Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@ibmz-mcp-server List all encryption keys in my Key Protect instance."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
[!License: MIT](https://opensource.org/licenses/MIT) [!MCP](https://modelcontextprotocol.io) [!npm](https://www.npmjs.com/package/ibmz-mcp-server)
MCP server for IBM Z mainframe integration. Provides HSM-backed key management via IBM Key Protect (FIPS 140-2 Level 3) and REST API access to mainframe programs (CICS, IMS, batch) via z/OS Connect.
Tool | Description |
| List encryption keys in Key Protect |
| Create root or standard keys |
| Get key details and metadata |
| Wrap (encrypt) a DEK with a root key |
| Unwrap (decrypt) a wrapped DEK |
| Rotate a root key |
| Delete a key (irreversible) |
| Get rotation and dual-auth policies |
Tool | Description |
| List available mainframe services |
| Get service details and OpenAPI spec |
| Call a mainframe program via REST (JSON to COBOL) |
| List outbound API configurations |
| Check z/OS Connect server health |
Related MCP server: Data Intelligence MCP Server
npm install{
"mcpServers": {
"ibmz": {
"type": "stdio",
"command": "node",
"args": ["/path/to/ibmz-mcp-server/index.js"],
"env": {
"IBM_CLOUD_API_KEY": "your-api-key",
"KEY_PROTECT_INSTANCE_ID": "your-instance-id",
"KEY_PROTECT_URL": "https://us-south.kms.cloud.ibm.com"
}
}
}
}Variable | Description | Required |
| IBM Cloud API key | Yes (Key Protect) |
| Key Protect instance OCID | Yes (Key Protect) |
| Key Protect endpoint | No (defaults to us-south) |
| z/OS Connect base URL | Yes (z/OS Connect) |
| Mainframe username | Yes (z/OS Connect) |
| Mainframe password | Yes (z/OS Connect) |
Root keys (KEK) are stored in the HSM and never leave the hardware. Data encryption keys (DEK) are wrapped by root keys for safe storage alongside ciphertext.
REST APIs that automatically map JSON payloads to COBOL copybooks, enabling access to CICS transactions, IMS programs, and batch jobs.
@modelcontextprotocol/sdk -- MCP protocol SDK
@ibm-cloud/ibm-key-protect -- Key Protect client
ibm-cloud-sdk-core -- IBM Cloud authentication
This server cannot be installed
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Governed MCP gateway: one endpoint for your tools, with credential custody and audit log.
Cloud-hosted MCP server for secure AI access to enterprise data sources via CData Connect AI.
MCP server for Product Management
MCP server for mandates, delegation, policy-gated execution, credential grants, and audit.
