mcpField
I
ibmz

ibmz

Local
github.com/ExpertVagabondSecurity0Updated 9w ago
Repository

About ibmz

ibmz is an MCP server for IBM Z integration, intended for systems that manage keys or access mainframe programs. It supports HSM key operations through IBM Key Protect and calls CICS, IMS, and batch programs through z/OS Connect.

Key features

  1. 01List, create, and inspect keys
  2. 02Wrap, unwrap, and rotate keys
  3. 03Retrieve key policies
  4. 04List z/OS Connect services and APIs
  5. 05Call mainframe programs through REST
  6. 06Check z/OS Connect health

Use cases

  1. 01Manage IBM Key Protect encryption keys
  2. 02Rotate root keys and review policies
  3. 03Inspect available mainframe services and OpenAPI specs
  4. 04Call mainframe programs with JSON requests

MCP support

As an MCP server, it exposes IBM Key Protect key management and z/OS Connect mainframe integration tools to clients.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "expertvagabond-ibmz": {
      "command": "npx",
      "args": [
        "-y",
        "ibmz-mcp-server"
      ]
    }
  }
}
Run commandnpx -y ibmz-mcp-server

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
npmibmz-mcp-server1.0.1

Tools

13

Saved tool list · updated 2w ago

ParameterTypeRequiredDescription
limitnumberNoMaximum number of keys to return (default: 100)
statearrayNoFilter by key states: 1=Active, 2=Suspended, 3=Deactivated, 5=Destroyed
offsetnumberNoNumber of keys to skip for pagination

Details

From the project README

ibmz-mcp-server

[!License: MIT](https://opensource.org/licenses/MIT) [!MCP](https://modelcontextprotocol.io) [!npm](https://www.npmjs.com/package/ibmz-mcp-server)

MCP server for IBM Z mainframe integration. Provides HSM-backed key management via IBM Key Protect (FIPS 140-2 Level 3) and REST API access to mainframe programs (CICS, IMS, batch) via z/OS Connect.

Tools (12 total)

Key Protect -- HSM Key Management
ToolDescription
key_protect_list_keysList encryption keys in Key Protect
key_protect_create_keyCreate root or standard keys
key_protect_get_keyGet key details and metadata
key_protect_wrap_keyWrap (encrypt) a DEK with a root key
key_protect_unwrap_keyUnwrap (decrypt) a wrapped DEK
key_protect_rotate_keyRotate a root key
key_protect_delete_keyDelete a key (irreversible)
key_protect_get_key_policiesGet rotation and dual-auth policies
z/OS Connect -- Mainframe Integration
ToolDescription
zos_connect_list_servicesList available mainframe services
zos_connect_get_serviceGet service details and OpenAPI spec
zos_connect_call_serviceCall a mainframe program via REST (JSON to COBOL)
zos_connect_list_apisList outbound API configurations
zos_connect_healthCheck z/OS Connect server health

Install

npm install

Configuration

{
  "mcpServers": {
    "ibmz": {
      "type": "stdio",
      "command": "node",
      "args": ["/path/to/ibmz-mcp-server/index.js"],
      "env": {
        "IBM_CLOUD_API_KEY": "your-api-key",
        "KEY_PROTECT_INSTANCE_ID": "your-instance-id",
        "KEY_PROTECT_URL": "https://us-south.kms.cloud.ibm.com"
      }
    }
  }
}
Environment Variables
VariableDescriptionRequired
IBM_CLOUD_API_KEYIBM Cloud API keyYes (Key Protect)
KEY_PROTECT_INSTANCE_IDKey Protect instance OCIDYes (Key Protect)
KEY_PROTECT_URLKey Protect endpointNo (defaults to us-south)
ZOS_CONNECT_URLz/OS Connect base URLYes (z/OS Connect)
ZOS_CONNECT_USERNAMEMainframe usernameYes (z/OS Connect)
ZOS_CONNECT_PASSWORDMainframe passwordYes (z/OS Connect)

Key Concepts

Envelope Encryption

Root keys (KEK) are stored in the HSM and never leave the hardware. Data encryption keys (DEK) are wrapped by root keys for safe storage alongside ciphertext.

z/OS Connect

REST APIs that automatically map JSON payloads to COBOL copybooks, enabling access to CICS transactions, IMS programs, and batch jobs.

Dependencies

  • @modelcontextprotocol/sdk -- MCP protocol SDK
  • @ibm-cloud/ibm-key-protect -- Key Protect client
  • ibm-cloud-sdk-core -- IBM Cloud authentication

License

MIT

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.