| name | contour |
| description | macOS MDM configuration toolkit. Generates and validates Apple configuration profiles, DDM declarations, MDM commands, Fleet GitOps output, Santa allowlists, and mSCP compliance artifacts from embedded Apple schema data. All output is auto-validated against 13,500+ Apple capability keys.
|
| allowed-tools | ["Bash","Read","Write"] |
contour
When to use
Activate when the user mentions:
- mobileconfig, configuration profile, MDM profile, payload
- Fleet policy, osquery query, compliance check, software install
- Santa, allowlist, blocklist, CEL, FAA
- mSCP, CIS, STIG, 800-53, security baseline
- DEP, ADE, enrollment, Setup Assistant
- DDM, declarative management, declaration
- Fleet GitOps, migrate, restructure
- osquery table, osquery column
Organization domain
Resolution order: --org flag → CONTOUR_ORG env var → .contour/config.toml → error.
In CI: set CONTOUR_ORG as a repository secret/variable.
Interactive: ask the user if not configured.
NEVER fall back to com.example.
Auto-validation
All generators auto-validate output against the embedded Apple schema.
Look for ✓ Schema validation passed or error/warning output after every generation.
No separate validate step needed — it is built in.
Step 1: Route to the right SOP
Run contour help-ai --sop <tool> to get the detailed workflow:
| User intent | SOP command |
|---|
| Fleet policy, osquery query, compliance check | contour help-ai --sop osquery |
| Software install, self-service, deployment | contour help-ai --sop osquery |
| Mobileconfig, configuration profile | contour help-ai --sop profile |
| MDM command (restart, lock, erase) | contour help-ai --sop profile |
| mSCP, CIS, STIG, 800-53 baseline | contour help-ai --sop mscp |
| DEP, enrollment, Setup Assistant | contour help-ai --sop enrollment |
| Fleet GitOps migration | contour help-ai --sop fleet-migrate |
| Santa rules, CEL, FAA | contour help-ai --sop santa |
| DDM declarations | contour help-ai --sop ddm |
| Rename display names, friendly naming, name.toml, reidentify | contour help-ai --sop profile-naming |
For the full routing table with examples, read references/sop-routing.md.
Step 2: Execute
contour profile search <keyword> --json # find payload types
contour profile generate <type> --full --org ORG # generate mobileconfig
contour profile command generate <cmd> --uuid # MDM command plist
contour profile command generate <cmd> --base64 # base64 for Fleet API
contour profile ddm generate <type> -o decl.json # DDM declaration
contour profile enrollment generate --interactive # DEP profile
contour profile synthesize <dir> --org ORG # managed prefs → mobileconfig
contour mscp schema search <keyword> --json # search compliance rules
contour mscp schema rule <id> --json # rule detail + payload
contour osquery search <keyword> --json # find osquery tables
contour osquery table <name> --json # full table schema
contour help-ai --sop <tool> # detailed SOP
Rules
- Commands use SPACES:
contour profile ddm info (NOT contour profile ddm.info)
- Dots are ONLY for help-ai:
contour help-ai --command profile.ddm.info
--json for machine-readable output--org <domain> on EVERY generate — never use com.example--dry-run to preview without writing--fragment for composable Fleet GitOps output--interactive for guided workflows (not available in CI)
Embedded data (offline, no network)
283 osquery tables · 13,500+ Apple MDM keys · 540 mSCP rules · 14 baselines · 71 skip keys · 200+ app schemas
