English Français العربية

io.github.ExpertVagabond/ibmz

Official registry Other

IBM Z mainframe MCP server - Key Protect HSM & z/OS

Source code Documentation

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

NPM package ibmz-mcp-server
Claude Code 
claude mcp add ibmz -- npx -y ibmz-mcp-server@1.0.1
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "ibmz": {
            "command": "npx",
            "args": [
                "-y",
                "ibmz-mcp-server@1.0.1"
            ]
        }
    }
}

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. ibmz-mcp-server
  2. Tools (12 total)
  3. Install
  4. Configuration
  5. Key Concepts
  6. Dependencies
  7. License

ibmz-mcp-server

\ \ \

MCP server for IBM Z mainframe integration. Provides HSM-backed key management via IBM Key Protect (FIPS 140-2 Level 3) and REST API access to mainframe programs (CICS, IMS, batch) via z/OS Connect.

Tools (12 total)

Key Protect -- HSM Key Management
ToolDescription
key_protect_list_keysList encryption keys in Key Protect
key_protect_create_keyCreate root or standard keys
key_protect_get_keyGet key details and metadata
key_protect_wrap_keyWrap (encrypt) a DEK with a root key
key_protect_unwrap_keyUnwrap (decrypt) a wrapped DEK
key_protect_rotate_keyRotate a root key
key_protect_delete_keyDelete a key (irreversible)
key_protect_get_key_policiesGet rotation and dual-auth policies
z/OS Connect -- Mainframe Integration
ToolDescription
zos_connect_list_servicesList available mainframe services
zos_connect_get_serviceGet service details and OpenAPI spec
zos_connect_call_serviceCall a mainframe program via REST (JSON to COBOL)
zos_connect_list_apisList outbound API configurations
zos_connect_healthCheck z/OS Connect server health

Install

npm install

Configuration

{
  "mcpServers": {
    "ibmz": {
      "type": "stdio",
      "command": "node",
      "args": ["/path/to/ibmz-mcp-server/index.js"],
      "env": {
        "IBM_CLOUD_API_KEY": "your-api-key",
        "KEY_PROTECT_INSTANCE_ID": "your-instance-id",
        "KEY_PROTECT_URL": "https://us-south.kms.cloud.ibm.com"
      }
    }
  }
}
Environment Variables
VariableDescriptionRequired
IBM_CLOUD_API_KEYIBM Cloud API keyYes (Key Protect)
KEY_PROTECT_INSTANCE_IDKey Protect instance OCIDYes (Key Protect)
KEY_PROTECT_URLKey Protect endpointNo (defaults to us-south)
ZOS_CONNECT_URLz/OS Connect base URLYes (z/OS Connect)
ZOS_CONNECT_USERNAMEMainframe usernameYes (z/OS Connect)
ZOS_CONNECT_PASSWORDMainframe passwordYes (z/OS Connect)

Key Concepts

Envelope Encryption

Root keys (KEK) are stored in the HSM and never leave the hardware. Data encryption keys (DEK) are wrapped by root keys for safe storage alongside ciphertext.

z/OS Connect

REST APIs that automatically map JSON payloads to COBOL copybooks, enabling access to CICS transactions, IMS programs, and batch jobs.

Dependencies

  • @modelcontextprotocol/sdk -- MCP protocol SDK
  • @ibm-cloud/ibm-key-protect -- Key Protect client
  • ibm-cloud-sdk-core -- IBM Cloud authentication

License

MIT

Frequently asked questions

What is io.github.ExpertVagabond/ibmz?

IBM Z mainframe MCP server - Key Protect HSM & z/OS

How do I install io.github.ExpertVagabond/ibmz?

It runs on your machine. In Claude Code: claude mcp add ibmz -- npx -y ibmz-mcp-server@1.0.1. For other clients, paste the JSON configuration from this page into their MCP settings.

Does io.github.ExpertVagabond/ibmz need an API key?

Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.

Is io.github.ExpertVagabond/ibmz open source?

Yes. Its code is on GitHub under the MIT license.

Who maintains io.github.ExpertVagabond/ibmz?

It is published by ExpertVagabond. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.