Skip to main content

JAMS MCP Overview

MCP stands for Model Context Protocol which is an open standard that lets AI assistants connect to business systems and retrieve live data, rather than relying solely on what they were trained on. Think of it as a structured bridge between the AI tool you already use and the products that run your environment.

JAMS ships its own MCP service that lets a user connect their AI tool to JAMS through MCP, so they can ask questions like:

  • "Show me all Jobs that failed overnight in the Finance folder."
  • "What does the Daily_Posting_NIGHTLY Job actually do?"
  • "What's currently running on the Production Agent?"

The AI tool calls into JAMS, retrieves the real data, and answers it. The result is a conversational layer on top of the same information already available in the JAMS Web Client.

The JAMS MCP service runs on your JAMS Web Client, inside your network. JAMS does not operate a cloud-hosted MCP endpoint. Your data stays on your infrastructure, and what any LLM provider receives depends on how you have configured your AI tool. JAMS MCP is designed for people who already use an AI coding or chat assistant in their daily work and would benefit from that assistant having live context about what JAMS is doing.

Supported AI Clients​

  • Claude Code (CLI)
  • Claude Desktop
  • Cursor
  • VS Code (GitHub Copilot)

Authentication and Identity​

Authentication to JAMS through JAMS MCP uses the same standard protocol as the JAMS Web Client: OAuth 2.0 / OpenID Connect. When you connect your AI tool, a JAMS sign-in page opens in your browser. You sign in once, and your AI client stores the resulting token locally. Token refresh happens automatically in the background. You will not be prompted to sign in again unless your JAMS account is revoked, you manually clear your AI client's MCP state, or you upgrade the bridge utility to a new major version.

The AI assistant sees exactly what you see in JAMS. Your existing JAMS roles and folder permissions apply to every call made through JAMS MCP. If you cannot see a particular folder or Job in the JAMS Web Client, your AI tool cannot see it through JAMS MCP either.

There is no shared or service-account mode. Each user signs in as themselves. An AI tool cannot be given a standing key that bypasses individual authentication. This means that if a team member leaves and their JAMS account is disabled, their AI tool loses JAMS access automatically on its next call. No additional cleanup step is required.

Write Actions and Approvals​

Most JAMS MCP tools are read-only. They execute immediately when your AI client requests them and return data for the AI to use in its answer. No approval step is needed for read operations.

A small number of tools make changes to JAMS. Today these are: submitting a Job, creating a Folder, and remediating a monitor entry (hold, release, reschedule, or cancel it). There are no bulk operations, and no tool edits or deletes a Job, Folder, schedule, or Agent definition.

JAMS flags every write tool as a write action (and marks Cancel as destructive) so your AI client can warn you before it runs. Whether you are prompted to approve, for either reads or writes, is governed by your AI client's settings, not enforced by JAMS. The major clients (Claude, Cursor, VS Code) prompt before running any tool by default.

Data Security​

When your AI tool calls a JAMS MCP tool, the result travels from JAMS back to your AI client. What happens next depends entirely on how your AI client is configured, specifically, which LLM provider it is pointed at. If your team uses a cloud-hosted LLM such as those provided by Anthropic, OpenAI, or Microsoft, tool results are sent to that provider as part of the conversation. If your AI client is configured against a locally-hosted model, data stays within your network.

Additional Items​

  • Stateless, multi-node capable. The JAMS MCP service is stateless. A single-node JAMS Web Client deployment runs one JAMS MCP instance; a multi-node deployment runs one MCP instance per JAMS Web Client node, with the Gateway load-balancing across them - the same model the other JAMS Web Client services use. You install one JAMS MCP per JAMS Web Client node, not one per Scheduler.
  • Per-user authentication required. There is no service-account or shared-credential mode. Every user must sign in as themselves. Each user must have their own JAMS account. If a user has their JAMS account revoked, the AI client loses access on the next call. To block JAMS MCP for a user, disable or revoke their JAMS account (or its token) in Identity. Because MCP uses the same login and the same API as the JAMS Web Client, removing a user's JAMS access removes their MCP access at the same time.
  • Load balancer ready. The JAMS MCP server can be used with a load balancer.
  • Corporate network or VPN required. The JAMS gateway is assumed to be reachable only from the internal network. JAMS MCP is not designed for public-internet exposure.
  • First-time sign-in requires an interactive browser. The initial OAuth flow opens a browser on the user's machine. AI clients running on headless or remote servers cannot complete this flow without additional configuration.
  • No shared conversation history. Each AI client maintains its own context. JAMS does not persist or replay MCP conversation history across sessions or clients.