Ibmz
Bridges Claude to IBM Z mainframes through two distinct paths: Key Protect for HSM-backed encryption (FIPS 140-2 Level 3) and z/OS Connect for calling CICS, IMS, and batch programs via REST. On the crypto side, you get envelope encryption workflows like wrapping DEKs with root keys that never leave the hardware, plus rotation and policy management. On the mainframe side, it translates JSON to COBOL copybooks so you can invoke legacy programs without touching JCL. Useful when you need Claude to orchestrate key lifecycles in regulated environments or interact with core banking and transaction systems that still run on Big Iron. Requires IBM Cloud credentials for Key Protect and mainframe auth for z/OS Connect.
- tools
- 13
- transport
- STDIO
- last updated
- Feb 14, 2026
Tools
13 toolsPublic tool metadata for what this MCP can expose to an agent.
key_protect_list_keysList encryption keys in Key Protect
List encryption keys in Key Protect
No parameter schema in public metadata yet.
key_protect_create_keyCreate root or standard keys
Create root or standard keys
No parameter schema in public metadata yet.
key_protect_get_keyGet key details and metadata
Get key details and metadata
No parameter schema in public metadata yet.
key_protect_wrap_keyWrap (encrypt) a DEK with a root key
Wrap (encrypt) a DEK with a root key
No parameter schema in public metadata yet.
key_protect_unwrap_keyUnwrap (decrypt) a wrapped DEK
Unwrap (decrypt) a wrapped DEK
No parameter schema in public metadata yet.
key_protect_rotate_keyRotate a root key
Rotate a root key
No parameter schema in public metadata yet.
key_protect_delete_keyDelete a key (irreversible)
Delete a key (irreversible)
No parameter schema in public metadata yet.
key_protect_get_key_policiesGet rotation and dual-auth policies
Get rotation and dual-auth policies
No parameter schema in public metadata yet.
zos_connect_list_servicesList available mainframe services
List available mainframe services
No parameter schema in public metadata yet.
zos_connect_get_serviceGet service details and OpenAPI spec
Get service details and OpenAPI spec
No parameter schema in public metadata yet.
zos_connect_call_serviceCall a mainframe program via REST (JSON to COBOL)
Call a mainframe program via REST (JSON to COBOL)
No parameter schema in public metadata yet.
zos_connect_list_apisList outbound API configurations
List outbound API configurations
No parameter schema in public metadata yet.
zos_connect_healthCheck z/OS Connect server health
Check z/OS Connect server health
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageReadme
ibmz-mcp-server
[!License: MIT](https://opensource.org/licenses/MIT) [!MCP](https://modelcontextprotocol.io) [!npm](https://www.npmjs.com/package/ibmz-mcp-server)
MCP server for IBM Z mainframe integration. Provides HSM-backed key management via IBM Key Protect (FIPS 140-2 Level 3) and REST API access to mainframe programs (CICS, IMS, batch) via z/OS Connect.
Tools (12 total)
Key Protect -- HSM Key Management
| Tool | Description |
|---|---|
key_protect_list_keys | List encryption keys in Key Protect |
key_protect_create_key | Create root or standard keys |
key_protect_get_key | Get key details and metadata |
key_protect_wrap_key | Wrap (encrypt) a DEK with a root key |
key_protect_unwrap_key | Unwrap (decrypt) a wrapped DEK |
key_protect_rotate_key | Rotate a root key |
key_protect_delete_key | Delete a key (irreversible) |
key_protect_get_key_policies | Get rotation and dual-auth policies |
z/OS Connect -- Mainframe Integration
Details
- Repository
- github.com/expertvagabond/ibmz-mcp-server
- Package
ibmz-mcp-server- Transport
- STDIO
- Registry
- MCP registry, active