面向 Codex 的 JumpServer STDIO MCP。使用 JumpServer URL、用户名和密码自动登录并缓存 API Token，无需手工创建 Token。
test_jumpserver_login：测试用户名密码登录，不返回 Token。
list_jumpserver_databases：查询数据库资产。
list_jumpserver_database_accounts：查询资产下的账号，不返回密码。
get_jumpserver_temporary_database_credential：签发数据库代理临时用户名和密码，
与 JumpServer Web 终端的“数据库连接信息”一致。
get_jumpserver_configured_database_credentials：无参数，一次签发配置数组内所有数据库资产的
临时用户名和密码。
Related MCP server: Supabase MCP Server
uv sync建议使用权限最小化的独立 JumpServer 用户，不要使用超级管理员。签发临时连接凭证需要
该用户拥有目标资产、账号和协议的登录授权；登录 ACL 的审批或 MFA 策略仍然有效。
本 MCP 不提供底层账号静态密码读取工具，也不需要 accounts.view_accountsecret 权限。
codex mcp add jumpserver -- \
/absolute/path/to/mcp-jumpserver/.venv/bin/mcp-jumpserver也可以写入 ~/.codex/config.toml：
[mcp_servers.jumpserver]
command = "/absolute/path/to/mcp-jumpserver/.venv/bin/mcp-jumpserver"
startup_timeout_sec = 20
tool_timeout_sec = 60
enabled = true
[mcp_servers.jumpserver.env]
JUMPSERVER_URL = "https://jumpserver.example.com"
JUMPSERVER_USERNAME = "codex-service-user"
JUMPSERVER_PASSWORD = "change-me"
JUMPSERVER_VERIFY_SSL = "true"
JUMPSERVER_DATABASE_ASSETS = '["DB-正式mysql-A", "DB-正式mysql-B"]'
# 可选：JUMPSERVER_ORG_ID = "组织 UUID"配置后在 Codex/ChatGPT 桌面端重启该 MCP，再调用 test_jumpserver_login。
日常直接无参数调用：
调用 get_jumpserver_configured_database_credentials结果中的 credentials 按配置顺序返回，消费前必须确认 errors 为空。需要临时查询配置外资产时，
再按资产精确名称调用单资产工具：
调用 get_jumpserver_temporary_database_credential：
{"asset":"DB-正式mysql-A","protocol":"mysql"}
调用 get_jumpserver_temporary_database_credential：
{"asset":"DB-正式mysql-B","protocol":"mysql"}返回的 connection.username 和 connection.password 是 JumpServer 数据库代理的临时凭证；
connection.host、connection.port、connection.database 是完整连接地址。如果资产授权了多个
账号，先指定 account 的用户名或 UUID。
Token 仅缓存在 MCP 进程内存中，收到 HTTP 401 后自动重新登录一次。
日志和异常不会输出 JumpServer 密码或 Token。
MCP 只签发 JumpServer 数据库代理临时凭据，不读取底层数据库账号的静态密码。
get_jumpserver_temporary_database_credential 返回短期明文连接凭证，也仅应在用户明确授权时调用。
uv run pytest
uv run ruff check .Create temporary proxy credentials for every configured database asset.
Asset names come from the JUMPSERVER_DATABASE_ASSETS JSON array. Callers must check that
errors is empty before consuming credentials. Each successful item contains short-lived
plaintext connection.username and connection.password values.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Even though annotations show readOnlyHint=false and destructiveHint=false, the description adds substantial context: that credentials are short-lived plaintext, that errors must be checked, and that it 'creates' credentials. This goes beyond the minimal annotation information and helps the agent understand side effects and expectations. No contradiction between description and annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the main purpose, then gives essential operational details (source array, error check, output content). No fluff, every sentence carries value. Perfectly sized for a zero-parameter bulk credential tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no parameters and an output schema already provided, the description covers all necessary context: the asset source (JUMPSERVER_DATABASE_ASSETS), the error-handling requirement, and the shape of each result. An agent can call and interpret this tool correctly without further information.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters, so the schema carries no parameter documentation burden. The baseline for 0 parameters is 4, and the description adds no parameter-specific details (none needed). It correctly relies on the empty schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action: 'Create temporary proxy credentials' for 'every configured database asset.' This distinguishes it from the sibling tool 'get_jumpserver_temporary_database_credential' which appears to be singular, while this one is bulk. The verb and resource are specific and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides usage context: it operates on all assets from a JSON array, and instructs callers to check 'errors' before using results. It implies when to choose this over the singular sibling (bulk vs single) but does not explicitly state exclusions or alternatives. This is clear enough for an agent to decide.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Create temporary database proxy credentials like JumpServer's DB Guide page.
The asset must be an exact name, address, or UUID. If multiple stored-secret accounts or database protocols are permitted, pass the account username/UUID and protocol explicitly. The returned connection.username and connection.password are short-lived plaintext credentials for the JumpServer database proxy, not the underlying database account secret.
| Name | Required | Description | Default |
|---|---|---|---|
| asset | Yes | ||
| account | No | ||
| protocol | No |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate this is a non-read-only, non-idempotent operation. The description adds valuable context by clarifying that the returned credentials are short-lived plaintext for the proxy, not the underlying database secret. It does not contradict annotations and supplements the mutation nature with important behavioral details about the output.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences and keeps the main purpose upfront. The first sentence states the core action; the second explains parameter conditions and the nature of the return values. It is dense but efficient, with no redundancy or filler, earning a high score for structure while still being readable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has an output schema, the description appropriately focuses on the key behavioral context: that the returned credentials are temporary and proxy-specific, not the underlying secret. It also covers the necessary input conditions for ambiguous cases. What is missing is an explicit note on side effects or cleanup behavior, but given annotations already signal a mutable operation, this is largely sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the tool description carries the full burden of defining parameters. It clarifies that 'asset' must be an exact name, address, or UUID, and explains when 'account' and 'protocol' should be passed explicitly (if multiple accounts/protocols are permitted). It also notes that account can be a username/UUID, providing concrete semantic guidance beyond the raw schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's action ('Create temporary database proxy credentials') and specifies the resource (temporary credentials for JumpServer database proxy). It also explicitly details what the returned connection.username and connection.password represent, distinguishing this from the sibling get_jumpserver_configured_database_credentials by the 'temporary' vs 'configured' contrast in the tool name and description.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives usage conditions for parameters (e.g., pass account/protocol explicitly when multiple are permitted) and mentions the asset must be an exact name, address, or UUID, but it does not explicitly contrast when to use this tool versus the sibling tools that list databases or configured credentials. The guidance is implied rather than explicit, and no exclusion criteria are stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List non-secret accounts for an exact database asset name, address, or UUID.
| Name | Required | Description | Default |
|---|---|---|---|
| asset | Yes | ||
| limit | No | ||
| search | No |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, covering safety. The description adds behavioral context by specifying that only non-secret accounts are returned and that the asset must be an exact match, which informs the agent about the nature of the results and the precision required. This goes beyond the structured annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, tight sentence with no fluff. It front-loads the action and scope, effectively communicating the essential information. The structure is optimal for quick parsing by an agent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that an output schema exists and annotations cover safety, the description is adequate but not comprehensive. It explains the critical asset requirement but omits details about pagination (limit) and filtering (search), which are optional but could affect how results are retrieved. An agent would need to infer their behavior from names and defaults, leaving some gap in completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description must explain parameter semantics. It clarifies the 'asset' parameter (accepts a name, address, or UUID), but does not mention 'limit' or 'search'. While these have useful defaults and types, their purpose is left to inference. The description only partially compensates for the lack of schema documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (list), the resource (non-secret accounts), and the identifying criteria (exact database asset name, address, or UUID). It distinguishes from sibling tools like list_jumpserver_databases (which lists databases, not accounts) and the credential retrieval tools, leaving no ambiguity about what is being listed.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use this tool: to list accounts for an exact asset identifier. It does not explicitly name alternatives or exclusion scenarios, but the 'exact' clause clarifies that fuzzy matching is not supported, and the sibling tools serve different purposes (testing, retrieving credentials, listing databases). The guidance is clear but could be more explicit about not using this for secret retrieval, which is covered by 'non-secret accounts'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List JumpServer database assets. Optionally filter by name or address.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| search | No |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, so the safety profile is covered. The description adds that search filters by name or address, which is a behavioral hint beyond the schema. However, it doesn't mention pagination, limit behavior, or the structure of the response, though the output schema may cover the latter. The description does not contradict annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that front-loads the core action and resource. It includes the filtering option without unnecessary words. Every word earns its place, and it's not under-specified—it covers the essential information in a compact form.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list tool with an output schema and robust annotations, the description is adequate. It specifies the action, resource, and filter behavior, and the existence of an output schema covers return details. The only gap is the lack of usage guidance relative to siblings, but given the tool's simplicity, this is a minor omission.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description compensates significantly by explaining that the 'search' parameter filters by name or address. This gives meaning beyond the bare schema field. The 'limit' parameter is not described, but its default and integer type make it self-explanatory; overall, the description adds useful semantic value for the key parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear action ('List') and a specific resource ('JumpServer database assets'), making it distinct from sibling tools that deal with accounts or credentials. It also mentions an optional filter by name or address, which further clarifies scope. No ambiguity exists about what this tool accomplishes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no explicit guidance on when to use this tool versus the siblings like list_jumpserver_database_accounts or get_jumpserver_configured_database_credentials. While the name implies its role, the rubric requires explicit alternatives or contexts, which are absent. A user must infer usage from the sibling names, not from the description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Verify URL and username/password authentication without returning the API token.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, covering safety and side-effect expectations. The description adds the valuable behavioral trait that it does not return the API token, which is not in the annotations. This extra context is useful, though it does not elaborate on failure modes or response details. With annotations carrying much of the burden, a 4 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficiently worded sentence. It states the action and a key behavioral exception upfront, with zero redundant phrases. Every word contributes to meaning, making it easy to parse at a glance.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no parameters, safe (read-only, idempotent) annotations, and an output schema documenting return values, the description is complete. It specifies the purpose and the critical 'no token returned' behavior, and the safety profile is already covered by annotations. Nothing an agent needs to invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters, so the schema is trivially 100% covered. Since there are no parameters to explain, the description has no obligation to add param details. The baseline for zero parameters is 4, and the description meets it by not misleading or missing anything.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action: 'Verify URL and username/password authentication' — a specific verb and resource. It also adds a distinguishing detail ('without returning the API token') that separates it from sibling tools that list databases or credentials. This is not a tautology and provides a precise, distinct purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage (when you want to test credentials without getting a token), but it does not explicitly state when to use this tool versus alternatives like the list/retrieve siblings. There is no mention of 'use this when...' or exclusions. The context is clear but the guidance is implicit rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.2.0get_jumpserver_configured_database_credentialsget_jumpserver_temporary_database_credentiallist_jumpserver_database_accountslist_jumpserver_databasestest_jumpserver_loginScored across 5 tools
Each tool has a distinct purpose: testing login, listing databases, listing accounts, and two credential-generation tools. The two credential tools differ by scope (single asset vs. all configured assets), which is clear from their descriptions, though they could still be confused at a glance.
All tool names follow a consistent verb_jumpserver_noun pattern using snake_case (test, list, list, get, get). The pattern is predictable and readable, with no mixing of conventions or vague verbs.
With 5 tools, the server is well-scoped for its purpose of managing and retrieving JumpServer database credentials. Each tool fills a clear role without excess or deficiency.
The set covers authentication verification, asset listing, account listing, and credential retrieval for single and bulk scenarios. Missing CRUD operations for databases or accounts are not central to the stated purpose, but a create/delete tool would round out the surface.
Manage remote servers, SSH terminals, files, databases and proxies with scoped access and approvals.
Scoped, audited SSH exec, sessions, and SFTP on your saved servers without exposing credentials
Issue, rotate and revoke scoped API-key passes for 25+ providers — the agent never sees a real key
Governed MCP gateway: one endpoint for your tools, with credential custody and audit log.
