io.github.NotHarshhaa/mainframe-mcp-server

claude mcp add mainframe-mcp-server -e 'ZOSMF_HOST=<ZOSMF_HOST>' -e 'ZOSMF_PORT=<ZOSMF_PORT>' -e 'ZOSMF_BASE_PATH=<ZOSMF_BASE_PATH>' -e 'ZOSMF_USER=<ZOSMF_USER>' -e 'ZOSMF_PASSWORD=<your zosmf_password>' -e 'ZOSMF_TOKEN=<your zosmf_token>' -e 'ZOSMF_TOKEN_TYPE=<ZOSMF_TOKEN_TYPE>' -e 'ZOSMF_REJECT_UNAUTHORIZED=<ZOSMF_REJECT_UNAUTHORIZED>' -e 'ZOSMF_CERT=<ZOSMF_CERT>' -e 'ZOSMF_CERT_KEY=<ZOSMF_CERT_KEY>' -e 'ZOSMF_TOKEN_FILE=<ZOSMF_TOKEN_FILE>' -e 'ZOSMF_USER_ID=<ZOSMF_USER_ID>' -e 'ZOSMF_PASSTICKET_APP=<ZOSMF_PASSTICKET_APP>' -e 'ZOWE_TEAM_CONFIG=<ZOWE_TEAM_CONFIG>' -e 'ZOSMF_PROFILE=<ZOSMF_PROFILE>' -e 'LOG_LEVEL=<LOG_LEVEL>' -e 'MCP_TRANSPORT=<MCP_TRANSPORT>' -e 'MCP_SSE_PORT=<MCP_SSE_PORT>' -e 'MAX_JOB_OUTPUT_LINES=<MAX_JOB_OUTPUT_LINES>' -e 'MAX_DATASET_READ_LINES=<MAX_DATASET_READ_LINES>' -e 'MAX_JES_SPOOL_FILES=<MAX_JES_SPOOL_FILES>' -e 'MAX_AUDIT_LINES=<MAX_AUDIT_LINES>' -e 'CMCI_CONTEXT=<CMCI_CONTEXT>' -e 'CMCI_HOST=<CMCI_HOST>' -e 'CMCI_PORT=<CMCI_PORT>' -e 'CMCI_BASE_PATH=<CMCI_BASE_PATH>' -e 'DB2_LOCATION=<DB2_LOCATION>' -e 'DB2_HOST=<DB2_HOST>' -e 'DB2_PORT=<DB2_PORT>' -e 'DB2_BASE_PATH=<DB2_BASE_PATH>' -e 'SMF_SUMMARY_DATASET=<SMF_SUMMARY_DATASET>' -e 'RMF_METRICS_ENABLED=<RMF_METRICS_ENABLED>' -e 'RACF_AUDIT_USS_PATH=<RACF_AUDIT_USS_PATH>' -e 'RACF_AUDIT_DATASET=<RACF_AUDIT_DATASET>' -e 'SECURITY_READ_ONLY=<SECURITY_READ_ONLY>' -e 'SECURITY_ALLOWED_TOOLS=<SECURITY_ALLOWED_TOOLS>' -e 'SECURITY_BLOCKED_TOOLS=<SECURITY_BLOCKED_TOOLS>' -e 'SECURITY_ALLOWED_DATASET_PATTERNS=<SECURITY_ALLOWED_DATASET_PATTERNS>' -e 'SECURITY_ALLOWED_USS_PATHS=<SECURITY_ALLOWED_USS_PATHS>' -e 'SECURITY_AUDIT_LOGGING=<SECURITY_AUDIT_LOGGING>' -e 'SECURITY_MAX_JCL_BYTES=<SECURITY_MAX_JCL_BYTES>' -e 'SECURITY_WRITE_APPROVAL=<SECURITY_WRITE_APPROVAL>' -e 'SECURITY_JCL_SCAN=<SECURITY_JCL_SCAN>' -e 'SECURITY_JCL_SCAN_STRICT=<SECURITY_JCL_SCAN_STRICT>' -e 'SECURITY_BLOCKED_PROGRAMS=<SECURITY_BLOCKED_PROGRAMS>' -e 'SECURITY_BLOCKED_JOB_CLASSES=<SECURITY_BLOCKED_JOB_CLASSES>' -e 'SECURITY_CHANGE_TICKET_PATTERN=<SECURITY_CHANGE_TICKET_PATTERN>' -e 'SECURITY_WRITE_WINDOW=<SECURITY_WRITE_WINDOW>' -e 'SECURITY_WRITE_DAYS=<SECURITY_WRITE_DAYS>' -e 'SECURITY_WRITE_WINDOW_TZ=<SECURITY_WRITE_WINDOW_TZ>' -- npx -y @notharshhaa/mainframe-mcp-server@3.0.0

{
    "mcpServers": {
        "mainframe-mcp-server": {
            "command": "npx",
            "args": [
                "-y",
                "@notharshhaa/mainframe-mcp-server@3.0.0"
            ],
            "env": {
                "ZOSMF_HOST": "<ZOSMF_HOST>",
                "ZOSMF_PORT": "<ZOSMF_PORT>",
                "ZOSMF_BASE_PATH": "<ZOSMF_BASE_PATH>",
                "ZOSMF_USER": "<ZOSMF_USER>",
                "ZOSMF_PASSWORD": "<your zosmf_password>",
                "ZOSMF_TOKEN": "<your zosmf_token>",
                "ZOSMF_TOKEN_TYPE": "<ZOSMF_TOKEN_TYPE>",
                "ZOSMF_REJECT_UNAUTHORIZED": "<ZOSMF_REJECT_UNAUTHORIZED>",
                "ZOSMF_CERT": "<ZOSMF_CERT>",
                "ZOSMF_CERT_KEY": "<ZOSMF_CERT_KEY>",
                "ZOSMF_TOKEN_FILE": "<ZOSMF_TOKEN_FILE>",
                "ZOSMF_USER_ID": "<ZOSMF_USER_ID>",
                "ZOSMF_PASSTICKET_APP": "<ZOSMF_PASSTICKET_APP>",
                "ZOWE_TEAM_CONFIG": "<ZOWE_TEAM_CONFIG>",
                "ZOSMF_PROFILE": "<ZOSMF_PROFILE>",
                "LOG_LEVEL": "<LOG_LEVEL>",
                "MCP_TRANSPORT": "<MCP_TRANSPORT>",
                "MCP_SSE_PORT": "<MCP_SSE_PORT>",
                "MAX_JOB_OUTPUT_LINES": "<MAX_JOB_OUTPUT_LINES>",
                "MAX_DATASET_READ_LINES": "<MAX_DATASET_READ_LINES>",
                "MAX_JES_SPOOL_FILES": "<MAX_JES_SPOOL_FILES>",
                "MAX_AUDIT_LINES": "<MAX_AUDIT_LINES>",
                "CMCI_CONTEXT": "<CMCI_CONTEXT>",
                "CMCI_HOST": "<CMCI_HOST>",
                "CMCI_PORT": "<CMCI_PORT>",
                "CMCI_BASE_PATH": "<CMCI_BASE_PATH>",
                "DB2_LOCATION": "<DB2_LOCATION>",
                "DB2_HOST": "<DB2_HOST>",
                "DB2_PORT": "<DB2_PORT>",
                "DB2_BASE_PATH": "<DB2_BASE_PATH>",
                "SMF_SUMMARY_DATASET": "<SMF_SUMMARY_DATASET>",
                "RMF_METRICS_ENABLED": "<RMF_METRICS_ENABLED>",
                "RACF_AUDIT_USS_PATH": "<RACF_AUDIT_USS_PATH>",
                "RACF_AUDIT_DATASET": "<RACF_AUDIT_DATASET>",
                "SECURITY_READ_ONLY": "<SECURITY_READ_ONLY>",
                "SECURITY_ALLOWED_TOOLS": "<SECURITY_ALLOWED_TOOLS>",
                "SECURITY_BLOCKED_TOOLS": "<SECURITY_BLOCKED_TOOLS>",
                "SECURITY_ALLOWED_DATASET_PATTERNS": "<SECURITY_ALLOWED_DATASET_PATTERNS>",
                "SECURITY_ALLOWED_USS_PATHS": "<SECURITY_ALLOWED_USS_PATHS>",
                "SECURITY_AUDIT_LOGGING": "<SECURITY_AUDIT_LOGGING>",
                "SECURITY_MAX_JCL_BYTES": "<SECURITY_MAX_JCL_BYTES>",
                "SECURITY_WRITE_APPROVAL": "<SECURITY_WRITE_APPROVAL>",
                "SECURITY_JCL_SCAN": "<SECURITY_JCL_SCAN>",
                "SECURITY_JCL_SCAN_STRICT": "<SECURITY_JCL_SCAN_STRICT>",
                "SECURITY_BLOCKED_PROGRAMS": "<SECURITY_BLOCKED_PROGRAMS>",
                "SECURITY_BLOCKED_JOB_CLASSES": "<SECURITY_BLOCKED_JOB_CLASSES>",
                "SECURITY_CHANGE_TICKET_PATTERN": "<SECURITY_CHANGE_TICKET_PATTERN>",
                "SECURITY_WRITE_WINDOW": "<SECURITY_WRITE_WINDOW>",
                "SECURITY_WRITE_DAYS": "<SECURITY_WRITE_DAYS>",
                "SECURITY_WRITE_WINDOW_TZ": "<SECURITY_WRITE_WINDOW_TZ>"
            }
        }
    }
}

Environment variables

• ZOSMF_HOST required z/OSMF hostname or IP address
• ZOSMF_PORT z/OSMF HTTPS port (default 443)
• ZOSMF_BASE_PATH Optional API gateway or mediation layer prefix for z/OSMF
• ZOSMF_USER z/OS user id (required with ZOSMF_PASSWORD unless ZOSMF_TOKEN is set)
• ZOSMF_PASSWORD secret Password for basic auth (required with ZOSMF_USER unless ZOSMF_TOKEN is set)
• ZOSMF_TOKEN secret Auth token (alternative to user/password)
• ZOSMF_TOKEN_TYPE Token type when using ZOSMF_TOKEN (e.g. LTPA2)
• ZOSMF_REJECT_UNAUTHORIZED Verify TLS certificates (true in production)
• ZOSMF_CERT PEM client certificate file path for mTLS auth
• ZOSMF_CERT_KEY PEM client key file path for mTLS auth (required with ZOSMF_CERT)
• ZOSMF_TOKEN_FILE Read ZOSMF_TOKEN from this file at startup (vault/agent injection)
• ZOSMF_USER_ID End-user id for PassTicket identity propagation (RACF sees this user, not the service account)
• ZOSMF_PASSTICKET_APP RACF PTKTDATA application name for PassTicket generation (default ZOSMF)
• ZOWE_TEAM_CONFIG Path to a zowe.config.json to import connection settings from (env vars win)
• ZOSMF_PROFILE Profile name inside the Zowe team config (defaults to defaults.zosmf)
• LOG_LEVEL Log level: fatal, error, warn, info, debug, trace, silent
• MCP_TRANSPORT Transport: stdio (IDE) or sse (legacy HTTP+SSE for container/network deployments)
• MCP_SSE_PORT Listen port when MCP_TRANSPORT=sse
• MAX_JOB_OUTPUT_LINES Max lines returned from a single spool DD
• MAX_DATASET_READ_LINES Max lines returned from dataset or USS reads
• MAX_JES_SPOOL_FILES Max spool files fetched during diagnostics
• MAX_AUDIT_LINES Max RACF audit log lines per query
• CMCI_CONTEXT CICSplex name or region APPLID (required for CICS tools)
• CMCI_HOST CMCI hostname (defaults to ZOSMF_HOST)
• CMCI_PORT CMCI HTTPS port (default 1490)
• CMCI_BASE_PATH CMCI REST base path
• DB2_LOCATION Db2 subsystem location name (required for Db2 tools)
• DB2_HOST Db2 REST hostname (defaults to ZOSMF_HOST)
• DB2_PORT Db2 REST port (default 50400)
• DB2_BASE_PATH Db2 REST base path
• SMF_SUMMARY_DATASET Optional SMF summary dataset for offline metrics
• RMF_METRICS_ENABLED Query z/OSMF RMF metrics when available
• RACF_AUDIT_USS_PATH USS path to RACF audit log file
• RACF_AUDIT_DATASET Sequential dataset containing RACF audit records
• SECURITY_READ_ONLY When true (default), blocks write tools such as submit_jcl
• SECURITY_ALLOWED_TOOLS Comma-separated allowlist of MCP tool names
• SECURITY_BLOCKED_TOOLS Comma-separated blocklist of MCP tool names
• SECURITY_ALLOWED_DATASET_PATTERNS Comma-separated dataset patterns (e.g. USERDEV.*,SYS1.*)
• SECURITY_ALLOWED_USS_PATHS Comma-separated USS path prefixes
• SECURITY_AUDIT_LOGGING Log every tool invocation to stderr (SIEM-friendly JSON)
• SECURITY_MAX_JCL_BYTES Maximum inline JCL size for submit_jcl
• SECURITY_WRITE_APPROVAL Human-in-the-loop: submit_jcl returns a one-time token and approve_write executes (default false)
• SECURITY_JCL_SCAN Pre-flight scan JCL before submission: IDCAMS DELETE, IEFBR14 DISP DELETE, blocked utilities (default true)
• SECURITY_JCL_SCAN_STRICT Strict scan mode: WARN findings also block submissions (default false)
• SECURITY_BLOCKED_PROGRAMS Comma-separated EXEC programs that may never run (extends ADRDSSU,ICKDSF,IEHINITT)
• SECURITY_BLOCKED_JOB_CLASSES Comma-separated JES job classes that may never be used
• SECURITY_CHANGE_TICKET_PATTERN Regex a changeTicket argument must match on writes, e.g. CHG[0-9]{6}
• SECURITY_WRITE_WINDOW Allowed write window, 24h HH:MM-HH:MM (overnight ranges allowed), e.g. 08:00-18:00
• SECURITY_WRITE_DAYS Weekdays writes are allowed: 0=Sun..6=Sat, e.g. 1-5
• SECURITY_WRITE_WINDOW_TZ IANA timezone for the write window (default UTC)