk: medium. |
| jumpcloud_config_deleteB | Mutating Postgres config delete. Use to remove obsolete non-secret settings. Destructive. Risk: high. |
| jumpcloud_health_checkA | Read-only health and credential check against JumpCloud using current user's active token. Use before large workflows. Risk: low. |
| jumpcloud_operation_invokeB | OpenAPI operation invoker. Use operationId+pathParams for high-fidelity execution with full API coverage. Mutating calls require admin key if configured. Risk: variable. |
| jumpcloud_api_requestB | Generic JumpCloud request executor. Use for explicit domain/method/path calls with full endpoint coverage. Mutations require admin key if configured. Risk: variable. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 20 tools
Several read-only introspection tools (connection_info, scope_info, tenant_list, tenant_scope_validate, health_check, query_suggestion) have overlapping purposes and could be confused. The two API execution tools (operation_invoke and api_request) also serve similar functions with only subtle invocation differences.
Tool names mix noun endings (connection_info, openapi_discovery) with verb endings (tenant_list, config_get). The prefix 'jumpcloud_' is consistent, but the action part is not a uniform verb_noun pattern, making the naming style inconsistent.
At 20 tools, the server is on the heavier end of the typical range. While many tools serve distinct configuration and discovery purposes, the count could be trimmed by consolidating some overlapping introspection and execution tools.
The tool surface covers connection info, scope/tenant management, policies, token lifecycle, config storage, and API execution, leaving no major dead ends. Minor gaps exist around tenant mutation beyond bootstrap, but generic invocation fills most needs.