MCP.Market

Ibmz MCP server

by ExpertVagabond·io.github.ExpertVagabond/ibmz·v1.0.1
No reviews yet

IBM Z mainframe MCP server - Key Protect HSM & z/OS

A92/100grade A
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
A92/100

full report

Adoption
Growing

0 stars39 downloads/wk

Reviews

Write one

Nobody has reviewed Ibmz yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Ibmz tools (13, 2 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • key_protect_create_keywrite action

    Create a new encryption key in IBM Key Protect HSM. Root keys protect other keys (envelope encryption). Standard keys encrypt data directly.

  • key_protect_delete_keywrite action

    Delete a key from IBM Key Protect. WARNING: This is irreversible and data encrypted with this key becomes unrecoverable.

  • key_protect_get_key

    Get metadata and details of a specific key from IBM Key Protect

  • key_protect_get_key_policies

    Get policies applied to a key (rotation, dual authorization)

  • key_protect_list_keys

    List encryption keys from IBM Key Protect (HSM-backed on IBM Z infrastructure, FIPS 140-2 Level 3 certified)

  • key_protect_rotate_key

    Rotate a root key. Creates new key version while maintaining ability to unwrap data encrypted with previous versions.

  • key_protect_unwrap_key

    Unwrap (decrypt) a wrapped data encryption key using a root key

  • key_protect_wrap_key

    Wrap (encrypt) a data encryption key using a root key. Used for envelope encryption - protects DEKs with a KEK stored in HSM.

  • zos_connect_call_service

    Call a z/OS Connect REST API to interact with mainframe programs. Maps JSON to COBOL copybooks automatically.

  • zos_connect_get_service

    Get detailed information about a z/OS Connect service including its OpenAPI specification and endpoint mappings

  • zos_connect_health

    Check the health status of the z/OS Connect server and connected subsystems

  • zos_connect_list_apis

    List all deployed API requester configurations (outbound calls from z/OS to external services)

  • zos_connect_list_services

    List all available z/OS Connect services (REST APIs exposing mainframe programs). Each service maps to CICS transactions, IMS programs, or batch jobs.

Public scan report

scanner v0.1.10 · 2026-09-28 · same rubric, same numbers if you re-run it

no findings
  • Code scan4 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 21 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 92/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Ibmz compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
92/100
higher than 95% of 48,255 servers
Tools
13
the typical server has 7
Tools that change things
15%
typical: 0%. Fewer write tools means less an agent can break
Downloads a week
39
more than 30% of 12,191 servers with a package

What its tools let an agent do: 11 read · 2 change

Install Ibmz in Claude Code, Cursor or VS Code

Runs npx -y ibmz-mcp-server on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add ibmz -- npx -y ibmz-mcp-server
Add to Cursor

What the publisher says

From the Ibmz repository's README, as published. We do not edit it. Read it on GitHub

ibmz-mcp-server

\ \ \

MCP server for IBM Z mainframe integration. Provides HSM-backed key management via IBM Key Protect (FIPS 140-2 Level 3) and REST API access to mainframe programs (CICS, IMS, batch) via z/OS Connect.

Tools (12 total)

Key Protect -- HSM Key Management

z/OS Connect -- Mainframe Integration

Install

npm install

Configuration

{
  "mcpServers": {
    "ibmz": {
      "type": "stdio",
      "command": "node",
      "args": ["/path/to/ibmz-mcp-server/index.js"],
      "env": {
        "IBM_CLOUD_API_KEY": "your-api-key",
        "KEY_PROTECT_INSTANCE_ID": "your-instance-id",
        "KEY_PROTECT_URL": "https://us-south.kms.cloud.ibm.com"
      }
    }
  }
}

Environment Variables

Key Concepts

Envelope Encryption

Root keys (KEK) are stored in the HSM and never leave the hardware. Data encryption keys (DEK) are wrapped by root keys for safe storage alongside ciphertext.

z/OS Connect

REST APIs that automatically map JSON payloads to COBOL copybooks, enabling access to CICS transactions, IMS programs, and batch jobs.

Dependencies

  • @modelcontextprotocol/sdk -- MCP protocol SDK
  • @ibm-cloud/ibm-key-protect -- Key Protect client
  • ibm-cloud-sdk-core -- IBM Cloud authentication

License

MIT

Nothing above is checked by us. What we check is on the safety report.

Ibmz: common questions

Is Ibmz MCP server safe?
Yes, by our scan: it is graded A (92/100). Read the Ibmz safety report
How do I install Ibmz?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Ibmz need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Ibmz maintained?
The last commit was 57 days ago (2026-09-08). The latest release is v1.0.1.
How does Ibmz compare with other MCP servers?
safety score 92/100 (higher than 95% of 48,255 servers); tools 13 (the typical server has 7); tools that change things 15% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

More from ExpertVagabond →