Skip to content
MCP ThesaurusMCP Thesaurus

ibmz

CommunityIncomplete39/100Claim

npm ibmz-mcp-serverstdioMITupdated 11d ago

MCP server for IBM Z mainframe integration. Provides HSM-backed key management via IBM Key Protect (FIPS 140-2 Level 3) and REST API access to mainframe programs (CICS, IMS, batch) via z/OS Connect.

SourceWebsite

What can you do with ibmz?

ibmz-mcp-server

[!License: MIT](https://opensource.org/licenses/MIT) [!MCP](https://modelcontextprotocol.io) [!npm](https://www.npmjs.com/package/ibmz-mcp-server)

MCP server for IBM Z mainframe integration. Provides HSM-backed key management via IBM Key Protect (FIPS 140-2 Level 3) and REST API access to mainframe programs (CICS, IMS, batch) via z/OS Connect.

Tools (12 total)

Key Protect -- HSM Key Management

Tool Description
key_protect_list_keys List encryption keys in Key Protect
key_protect_create_key Create root or standard keys
key_protect_get_key Get key details and metadata
key_protect_wrap_key Wrap (encrypt) a DEK with a root key
key_protect_unwrap_key Unwrap (decrypt) a wrapped DEK
key_protect_rotate_key Rotate a root key
key_protect_delete_key Delete a key (irreversible)
key_protect_get_key_policies Get rotation and dual-auth policies

z/OS Connect -- Mainframe Integration

Tool Description
zos_connect_list_services List available mainframe services
zos_connect_get_service Get service details and OpenAPI spec
zos_connect_call_service Call a mainframe program via REST (JSON to COBOL)
zos_connect_list_apis List outbound API configurations
zos_connect_health Check z/OS Connect server health

Install

npm install

Configuration

{
  "mcpServers": {
    "ibmz": {
      "type": "stdio",
      "command": "node",
      "args": ["/path/to/ibmz-mcp-server/index.js"],
      "env": {
        "IBM_CLOUD_API_KEY": "your-api-key",
        "KEY_PROTECT_INSTANCE_ID": "your-instance-id",
        "KEY_PROTECT_URL": "https://us-south.kms.cloud.ibm.com"
      }
    }
  }
}

Environment Variables

Variable Description Required
IBM_CLOUD_API_KEY IBM Cloud API key Yes (Key Protect)
KEY_PROTECT_INSTANCE_ID Key Protect instance OCID Yes (Key Protect)
KEY_PROTECT_URL Key Protect endpoint No (defaults to us-south)
ZOS_CONNECT_URL z/OS Connect base URL Yes (z/OS Connect)
ZOS_CONNECT_USERNAME Mainframe username Yes (z/OS Connect)
ZOS_CONNECT_PASSWORD Mainframe password Yes (z/OS Connect)

Key Concepts

Envelope Encryption

Root keys (KEK) are stored in the HSM and never leave the hardware. Data encryption keys (DEK) are wrapped by root keys for safe storage alongside ciphertext.

z/OS Connect

REST APIs that automatically map JSON payloads to COBOL copybooks, enabling access to CICS transactions, IMS programs, and batch jobs.

Dependencies

  • @modelcontextprotocol/sdk -- MCP protocol SDK
  • @ibm-cloud/ibm-key-protect -- Key Protect client
  • ibm-cloud-sdk-core -- IBM Cloud authentication

License

MIT