Skip to content
actionlake
Start free

Connectors · Identity & security

JumpCloud MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to JumpCloud and the rest of your systems. It gives your agent 506 JumpCloud actions (315 reads, 132 writes and 59 that wait for a confirmation) and holds the JumpCloud credential itself, so the agent never does. It paces JumpCloud's limits and records every call.

Connect JumpCloud freeSee pricing

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

claude mcp add --transport http actionlake https://connect.actionlake.com/mcp
the first call
do {  action: "jumpcloud.systemusers.list",  intent: "check which JumpCloud account is connected"}# List JumpCloud users · read · 1 upstream call
  • 506actionsin one signed file
  • 315readlook, never change
  • 132writecreate and update
  • 59wait for a yesdestructive, confirmed first

Set up

Connect JumpCloud in three steps.

  1. 01

    Add actionlake to Claude.

    Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.

    https://connect.actionlake.com/mcp
  2. 02

    Connect JumpCloud.

    Header credentials. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key.

    • api_keyJumpCloud API key
    • org_idOrganization ID (MSP / multi-tenant keys only)
    account { op: "connections.requirements", service: "jumpcloud" }
# free: exactly what to paste, and what is found for you
  3. 03

    Make the first call. Check before a write.

    Ask in plain words; Claude picks the action. Before anything changes, check validates the call and prices it, for free.

    do    { action: "jumpcloud.systemusers.list" }# list jumpcloud users · read · 1 upstream callcheck { action: "jumpcloud.systemusers.create", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent

JumpCloud at a glance

Sign-in
Header credentials. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead.
You provide
api_keyorg_id
Limits we pace to
2,000 calls a minute, per connection
API covered
JumpCloud API v1+v2console.jumpcloud.com/api
Built from
JumpCloud's documentation, read 15 September 2026docs.jumpcloud.comdocs.jumpcloud.com
Service file
Version 2.0.0, signed (Ed25519)
Cached reads
308 of 315 reads, for up to an hour; a write clears what it affects
Ready-made plans
10 in the store
Shared entities
6, so ask can line JumpCloud up with your other systems
Data
Processed and stored in Sydney, Australia. No US region yet

Capabilities

What an AI agent can do in JumpCloud.

506 actions in 17 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

  • 315readlook, never change
  • 132writecreate and update
  • 59destructivewait for a confirmation

  1. Directory

    147

    81 read · 49 write · 17 destructive

    List JumpCloud users · List user groups · List all groups · Create a JumpCloud user

  2. Management

    65

    39 read · 14 write · 12 destructive

    List user groups for a system group · List user groups for a system · List JumpCloud systems · List systems for a command

  3. Insights

    60

    60 read · 0 write · 0 destructive

    Query System Insights: azure_instance_metadata · Query System Insights: azure_instance_tags · Query System Insights: battery · Query System Insights: chassis_info

  4. Policy

    33

    24 read · 7 write · 2 destructive

    List users for a policy · List users for a policy group · List user groups for a policy · List user groups for a policy group

  5. SSO

    23

    14 read · 6 write · 3 destructive

    List importable application users · List users for an application · List users on an IdP routing policy · List SSO applications

  6. Settings

    23

    9 read · 10 write · 4 destructive

    List custom email templates · Create a custom email · Get a custom email · Update a custom email

  7. Monitoring

    22

    12 read · 7 write · 3 destructive

    List alerts · List device monitoring rules · List monitoring rule templates · List system groups on a monitoring rule

  8. Reporting

    20

    11 read · 7 write · 2 destructive

    List custom reports · List built-in reports · Create a custom report · Get a custom report

9 more areas · 113 actions
  • Tenancy 20
  • Software 18
  • Mfa 15
  • Access 14
  • Credentials 13
  • Risk 12
  • Access 10
  • Automation 10
  • Billing 1

Top actions

The JumpCloud API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 212 of JumpCloud's 225 action names are shared with at least one other connector, so an agent learns them once.

ActionWhat it doesEffectSame name in
jumpcloud.systemusers.listList JumpCloud usersList directory users with activation, MFA and password state. Use jumpcloud.systemusers.get for one user.readidentity.user.list474 connectors
jumpcloud.usergroups.listList user groupsList user groups with their type and attributes. Use jumpcloud.usergroups.members.list for membership.readidentity.group.list262 connectors
jumpcloud.roles.listList administrator rolesList the administrator roles defined for this organization.readidentity.role.list184 connectors
jumpcloud.groups.listList all groupsList user groups and system groups together in one call.readidentity.group.list262 connectors
jumpcloud.systemusers.createCreate a JumpCloud userCreate a directory user with a username and email.writeidentity.user.create262 connectors
jumpcloud.applications.listList SSO applicationsList the SSO applications configured in this organization.readidentity.application.list37 connectors
jumpcloud.usergroups.createCreate a user groupCreate a user group, optionally with a dynamic membership query.writeidentity.group.create205 connectors
jumpcloud.roles.createCreate an administrator roleCreate an administrator role with a named permission set.writeidentity.role.create105 connectors
jumpcloud.systems.listList JumpCloud systemsList enrolled systems (devices) with OS, agent version and connection state.readdevice.endpoint.list65 connectors
jumpcloud.systemusers.deleteDelete a JumpCloud userPermanently delete one directory user and unbind it from every system.destructiveidentity.user.delete253 connectors
jumpcloud.application_templates.listList application templatesList the SSO application templates JumpCloud publishes.readidentity.application.list37 connectors
jumpcloud.systeminsights.uptimeQuery System Insights: uptimeQuery the System Insights uptime table — system uptime collected from every enrolled system.readdevice.endpoint.list65 connectors

Try it

Prompts to paste into Claude.

Each one names the JumpCloud actions it will call, so you know what it reads and what it changes before you send it.

  1. Readread

    Which JumpCloud devices have not checked in for a week?

    callsjumpcloud.systems.list

  2. Planwrite

    Triage open identity risk alerts in JumpCloud.

    callsjumpcloud.identityrisk.stats.getjumpcloud.alerts.occurrences.listjumpcloud.identityrisk.events.getjumpcloud.identityrisk.identities.trendjumpcloud.alerts.status.set

  3. Planwrite

    Build and schedule a recurring access review report in JumpCloud.

    callsjumpcloud.reports.custom.listjumpcloud.saved_views.listjumpcloud.reports.custom.createjumpcloud.reports.runs.createjumpcloud.reports.scheduled.create

  4. Writewrite

    Create a JumpCloud user in JumpCloud. Show me exactly what you will send before you save it.

    callsjumpcloud.systemusers.create

The plan store

Ready-made plans for JumpCloud.

10 plans in the store. Install one and your agent runs it by name; the reply says which connections are still missing. A schedule can run a plan on a timetable. There are no triggers or webhooks, by design.

  1. Audit disk encryption across the fleet

    Use it when Someone asks which laptops are missing FileVault or BitLocker, or a compliance review needs encryption evidence.

    Effect
    read
    Steps
    3 · loops
    Install
    jumpcloud-disk-encryption-audit

  2. Triage open identity risk alerts

    Use it when The security team is working through JumpCloud identity risk alerts and wants them summarised and acknowledged.

    Effect
    write
    Steps
    4 · loops
    Needs
    alert id and status
    Install
    jumpcloud-identity-risk-triage

  3. Onboard a new hire

    Use it when A new starter needs a JumpCloud identity created and secured before day one.

    Effect
    write
    Steps
    4
    Needs
    department, email, firstname, job title, lastname, ssh key name, ssh public key and username
    Install
    jumpcloud-onboard-new-hire

  4. Review and apply user group membership suggestions

    Use it when A dynamic user group has pending membership suggestions that someone needs to review before applying.

    A person decidesApply total 'operation type' membership suggestions to user group group id.

    Effect
    write
    Steps
    5
    Needs
    group id and operation type
    Install
    jumpcloud-apply-group-membership-suggestions

  5. Import a batch of users from the HR feed

    Use it when HR has a batch of new starters in Workday that need creating in JumpCloud together.

    A person decidesCreate total users in JumpCloud from the Workday import batch.

    Effect
    write
    Steps
    5
    Needs
    users and workday id
    Install
    jumpcloud-bulk-import-users-from-hr

  6. Build and schedule a recurring access review report

    Use it when Someone wants a recurring JumpCloud access or compliance report emailed to a group.

    Effect
    write
    Steps
    5
    Needs
    definition, name, recipients and schedule
    Install
    jumpcloud-schedule-access-review-report

  7. Lock a lost or stolen laptop

    Use it when A laptop is reported lost or stolen and must be locked out immediately.

    A person decidesRemotely lock system system id reported lost by reported by and expire its users' passwords.

    Effect
    destructive
    Steps
    5 · loops
    Needs
    reported by and system id
    Install
    jumpcloud-lock-lost-laptop

  8. Offboard a departing employee

    Use it when An employee is leaving and their JumpCloud access must be revoked the same day.

    A person decidesSuspend and expire JumpCloud user user id (reason) and lock their systems.

    Effect
    destructive
    Steps
    5
    Needs
    reason and user id
    Install
    jumpcloud-offboard-departing-employee

  9. Run a command across matching systems

    Use it when An admin needs to execute the same shell or PowerShell command on a group of managed systems.

    A person decidesRun command 'name' on number of results systems matching filter.

    Effect
    destructive
    Steps
    5 · loops
    Needs
    command, command type, filter and name
    Install
    jumpcloud-run-command-on-fleet

  10. Decommission a retired system

    Use it when A machine has been returned or scrapped and its JumpCloud record must be removed.

    A person decidesPermanently delete system system id (asset asset tag) from JumpCloud. This cannot be undone.

    Effect
    destructive
    Steps
    6
    Needs
    asset tag and system id
    Install
    jumpcloud-decommission-system
install a plan
account { op: "plans.install", slug: "jumpcloud-disk-encryption-audit" }
# then ask for it by name; a schedule can run it on a timetable

Governance for JumpCloud

Destructive actions wait for a yes.

59 JumpCloud actions are destructive. The first 10:

  • Delete a JumpCloud userjumpcloud.systemusers.delete
  • Transfer a user to another organizationjumpcloud.graph.users.transfer
  • Delete a user groupjumpcloud.usergroups.delete
  • Delete an administrator rolejumpcloud.roles.delete
  • Delete an SSO applicationjumpcloud.applications.delete
  • Delete a Duo applicationjumpcloud.duo.applications.delete
  • Delete a JumpCloud systemjumpcloud.systems.delete
  • Transfer a system to another organizationjumpcloud.graph.systems.transfer
  • Suspend a userjumpcloud.systemusers.suspend
  • Delete a service accountjumpcloud.service_accounts.delete

A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

dojumpcloud.systemusers.deleteconfirm_policy: human

Delete a JumpCloud user?

intent: the user asked me to delete a JumpCloud user

run suspended · waiting for a named person · key jumpcloud-agent cannot confirm itself
In the console, or from an emailed signed link.
a key for this connector
account {  op: "keys.create", name: "jumpcloud-agent",  allowed_actions: ["jumpcloud.*"], cap_calls: 2000,  confirm_policy: "human_for_writes",  approval_rules: [    { match: "jumpcloud.systemusers.delete", approver: "[email protected]" },    { match: "jumpcloud.graph.users.transfer", approver: "[email protected]" },    { match: "jumpcloud.usergroups.delete", approver: "[email protected]" }  ]}
Illustrative. Scoped to JumpCloud only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

What JumpCloud costs on actionlake.

Every JumpCloud action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call JumpCloud refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

  • 1upstream call per actionall 506 JumpCloud actions
  • 240actions pageeach page of a long list is one call
  • 308reads can be cacheda cache hit costs nothing
  • 100,000calls a month, freepaid plans from US$49 a month for 250,000

See pricing

Action index

Every JumpCloud action.

506 actions by area: the id your agent calls, what it does, and its effect.

Directory147
  • jumpcloud.groups.listList all groupsread
  • jumpcloud.systemusers.createCreate a JumpCloud userwrite
  • jumpcloud.systemusers.listList JumpCloud usersread
  • jumpcloud.usergroups.listList user groupsread
  • jumpcloud.activedirectories.agents.createRegister an Active Directory agentwrite
  • jumpcloud.activedirectories.agents.deleteDelete an Active Directory agentdestructive
  • and 141 more in this area
Management65
  • jumpcloud.graph.commands.systemsList systems for a commandread
  • jumpcloud.graph.systemgroups.usergroupsList user groups for a system groupread
  • jumpcloud.graph.systems.usergroupsList user groups for a systemread
  • jumpcloud.systems.listList JumpCloud systemsread
  • jumpcloud.commandqueue.deleteCancel a queued commanddestructive
  • jumpcloud.commandresults.deleteDelete a command resultdestructive
  • and 59 more in this area
Insights60
  • jumpcloud.systeminsights.azure_instance_metadataQuery System Insights: azure_instance_metadataread
  • jumpcloud.systeminsights.azure_instance_tagsQuery System Insights: azure_instance_tagsread
  • jumpcloud.systeminsights.batteryQuery System Insights: batteryread
  • jumpcloud.systeminsights.chassis_infoQuery System Insights: chassis_inforead
  • jumpcloud.systeminsights.alfQuery System Insights: alfread
  • jumpcloud.systeminsights.alf_exceptionsQuery System Insights: alf_exceptionsread
  • and 54 more in this area
Policy33
  • jumpcloud.graph.policies.usergroupsList user groups for a policyread
  • jumpcloud.graph.policies.usersList users for a policyread
  • jumpcloud.graph.policygroups.usergroupsList user groups for a policy groupread
  • jumpcloud.graph.policygroups.usersList users for a policy groupread
  • jumpcloud.graph.policies.associations.listList associations of a policyread
  • jumpcloud.graph.policies.associations.manageBind or unbind a policywrite
  • and 27 more in this area
SSO23
  • jumpcloud.applications.import.usersList importable application usersread
  • jumpcloud.applications.listList SSO applicationsread
  • jumpcloud.graph.applications.usersList users for an applicationread
  • jumpcloud.graph.idp_policies.usersList users on an IdP routing policyread
  • jumpcloud.application_templates.getGet an application templateread
  • jumpcloud.application_templates.listList application templatesread
  • and 17 more in this area
Settings23
  • jumpcloud.customemails.createCreate a custom emailwrite
  • jumpcloud.customemails.getGet a custom emailread
  • jumpcloud.customemails.list_templatesList custom email templatesread
  • jumpcloud.customemails.updateUpdate a custom emailwrite
  • jumpcloud.customemails.deleteDelete a custom emaildestructive
  • jumpcloud.feature_settings.listList feature settingsread
  • and 17 more in this area
Monitoring22
  • jumpcloud.alerts.listList alertsread
  • jumpcloud.graph.healthmonitoring.systemgroupsList system groups on a monitoring ruleread
  • jumpcloud.healthmonitoring.rules.listList device monitoring rulesread
  • jumpcloud.healthmonitoring.ruletemplates.listList monitoring rule templatesread
  • jumpcloud.alerts.bulk_deleteBulk-delete alertsdestructive
  • jumpcloud.alerts.bulk_updateBulk-update alertswrite
  • and 16 more in this area
Reporting20
  • jumpcloud.reports.custom.createCreate a custom reportwrite
  • jumpcloud.reports.custom.getGet a custom reportread
  • jumpcloud.reports.custom.listList custom reportsread
  • jumpcloud.reports.jumpcloud.listList built-in reportsread
  • jumpcloud.reports.custom.deleteDelete a custom reportdestructive
  • jumpcloud.reports.custom.updateUpdate a custom reportwrite
  • and 14 more in this area
Tenancy20
  • jumpcloud.roles.createCreate an administrator rolewrite
  • jumpcloud.roles.getGet an administrator roleread
  • jumpcloud.roles.listList administrator rolesread
  • jumpcloud.roles.updateUpdate an administrator rolewrite
  • jumpcloud.administrators.organizationlinks.createGrant an administrator access to an organizationdestructive
  • jumpcloud.administrators.organizationlinks.deleteRevoke an administrator's organization accessdestructive
  • and 14 more in this area
Software18
  • jumpcloud.graph.softwareapps.systemsList systems for a software appread
  • jumpcloud.software_catalog.listList the software catalogueread
  • jumpcloud.softwareapps.listList software appsread
  • jumpcloud.softwareapps.statuses.listList software app install statusesread
  • jumpcloud.graph.softwareapps.associations.listList associations of a software appread
  • jumpcloud.graph.softwareapps.associations.manageBind or unbind a software appwrite
  • and 12 more in this area
Mfa15
  • jumpcloud.duo.applications.createCreate a Duo applicationwrite
  • jumpcloud.duo.applications.getGet a Duo applicationread
  • jumpcloud.duo.applications.listList Duo applicationsread
  • jumpcloud.duo.applications.updateUpdate a Duo applicationwrite
  • jumpcloud.duo.accounts.createLink a Duo accountwrite
  • jumpcloud.duo.accounts.deleteUnlink a Duo accountdestructive
  • and 9 more in this area
Access14
  • jumpcloud.authn_policies.createCreate an authentication policywrite
  • jumpcloud.authn_policies.evaluate.optionsList authentication evaluation optionsread
  • jumpcloud.authn_policies.listList authentication policiesread
  • jumpcloud.authn_policies.updateUpdate an authentication policywrite
  • jumpcloud.authn_policies.deleteDelete an authentication policydestructive
  • jumpcloud.authn_policies.evaluate.detailsDetail an authentication policy evaluationread
  • and 8 more in this area
Credentials13
  • jumpcloud.graph.passwordmanageritems.associations.listList associations of a password manager itemread
  • jumpcloud.graph.passwordmanageritems.usergroupsList user groups for a password manager itemread
  • jumpcloud.graph.passwordmanageritems.usersList users for a password manager itemread
  • jumpcloud.passwordpolicies.createCreate a password policywrite
  • jumpcloud.graph.passwordmanageritems.associations.manageBind or unbind a password manager itemwrite
  • jumpcloud.passwordpolicies.custombanned.getGet the custom banned password listread
  • and 7 more in this area
Risk12
  • jumpcloud.identityrisk.events.listList identity risk eventsread
  • jumpcloud.identityrisk.factors_timelineQuery the risk factors timelineread
  • jumpcloud.identityrisk.geolocations.listList access geolocationsread
  • jumpcloud.identityrisk.login_types.listList login typesread
  • jumpcloud.access_risk_settings.listList access risk settingsread
  • jumpcloud.access_risk_settings.setSet an access risk settingwrite
  • and 6 more in this area
Access10
  • jumpcloud.graph.radiusservers.associations.listList associations of a RADIUS serverread
  • jumpcloud.graph.radiusservers.usergroupsList user groups for a RADIUS serverread
  • jumpcloud.graph.radiusservers.usersList users for a RADIUS serverread
  • jumpcloud.radiusservers.listList RADIUS serversread
  • jumpcloud.graph.radiusservers.associations.manageBind or unbind a RADIUS serverwrite
  • jumpcloud.graph.radiusservers.systemgroupsList system groups for a RADIUS serverread
  • and 4 more in this area
Automation10
  • jumpcloud.workflows.createCreate a workflowwrite
  • jumpcloud.workflows.getGet a workflowread
  • jumpcloud.workflows.listList workflowsread
  • jumpcloud.workflows.templates.listList workflow templatesread
  • jumpcloud.workflows.deleteDelete a workflowdestructive
  • jumpcloud.workflows.runRun a workflowdestructive
  • and 4 more in this area
Billing1
  • jumpcloud.subscriptions.listList subscriptionsread

This index shows a sample of each area. All 506 actions, with their inputs and prices, are in the catalogue, which a free sandbox key can search.

Questions

The JumpCloud MCP server, answered.

Is there a JumpCloud MCP server for Claude?

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 506 JumpCloud actions across directory, management, insights and policy, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by JumpCloud.

What do I need to connect JumpCloud?

JumpCloud API key and Organization ID (MSP / multi-tenant keys only). The free call account { op: "connections.requirements", service: "jumpcloud" } lists exactly what to paste.

Can an AI agent delete or change things in JumpCloud?

Only if its key allows it, and only with an explicit confirmation. 59 JumpCloud actions are destructive, including delete a JumpCloud user, transfer a user to another organization and delete a user group. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

Will an AI agent use up my JumpCloud API limit?

actionlake paces every call to the limits in the JumpCloud service file: 2,000 calls a minute per connection. Repeated reads are answered from cache (308 JumpCloud actions can be), which never reaches JumpCloud.

What does a JumpCloud action cost?

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (240 JumpCloud actions page). Cache hits, searches, dry runs and calls JumpCloud refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

Which JumpCloud API does it cover?

The JumpCloud API v1+v2 at console.jumpcloud.com/api. It is built from JumpCloud's documentation as read on 15 September 2026. 506 actions in 17 areas, each one in the signed service file (version 2.0.0).

Does actionlake keep my JumpCloud data, and where?

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to an hour, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your JumpCloud credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

Which AI clients can use it?

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

More connectors like JumpCloud

Shares the most action names with

Joins with, on shared entities

Browse

actionlake is independent. It is not made or endorsed by JumpCloud; the name is the vendor's own. Counts are from the JumpCloud service file, version 2.0.0.

Give your agent JumpCloud today.

Connect JumpCloud freeSee pricing

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.