Stale devices
Priya Sharma, IT manager at Acme Ltd, asked which Macs had not checked in for a week. Memtro listed them with assigned user, OS version and blueprint, and noted one already in Lost Mode.
Kandji + Memtro
Which Macs have not checked in this week, and who are they assigned to?
Kandji, now Iru, connects Memtro to your Apple device management. It reads devices with model, platform, OS version, last check-in, assigned user, asset tag, blueprint, agent and Lost Mode state and tags, device notes, directory users, the audit log, blueprints, threat detections and vulnerability detections by CVE. When asked, and once an administrator has granted the action by name, it can lock, erase, restart or shut down a device, toggle Lost Mode, clear a passcode, release a locked Mac account, refresh inventory, rename, note or retag a device, move its blueprint, or delete its record. Serial numbers are not returned.
In Memtro
What you can do with Kandji in Memtro
Ask in plain English from chat, your editor, a scheduled job or your own agent. The model picks the right Kandji tool, reads what it needs, and answers with the source cited.
What it does
- 01Lists devices with model, platform, OS version, last check-in, assigned user, asset tag, blueprint, agent and Lost Mode state and tags
- 02Reads a device's notes, and directory users with department, job title and how many devices they have
- 03Reads the audit log of who changed what, and blueprints with how many computers use each
- 04Lists threat detections with status and device, and vulnerability detections by CVE with CVSS score and severity, where you have those Kandji products
- 05When asked and granted, locks, erases, restarts or shuts down a device, turns Lost Mode on or off, clears a passcode, or releases a Mac's locked local account, and erasing wipes the device permanently
- 06When asked and granted, refreshes inventory, renames a device, adds a note, changes its asset tag, user or tags, moves it to another blueprint, which changes its apps and settings, or deletes its record
Acts when asked
When you ask it to
These tools change something in Kandji. The model is told to use them only when you ask for exactly that, and an administrator grants each one by name to the teams that may use it; a personal connection acts only after its owner allows it.
- 01Lock a device (the unlock PIN stays in the Kandji console)
- 02Erase a device (all data lost, permanent)
- 03Restart a device
- 04Shut down a device
- 05Turn on Lost Mode on an iPhone or iPad
- 06Turn off Lost Mode
- 07Clear an iPhone or iPad passcode
- 08Unlock a Mac's locked local account
- 09Delete a device record (it stops being managed)
- 10Ask a device to check in and refresh its inventory
- 11Rename a device
- 12Add a note to a device
- 13Change a device's asset tag, assigned user or tags
- 14Move a device to another blueprint (changes its apps and settings)
In practice
Ask it like you would a colleague
Once Kandji is connected, these are the kinds of things people ask. Plain questions, no syntax. If the answer lives partly in another system you have connected, Memtro looks there too.
Kandji + MemtroWhich Macs have not checked in this week?
Which devices are still on an old macOS version?
Which critical vulnerabilities are open across the fleet?
Who changed the engineering blueprint last week?
Lock Tom's MacBook and show our support number
A lost laptop
Dan Fletcher, IT administrator at Northwind, asked Memtro to lock a laptop reported lost on a train and show the help desk number. Memtro sent the lock command through Kandji. The PIN that releases the lock stayed in the Kandji console and was never shown in Memtro.
Teams
Where it fits
The teams that lean on Kandji most, a question each of them asks, and what they connect beside it.
- EngineeringKeep decisions from evaporatingEngineer, Tech lead, On call, New joiner“Who owns the billing migration, and what did we decide about retries?”Used alongside GitHub, Linear, Jira, Confluence, Slack and 5 more.
- ProductHear what customers actually ask forProduct manager, Researcher, Designer, Head of product“Which customers asked for SSO this quarter, and what is their combined ARR?”Used alongside Help Scout, HubSpot, Linear, Jira, Slack and 6 more.
- Agent buildersMemory and tools for the agents you buildSolo builder, Platform team, Automation engineer, Whoever signs it off“Search memtro for what we know about Acme before drafting the proposal”Used alongside GitHub, Linear and Slack.
Better together
Works with
A record in Kandji is rarely the whole story. Connect the systems that hold the rest and Memtro checks them together, then remembers what it learned so the next question starts further along.
- Work managementKandji with JiraJQL search, issue details and projects from Jira Cloud.
- Work managementKandji with Clio ManageAsk the matter: its client, its fee earner, the time on it and what is still unbilled.
- Work managementKandji with LinearIssues, projects and teams, synced hourly into memory.
- SupportKandji with Help ScoutAI that reads your support conversations and cross-references the customer everywhere else.
- SupportKandji with ZendeskEvery ticket, reply and internal note, ready to be asked about.
- SupportKandji with IntercomCustomer conversations and the people behind them, in your company memory.
- Documents and wikisKandji with NotionSearch pages and query databases, and write to them when you ask.
- Documents and wikisKandji with Google DriveSearch Drive and read Docs, Sheets and Slides as text, and write a Doc when you ask.
- Documents and wikisKandji with ConfluenceSearch and read wiki pages, and write them when you ask.
Also in Engineering and operations
Using something else for the same job, or both? Each connector has its own tools; connect as many as you like.
- GitHub
- AWS CloudWatch
- Sentry
- ServiceNow
- Okta
- Twilio
- AWS CloudTrail
- GitLab
- Bitbucket
- Vercel
- PagerDuty
- Datadog
- Grafana
- incident.io
- Azure DevOps
- CircleCI
- Cloudflare
- LaunchDarkly
- New Relic
- Rollbar
- Snyk
- Better Stack
- Buildkite
- DigitalOcean
- Heroku
- Netlify
- SonarQube Cloud
- Statuspage
UptimeRobot- Axiom
- BugSnag
- Checkly
- Hetzner Cloud
Honeycomb- Pingdom
- Render
- Statsig
- Sumo Logic
- Supabase
- HCP Terraform
- Vultr
- Airbrake
- Codecov
Cronitor- Dynatrace
FireHydrant- Fly.io
- Honeybadger
- Akamai Linode
- Octopus Deploy
- Pulumi
- Rootly
- Semgrep
- Splunk
StatusCake- Tailscale
- Argo CD
- authentik
- Coolify
- Gitea
GlitchTip
GLPI- Jenkins
Langfuse
LibreNMS- n8n
NetBox- Portainer
- Prefect
Snipe-IT
Woodpecker CI
Zabbix
LangSmith
Helicone- OpenAI (usage and cost)
- Anthropic (usage and cost)
- Algolia
- Flagsmith
- Unleash
GrowthBook
Drata
Intruder
GitGuardian
Secureframe
ilert- KnowBe4
JumpCloud
ConfigCat- Railway
- Fastly
- Postman
- Make
- Braintrust
- OpenRouter
- ElevenLabs
Split- Scaleway
Aikido Security- AssemblyAI
Astronomer- Bamboo
- Baseten
- Bitrise
- Bitwarden
- BrowserStack
- bunny.net
- Cachet
- Checkmk
- Civo
- Cloudsmith
- Codacy
- Codemagic
Comet Opik- Coralogix
CrowdStrike Falcon- Dagster+
- DeepSource
Detectify- Docker Hub
Domotz- Grafana OnCall
- Harness
- Hugging Face
- Instatus
- Koyeb
- Lambda Cloud
LambdaTest
LangWatch
LlamaCloud
Logz.io
Lunary- Mezmo
NinjaOne- Nomad
Northflank- Oh Dear
- OVHcloud
Portkey- Probely (Snyk API & Web)
PromptLayer- Proxmox VE
PRTG Network Monitor- Qase
Raygun
Retell AI- Retool
Runpod- SecurityScorecard
- Semaphore CI
Shodan- SigNoz
- Socket
Spike.sh
Squadcast- SwaggerHub
- TeamCity
Tenable- Together AI
- Travis CI
UpGuard
Uptime.com
Vanta- Vapi
- Windmill
Zenduty- OpsLevel
Cortex- Auth0
- Clerk
WorkOS
Automox
Huntress- HackerOne
SimpleMDM- AppSignal
Healthchecks.io
Rapid7 InsightVM- 1Password Events
- JFrog Artifactory
- Sauce Labs
Zenhub- Deepgram
- Replicate
Setup
How to connect
Connect withSubdomain, region and API token
- 1
In Kandji, open Settings → Access → API tokens → Add Token, name it Memtro and create it. Copy the token, as it is shown once.
- 2
Configure permissions: grant the device read permissions and only the device actions you want Memtro to take. Do not grant the device secrets permissions.
- 3
In Memtro, open Connections → Kandji and paste Subdomain (the first part of the API URL shown on that page), Region (us or eu) and API token.
- 4
Ask your first question: which Macs have not checked in this week?
Also works from
Chat in the dashboard, the OpenAI-compatible API, scheduled jobs, and any MCP client: Claude Code, OpenCode, Cursor, Claude Desktop. The Kandji tools are the same everywhere.
FAQ
Questions
Can Memtro change anything in Kandji?+
Only when you ask, and only what it has been granted: lock a device (the unlock PIN stays in the Kandji console); erase a device (all data lost, permanent); restart a device; shut down a device; turn on Lost Mode on an iPhone or iPad; turn off Lost Mode; clear an iPhone or iPad passcode; unlock a Mac's locked local account; delete a device record (it stops being managed); ask a device to check in and refresh its inventory; rename a device; add a note to a device; change a device's asset tag, assigned user or tags; move a device to another blueprint (changes its apps and settings). Every other tool reads, searches or lists. The Connections page labels the tools that act, an administrator grants each one by name to the teams that may use it, and a personal connection acts only after its owner allows it.
Who can use a Kandji connection?+
A personal connection serves only your own requests. A shared connection serves the organisation: everyone, or only the teams an admin chooses. Admins can always add shared connections; other members need the permission.
Does Memtro store my Kandji data?+
Credentials are encrypted at rest. Tool results are cached briefly so agent loops do not repeat identical calls, and the facts the model extracts are saved to your organisation's memory with provenance (system, record and link) so they can be checked and superseded.
How do I connect Kandji?+
Subdomain, region and API token. In Kandji, open Settings → Access → API tokens → Add Token, name it Memtro and create it. Copy the token, as it is shown once.
Connect Kandji in a few minutes
Seven-day free trial, then one monthly price per organisation. Connectors, jobs and memory are never metered.