Magic Toolbox v1.0.3

Magic Toolbox 1.0.3

A redesigned Home screen, three new tools, a PIN lock for sensitive tools, and much safer write operations across Clone, Wipe, Disable and Restore.

Highlights

• Redesigned Home screen. The 21 tools are grouped into four categories you open with a click: Jamf Pro Tools, Audit & Health Check, Profile Builders and Content & Packages, each showing how many tools it holds. Saved Servers sit just above them, and a new tile opens the MDM Reporting Tool. If a tool is still writing to Jamf Pro in the background, a banner says so and the other tools wait until it finishes.
• Three new tools
  • Network Check tests whether this Mac can reach the endpoints Jamf, Apple, Microsoft, Google, Okta, CrowdStrike, Zoom and Slack need, plus any hosts you add. Export the results as HTML.
  • Profile Signer signs .mobileconfig profiles and .pkg installers with a certificate from your keychain.
  • Profile Unsigner removes the signature from profiles and packages so you can read and edit them.
• Tool Lock. Require a PIN before chosen tools (Wipe, for example) can be opened.
• Undo for every write tool. Clone backs up destination objects before overwriting them, Disable saves an undo backup, Wipe has a dry run, and Restore can now write objects back in place.
• Honest results. When something can't be read from Jamf Pro, the audit tools say the results are incomplete instead of reporting an all-clear.

New

• The MDM Reporting Tool tile opens the app, or its web page if it isn't installed. Set it up, or hide the tile, in Preferences → Third-Party Tools.
• Preferences → Profile Signing Certificate picks the certificate Profile Signer uses.
• Clone, Wipe, Disable, Restore and Unused deletes write a journal of every change as it happens, so there's a record even if the app is force-quit.

Safer changes to Jamf Pro

Clone

• Asks for a passphrase and saves an encrypted, verified backup of every destination object before overwriting it. Open it in Restore to put the old objects back.
• Clone Scope never widens a scope. Missing target groups are left out, and a missing exclusion or limitation fails the object instead.
• Existing destination objects keep their scope when you choose No Scope.
• References to categories, scripts, packages and so on are matched by name on the destination, never by the source's IDs.
• New option: Create static groups without members.

Disable

• Saves an encrypted undo backup of the original enabled state and scope first. Undo from backup… puts it all back.
• Warns that removing scope uninstalls profiles and apps from devices.
• Won't disable the account you're signed in with, or an account whose status can't be read.

Wipe

• Dry run shows exactly what would be deleted, in order, without deleting anything.
• Deleting needs the server's host name typed to confirm.
• Your own session's credentials are skipped unless you choose to delete them last.
• Items that can't be restored need a separate acknowledgement, or can be excluded in one click.
• Selecting a group no longer deletes the policies scoped to it. They're listed as related items you can opt in to.

Restore

• New Update existing objects mode writes backed-up objects over live ones.
• Opens Clone backups, re-links restored objects to each other's new IDs, and has an Abort button.

All backups need a passphrase of at least 12 characters, are readable only by your user account, and are read back and checked before anything changes.

Improved

Audit tools

• Unused: new matching rules (PreStages, patch titles, printers, criteria and more), deletion is blocked for incomplete categories, and references are re-checked just before deleting.
• Account Audit: covers local and LDAP account groups, and flags custom privilege sets with critical privileges.
• Cert & Token Expiry: adds the active CA certificate's expiry.
• Smart Group Audit: takes OR and parentheses into account, and has no limit on how many groups it audits.
• Profile Conflicts: rewritten detection. macOS and iOS profiles are compared separately, Wi-Fi, VPN and certificates are compared per network or certificate, different-group scopes are flagged as a possible overlap, and secrets are redacted.

Profile builders

• Uploads ask before overwriting a profile with the same name.
• Generated profiles get stable identifiers, so re-uploading updates the profile on devices instead of adding a second one.
• PPPC Analyser: User Can Allow for Screen Recording and Input Monitoring, manual code requirements for apps from a .pkg, an Apple Events receiver picker, and warnings before a profile blocks camera, microphone or screen sharing.
• System Extensions: accepts .dext, writes every type an extension has, and asks you to confirm a Team ID taken from an installer.
• Login Item Profiles: finds helpers and launch items inside apps, and is Allow-only to match Apple's payload.
• Web Content Filter: saving follows the same validation as uploading.

Everything else

• Inspector now verifies package and app signatures, shows the Distribution XML, and has new review findings.
• Compare evaluates building, department and network segment scope, and can ignore case when comparing servers.
• Icons shows the policy's name and asks you to confirm before attaching an icon.
• Downloader no longer overwrites files with the same name.
• The app asks before you quit or close the window while a tool is writing to Jamf Pro.
• Saved servers can be reordered, and tools store a link to a saved server rather than a copy of its secret.
• Throttled requests are retried automatically, and sign-in errors show what Jamf Pro actually returned.
• Licences are re-checked every 6 hours while the app runs. After the offline grace period the licence key is kept, so it comes back as soon as the app is online again.

Before you upgrade

• Login Item Profiles rules set to Deny or Ask are dropped, because Apple's payload only supports Allow.
• The Web Content Filter Identity certificate field has been removed.
• Saved Jamf credentials are now only readable while the Mac is unlocked.
• Inspector may contact Apple to check whether a package's signing certificate has been revoked.

Full documentation: Magic Toolbox wiki

Magic Toolbox v1.0.2

New Tools

Profile Signer
Sign .mobileconfig profiles and .pkg packages with your local code-signing certificate. Profiles are processed entirely on-device and never sent to a remote server. Select your signing certificate in Preferences.

Profile Unsigner
Strip CMS signing from .mobileconfig profiles and .pkg packages. Useful for editing locked profiles before re-signing. Also fully local.

Network Check
Test firewall connectivity to Jamf, Apple, Microsoft, and Google services in one click. Runs TCP/UDP reachability checks from this Mac against all required endpoints and shows pass/fail/latency per result. Add custom hosts alongside the built-in catalog. Results can be exported as an HTML report.

⸻

New Features

MDM Reporting Tool tile
The home screen now includes a tile for the MDM Reporting Tool. If you have it installed, point Magic Toolbox at it in Preferences → Third-Party Tools and the tile will launch it directly. If it isn't configured or can't be found, the tile opens mdmmagic.au/tools instead. The tile can be hidden from the same Preferences section if you'd prefer a cleaner home screen.

⸻

Improvements

PKG Inspector — Security hardening
The inspector now treats all data read from a package as untrusted. Numeric fields are parsed as unsigned integers, every offset and size is overflow-checked against the file bounds, loop iterations are capped, and decompression is streamed with a hard 512 MB output limit. Script content is now scanned for suspicious patterns and flagged inline.

Compare — Race condition fix
A scan token is now attached to each scan run. Results from a cancelled or stale scan can no longer overwrite state from a newer one. Case-insensitive name matching has also been added, and keychain save failures are now surfaced as an error rather than being silently dropped.

Operation safety lock
Tool switching and window close are now blocked while a write or destructive operation is in progress. Attempting either will prompt for confirmation, preventing operations from being torn down mid-run.

⸻

Bug Fixes

• Fixed unused SecTrustEvaluateWithError result in Profile Signer causing a compiler warning
• Fixed Swift 6 concurrency data race on the connection resume flag in Network Check

Magic Toolbox v1.0.1

This release is the result of a full internal security audit of Magic Toolbox, alongside two new tools and a long list of reliability fixes across almost every tool in the app.

New features

• Profile Signer – Sign .mobileconfig configuration profiles locally using a code-signing certificate from your keychain.
• Profile Unsigner – Strip the signature from a signed .mobileconfig, producing a plain, editable profile.
• MDM Reporting Tool launcher – A new Home screen tile for quick access to the companion MDM Reporting Tool app, configurable from Preferences.
• Wipe: Dry Run mode – Preview the full deletion plan and report before anything is actually deleted.
• Disable: Undo – Revert a Disable run from its automatically created backup.
• Clone: pre-overwrite backups – Destination objects are saved to an encrypted backup before they are overwritten.
• Restore: "Update existing objects" mode – Restore from the pre-overwrite backups that Clone now creates, updating the existing objects in place.
• Clone: "Select/Deselect Matching" – Quickly select or deselect all currently filtered results.
• Compare: case-insensitive name matching – Optional when comparing objects across multiple instances.
• Account Audit: account groups – Now covers groups, including directory/LDAP groups that grant admin access to all their members, not just individual accounts.
• New Preferences sections – Choose which certificate Profile Signer uses, and configure the location of the MDM Reporting Tool app.
• Safer app exit – If you try to quit or close the window while a destructive operation (Wipe, Disable, Restore, etc.) is still running, Magic Toolbox now asks whether to keep it running or close anyway, instead of killing it silently.

Security fixes

Credential and licence handling

• Saved Jamf credentials in the Keychain now require the Mac to be unlocked for every read, and deleting a saved server cleans up every copy of its credentials instead of leaving stale copies behind.
• Credential forms now only write to the Keychain when you explicitly save, rather than on every keystroke.
• Licence checks no longer use your Mac's hardware serial number as an identifier, now re-validate automatically every few hours instead of only at launch, and can no longer be bypassed by rolling back the system clock. The licence server now also rate-limits and validates incoming requests.
• Your Jamf API session token is no longer forwarded if a request is redirected to a different host, and is only attached to secondary downloads (like icons) when going back to your own Jamf server over HTTPS.

Destructive operations (Wipe, Unused, Clone, Disable, Restore)

• Encrypted backups are now verified by decrypting them immediately after they're written, before any deletion or change proceeds.
• Wipe, Unused and Disable now detect and protect the Jamf account or API client your current session is using, so you can't accidentally disable or delete the credentials you're working with.
• Items that couldn't be read are now treated as "do not touch" rather than assumed safe to delete, and destructive bulk actions require typed, name-matched confirmation.
• XML responses from Jamf are now parsed with external entity loading disabled, closing an XXE injection path.

File and data handling

• Inspector now performs real cryptographic signature verification on packages instead of just detecting that a signature block is present. It also enforces limits to block "zip-bomb" style packages, blocks path-traversal ("zip-slip") entries on export, and no longer follows symlinks or opens special files outside an inspected app bundle.
• Downloader now keeps downloaded files confined to the folder you chose.
• Filenames used in uploads and downloads are sanitised to prevent header injection.
• Exported CSV reports are now escaped against formula/CSV injection, and HTML reports ship with a Content-Security-Policy and stricter escaping.
• PPPC profile generation is now blocked if it would embed a missing or placeholder code signature.

Information exposure

• Sensitive values (API/SSO tokens, pre-shared keys, certificates) are now masked in Profile Conflicts results and exported reports.
• The in-app debug log now redacts a wider range of secrets (Basic auth, JWTs, licence keys, OAuth tokens).

Improvements

• Wipe, Unused, Clone, Disable and Restore now keep a persistent, crash-surviving action log, visible from the results screen.
• Pagination fixes mean large Jamf instances are no longer silently truncated in several audit and report tools.
• Partially successful scans and exports now clearly show "Incomplete" instead of silently reporting clean.
• Several scanners now run off the main thread for a more responsive UI.
• Backup passphrases now require a minimum length and confirmation, with a strength meter.
• The About screen shows your actual installed version and build instead of a hardcoded "1.0".

Bug fixes

• Config Profile Conflicts – Profiles that failed to load are no longer treated as conflict-free; Mac and mobile profiles sharing an ID are no longer confused.

Magic Toolbox v1.0.0

Warning

Licence purchasing is not available at the moment, but will be in the near future. If you would like a licence, email info@mdmmagic.au to be notified once purchasing becomes available. In the meantime, every new install includes a 72-hour free trial with all features unlocked.

Magic Toolbox 1.0 — first public release

An all-in-one Jamf Pro admin suite: eighteen tools in one native macOS window.

What's included

• Across servers: Clone, Compare (computers, mobile devices or 2–4 instances), Wipe, Restore, Disable
• Audits and health checks: Profile Conflicts, Smart Group Audit, Account Audit, Cert & Token Expiry, Unused
• Profile builders: PPPC Analyser (with macOS 27+ AppSettings export), System Extensions, Web Content Filter, Notifications, Login Item Profiles
• Content and packages: Inspector (fully offline .pkg/.app analysis), Downloader, Icons

Also

• Save servers once and use them in every tool. Secrets are kept in the macOS Keychain
• Every tool checks your Jamf Pro privileges before it starts
• Branded, self-contained HTML reports, plus CSV and .mobileconfig output where relevant
• Wipe and Unused save a passphrase-encrypted backup before deleting anything
• Sandboxed: the app only reads or writes files you choose

⚠️ Clone, Wipe, Unused and Disable change Jamf Pro. Try them on a test server first.

Install

1. Download the .pkg installer below.
2. Double-click it and follow the installer. You'll need an administrator password.
3. Launch Magic Toolbox from /Applications.

To deploy it to a fleet, upload the package to Jamf Pro and deploy it like any other package, or run sudo installer -pkg /path/to/package.pkg -target /.

Signed by MDM Magic and notarised by Apple, so it installs without any Gatekeeper warnings. Requires macOS 15 Sequoia or later.

📖 Documentation