SimpleMDM MCP server

What the model can do

SimpleMDM Apple device management: devices with OS, model, supervision, passcode, FileVault, Activation Lock, firewall and battery state, a device's installed apps and directly assigned profiles, assignment groups, the app catalogue, the audit log, scripts and script jobs. When asked, can lock, wipe, restart, shut down, update, unenrol or refresh a device, turn lost mode on or off, clear its passcode, disable Activation Lock, send it a message, move it between assignment groups, and run or cancel a script on Macs.

Reads

• simplemdm_list_devicesList SimpleMDM devices: name, status, the managed Apple ID of the device's user, model, OS version, last seen, enrolled, supervised…
• simplemdm_get_deviceOne SimpleMDM device in detail: the list fields plus build, enrolment channel, Find My, iCloud backup, firmware and recovery lock enabled…
• simplemdm_list_assignment_groupsSimpleMDM assignment groups, which pair apps and profiles with devices: name, static or dynamic, auto-deploy, and how many apps…
• simplemdm_list_appsThe SimpleMDM app catalogue: name, bundle identifier, type (app store, enterprise, custom b2b) and version.
• simplemdm_list_logsThe SimpleMDM audit log of admin and device events: when (as SimpleMDM writes it, MM/DD/YY HH:MM:SS), namespace, event type, level…
• simplemdm_list_scriptsSimpleMDM scripts (macOS): id, name, whether it takes variables, and when it was created and changed.
• simplemdm_script_jobsSimpleMDM script jobs from the last month (a job is a script sent to devices): script, status (pending, completed, completed-with-errors, cancelled)…

Acts, when you ask

These change something in SimpleMDM. The model is told to use them only when you ask for exactly that, and each one is granted by name: per team on a shared connection, by the owner on a personal one.

• simplemdm_lock_deviceLock a SimpleMDM device now, optionally showing a message and phone number on the lock screen.
• simplemdm_wipe_deviceErase a SimpleMDM device: all content and settings are deleted, the device is unenrolled from SimpleMDM and returned to factory settings.
• simplemdm_restart_deviceRestart a SimpleMDM device, interrupting whoever is using it.
• simplemdm_shutdown_deviceShut down a SimpleMDM device.
• simplemdm_update_osUpdate a SimpleMDM device's OS now (iOS, iPadOS, tvOS, macOS).
• simplemdm_enable_lost_modeTurn on lost mode for a supervised SimpleMDM device: it is locked and shows the message and/or phone number given…
• simplemdm_disable_lost_modeTurn lost mode off for a SimpleMDM device, so whoever holds it can use it again with its passcode.
• simplemdm_clear_passcodeUnlock a SimpleMDM device and remove its passcode.
• simplemdm_disable_activation_lockDisable Activation Lock on a SimpleMDM device, removing the protection that ties it to an Apple ID so it can be erased and set up by anyone.
• simplemdm_unenroll_deviceUnenrol a device from SimpleMDM.
• simplemdm_refresh_deviceAsk a SimpleMDM device to report its information and app inventory again.
• simplemdm_send_messageSend a push notification to a device's SimpleMDM app (it must be installed with notifications on).
• simplemdm_assign_device_to_groupAdd a device to a SimpleMDM assignment group, so it receives that group's apps, profiles and settings.
• simplemdm_unassign_device_from_groupRemove a device from a SimpleMDM assignment group; the apps, profiles and settings the group gave it are withdrawn.
• simplemdm_run_scriptRun a SimpleMDM script (from simplemdm_list_scripts) on Macs: the devices listed and/or every Mac in the assignment groups listed.
• simplemdm_cancel_script_jobCancel a SimpleMDM script job.

Connect it

First connect SimpleMDM on Dashboard → Connections, then add Memtro to your client once. The SimpleMDM tools appear alongside the tools of everything else you have connected; nothing is configured per connector.

claude plugin marketplace add memtro-org/claude-memtro
claude plugin install memtro@memtro --config api_key=sk-memtro-...

{
  "mcpServers": {
    "memtro": {
      "url": "https://platform.memtro.com/api/mcp",
      "headers": {
        "Authorization": "Bearer sk-memtro-..."
      }
    }
  }
}

{
  "mcp": {
    "memtro": {
      "type": "remote",
      "url": "https://platform.memtro.com/api/mcp",
      "headers": {
        "Authorization": "Bearer sk-memtro-..."
      }
    }
  }
}

Who may use it

The key identifies the person, and the server offers that person the tools they may use everywhere else in Memtro. A shared SimpleMDM connection is used by the teams an administrator granted it to, tool by tool, on the Permissions page; a personal connection is used by its owner alone, and its tools that act stay off until the owner allows them. See Teams and permissions and Connectors.

Ask it like this

• › Which Macs have FileVault turned off?
• › Which devices have not been seen in the last week?
• › What apps are installed on Priya's MacBook?
• › Did last night's cleanup script succeed on every Mac?
• › Put Dan's iPhone into lost mode with my phone number

Questions

Is this an official SimpleMDM MCP server?

No. It is Memtro's MCP server with Memtro's SimpleMDM connector behind it: the connector reads SimpleMDM through its API with the credentials you connect on Dashboard → Connections, and SimpleMDM publishes nothing here. The same endpoint carries every other system you connect and Memtro's memory tools.

What does it cost?

Nothing on top of Memtro. One price per organisation by its number of users, from $50 a month for up to 10 users after a 7-day free trial, with every connector, the MCP server, jobs and memory included. You bring your own model keys.

Can it change anything in SimpleMDM?

Only when you ask, and only what it has been granted: lock a device, optionally with a message and phone number on the lock screen (iPhone and iPad); erase a device and unenrol it, returning it to factory settings (permanent); restart a device; shut down a device; update a device's OS now; turn lost mode on for a device (locks it with a message); turn lost mode off for a device; remove a device's passcode; disable Activation Lock on a device; unenrol a device from SimpleMDM; ask a device to refresh its inventory; send a push message to a device's SimpleMDM app; add a device to an assignment group; remove a device from an assignment group; run a script on Macs; cancel a script job that has not reached its devices. Every other tool reads, searches or lists. An administrator grants each acting tool by name per team, and a personal connection acts only after its owner allows it.

Which clients work?

Any MCP client that speaks Streamable HTTP: Claude Code, Cursor, Claude Desktop, OpenCode, Codex, Zed, Windsurf, Cline and the Anthropic and OpenAI SDKs. There is no local process to run; the server is remote and authenticated with your key.

Other MCP servers · Engineering and operations

• GitHub MCP server
• AWS CloudWatch MCP server
• Sentry MCP server
• ServiceNow MCP server
• Okta MCP server
• Twilio MCP server