How to use the JumpServer Bastion CLI Harness agent skill

What the skill lets the agent do

The skill wraps the JumpServer REST API in a stateful CLI harness. It covers asset, user, permission, account, session, audit, and operations management. Commands are grouped by area, such as auth, asset, user, perm, account, session, audit, ops, system, label, and role.

The harness supports one-shot commands and an interactive REPL mode. It keeps a stored session token between commands, so the agent does not need to log in again for each step.

• Log in, check status, switch organizations, and log out (auth group)
• List, get, create, update, and delete assets and asset nodes
• Create and manage users, user groups, and roles
• List and manage asset permissions and the assets they authorize
• View and create asset accounts, view secrets and password change history
• List and view terminal sessions and replays, kill active sessions, review command history
• Read login, operation, FTP, password, and activity audit logs

Install the skill

Download the skill ZIP from this page. Then choose one of the two install routes below.

For a personal install, unzip the file into ~/.claude/skills/. For a project-only install, unzip it into the .claude/skills/ folder inside your project. Claude Code will then find the skill as a folder containing SKILL.md.

To use the skill in the Claude apps instead, upload the ZIP under Settings → Capabilities → Skills.

• Personal: unzip into ~/.claude/skills/
• Project: unzip into .claude/skills/ in the project root
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

Install the Python harness

The skill calls a Python package named cli-anything-jumpserver. The SKILL.md quick start installs it from the agent-harness folder of the source repository in editable mode. The file does not list the exact dependencies, so check the package files if the install fails.

You need Python available on your machine and a network path to your JumpServer instance.

Connect to your JumpServer bastion

Authenticate first. The login command takes the JumpServer URL and your credentials and stores a session token for later commands. Use an account with appropriate roles for the tasks you want the agent to perform.

The login command also accepts an --org option for choosing an organization and an --insecure option. Check status at any time to confirm the session is still active, and run logout to clear it.

• Use --org to select an organization when your deployment has several
• Run auth status before a batch of work to confirm the stored session is valid
• Run auth logout when you are finished

Trigger the skill with natural requests

You do not need to type commands yourself. Ask the agent in plain language and name the JumpServer task. The agent can then choose the right command group. Good requests name the object, the action, and the scope, for example which asset type, user, or time window.

For any change, ask for a dry run first. The create, update, and delete commands accept a --dry-run option, and the create and update commands for users, permissions, and accounts also accept it. Review the dry-run output before asking for the real change.

• "List the database assets on the production node that are inactive."
• "Show me the login audit logs for user alice from the last week."
• "Dry-run creating a user named bob with the auditor role, then show me the result."
• "List the active sessions on asset web-01 and show command history for them."

Safety notes before you use it

The skill runs scripts and uses the network. It talks only to the JumpServer instance you log in to, but it can change that system. Commands can create, update, and delete assets, users, permissions, and accounts. The kill command ends an active session.

The account secret view command returns account passwords. If agents must never see passwords, do not give this skill access to that environment. Use a test JumpServer for trial runs, and keep a human in the loop for any change to a production bastion.

• Use a non-production JumpServer for your first tests
• Always run --dry-run on create, update, and delete commands
• Keep a human review step before any kill, delete, or secret view
• Use an account with the minimum roles needed for the task
• Avoid unattended runs on production bastions

Tips for better results

Keep the session token in mind. Because the harness stores it between commands, a long session may expire, so re-run auth status if commands start failing. Use the --limit and --offset options on list commands when you expect many results, and use --search or type filters to narrow the output.

Interactive REPL mode suits exploratory work, where you ask follow-up questions about the same data. One-shot commands suit repeatable checks and are easier to review afterwards.

• Narrow lists with --search, --type, --user, or --asset to keep output readable
• Use --limit and --offset to page through large result sets
• Use the session commands with --active or --finished to separate live and past sessions
• Use REPL mode for exploration and one-shot commands for repeatable tasks