Iru / Kandji MCP server
Query devices, Blueprints, and Library Items across your Apple fleet through Iru's hosted MCP endpoint.
About
Connect Tracecat to Iru / Kandji to query Apple device inventory and management state for SOC analysts and IT admins running macOS, iPadOS, and iOS at scale. You can resolve a device by serial or user and pull its Blueprint assignment for investigation context. From there, inspect Library Items, walk recent device activity, and answer fleet posture questions with precision.
Setup
- 1
Create an API key
The Iru MCP server is hosted by Iru and authenticates with an Enterprise API token that has MCP access enabled. Each token is paired with an MCP profile that controls which Enterprise API endpoints the agent can call.
- 2
Select the
Iru / Kandjitile in the Tracecat MCP catalogOpen the
MCP catalogin your workspace, select theIru / Kandjitile, and paste your API key. - 3
Enable
Iru / Kandjiin your agentIn your
ai.agentaction orAgents→toolstab, selectIru / Kandjifrom theMCP integrationsdropdown.
Tools
list_devices | List Apple devices enrolled in Iru with their inventory details. |
get_device | Retrieve full device details, including user assignment and posture. |
search_devices | Search devices by serial, hostname, user, model, or Blueprint. |
list_blueprints | List Iru Blueprints and the Library Items they include. |
get_blueprint | Retrieve the contents of a specific Blueprint, including assignment rules. |
list_library_items | List Library Items such as apps, scripts, and configuration profiles. |
get_library_item | Retrieve the configuration of a specific Library Item. |
list_device_activity | List recent activity events for a device, such as enrollment and policy runs. |