Skip to main content

Enabling JAMS MCP

Before You Begin​

Before connecting an AI client to JAMS, make sure these items are in place:

  • Node.js 23.8 or newer on the user's machine.

    • Most users will not have this installed, and in managed environments, it typically requires IT to distribute it via SCCM, Intune, or equivalent.
    • Every supported AI client connects through a small bridge utility (mcp-remote) that runs on Node. Node 23.8 or newer is only needed if you plan to use the simpler --use-system-ca certificate option (Option A below); the CA-bundle option (Option B) works on any current Node.

  • A supported AI client installed and licensed for the user.

  • TLS certificate trust on the user's machine.

    • In most corporate environments, the JAMS gateway certificate is already trusted because it is signed by the corporate CA, and nothing extra is needed. In development or self-signed scenarios, IT may need to distribute a CA bundle to the user's machine.

  • JAMS Web Client installed and reachable.

    • The JAMS MCP service is an option in the JAMS Web Client installer.

  • The JAMS Web Client gateway URL.

  • A JAMS user account.

    • The user signs in using their normal JAMS credentials during first connection.
    • The existing JAMS user permissions apply automatically to JAMS MCP. Any user who can log in to the JAMS Web Client can also connect their AI tool through JAMS MCP, subject to the same folder- and Job-level access controls already in place.

1. Installation​

There is no separate JAMS MCP installer or enable MCP setting. When you install the JAMS Web Client and select the JAMS MCP option, the JAMS MCP service is installed as a Windows service on your JAMS Web Client.

The MCP service is reachable at: https://<your-gateway-host>/mcp. Replace <your-gateway-host> with the same hostname your team already uses to reach the JAMS Web Client. If you prefer not to expose JAMS MCP, such as during a phased rollout, you can block the /mcp path at your reverse proxy or firewall without affecting any other JAMS functionality.

2. Configuring JAMS TLS Certificate​

Your MCP client connects to JAMS Web Client over HTTPS through a small bridge program called mcp-remote. That bridge runs on Node.js, and Node has its own list of trusted certificate authorities that are separate from the Windows trust store.

You have two ways to handle this. Pick whichever fits your environment:

Option A — --use-system-ca (preferred, simplest)​

This option works if both of the following are true:

  • Your Node version is 23.8 or newer (node --version shows v23.8.0 or newer).
  • The JAMS Gateway certificate is signed by a CA your Windows machine already trusts (typically your corporate root CA, pushed by IT via Group Policy).

When you configure your client, you'll add NODE_OPTIONS=--use-system-ca to its environment, and you can skip Option B entirely.

Option B — Distribute the JAMS CA bundle to your machine​

Use this if Option A doesn't apply due to older Node version, a self-signed cert, or a load-balancer certificate is not in Windows trust.

The MCP server automatically publishes a PEM bundle of its certificate chain. Download it once to your machine:

info

You may need to adjust the command based on where you are connecting. If you are connecting to the JAMS MCP remotely, use the following path: %PROGRAMDATA%\JAMS\ca-bundle.pem. If you are connecting on the same machine as the JAMS MCP, use %PROGRAMFILES%\JAMS\Shared\JAMS MCP\ca-bundle.pem. The examples below are for connecting remotely.

New-Item -Path $env:PROGRAMDATA\JAMS -ItemType Directory -Force | Out-Null
Invoke-WebRequest https://<your-gateway-host>/mcp/ca-bundle.pem -OutFile $env:PROGRAMDATA\JAMS\ca-bundle.pem

If PowerShell displays an error, you can also run the following CURL:

if not exist "%PROGRAMDATA%\JAMS" mkdir "%PROGRAMDATA%\JAMS"
curl -o "%PROGRAMDATA%\JAMS\ca-bundle.pem" https://<your-gateway-host>/mcp/ca-bundle.pem

Replace <your-gateway-host> with your actual Gateway hostname (no port needed for this URL).

If the download fails with a TLS error (common for dev / self-signed setups), use one of these workarounds:

  • PowerShell 7+: add -SkipCertificateCheck to the command above.
  • Open the URL in your browser, click through the warning, and save the file manually to C:\ProgramData\JAMS\ca-bundle.pem.
  • Ask your IT admin to push the file via GPO or Intune to C:\ProgramData\JAMS\ca-bundle.pem.

You'll reference this path ( C:\ProgramData\JAMS\ca-bundle.pem) in the next step.

3. Installing and Configuring mcp-remote​

Ensure you have mcp-remote installed and pin the installed version into your MCP configuration. You'll need a version number for the mcp-remote npm package, wherever you see <MCP-REMOTE-VERSION> in the configs below, substitute it.

A few options:

  • Use @latest (e.g. mcp-remote@latest) for a quick local trial. Npx will resolve to what is currently published.
  • Pick a recent version. Look at the npm page for mcp-remote, choose a recent stable release, try it locally end-to-end, and pin that exact version in your config.

4. Connecting an AI Client to JAMS​

The specific configuration steps differ by AI client. Pick the section below that matches your AI client.

In every example, replace:

The process is the same for all supported clients:

  1. Edit a config file for your AI client.
  2. Point the client to the JAMS MCP service at https://<your-gateway-host>/mcp.
  3. Sign in with your JAMS credentials. The AI client receives a token and caches it locally.
  4. Start working. From this point on, you can ask your AI tool questions about JAMS and it will call into the live system to answer them.

You do not paste an API key anywhere in this process. Authentication is interactive, browser-based, and tied to the same login you use in the JAMS Web Client.

Claude Code​

On native Windows, npx must be invoked through command line.

  1. Open the command prompt.
  2. Update and run the following command:
claude mcp add --transport stdio --scope user jams-mcp -e "NODE_EXTRA_CA_CERTS=C:\PROGRAMDATA\JAMS\ca-bundle.pem" 
-- cmd /c npx -y mcp-remote@0.1.38 https://gateway.example.com/mcp
  1. Restart Claude Code. The server appears in /mcp.

Claude Desktop​

  1. Edit the claude_desktop_config.json. Its location may vary based on your installation.
  2. Update and paste the following into the configuration file. Update <your-username> and the npx.cmd path if Node is installed somewhere else.
{
    "mcpServers": {
        "JAMS": {
            "command": "C:\\Program Files\\nodejs\\npx.cmd",
            "args": [
                "-y",
                "mcp-remote@<MCP-REMOTE-VERSION>",
                "https://gateway.example.com/mcp"
            ],
            "env": {
                "NODE_EXTRA_CA_CERTS": "C:\\ProgramData\\JAMS\\ca-bundle.pem",
                "APPDATA": "C:\\Users\\<your-username>\\AppData\\Roaming"
            }
        }
    }
}
  1. Save and close the file.
  2. Close Claude Desktop from the Windows system tray. It must be completely closed.
  3. Open PowerShell and run the following command for preauthentication:
warning

This will terminate all running Node.js processes on your machine.

taskkill /F /IM node.exe 2>$null
Remove-Item -Recurse -Force "$env:USERPROFILE\.mcp-auth" -ErrorAction SilentlyContinue
$env:NODE_EXTRA_CA_CERTS = "C:\ProgramData\JAMS\ca-bundle.pem"
npx -y mcp-remote@<MCP-REMOTE-VERSION> https://gateway.example.com/mcp
  1. Start Claude Desktop. It reuses the cached tokens and connects without prompting again.

Cursor​

  1. Open ~/.cursor/mcp.json or .cursor/mcp.json in your project root for project-scoped.
  2. Update and paste the following into the configuration file.
{
    "mcpServers": {
        "JAMS": {
            "command": "npx",
            "args": [
                "-y",
                "mcp-remote@<MCP-REMOTE-VERSION>",
                "https://gateway.example.com/mcp"
            ],
            "env": {
                "NODE_EXTRA_CA_CERTS": "C:\\ProgramData\\JAMS\\ca-bundle.pem"
            }
        }
    }
}
  1. Save and close the configuration file.
  2. Restart Cursor. JAMS will appear under Settings | MCP.

VS Code (GitHub Copilot)​

Ensure you have VS Code 1.101 or newer before starting this configuration.

  1. Open .vscode/mcp.json (workspace) or your user profile config.
  2. Note that the top-level key is servers, not mcpServers:
  3. Update and paste the following:
{
    "servers": {
        "JAMS": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "mcp-remote@<MCP-REMOTE-VERSION>",
                "https://gateway.example.com/mcp"
            ],
            "env": {
                "NODE_EXTRA_CA_CERTS": "C:\\ProgramData\\JAMS\\ca-bundle.pem"
            }
        }
    }
}
  1. Refresh MCP from the VS Code command palette.

5. Authenticating​

The first tool call from Claude Code, Cursor, or VS Code opens a browser tab pointing at the JAMS Web Client sign-in page. Sign in, the browser redirects back, and the connection is established. Tokens are cached locally and refreshed automatically. You generally won't need to sign in again unless your account is revoked or you upgrade mcp-remote to a new major version.

6. Submitting a Request​

In your client's chat window, ask something that exercises a JAMS tool. Examples:

  • "List my failed jobs from yesterday."
  • "Show me the source of the Nightly_DataLoad job."
  • "What folders contain jobs that run on the WIN-PROD-01 agent?"

Your client picks the appropriate MCP tool, the MCP server forwards it to the JAMS API as you (your permissions are honored), and the result comes back into chat.

7. Reviewing Guardrails​

The JAMS MCP server includes a content-redaction filter that scans tool output for sensitive substrings before it reaches the LLM. The server ships with a small built-in pattern pack enabled by default, so some high-value secret shapes (SSNs, cloud API keys, JWTs) are removed by default. Admins extend the shipped pack by authoring additional patterns in appsettings.json, or replace it entirely with a narrower site-specific list.

You can add your own patterns using Regex.

  1. Open C:\Program Files\JAMS\JAMS MCP\appsettings.json.
  2. Add one or more patterns to the CustomPatterns.
"Guardrails": {
  "Enabled": true,
  "DefaultRedactionMode": "Replace",
  "CustomPatterns": [
    {
      "Name": "customer-account",
      "Pattern": "CUSTACCT-\\d{8}"
    }
  ]
}
  1. Save the file. No restart is required.

After this change, any read tool that returns text containing CUSTACCT-74839201 will return <<REDACTED:customer-account>> to the LLM instead.