mcp-jumpserver

JumpServer STDIO MCP for Codex. Automatically logs in with the JumpServer URL, username, and password and caches the API Token, so there is no need to create a Token manually.

Tools

• test_jumpserver_login: Tests username/password login, does not return a Token.

• list_jumpserver_databases: Queries database assets.

• list_jumpserver_database_accounts: Queries accounts under an asset, does not return passwords.

• get_jumpserver_temporary_database_credential: Issues a temporary username and password for the database proxy, consistent with the "Database Connection Info" in the JumpServer Web terminal.

• get_jumpserver_configured_database_credentials: No parameters, issues temporary usernames and passwords for all database assets in the configuration array at once.

Related MCP server: Supabase MCP Server

Installation

uv sync

It is recommended to use a dedicated JumpServer user with least privilege, not a super administrator. Issuing temporary connection credentials requires that this user has login authorization for the target asset, account, and protocol; the approval or MFA policies of the login ACL still apply. This MCP does not provide a tool for reading static passwords of underlying accounts, nor does it require the accounts.view_accountsecret permission.

Configure Codex

codex mcp add jumpserver -- \
  /absolute/path/to/mcp-jumpserver/.venv/bin/mcp-jumpserver

You can also write it into ~/.codex/config.toml:

[mcp_servers.jumpserver]
command = "/absolute/path/to/mcp-jumpserver/.venv/bin/mcp-jumpserver"
startup_timeout_sec = 20
tool_timeout_sec = 60
enabled = true

[mcp_servers.jumpserver.env]
JUMPSERVER_URL = "https://jumpserver.example.com"
JUMPSERVER_USERNAME = "codex-service-user"
JUMPSERVER_PASSWORD = "change-me"
JUMPSERVER_VERIFY_SSL = "true"
JUMPSERVER_DATABASE_ASSETS = '["DB-正式mysql-A", "DB-正式mysql-B"]'
# 可选：JUMPSERVER_ORG_ID = "组织 UUID"

After configuration, restart this MCP in the Codex/ChatGPT desktop app, then call test_jumpserver_login.

Get Temporary Database Credentials

For daily use, call it directly without parameters:

调用 get_jumpserver_configured_database_credentials

The credentials in the result are returned in configuration order; you must confirm errors is empty before consuming them. When you need to temporarily query an asset outside the configuration, call the single-asset tool with the exact asset name:

调用 get_jumpserver_temporary_database_credential：
{"asset":"DB-正式mysql-A","protocol":"mysql"}

调用 get_jumpserver_temporary_database_credential：
{"asset":"DB-正式mysql-B","protocol":"mysql"}

The returned connection.username and connection.password are temporary credentials for the JumpServer database proxy; connection.host, connection.port, and connection.database form the full connection address. If an asset has multiple authorized accounts, first specify the username or UUID of account.

Security Notes

• The Token is cached only in the MCP process memory and automatically re-logs in once upon receiving HTTP 401.

• Logs and exceptions do not output the JumpServer password or Token.

• The MCP only issues temporary credentials for the JumpServer database proxy and does not read static passwords of underlying database accounts.

• get_jumpserver_temporary_database_credential returns short-lived plaintext connection credentials and should only be called with explicit user authorization.

Testing

uv run pytest
uv run ruff check .