ibm-i-5250-mcp
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@ibm-i-5250-mcpopen order entry on PROD, put the cursor on the fifth line and delete it"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
ibm-i-5250-mcp
An MCP server that lets AI tools like Claude Code drive IBM i 5250 green screens, the way the Playwright MCP server drives web pages. An agent opens a session, sees the screen in a structured form, types into fields, presses keys, and reads the result back.
Interactive RPG is the code nobody can test automatically: it only exists when a display file is on a screen and someone is typing into it. The source says what should happen and nothing says what did. This server hands an assistant the screen itself, so a program can be driven, watched and pinned down with tests that run again after every compile.
It speaks TN5250 straight over a socket, negotiating BINARY, TERMINAL-TYPE, END-OF-RECORD and NEW-ENVIRON the way a real terminal does. No emulator, no JVM, no SSH tunnel, nothing to install on the IBM i, and pure Node on the client. If the telnet server is started, which it is by default, this works.
Example workflow
Say you ask: "open order entry on PROD, put the cursor on the fifth line and delete it."
session_open(server: "PROD")signs on and returns the first screen.screen_do(actions: ["type f1: 1", "key: Enter"])walks the menus. Typing and the key travel as one exchange, because a 5250 holds typing locally and transmits nothing until an AID key.Every action returns a snapshot: the literal screen, plus the format table with stable refs.
screen: signature 8156d875c512 size: 24x80 cursor: 18,7 keyboard: unlocked ....5....1....5....2....5....3....5....4....5....5....5....6....5....7....5....8 1 | Command Entry MYBOX1 | 2 | Request level: 1 | 17 | Type command, press Enter. | 18 | ===> | 22 | F3=Exit F4=Prompt F9=Retrieve F10=Include detailed messages | fields: 1 input, 0 output [f1] 18,7 len 313 INPUT ""Blank rows are dropped and real row numbers kept.
screen_do(actions: ["cursor: 6,2", "key: F2"])opens the confirmation window the program paints. The snapshot now carries the window's field, and the cursor is inside it.screen_do(actions: ["type f23: Y", "key: Enter"])answers it.run_testsreplays the whole thing from a Markdown file after the next compile, so the answer stays answered.
Related MCP server: ibmi-mcp
The live view
Set IBMI_5250_VIEWER=true to turn it on. session_open then starts a small page on your machine
and returns its URL. Open it once and watch the green screen repaint as the agent works, in the real
5250 colours, with the cursor and keyboard state.
The page is non interactive, so it is there to watch and nothing more. It runs on
http://127.0.0.1:5250, or whatever port you set in IBMI_5250_VIEWER_PORT, and the URL carries a
token that is new for every session.
Requirements
Node 18 or newer on the client.
A telnet server running on the IBM i, which is the default. Port 23 plain, or 992 for TLS.
A user profile to sign on with. Make a dedicated one rather than using your own, because a green screen has a command line. See Security for more info.
Install
Run it straight from npm with npx (no build), or clone and build from source. Either way, all
settings live in a .env file (see Configuration).
Option A: from npm
Register the server with Claude Code:
claude mcp add ibmi-5250 --scope user -- npx -y ibm-i-5250-mcpOr install it once and point at the binary:
npm install -g ibm-i-5250-mcp
claude mcp add ibmi-5250 --scope user -- ibm-i-5250-mcpThen create a .env with your connection details in ~/.ibm-i-servers/ if the other IBM i MCP
servers should use it too, or in ~/.ibm-i-5250-mcp/ if only this one should (create the folder if
it does not exist). Restart Claude Code or run /mcp. A package installed from npm or run with npx
has no stable folder of its own (the npx copy lives in a cache that is wiped on every update), so a
home folder is the reliable place to keep credentials. See Configuration for the full search order.
Option B: from source
git clone https://github.com/SH4RKKK/ibm-i-5250-mcp && cd ibm-i-5250-mcp
npm install && npm run build
cp .env.example .env
claude mcp add ibmi-5250 --scope user -- node "$PWD/dist/index.js"Fill in the required values in your .env (the optional ones are under Configuration):
IBMI_HOST=your.ibmi.host
IBMI_USER=MYUSER
IBMI_PASSWORD=changemeRestart Claude Code or run /mcp and the tools show up. Built from source, the server reads the
.env from its own folder, so it works no matter which directory Claude Code launches it from.
Configuration
All configuration lives in a .env file. The server looks for it in these places, first match wins,
and the first file found supplies the whole profile rather than being merged with the others:
a folder you name yourself in
IBMI_MCP_CONFIG_DIR. Set it on the MCP server entry rather than in your shell, because your MCP client launches the server, not you:claude mcp add ibmi-5250 --env IBMI_MCP_CONFIG_DIR=/path/to/folder -- npx -y ibm-i-5250-mcp~/.ibm-i-servers/, shared with the other IBM i MCP servers~/.ibm-i-5250-mcp/, for profiles only this server should seethe server's own install folder, next to
dist/, if you cloned and built from source
A real environment variable, if one is set, always takes precedence over a value in the file.
Put a box in ~/.ibm-i-servers/ and every IBM i MCP server you run picks it up from there, so its
host, user and password are written once instead of once per server. Use ~/.ibm-i-5250-mcp/ only
for a box this server should reach and the others should not, and note that the shared folder wins
when the same name is in both.
Variable | Required | Default | Purpose |
| yes | IBM i host or IP | |
| yes | user profile | |
| yes | password | |
| no | virtual device to claim. Set a fixed name, or the host picks a | |
| no |
|
|
| no |
| EBCDIC code page. 273 German, 500 international, 1140 US with the euro sign |
| no |
| terminal type to negotiate. |
| no |
| accept any certificate on 992, self signed included |
| no |
|
|
| no |
| falls back to a free port when this one is busy |
| no | typed into Current library at sign on | |
| no | typed into Program/procedure at sign on | |
| no | typed into Menu at sign on | |
| no |
|
|
| no | extra verbs allowed on a command line in restricted mode | |
| no | extra verbs refused when restricted mode is off |
The screen size is not a setting. The host picks it per screen with Clear Unit or Clear Unit Alternate, so one session renders a 24x80 program at 24x80 and a 132 column one at 132.
Restricted mode
Restricted mode is an allowlist, and it is on unless you set IBMI_RESTRICTED=false. Ten job scoped
commands can be typed on a command line and everything else is refused: call, strdbg, enddbg,
chgcurlib, addlible, rmvlible, chglibl, dsplibl, edtlibl and signoff. Put your own
start command in IBMI_ALLOWED_CL.
Turn it off and nothing is refused unless IBMI_BLOCKED_CL names it. There is no built in denylist,
because all the guard ever sees is text going into a field. Guessing at destructive verbs by prefix
would read as protection without being any.
See assertCommandAllowed in src/guard.ts.
Multiple servers
To work with more than one IBM i, add one env file per box next to .env. The name after .env. is
the server name.
.env the default server
.env.PROD a server named PROD
.env.DEV a server named DEVEach file holds the same variables for that box. You never type the server name yourself:
session_open takes an optional server argument and the assistant fills it in from what you say,
so "open a session on PROD" loads .env.PROD. Say nothing about a box and it uses .env.
list_servers is how the assistant learns which names exist.
Tools
Session
session_open: connects, signs on and returns the first screen. Clears the device level screens in the way, including the "Attempt to Recover Interactive Job" one a previous dropped session leaves behind.device,library,programandmenuoverride the profile for this session.session_close: signs off and releases the device. It presses its way out of an application first, using F12 to decline a screen that is asking something and F3 otherwise, both of which discard rather than commit.list_servers: the configured boxes, the sessions currently open, and the folders that were searched.
Drive the screen
screen_do: takes a list of actions, runs them in order, and returns only the final screen. Three action forms, the same ones a test file uses:Action
Does
type f1: ACME LTDput text in a field, by ref, by
row,col, or by DDS name once knownkey: EnterEnter, F1 to F24, PageUp, PageDown, Help, Clear, Print
cursor: 6,53move the cursor before the key
Cursor position is an argument to the key, which is why it has its own action: Help on a message line explains that message, Help anywhere else explains the field under it. If an action fails the run stops there, and the error names the action and returns the screen as it stands.
screen_snapshot: the current screen, changing nothing.
Tests
run_tests: replays the screen tests inscreen-tests/and reports what passed. Opens its own session when none is given, and signs it off afterwards.
Screen tests
Work in progress. The format below runs, but expect it to change.
A test is a Markdown file in screen-tests/. Prose is ignored, so the file reads as a specification,
and the runner only looks at two fenced blocks: 5250-do for the same action lines screen_do takes,
and 5250-expect for checks.
```5250-do
type f1: call mylib/ordentr
key: Enter
```
```5250-expect
text: Order Entry
message: none
fields: 4 input
```Run them in conversation with run_tests, or from a terminal:
node scripts/test.mjs # screen-tests/ on the default box
node scripts/test.mjs screen-tests MYBOX # a folder, or one .md file
node scripts/test.mjs screen-tests MYBOX ordentr # only tests whose file name matchesFrom a terminal it exits non zero when anything failed, so a build job can gate on it.
A 5250-expect block asserts what the screen should look like. text and not text look for a
substring, message for a message id or none, fields for the number of input fields, and
field f1 for one field's exact value. cursor, keyboard and signature check where the cursor
sits, whether the keyboard is locked, and whether the layout still matches.
screen-tests/example.md explains each one in full.
Progress and logging
Tools narrate while they run, so a slow box looks slow rather than hung.
Live updates go out as MCP progress notifications
when the client asks for them, which Claude Code does: signing on as MYUSER, pressing F3 to reach a screen with a command line, running test 2 of 7. Clients that do not ask get the same messages
as info level log notifications instead. Everything is mirrored to stderr, because stdout is the
JSON-RPC channel and anything printed there would corrupt the protocol.
When nothing has happened for eight seconds a watchdog repeats the last step with the elapsed time
(still working: pressing Enter (24s elapsed)). A host that never answers times out after 15
seconds, and the error names the request it was last waiting on and returns the trail with timings.
Security
This server signs on to your IBM i and types into whatever screen is in front of it. A green screen has a command line, so anything driving it can type a CL command into a field and press Enter. Treat it like any tool that can act on the box.
Least privilege first. The server can do exactly what the profile in the env file can do, so give it one that reaches the program under test and nothing else. Add
lmtcpb(*yes)and IBM i itself refuses almost everything typed on a command line. Restricted mode narrows it further.Password masking. Anything the screen hides while you type it stays hidden. Your password never shows up in what the assistant reads, in the live view, or in the logs.
The live view. A non interactive page, served on 127.0.0.1 only, gated by a token that is new for every session.
Prompt injection. Screen text, message lines and field values come back to the model as untrusted text. A program could paint text that tries to steer the assistant into typing something. The controls above limit what that could actually do.
Secrets. Credentials live in
.envand.env.*. Keep them readable only by you.
Project layout
src/
index.ts tool registration
session.ts one 5250 session
telnet.ts TN5250 transport
screen.ts screen buffer and format table
inbound.ts records sent to the host
codes.ts 5250 code tables
guard.ts the command line guard
ebcdic.ts EBCDIC tables
snapshot.ts the LLM facing view of a screen
render.ts the live view page
viewer.ts the live view server
config.ts config discovery and the Profile loader
testrun.ts the screen test runner
report.ts progress and logging
types.ts shared types
selfcheck.ts npm run check, the test suite
scripts/
smoke.mjs live smoke test
test.mjs screen tests from a terminal
test/fixtures/
signon.bin a sign on record, for the test suiteAcknowledgements
Written from scratch, building on the work of others:
green-screen-react (MIT): the 5250 code tables were adapted from
packages/proxy/src/tn5250/constants.ts.tn5250 (LGPL-2.1): read as reference for the data stream and the save screen and query replies. No code was copied.
Thanks to those teams and the wider IBM i community.
License
Apache-2.0. See LICENSE and NOTICE. The 5250 code tables adapted from green-screen-react keep their MIT license, which NOTICE carries in full. The dependencies keep their own licenses (MIT and BSD-2-Clause), both of which are compatible with Apache-2.0.
Available Tools
6 toolslist_serversA
List the configured IBM i servers, named by the .env. files on disk, plus the keys screen_do accepts.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It transparently discloses that the server list is derived from .env.<name> files on disk and that return content includes screen_do keys. It does not state output format or explicitly confirm it is a read-only operation, but the verb 'List' makes the lack of side effects reasonably clear.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence, front-loaded with the action and resource, with no filler. Every part adds useful information about what the tool returns.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple zero-parameter listing tool, the description is adequate: it names the resource, the source of server names, and the additional keys included in the result. A slightly more explicit statement of output shape would make it fully complete since no output schema is provided.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the description does not need to explain any. The schema already covers this fully, and the baseline for no-parameter tools applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') and names a concrete resource ('configured IBM i servers'), and it further clarifies the naming source ('named by the .env.<name> files on disk') and that it also exposes the keys screen_do accepts. This clearly distinguishes it from sibling tools like session_open and screen_do.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage context is implied: an agent would call this to discover available servers and screen_do keys before using other session tools. However, the description does not explicitly state when to use this versus alternatives, nor does it provide exclusions or ordering guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
run_testsA
Replay screen regression tests against a program and report what passed. A test is a Markdown file with 5250-do blocks (the same action lines screen_do takes) and 5250-expect blocks (checks against the screen that came back), so it reads as a specification. Use this after compiling a change to see whether the display behaviour it was supposed to keep still holds, or before making one to write the expected screens first and watch them fail. Opens its own session and closes it, unless you pass session to reuse one that is already open.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | a test file, or a directory of *.md tests to run in name order (default: "screen-tests") | |
| filter | No | only run tests whose file name contains this, ignoring case | |
| server | No | which IBM i to use, named by a .env.<name> file. Omit for the default .env server | |
| session | No | reuse this already open session instead of opening and closing one. The session is left where the last test finished |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the full disclosure burden. It covers the test file format, the outcome ('report what passed'), and important session lifecycle behavior: opens/closes its own session unless `session` is passed, and leaves the session where the last test finished. It does not disclose failure behavior or output format, but the added session context is genuinely useful and goes beyond the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four sentences, each earning its place: the main action, the test format, the recommended usage timing, and the session behavior. The primary verb and result are front-loaded, and there is no repetition of schema properties or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with four fully documented optional parameters, the description is close to complete: it explains what a test is, when to run it, and the session side effects. The main gap is 'report what passed' — there is no output schema and no detail about how pass/fail results are presented, though this is a minor omission for a test runner.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema documents all four parameters with descriptions (100% coverage), so the baseline is 3. The description adds useful background on authoring test files with 5250-do/5250-expect blocks, which helps an agent understand the tool's domain, but it does not add parameter-specific meaning beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'Replay screen regression tests against a program and report what passed.' It also distinguishes itself from siblings by explaining the 5250-do/5250-expect Markdown test format and how it relates to screen_do, making it clear this is the batch test-runner rather than an interactive screen tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit timing guidance: 'Use this after compiling a change... or before making one...' to verify preserved behavior or drive expected screens. It also explains when to reuse a session versus letting the tool open and close its own. It does not explicitly name when-not-to-use alternatives, which keeps it just below a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
screen_doA
Drive the screen: type into fields, move the cursor and press keys, in one call. Actions run in order and only the final screen comes back, so put a whole interaction in one call instead of one action per call.
Each action is a line: "type f1: ACME LTD" put text in a field, by ref from the snapshot, by "row,col", or by DDS name once known "key: Enter" Enter, F1 to F24, PageUp, PageDown, Help, Clear, Print "cursor: 6,53" move the cursor, which is an argument to the key: Help on a message line explains that message, Help anywhere else explains the field under it
Typing sends nothing to the host. A 5250 holds it locally and transmits only on a key, so ["type f1: ACME", "type f2: 100", "key: Enter"] is one exchange with the box, not three. If an action fails the run stops there and the error names it, with the screen as it stands.
| Name | Required | Description | Default |
|---|---|---|---|
| actions | Yes | the actions, in order, e.g. ["type f1: ACME LTD", "key: Enter"] | |
| session | No | which open session to act on. Omit unless you opened more than one (default: "default") |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it delivers: it discloses execution order, failure semantics ('If an action fails the run stops there and the error names it'), and the 5250 transmission model where typing sends nothing to the host until a key is pressed. This prevents a caller from assuming per-action round-trips.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Every sentence earns its place: overview, batch rationale, action grammar, network-behavior caveat, and failure mode. The most important facts are front-loaded, and the examples make the syntax immediately understandable without padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description still states what is returned ('only the final screen comes back') and what happens on failure. With no annotations, it explains the host-communication behavior and stopping semantics. Together this is enough for an agent to construct valid, correctly batched calls.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although schema coverage is 100%, the description adds a full action mini-language beyond the schema: valid prefixes like 'type', 'key', and 'cursor', accepted key names, field-addressing modes (ref, row,col, DDS name), and cursor behavior. It also clarifies the session parameter's default behavior and when to omit it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a concrete action and resource: 'Drive the screen: type into fields, move the cursor and press keys, in one call.' It clearly enumerates what the tool does and its one-call scope, and it distinguishes itself from observational siblings like screen_snapshot by being the interactive/input-driving tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit usage guidance: batch a whole interaction into one call rather than one action per call, with a rationale about order and the final screen. However, it does not explicitly name sibling alternatives such as screen_snapshot for read-only inspection, so the when-not-to-use guidance is implied rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
screen_snapshotA
Return the current screen without changing anything: the literal screen text, the field list with refs, the cursor position, the keyboard state and any message line. Use this to look before acting.
| Name | Required | Description | Default |
|---|---|---|---|
| session | No | which open session to act on. Omit unless you opened more than one (default: "default") |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and performs well: it explicitly states 'without changing anything' and lists the full return payload (screen text, field list, cursor, keyboard, message line), making the non-destructive behavior unmistakable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence that front-loads the verb and scope, then a dense colon list of return components and a final usage pointer. No filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description fully specifies what the snapshot contains and its safety profile, and the schema resolves the session selection. For a simple read-only tool without an output schema, nothing essential is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the only parameter (session), including a default and guidance on when to omit it. The description adds no further parameter detail, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clear verb+resource: 'Return the current screen' plus an explicit enumeration of the snapshot contents. The qualifier 'without changing anything' differentiates it from action tools like screen_do.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Use this to look before acting' gives explicit timing guidance and implies it precedes mutation tools, but it does not name sibling alternatives or state when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
session_closeA
Sign off and close the session, releasing the virtual device. Always do this when finished: just dropping the connection leaves a disconnected interactive job on the box, so the next run meets an "Attempt to Recover Interactive Job" screen instead of the application, and it holds licensed interactive capacity.
| Name | Required | Description | Default |
|---|---|---|---|
| session | No | which open session to act on. Omit unless you opened more than one (default: "default") | |
| signOff | No | type signoff on the command line first, when the screen has one (default: true). Pass false to drop the connection immediately |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses important behavioral traits beyond the schema: it releases the virtual device, and it warns that simply dropping the connection leaves a disconnected interactive job that can cause problems on the next run. It also explains the impact on licensed interactive capacity. Since no annotations are provided, the description carries the full burden, and it does so well, though it could mention whether the operation is reversible or if it requires confirmation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and front-loaded with the core action ('Sign off and close the session, releasing the virtual device'), followed by a clear directive and consequence. Every sentence earns its place, and the warning about the 'Attempt to Recover Interactive Job' screen is valuable context without being verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (2 optional parameters, no output schema), the description is quite complete. It explains the purpose, the consequence of misuse, and the parameter behavior. It could be slightly more complete by mentioning what happens after closing (e.g., whether the session is immediately terminated or if there's a grace period), but overall it provides enough context for an agent to use it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 100%, so the schema already documents both parameters ('session' and 'signOff'). The description adds context about the 'signOff' parameter by explaining the default behavior ('type signoff on the command line first') and the alternative ('Pass false to drop the connection immediately'). However, it doesn't add much beyond what the schema already states, so a baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Sign off and close the session, releasing the virtual device.' It uses a specific verb ('close') and resource ('session'), and distinguishes it from siblings like session_open by focusing on the teardown action. The description also explains the consequence of not using it, which further clarifies its role.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use this tool: 'Always do this when finished.' It also explains the negative consequence of not using it (leaving a disconnected interactive job, causing an 'Attempt to Recover Interactive Job' screen and holding licensed capacity). This provides clear guidance on when it is necessary, though it doesn't explicitly name alternatives, the context makes it obvious this is the closing counterpart to session_open.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
session_openA
Open a 5250 session to an IBM i and sign on, then return the first screen. Also starts a live view in the browser so a human can watch what you do. Returns a screen snapshot: the literal 24x80 screen plus a field list with refs you use in screen_do.
| Name | Required | Description | Default |
|---|---|---|---|
| menu | No | menu to land on at sign on. Overrides the profile | |
| device | No | virtual device name to claim, e.g. MCPDEV01. Overrides the profile. A fixed device makes a run reproducible | |
| server | No | which IBM i to use, named by a .env.<name> file. Omit for the default .env server | |
| signOn | No | sign on using the profile credentials (default: true). Pass false to stop at the sign on screen | |
| library | No | current library to set at sign on, typed into the Current library field. Overrides the profile | |
| program | No | program to land in at sign on, typed into the Program/procedure field. Overrides the profile | |
| session | No | a name for this session, so you can open more than one (default: "default") |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden, and it discloses two non-obvious behaviors: it starts a live browser view for a human observer, and its return value is a literal 24x80 screen plus a field list. It does not mention cleanup via session_close or failure behavior, but the key side effects and return contract are named.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler. The main action is front-loaded, followed by the browser side effect and the return contract, so every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description defines the return value, names the browser side effect, and references the downstream tool, which is strong for a tool with no output schema. It omits explicit lifecycle guidance such as closing the session with session_close or behavior when reopening the same session name, leaving a small but real gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already documents all 7 parameters with 100% coverage, so the description does not need to add per-parameter meaning. It usefully ties output field refs to screen_do, but that is output-oriented rather than parameter-oriented, matching the baseline for fully covered schemas.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific action and resource: 'Open a 5250 session to an IBM i and sign on, then return the first screen.' It also differentiates from siblings by defining the return artifact as a screen snapshot with field refs meant for screen_do, so an agent can tell it apart from screen_snapshot and screen_do.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description establishes clear context: use it at the start of a session, and the returned field refs are explicitly tied to screen_do, giving natural next-step guidance. It does not explicitly state when not to use it (e.g., if a session already exists, prefer screen_snapshot), so it stops short of full exclusion criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v0.1.0- First observed
list_servers - First observed
run_tests - First observed
screen_do - First observed
screen_snapshot - First observed
session_close - First observed
session_open
TDQS
Scored across 6 tools
Each tool owns a distinct responsibility: session lifecycle (open/close), passive inspection (screen_snapshot), active interaction (screen_do), regression testing (run_tests), and configuration (list_servers). Even though screen_snapshot and screen_do both return screens, one is inspect-only and the other is action-driven, so there is no real ambiguity.
The resource-prefixed names like session_open, session_close, and screen_do are readablearke, but the convention is not uniform: screen_snapshot is a noun phrase while run_tests and list_servers use verb_noun order. All names share lowercase snake_case, but an agent cannot consistently predict whether the verb appears first or last.
Six tools is well-scoped for a 5250 automation server: session lifecycle, inspection, action, testing, and server discovery each get one clear tool. There is no redundancy or bloat, and each tool earns its place.
The surface covers the full session lifecycle and interaction loop: open, snapshot, act, close, plus regression testing and server discovery. screen_do's combined action syntax handles typing, cursor movement, and keys in one exchange, so there are no obvious dead ends for the intended domain.
Maintenance
Related MCP Connectors
Eyes and hands on real Windows PCs — observe, click, type via Glasswarp API.
AI-powered browser automation — navigate, click, fill forms, and extract data from any website.
Hosted browser for AI agents: screenshots, post-JS DOM, console, WCAG. No install, no API key.
Undetectable cloud browser sessions for AI agents and scrapers. Navigate, extract, click, captcha.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceEnables AI agents to interact with IBM i systems through the Model Context Protocol, providing secure SQL-based access to Db2 for i databases for querying, monitoring, and executing operations.Apache 2.0
- AlicenseAqualityCmaintenanceGive your AI Agent terminal access to your IBM i system via TN5250. ibmi-mcp is an MCP server that lets AI Agents like Claude interact with IBM i the same way a human would through a 5250 green-screen terminal.814BSD 2-Clause "Simplified"
- AlicenseBqualityDmaintenanceEnables AI-driven browser automation with advanced form testing, batch operations, and intelligent element extraction for MCP-compatible applications.1445 npmMIT
- AlicenseNot gradedqualityDmaintenanceEnables AI assistants to securely interact with IBM i (AS/400) systems via ODBC, supporting SQL queries, CL commands, source code reading, compilation, and spoolfile analysis.2MIT