Generate production-ready Apple Configuration Profiles validated against the official device-management schema. Wi-Fi, VPN, restrictions, certificates. For MDM and Apple admins running Jamf Pro, Microsoft Intune, Kandji, Mosyle, or Apple Profile Manager.
Stop guessing payload keys and value types. Build profiles that are correct by construction.
Every key is checked against Apple's official YAML schema definitions — required fields, types, allowed values, and ranges. No more silent misconfigurations.
Schemas come from github.com/apple/device-management and are cached on your machine. A payload type Apple adds arrives with the next online fetch. Keys Apple changes inside a file that is already cached arrive when you run fetch_schema.py --refresh, because the cache has no expiry.
Sign profiles with your X.509 certificate for production MDM deployment, from PEM files through OpenSSL or from an identity in the macOS keychain, where the private key never leaves it. The device shows a profile as verified once it trusts the signing CA; the install prompt stays either way. Unsigned belongs on your own test devices and nowhere else.
Combine Wi-Fi, restrictions, certificates, and more in a single profile — the Apple-standard way. Each payload gets its own deterministic UUID.
Once schemas are cached locally, the entire workflow runs offline. Perfect for air-gapped environments or CI/CD pipelines.
Same input always produces the same UUIDs and output, so a rebuild is byte-identical and re-deploying does not change device state. The profile itself stays out of version control: it holds every password in clear text, which is why the repository ships a .gitignore that blocks *.mobileconfig and a tools/scan_secrets.py that fails CI when one gets committed anyway.
Three scripts, one clean workflow. Run them yourself in a terminal, or let Claude drive them: SKILL.md in the repository turns the same scripts into a Claude skill that asks for platform, payload type, and required keys, then builds the profile.
Download every Apple profile schema from the official repository. Cached locally for offline use. fetch_schema.py --list prints how many payload types the current schema set defines.
Explore available payload types, check required keys and allowed values, then write your spec file.
Generate the .mobileconfig with strict validation. Optionally sign it for production deployment.
Push via MDM, share over AirDrop, or install manually. The profile is ready for any deployment method.
Clone the repository or take the release archive. Both give you the same scripts.
# Get it: clone the repository ... git clone https://github.com/GodModeAI2025/mobileconfig-builder.git # ... or download the release archive (SKILL.md, references/, scripts/, assets/, evals/) # The link points at the newest published release, so it 404s until there is one. curl -LO https://github.com/GodModeAI2025/mobileconfig-builder/releases/latest/download/mobileconfig-builder.zip # Fetch Apple's official profile schemas python3 scripts/fetch_schema.py # See what keys a Wi-Fi profile needs python3 scripts/inspect_payload.py com.apple.wifi.managed --os macOS --required-only # Build a profile from a spec file python3 scripts/build_mobileconfig.py assets/examples/wifi_guest.json \ -o guest-wifi.mobileconfig \ --validate-strict # Output: Unsigned profile written to guest-wifi.mobileconfig # Optional: sign for production, from PEM files python3 scripts/build_mobileconfig.py assets/examples/wifi_guest.json \ -o guest-wifi.mobileconfig \ --sign-cert cert.pem --sign-key key.pem # ... or from a macOS keychain identity, key stays in the keychain security find-identity -v -p smime python3 scripts/build_mobileconfig.py assets/examples/wifi_guest.json \ -o guest-wifi.mobileconfig \ --sign-identity "Profile Signer 2026"
Simple JSON input — the builder handles the rest.
// assets/examples/classroom_ipad.json { "meta": { "PayloadIdentifier": "com.example.classroom.ipad", "PayloadDisplayName": "Classroom iPad Profile", "PayloadDescription": "Wi-Fi + restrictions for student iPads", "PayloadOrganization": "Example School" }, "payloads": [ { "PayloadType": "com.apple.wifi.managed", "SSID_STR": "School-Net", "EncryptionType": "WPA2", "AutoJoin": true }, { "PayloadType": "com.apple.applicationaccess", "allowAppInstallation": false, "allowExplicitContent": false, "allowInAppPurchases": false } ] }
Every payload type in Apple's schema validates and builds. The exact count changes with each Apple update, so ask fetch_schema.py --list for it. Payloads with a <data> key, certificates above all, take their bytes from {"__base64__": "..."} or {"__file__": "ca.der"} in a JSON spec, or from the !!binary tag in YAML. A bare base64 string is still a string: with --validate-strict the build exits with code 2 and writes nothing, without that flag it writes the value as a <string> where the schema expects <data>. Here are the most common ones.
| Use Case | PayloadType |
|---|---|
| Wi-Fi | com.apple.wifi.managed |
| VPN | com.apple.vpn.managed |
| Mail Account | com.apple.mail.managed |
| Exchange ActiveSync | com.apple.eas.account |
| Restrictions (iOS/iPadOS) | com.apple.applicationaccess |
| Restrictions (macOS) | com.apple.applicationaccess.new |
| Certificate (PKCS#12) | com.apple.security.pkcs12 |
| FileVault | com.apple.MCX.FileVault2 |
| Software Update | com.apple.SoftwareUpdate |
| Privacy / TCC Permissions | com.apple.TCC.configuration-profile-policy |
Built profiles work with every Apple deployment method.
Import directly into Jamf Pro, Kandji, Mosyle, Microsoft Intune, or Apple Profile Manager for fleet-wide deployment.
Load profiles onto devices via USB using Apple Configurator 2 for supervised device setup and provisioning.
Share via AirDrop, email, or web download. Users install with a few taps in Settings (iOS) or System Settings (macOS).