Odel
MCP server: One MCP server.

Ibmz

@expertvagabondMCP server · External

IBM Z mainframe MCP server - Key Protect HSM & z/OS

v1.0.1MITRust
Freeno charge per call
How to install

Runs on your machine from its package; the steps are below.

What it does

  1. Reads
  2. Writes
  3. High impact

At most: moves money, runs code or commands, deletes data, or sends messages for you.

What it costs

Free

Odel charges nothing per call. The publisher may charge for its own service.

Runs locally over stdio

This server isn't hosted — your MCP client launches it from a package registry. Use one of the commands below, or drop the config into your client (e.g. Claude Desktop).

npmibmz-mcp-serverv1.0.1

Run

npx -y ibmz-mcp-server

MCP client config

{
  "mcpServers": {
    "ibmz": {
      "command": "npx",
      "args": [
        "-y",
        "ibmz-mcp-server"
      ]
    }
  }
}
README2 min read

ibmz-mcp-server

[!License: MIT](https://opensource.org/licenses/MIT) [!MCP](https://modelcontextprotocol.io) [!npm](https://www.npmjs.com/package/ibmz-mcp-server)

MCP server for IBM Z mainframe integration. Provides HSM-backed key management via IBM Key Protect (FIPS 140-2 Level 3) and REST API access to mainframe programs (CICS, IMS, batch) via z/OS Connect.

Tools (12 total)

Key Protect -- HSM Key Management

ToolDescription
key_protect_list_keysList encryption keys in Key Protect
key_protect_create_keyCreate root or standard keys
key_protect_get_keyGet key details and metadata
key_protect_wrap_keyWrap (encrypt) a DEK with a root key
key_protect_unwrap_keyUnwrap (decrypt) a wrapped DEK
key_protect_rotate_keyRotate a root key
key_protect_delete_keyDelete a key (irreversible)
key_protect_get_key_policiesGet rotation and dual-auth policies

z/OS Connect -- Mainframe Integration

ToolDescription
zos_connect_list_servicesList available mainframe services
zos_connect_get_serviceGet service details and OpenAPI spec
zos_connect_call_serviceCall a mainframe program via REST (JSON to COBOL)
zos_connect_list_apisList outbound API configurations
zos_connect_healthCheck z/OS Connect server health

Install

bash
npm install

Configuration

json
{
  "mcpServers": {
    "ibmz": {
      "type": "stdio",
      "command": "node",
      "args": ["/path/to/ibmz-mcp-server/index.js"],
      "env": {
        "IBM_CLOUD_API_KEY": "your-api-key",
        "KEY_PROTECT_INSTANCE_ID": "your-instance-id",
        "KEY_PROTECT_URL": "https://us-south.kms.cloud.ibm.com"
      }
    }
  }
}

Environment Variables

VariableDescriptionRequired
IBM_CLOUD_API_KEYIBM Cloud API keyYes (Key Protect)
KEY_PROTECT_INSTANCE_IDKey Protect instance OCIDYes (Key Protect)
KEY_PROTECT_URLKey Protect endpointNo (defaults to us-south)
ZOS_CONNECT_URLz/OS Connect base URLYes (z/OS Connect)
ZOS_CONNECT_USERNAMEMainframe usernameYes (z/OS Connect)
ZOS_CONNECT_PASSWORDMainframe passwordYes (z/OS Connect)

Key Concepts

Envelope Encryption

Root keys (KEK) are stored in the HSM and never leave the hardware. Data encryption keys (DEK) are wrapped by root keys for safe storage alongside ciphertext.

z/OS Connect

REST APIs that automatically map JSON payloads to COBOL copybooks, enabling access to CICS transactions, IMS programs, and batch jobs.

Dependencies

  • @modelcontextprotocol/sdk -- MCP protocol SDK
  • @ibm-cloud/ibm-key-protect -- Key Protect client
  • ibm-cloud-sdk-core -- IBM Cloud authentication

License

MIT

Similar modules