About io.github.ExpertVagabond/ibmz
io.github.ExpertVagabond/ibmz is an MCP server published by ExpertVagabond in the Developer Tools category: iBM Z mainframe MCP server - Key Protect HSM & z/OS.
Recent commit activity is the strongest signal that reported issues will get attention.
Install
claude mcp add io-github-expertvagabond-ibmz -- npx -y ibmz-mcp-servernpx -y ibmz-mcp-serverThis server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.
Tools (8)
key_protect_create_keyCreate root or standard keys
Parameters not published.
key_protect_delete_keyDelete a key (irreversible)
Parameters not published.
key_protect_get_keyGet key details and metadata
Parameters not published.
key_protect_get_key_policiesGet rotation and dual-auth policies
Parameters not published.
key_protect_list_keysList encryption keys in Key Protect
Parameters not published.
key_protect_rotate_keyRotate a root key
Parameters not published.
key_protect_unwrap_keyUnwrap (decrypt) a wrapped DEK
Parameters not published.
key_protect_wrap_keyWrap (encrypt) a DEK with a root key
Parameters not published.
Ask AI
Ask AI about io.github.ExpertVagabond/ibmz
Powered by Claude · Grounded in docs
Security checks
- ✓README presentThe repository ships documentation.
5 checks have not been run yet.
README
ibmz-mcp-server
[!License: MIT](https://opensource.org/licenses/MIT) [!MCP](https://modelcontextprotocol.io) [!npm](https://www.npmjs.com/package/ibmz-mcp-server)
MCP server for IBM Z mainframe integration. Provides HSM-backed key management via IBM Key Protect (FIPS 140-2 Level 3) and REST API access to mainframe programs (CICS, IMS, batch) via z/OS Connect.
Tools (12 total)
Key Protect -- HSM Key Management
| Tool | Description |
|---|---|
key_protect_list_keys |
List encryption keys in Key Protect |
key_protect_create_key |
Create root or standard keys |
key_protect_get_key |
Get key details and metadata |
key_protect_wrap_key |
Wrap (encrypt) a DEK with a root key |
key_protect_unwrap_key |
Unwrap (decrypt) a wrapped DEK |
key_protect_rotate_key |
Rotate a root key |
key_protect_delete_key |
Delete a key (irreversible) |
key_protect_get_key_policies |
Get rotation and dual-auth policies |
z/OS Connect -- Mainframe Integration
| Tool | Description |
|---|---|
zos_connect_list_services |
List available mainframe services |
zos_connect_get_service |
Get service details and OpenAPI spec |
zos_connect_call_service |
Call a mainframe program via REST (JSON to COBOL) |
zos_connect_list_apis |
List outbound API configurations |
zos_connect_health |
Check z/OS Connect server health |
Install
npm install
Configuration
{
"mcpServers": {
"ibmz": {
"type": "stdio",
"command": "node",
"args": ["/path/to/ibmz-mcp-server/index.js"],
"env": {
"IBM_CLOUD_API_KEY": "your-api-key",
"KEY_PROTECT_INSTANCE_ID": "your-instance-id",
"KEY_PROTECT_URL": "https://us-south.kms.cloud.ibm.com"
}
}
}
}
Environment Variables
| Variable | Description | Required |
|---|---|---|
IBM_CLOUD_API_KEY |
IBM Cloud API key | Yes (Key Protect) |
KEY_PROTECT_INSTANCE_ID |
Key Protect instance OCID | Yes (Key Protect) |
KEY_PROTECT_URL |
Key Protect endpoint | No (defaults to us-south) |
ZOS_CONNECT_URL |
z/OS Connect base URL | Yes (z/OS Connect) |
ZOS_CONNECT_USERNAME |
Mainframe username | Yes (z/OS Connect) |
ZOS_CONNECT_PASSWORD |
Mainframe password | Yes (z/OS Connect) |
Key Concepts
Envelope Encryption
Root keys (KEK) are stored in the HSM and never leave the hardware. Data encryption keys (DEK) are wrapped by root keys for safe storage alongside ciphertext.
z/OS Connect
REST APIs that automatically map JSON payloads to COBOL copybooks, enabling access to CICS transactions, IMS programs, and batch jobs.
Dependencies
@modelcontextprotocol/sdk-- MCP protocol SDK@ibm-cloud/ibm-key-protect-- Key Protect clientibm-cloud-sdk-core-- IBM Cloud authentication
License
README copy captured when this server was indexed; it may lag the repository. The original is authoritative.