Skip to main content
Jamf Pro provides AI agent tools for macOS device management. Reference these tools in using @ mentions to look up computers, lock lost devices, and erase stolen ones without escalating to IT.

​
Look up computers

Get computer information

Finds a Mac managed by Jamf Pro and returns its details. You can scope the response to specific inventory sections; if none are passed, the tool returns basic computer information. Run this tool first to confirm a device’s name and serial number before locking or erasing.Tool name: @Computer InfoInput fields:
  • serial_number - the computer’s serial number. If omitted, the tool tries to match on the requesting user’s email in Jamf.
  • computer_id - the Jamf Pro computer ID, for example 2. The most precise selector. Use it when a previous lookup returned multiple matching computers.
  • computer_name - the computer’s name in Jamf Pro, matched exactly.
  • sections - inventory sections to include in the response. Pass one or more uppercase values such as APPLICATIONS, CONFIGURATION_PROFILES, HARDWARE, OPERATING_SYSTEM, SECURITY, STORAGE, or SOFTWARE_UPDATES. Defaults to basic information when omitted.
Output data:
  • computer - the computer record from Jamf Pro, containing the requested inventory sections.
Common use cases:
  • Look up a Mac’s serial number, model, and OS version before acting on it
  • Check which configuration profiles are installed on a device
  • Verify that a Mac is enrolled and managed by Jamf
  • Pull security posture or disk encryption details during a compliance review
Example rule:

When a user reports issues with their Mac, use @Computer Info to look up the device. Ask for their serial number if they know it; otherwise the tool tries to match on their email. Check the management status, OS version, and installed profiles, then suggest troubleshooting steps based on what you find.

​
Secure lost or stolen computers

Sends a remote lock command to a Mac through Jamf Pro. The Mac displays a lock screen the next time it comes online and stays locked until someone enters a 6-digit unlock PIN. The unlock PIN is delivered to the requester as a private Slack DM and never appears in the ticket.
Locking a Mac prevents the user from signing in until the unlock PIN is entered. Confirm the device’s name and serial number with the requester before sending the command.
Tool name: @Lock MacInput fields:
  • serial_number (required) - serial number of the Mac to lock. Run @Computer Info first to confirm it.
Common use cases:
  • Lock a misplaced Mac while the user searches for it
  • Secure a device left unattended in a public place
  • Lock a Mac while a suspected security incident is investigated
Example rule:

When a user reports a lost Mac, use @Computer Info to confirm the device and its serial number. Ask the user to confirm before sending the lock command. Use @Lock Mac and tell them the lock takes effect the next time the Mac connects to the internet. Let them know the unlock PIN will arrive as a private Slack DM.

Sends a remote erase command to a Mac through Jamf Pro. The Mac is wiped the next time it comes online. For Intel Macs, a 6-digit setup PIN is generated and delivered to the requester as a private Slack DM; the user needs it to complete setup after the erase. The erase command cannot be recalled once sent.
Erasing a Mac permanently destroys all data and cannot be undone. Use this tool only for confirmed stolen or unrecoverable devices. For a lost or misplaced Mac, use @Lock Mac instead.
Tool name: @Erase MacInput fields:
  • serial_number (required) - serial number of the Mac to erase. Run @Computer Info first to confirm it.
Common use cases:
  • Wipe a confirmed stolen Mac to protect sensitive data
  • Erase an unrecoverable device before decommissioning
  • Remove data from a Mac that was lost and will not be recovered
Example rule:

When a user reports a stolen Mac, use @Computer Info to confirm the device. If the Mac was only lost, offer @Lock Mac instead. Before erasing, confirm with the user that the Mac was stolen and will not be recovered. Use @Erase Mac and tell them the erase takes effect the next time the Mac connects. Let them know that for Intel Macs a setup PIN will arrive as a private Slack DM.

​
Lock and erase permissions

Both tools find the Mac by serial number and only act on Macs that Jamf reports as managed. An unmanaged Mac can’t receive remote commands, so the agent tells the requester to contact IT. A Mac counts as yours only when the owner email on its Jamf record exactly matches your Ravenna email. A Mac with no owner email in Jamf counts as someone else’s. When a requester lacks the required role, the agent explains the limit and advises them to contact IT. Set @Erase Mac to Requires approval so IT leads approve every wipe before it runs. While approval is pending, the agent tells the requester the erase is waiting on IT rather than reporting it as done.
Lock and erase need Jamf API privileges beyond a read-only role. If the API role is missing them, the tool returns a JAMF_PRIVILEGE_MISSING error naming the missing privilege. See the setup guide for the full list.
A tool with no execution policy set runs without asking. When Copilot drafts a rule, it suggests Requires confirmation for write tools and Requires approval for delete tools, and you can change either per rule. See tool execution policies.

​
Setup

1

Install Jamf Pro integration

Follow the Jamf Pro setup guide to connect your Jamf Pro instance to Ravenna.
2

Configure agent

Open your agent’s settings and add the Jamf Pro tools you want it to use under Tools. An admin has to attach each tool before an agent or rule can call it.
3

Create rules

Write that reference Jamf Pro tools using @ mentions.
4

Test tools

Test your rules on a real request to verify the tools work as expected.

​
Best practices

  • Look up before you act. Use @Computer Info to confirm a device’s name and serial number before locking or erasing. The tool matches on the requesting user’s email when no serial is provided and surfaces multiple results if more than one device matches.
  • Prefer lock over erase. Use @Lock Mac when a device is lost or misplaced. Lock is reversible; erase permanently destroys all data. Only use @Erase Mac for confirmed stolen or unrecoverable devices.
  • Gate destructive tools. Put @Lock Mac and @Erase Mac behind Requires approval in any rule an agent can reach on its own. The erase command cannot be recalled once sent.
  • Keep PINs private. Both lock and erase deliver a PIN to the requester as a private Slack DM. Never repeat, display, or ask for a PIN in the ticket.
Learn more about configuring agents and Jamf Pro workflow actions
Last modified on September 30, 2026