Tracecat

Iru / Kandji MCP server

Query devices, Blueprints, and Library Items across your Apple fleet through Iru's hosted MCP endpoint.

Endpoint
http
Official docs

About

Connect Tracecat to Iru / Kandji to query Apple device inventory and management state for SOC analysts and IT admins running macOS, iPadOS, and iOS at scale. You can resolve a device by serial or user and pull its Blueprint assignment for investigation context. From there, inspect Library Items, walk recent device activity, and answer fleet posture questions with precision.

Setup

  1. 1

    Create an API key

    The Iru MCP server is hosted by Iru and authenticates with an Enterprise API token that has MCP access enabled. Each token is paired with an MCP profile that controls which Enterprise API endpoints the agent can call.

  2. 2

    Select the Iru / Kandji tile in the Tracecat MCP catalog

    Open the MCP catalog in your workspace, select the Iru / Kandji tile, and paste your API key.

  3. 3

    Enable Iru / Kandji in your agent

    In your ai.agent action or Agents → tools tab, select Iru / Kandji from the MCP integrations dropdown.

Tools

list_devices

List Apple devices enrolled in Iru with their inventory details.

get_device

Retrieve full device details, including user assignment and posture.

search_devices

Search devices by serial, hostname, user, model, or Blueprint.

list_blueprints

List Iru Blueprints and the Library Items they include.

get_blueprint

Retrieve the contents of a specific Blueprint, including assignment rules.

list_library_items

List Library Items such as apps, scripts, and configuration profiles.

get_library_item

Retrieve the configuration of a specific Library Item.

list_device_activity

List recent activity events for a device, such as enrollment and policy runs.

Deploy the Iru / Kandji MCP server in minutes

Connect your security agents to 50+ hosted MCP servers.

Self-host free