Documentation

How Jarl manages multiple Jamf Pro tenants — playbooks, backups, AI, and more.

Overview

Jarl is a native macOS app for managing multiple Jamf Pro (Jamf Cloud) instances through the Jamf Pro API. It authenticates with OAuth 2.0 client credentials — no Jamf user accounts, no SSO, and no backend server of mine sitting between you and your Jamf tenants. Everything Jarl does talks directly to the Jamf Pro instances you configure.

Requirements

• macOS 27 or later, Apple Silicon only
• A Jamf Pro instance with an API Role and API Client configured
• Apple Intelligence enabled (only needed for the AI Assistant — everything else works without it)

Adding an Organization

1. In Jamf Pro, go to Settings → System → API Roles and Clients
2. Create an API Role scoped to the privileges Jarl needs for what you plan to use (read-only for inventory/reporting, write access for Playbooks/Copy Between Orgs)
3. Create an API Client using that role, and generate a client secret
4. In Jarl, add a new organization with your Jamf Pro URL, Client ID, and Client Secret

Add as many organizations as you manage — each with its own credentials, and each groupable by client if you're an MSP managing multiple tenants.

Playbooks

Playbooks let you declare the desired state of your Jamf Pro resources — Smart Groups, Static Groups, Policies, Scripts, Configuration Profiles, Extension Attributes, and Package metadata — instead of clicking through the Jamf Pro console by hand. Jarl diffs a playbook against what's actually in your org and only touches what's changed.

resources:
  - name: "Engineering – Smart Group"
    type: SmartGroup
    state: present
    config:
      criteria:
        - attribute: Department
          operator: is
          value: Engineering

  - name: "Baseline Security Profile"
    type: ConfigurationProfile
    state: present
    config:
      payloadPath: ./profiles/baseline-security.mobileconfig
      scope:
        smartGroup: "Engineering – Smart Group"

Running a playbook is a two-step plan/apply flow, like Terraform: Jarl first shows you exactly what it would create, update, or leave unchanged, then applies it once you confirm. Resources can also be marked state: absent to declaratively tear them down.

Scheduling

Playbooks can run on a schedule while Jarl is open, using a background login item — useful for reconciling drift automatically (e.g. re-applying a baseline configuration profile every night).

Community Playbooks

Browse and import playbooks shared by other Jamf admins from the public Jarl_Playbooks repository, instead of writing every playbook from scratch. Contributions welcome.

Backups

Jarl can export your Jamf Pro configuration — Smart Groups, Static Groups, Policies, Scripts, Configuration Profiles, Packages, and Extension Attributes — to a local folder as JSON, one file per resource, organized into per-type subfolders. If one resource fails to export, the rest still complete.

• Export Now… — a one-off backup on demand
• Schedule Automatic Backups… — recurring, unattended exports to a folder you choose

Gimle Backups

Gimle makes read-only, deduplicated backups of a Jamf Pro server. Jarl can open those backups as an organization of its own, so you can look through a tenant offline, or as it was last week, without touching the live server.

1. Choose File → Open Gimle Backup Folder… (⇧⌘O) and pick the folder Gimle backs up into, or the folder of a single instance.
2. Every instance found becomes an organization, marked with a drive icon. Its backups are read from the folder; nothing is copied.
3. Use the backup menu in the toolbar to follow the Newest Backup (it switches by itself when a newer one appears) or to pin an older one, like Time Machine.

Devices, Smart and Static Groups, Policies, Configuration Profiles, Scripts, Packages and Extension Attributes work as in a live organization, including search and the relationship map.

Copy Between Orgs

Every resource list — Smart Groups, Static Groups, Policies, Scripts, Configuration Profiles, Packages, Extension Attributes — has a Copy to Organization… action that copies that resource into a different Jamf Pro tenant you manage in Jarl.

Anything that doesn't carry over is called out explicitly in the confirmation, so you always know what landed and what didn't.

AI Assistant

Jarl includes an in-app chat assistant, built on Apple's Foundation Models framework, so you can ask questions about your Jamf environment in plain language instead of clicking through resource lists. It shares the same read-only tool set as the MCP server below.

MCP Server

Jarl can run a local MCP (Model Context Protocol) server, bound to 127.0.0.1 only, so any MCP-compatible AI client or tool can query and manage your Jamf Pro environment directly.

• Off by default — enable it in Settings
• ~25 read tools (list/search/get across every resource type) are available once enabled
• Write tools (create/update/delete/upload) are a separate opt-in toggle, off by default even when the server itself is on

Relationship Map

A force-directed graph visualizing how your Jamf resources connect — which devices belong to which Smart Groups, which groups are scoped to which Policies and Configuration Profiles, and so on. Useful for understanding the blast radius of a change before you make it, or for untangling an org you didn't originally set up.

Secrets & Touch ID

API client secrets are stored in the macOS Keychain, never in plain text on disk. Revealing a stored secret requires Touch ID or Face ID.

Managed Deployment (MDM)

Jarl can receive its organizations from your MDM, the way Gimle receives its instances. Users get the organizations without ever seeing a client ID or secret, and cannot edit, duplicate or delete them. Preferences domain: com.spectrechen.jarl. Upload a custom schema as an External Application in Jamf Pro, or deploy a plist. Keys that are set are locked; keys you leave out stay editable.

<key>ManagedOrganizations</key>
<array>
  <dict>
    <key>Name</key><string>Production</string>
    <key>URL</key><string>https://yourorg.jamfcloud.com</string>
    <key>ClientID</key><string>…</string>
    <key>ClientSecret</key><string>JARL-ENC:v1:…</string>
    <key>ClientName</key><string>Acme Corp</string>   <!-- optional sidebar group -->
  </dict>
</array>

URL (https only), ClientID and ClientSecret are required; an incomplete entry is skipped with a warning under Settings. The same URL and client ID always map to the same organization, so playbooks and schedules survive profile updates, and an organization removed from the profile disappears from Jarl. A managed organization's secret is never stored in Jarl's Keychain: it is read from the profile and decrypted only when Jarl requests an access token.

Encrypted client secrets

Anyone on a Mac can read managed preferences, so ClientSecret should be a JARL-ENC:v1 value (P-256 ECDH, HKDF-SHA256, AES-256-GCM, the same construction as Gimle's). It uses the same organisation key as Gimle, so a Mac that already has Gimle's key profile needs nothing new. Open Tools/encrypt.html in a browser (it works offline), paste the organisation's public key and the secret, and put the result into ClientSecret.