contour

name	contour
description	macOS MDM configuration toolkit. Generates and validates Apple configuration profiles, DDM declarations, MDM commands, Fleet GitOps output, Santa allowlists, and mSCP compliance artifacts from embedded Apple schema data. All output is auto-validated against 13,500+ Apple capability keys.
allowed-tools	["Bash","Read","Write"]

contour

When to use

Activate when the user mentions:

• mobileconfig, configuration profile, MDM profile, payload
• Fleet policy, osquery query, compliance check, software install
• Santa, allowlist, blocklist, CEL, FAA
• mSCP, CIS, STIG, 800-53, security baseline
• DEP, ADE, enrollment, Setup Assistant
• DDM, declarative management, declaration
• Fleet GitOps, migrate, restructure
• osquery table, osquery column

Organization domain

Resolution order: --org flag → CONTOUR_ORG env var → .contour/config.toml → error. In CI: set CONTOUR_ORG as a repository secret/variable. Interactive: ask the user if not configured. NEVER fall back to com.example.

Auto-validation

All generators auto-validate output against the embedded Apple schema. Look for ✓ Schema validation passed or error/warning output after every generation. No separate validate step needed — it is built in.

Step 1: Route to the right SOP

Run contour help-ai --sop <tool> to get the detailed workflow:

User intent	SOP command
Fleet policy, osquery query, compliance check	contour help-ai --sop osquery
Software install, self-service, deployment	contour help-ai --sop osquery
Mobileconfig, configuration profile	contour help-ai --sop profile
MDM command (restart, lock, erase)	contour help-ai --sop profile
mSCP, CIS, STIG, 800-53 baseline	contour help-ai --sop mscp
DEP, enrollment, Setup Assistant	contour help-ai --sop enrollment
Fleet GitOps migration	contour help-ai --sop fleet-migrate
Santa rules, CEL, FAA	contour help-ai --sop santa
DDM declarations	contour help-ai --sop ddm
Rename display names, friendly naming, name.toml, reidentify	contour help-ai --sop profile-naming

For the full routing table with examples, read references/sop-routing.md.

Step 2: Execute

contour profile search <keyword> --json          # find payload types
contour profile generate <type> --full --org ORG  # generate mobileconfig
contour profile command generate <cmd> --uuid    # MDM command plist
contour profile command generate <cmd> --base64  # base64 for Fleet API
contour profile ddm generate <type> -o decl.json # DDM declaration
contour profile enrollment generate --interactive # DEP profile
contour profile synthesize <dir> --org ORG       # managed prefs → mobileconfig
contour mscp schema search <keyword> --json      # search compliance rules
contour mscp schema rule <id> --json             # rule detail + payload
contour osquery search <keyword> --json          # find osquery tables
contour osquery table <name> --json              # full table schema
contour help-ai --sop <tool>                     # detailed SOP

Rules

• Commands use SPACES: contour profile ddm info (NOT contour profile ddm.info)
• Dots are ONLY for help-ai: contour help-ai --command profile.ddm.info
• --json for machine-readable output
• --org <domain> on EVERY generate — never use com.example
• --dry-run to preview without writing
• --fragment for composable Fleet GitOps output
• --interactive for guided workflows (not available in CI)

Embedded data (offline, no network)

283 osquery tables · 13,500+ Apple MDM keys · 540 mSCP rules · 14 baselines · 71 skip keys · 200+ app schemas