Open-source building blocks for the modern workplace — from the Terraform plan all the way down to the Win32 syscall.

macOS · Windows · Apple Business Manager · Jamf Pro · Jamf Protect · Intune / Microsoft 365 · Entra ID

Who it's for — Workplace and EUC platform teams who want to manage devices the way software teams ship code: versioned, tested, reviewed and automated.

We started with Terraform providers for Jamf Pro and Microsoft 365. Today we're a full-stack Go ecosystem for endpoint management, covering every layer between your pipeline and the operating system.

Device management has historically been written in whatever language the vendor shipped an SDK in (if one even exists). PowerShell here, Bash there, Swift or .Net when you need to touch the OS. This fragments tooling, testing and hiring. We picked one language and have gone all in.

• One static binary, covers every platform. Cross-compile from CI, ship a single artifact to macOS, Windows and Linux. No runtime, no interpreter, no dependency chain on the endpoint.

Status labels used throughout: production-ready, stable API  ·  usable now, API may still move  ·  early, spec-complete or lightly exercised

Pure-Go APFS, read and write, without a Mac. go-apfs-v2 mounts DMGs and raw images, unlocks FileVault volumes, and writes populated volumes, snapshots, volume groups and transparent compression. Validated against Apple's own fsck_apfs and hdiutil, plus Linux apfsck. Linux CI runners can now do work that previously demanded Apple hardware.

Pure-Go TPM 2.0. go-sdk-vtpm2 is a pure go software vTPM built from the TCG specification — measured boot, BitLocker sealing and attestation for Windows 11 guests. No swtpm, no C dependency.

Windows install media with zero external tooling. go-sdk-winmediafoundry acquires and builds Windows installation media with no wimlib, no DISM, no oscdimg and no cabextract. One binary, cross-platform.

The entire Win32 surface, typed and idiomatic. go-bindings-win32 generates Go for every function, struct, enum, constant and COM interface in Microsoft's win32metadata — hundreds of namespaces. WinRT, the WDK, WMI and the Windows App SDK follow the same pattern, all built on the shared go-winmd parser.

Windows CSPs as a typed API. go-sdk-windowscsp turns Microsoft's DDF v2 definitions into typed LCRUD operations with OMA-DM SyncML — the Configuration Service Provider surface, callable like any other Go package.

AI agents that can use Windows. windows-mcp-server bridges agents to the desktop through the Windows accessibility tree: UI automation, synthetic input, window control, PowerShell, registry, filesystem. No vision model in the loop.

Manage your modern workplace estate as version-controlled, peer-reviewed, pipeline-deployed code.

Repository	Reach for it when	Status
terraform-provider-jamfpro	The community Jamf Pro tf provider for classic and Jamf Pro APIs
terraform-provider-microsoft365	The community M365 tf provider for Graph v1.0 and beta APIs
terraform-provider-thousandeyes	You manage ThousandEyes network monitoring alongside the estate
terraform-plugin-framework-codegen	You're building your own provider and want the boilerplate generated

Learn and copy: terraform-training-jamfpro — hands-on Terraform + GitOps course for workplace engineers · terraform-demo-jamfpro-v2 — reference GitHub Actions + Terraform Cloud pipeline · terraform-demo-microsoft365 — reference GitLab branching + Terraform pipeline

Typed, idiomatic clients for the tools that run the modern workplace — the layer the providers and CLIs are built on.

Repository	Reach for it when	Status
go-sdk-jamfpro-v2	You're writing Go against Jamf Pro and want the full API surface — 700+ functions
go-sdk-jamfprotect	You're automating Jamf Protect endpoint security
go-sdk-appleservices	You need Apple enterprise services — ABM, DDM, MDM, notarization, iTunes
go-sdk-sofa	You need to know what Apple shipped, when, and which CVEs it closed
go-sdk-thousandeyes	You want the ThousandEyes v7 API with retries, throttling and pagination handled
go-sdk-workbrew	You manage Homebrew across a fleet
go-sdk-nexthink	You're pulling digital-experience telemetry into your own tooling
go-sdk-virustotal	You're screening binaries or hashes before they reach the fleet
go-sdk-cve	You need NVD CVE data in a vulnerability workflow
go-lib-winget-pkgs	You want WinGet package metadata from a local clone, with no API calls
go-api-http-client	You're building your own workplace API client and want auth, retries and rate limiting solved

_{Also: go-sdk-brew · go-sdk-chocolatey — package-manager SDKs.}

Idiomatic Go generated from vendor metadata — the whole OS API surface, typed and callable. This is the foundation for building native Windows and macOS applications in Go, work that normally requires C, Swift or .NET.

Repository	Reach for it when	Status
go-bindings-macosplatform	You need macOS frameworks from Go, over a purego/cgo Objective-C bridge
go-bindings-win32	You need any Win32 API — every function, struct, enum and COM interface, from win32metadata
go-bindings-winrt	You need modern Windows features — toasts, Bluetooth LE, Windows Hello, MDM/provisioning
go-bindings-wmi	You want typed WMI / CIM classes instead of hand-rolled COM plumbing
go-bindings-wdk	You're working against the Windows Driver Kit surface (Windows.Wdk.*)
go-bindings-windowsappsdk	You're building a modern Windows desktop app in Go
go-winmd	You're generating your own bindings — this is the shared metadata parser underneath all of the above

Where the bindings get used: filesystems, firmware, provisioning and install media.

Repository	Reach for it when	Status
go-apfs-v2	You need to read, mount or write APFS and HFS+ volumes without macOS
go-sdk-vtpm2	You need a software TPM 2.0 for measured boot, BitLocker sealing or attestation
go-sdk-winmediafoundry	You're acquiring or building Windows install media in a pipeline
go-sdk-windowscsp	You need typed Configuration Service Provider operations with OMA-DM SyncML
go-macos-sandbox	You need to run or inspect code under the macOS sandbox
go-appdeploymenttoolkit	You want PSADT-style app deployment without a PowerShell dependency
go-settings-catalog	You're working with the Intune settings catalog programmatically

Repository	Reach for it when	Status
windows-mcp-server	You want an AI agent to drive Windows through the accessibility tree — UI automation, input, registry, PowerShell, no vision model

• Everything as code : if it can be configured, it should be versioned, tested and automated
• Generated from source of truth : vendor metadata, not hand-transcribed docs that drift
• Cross-platform by default : macOS and Windows parity by design, never as an afterthought
• Built in the open : open source, community-first, minimal vendor gatekeeping

Built for the community, by the community. Mac admins, Windows endpoint engineers and DevOps practitioners all welcome.

• Discord — join the community server
• Slack — Mac Admins Slack, #terraform-provider-jamfpro
• Discussions — GitHub Discussions on each repository
• Issues & PRs — bug reports, feature requests and contributions welcome across every repo

Made with ❤️ by the Deployment Theory team