@ztechlab/mcp-server-yubikey
Allows reading YubiKey information via the ykman CLI, including device details, OTP slots, FIDO2 status and credentials, PIV certificates and keys, and OpenPGP status.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@@ztechlab/mcp-server-yubikeyWhat YubiKey is plugged in?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
@ztechlab/mcp-server-yubikey
MCP server that exposes YubiKey management tools to AI agents via the ykman CLI.
Read-only. No writes, no resets, no destructive operations.
Prerequisites
YubiKey Manager CLI (
ykman) installed and on PATHA YubiKey connected via USB
Node.js 18+
Related MCP server: Warden MCP Server
Install
npm install -g @ztechlab/mcp-server-yubikeyConfiguration
Claude Code
Add to your .mcp.json:
{
"mcpServers": {
"yubikey": {
"command": "mcp-server-yubikey"
}
}
}Claude Desktop
Add to your Claude Desktop config (claude_desktop_config.json):
{
"mcpServers": {
"yubikey": {
"command": "npx",
"args": ["-y", "@ztechlab/mcp-server-yubikey"]
}
}
}Custom ykman path
If ykman is not on PATH, set the YKMAN_PATH environment variable:
{
"mcpServers": {
"yubikey": {
"command": "mcp-server-yubikey",
"env": {
"YKMAN_PATH": "C:/Program Files/Yubico/YubiKey Manager CLI/ykman.exe"
}
}
}
}Tools
All tools are read-only. Tools that accept a serial parameter will use the only connected key if omitted.
Tool | Description |
| List all connected YubiKeys with serial numbers |
| Device details: serial, firmware, model, interfaces, enabled applications |
| OTP slot configuration (Slot 1 and Slot 2 status) |
| FIDO2 applet status: PIN set, credentials stored, remaining retries |
| List FIDO2 resident credentials (passkeys). Requires PIN. |
| List enrolled fingerprints (YubiKey Bio). Requires PIN. |
| PIV application status: management key type, PIN/PUK retries, certificate slots |
| PIV key metadata for a specific slot (9a, 9c, 9d, 9e) |
| OpenPGP application status: key slots, touch policies, signature count |
| OpenPGP key slot metadata (sig, enc, aut, att) |
Examples
Once configured, ask your AI agent:
"What YubiKey is plugged in?"
"Show me the FIDO2 status on my YubiKey"
"What PIV certificates are on this key?"
"List the OTP slot configuration"
License
MIT
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Latest Blog Posts
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/dazaffino/mcp-server-yubikey'
If you have feedback or need assistance with the MCP directory API, please join our Discord server