# @ztechlab/mcp-server-yubikey

MCP server that exposes YubiKey management tools to AI agents via the [ykman](https://developers.yubico.com/yubikey-manager/) CLI.

Read-only. No writes, no resets, no destructive operations.

## Prerequisites

- [YubiKey Manager CLI](https://www.yubico.com/support/download/yubikey-manager/) (`ykman`) installed and on PATH
- A YubiKey connected via USB
- Node.js 18+

## Install

```bash
npm install -g @ztechlab/mcp-server-yubikey
```

## Configuration

### Claude Code

Add to your `.mcp.json`:

```json
{
  "mcpServers": {
    "yubikey": {
      "command": "mcp-server-yubikey"
    }
  }
}
```

### Claude Desktop

Add to your Claude Desktop config (`claude_desktop_config.json`):

```json
{
  "mcpServers": {
    "yubikey": {
      "command": "npx",
      "args": ["-y", "@ztechlab/mcp-server-yubikey"]
    }
  }
}
```

### Custom ykman path

If `ykman` is not on PATH, set the `YKMAN_PATH` environment variable:

```json
{
  "mcpServers": {
    "yubikey": {
      "command": "mcp-server-yubikey",
      "env": {
        "YKMAN_PATH": "C:/Program Files/Yubico/YubiKey Manager CLI/ykman.exe"
      }
    }
  }
}
```

## Tools

All tools are read-only. Tools that accept a `serial` parameter will use the only connected key if omitted.

| Tool | Description |
|------|-------------|
| `yubikey-list` | List all connected YubiKeys with serial numbers |
| `yubikey-info` | Device details: serial, firmware, model, interfaces, enabled applications |
| `yubikey-otp-info` | OTP slot configuration (Slot 1 and Slot 2 status) |
| `yubikey-fido-info` | FIDO2 applet status: PIN set, credentials stored, remaining retries |
| `yubikey-fido-credentials` | List FIDO2 resident credentials (passkeys). Requires PIN. |
| `yubikey-fido-fingerprints` | List enrolled fingerprints (YubiKey Bio). Requires PIN. |
| `yubikey-piv-info` | PIV application status: management key type, PIN/PUK retries, certificate slots |
| `yubikey-piv-keys-info` | PIV key metadata for a specific slot (9a, 9c, 9d, 9e) |
| `yubikey-openpgp-info` | OpenPGP application status: key slots, touch policies, signature count |
| `yubikey-openpgp-keys-info` | OpenPGP key slot metadata (sig, enc, aut, att) |

## Examples

Once configured, ask your AI agent:

- "What YubiKey is plugged in?"
- "Show me the FIDO2 status on my YubiKey"
- "What PIV certificates are on this key?"
- "List the OTP slot configuration"

## License

MIT