Privacy and Security

Privacy and Security

Approving Magic Toolbox for your organisation? The Security FAQ has detailed answers for security teams.

At a glance

• Magic Toolbox is a sandboxed macOS app.
• It connects to the Jamf Pro servers you enter, to the MDM Magic licence server, to download links your Jamf Pro server gives it (packages and icons), and to the endpoints Network Check tests.
• Credentials are kept in the macOS Keychain, and only when you choose to save them. They never sync to other devices.
• There is no analytics or telemetry. Nothing about your Jamf data is sent to MDM Magic.

Network connections

Destination	When	What is sent
Your Jamf Pro server(s)	When you connect in a tool	Your credentials (to get an access token) and the API requests the tool needs
MDM Magic licence server (magictoolboxlicenses.mdmmagic.workers.dev, on Cloudflare Workers)	Activation, deactivation, at app launch when the licence token is due for renewal, every 6 hours while the app runs, and when you switch back to the app (at most every 15 minutes). Not during the trial	Your licence key and a random ID the app creates for this Mac, which links the licence to this Mac. No serial number or other hardware ID is sent
Package download links from Jamf Pro	Downloader, when you download a package	A request for the package. No Jamf token is sent
Icon links from Jamf Pro	Icons and Clone	Requests to download the images, over HTTPS only. The Jamf access token is only attached when the link points to your Jamf Pro server itself, never to other hosts
Endpoints you test	Network Check, when you click Run Scan	A TCP connection that's closed as soon as it opens, or a single UDP packet. No data is sent
Apple's certificate servers	Inspector, when it verifies a package signature	macOS may check whether the signing certificate has been revoked

If your network uses a firewall or proxy allow-list, allow outbound HTTPS to your Jamf Pro servers, to magictoolboxlicenses.mdmmagic.workers.dev (licensing), and to the hosts your Jamf Pro package and icon links point to (Downloader, Clone and Icons).

Access tokens are requested for each step and revoked on Jamf Pro when the step finishes, so they can't be reused. If Jamf Pro redirects a request to another host, the token is removed from the redirected request. See Are API tokens destroyed after use?

What is stored on your Mac

Data	Where
Jamf credentials you choose to save (per tool or as a Saved Server)	macOS Keychain, this Mac only. A tool that uses a Saved Server stores a link to it, not a second copy of the secret
Tool Lock PIN	macOS Keychain, as a SHA-256 hash, not the PIN itself
Saved Server names, URLs, usernames and Client IDs	App preferences, inside the app's sandbox container
Licence key, activation token, this Mac's random licence ID, trial start date and offline grace period	macOS Keychain, tied to this Mac
Preferences, reviewed conflicts, which tools are locked, your chosen signing certificate (a reference to it, not the certificate) and the MDM Reporting Tool's bundle ID	App preferences
Journals from Clone, Wipe, Disable, Restore and Unused	Next to the backup file, or in your Downloads folder, or in the app's container (MagicToolbox/Journals)
Login Item Profiles rule sets	The app's sandbox container (~/Library/Containers/au.mdmmagic.MagicToolbox)
Icons downloaded during an Icons scan	A temporary folder in the app's sandbox container, deleted when you click Scan Again, leave the tool or quit
Debug logs	Memory only (up to 5,000 entries), cleared when the app quits

Files you create

Exported files are only written where you choose in a save or folder dialog. Take care with these:

• Wipe backups (.json) contain the full configuration of every object on the server: scripts, policies, profiles, extension attributes, API roles and more. They're encrypted with the passphrase you choose in Wipe. Restore needs the same passphrase and rejects a file that's been changed. Use a long passphrase and keep the file somewhere safe.
• Unused backups (.json) are saved before Unused deletes anything. They hold the full records of the deleted items, encrypted with the passphrase you enter when deleting, the same way as Wipe backups.
• Clone backups (.json) hold the full records of destination objects Clone overwrote, and Disable undo backups (.json) hold the original scope and enabled state of everything Disable changed. Both are encrypted the same way.
• All backups need a passphrase of at least 12 characters, are readable only by your user account (0600), and are read back and checked before anything is changed.
• Journals (.log) are plain text. They list the server, and the name, ID and outcome of every object a run changed, but no object contents or credentials.
• Signed and unsigned profiles from Profile Signer and Profile Unsigner. An unsigned profile is plain XML, so any secrets in it are readable.
• Web Content Filter profiles with a server Password filled in store it as plain text in the .mobileconfig. The password is hidden on screen as you type it.
• HTML reports contain server names and object names. Check them before sharing outside your organisation.

HTTPS only

Every connection uses HTTPS. If you type an http:// address, in a tool or under Saved Servers, the app changes it to https://. macOS's App Transport Security is left at its defaults, so TLS 1.2 or later and a trusted certificate are required.

Least privilege

Use separate API clients with tightly limited roles for each job. See Jamf API Permissions → Suggested roles. Keep Delete privileges off accounts that can reach production.