Back to Browse

Mainframe MCP Server

Developer ToolsUse Caution4.8MCP RegistryLocal
Free

Server data from the Official MCP Registry

MCP server for IBM z/OS jobs, datasets, USS, and operational diagnostics via Zowe SDK.

About

MCP server for IBM z/OS jobs, datasets, USS, and operational diagnostics via Zowe SDK.

Security Report

4.8
Use Caution4.8High Risk

Valid MCP server (2 strong, 3 medium validity signals). 7 known CVEs in dependencies (0 critical, 4 high severity) Package registry verified. Imported from the Official MCP Registry. Trust signals: trusted author (3/3 approved).

6 files analyzed · 8 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

file_system

Check that this permission is expected for this type of plugin.

What You'll Need

Set these up before or after installing:

z/OSMF hostname or IP addressOptional

Environment variable: ZOSMF_HOST

z/OSMF HTTPS port (default 443)Optional

Environment variable: ZOSMF_PORT

Optional API gateway or mediation layer prefix for z/OSMFOptional

Environment variable: ZOSMF_BASE_PATH

z/OS user id (required with ZOSMF_PASSWORD unless ZOSMF_TOKEN is set)Optional

Environment variable: ZOSMF_USER

Password for basic auth (required with ZOSMF_USER unless ZOSMF_TOKEN is set)Required

Environment variable: ZOSMF_PASSWORD

Auth token (alternative to user/password)Required

Environment variable: ZOSMF_TOKEN

Token type when using ZOSMF_TOKEN (e.g. LTPA2)Optional

Environment variable: ZOSMF_TOKEN_TYPE

Verify TLS certificates (true in production)Optional

Environment variable: ZOSMF_REJECT_UNAUTHORIZED

PEM client certificate file path for mTLS authOptional

Environment variable: ZOSMF_CERT

PEM client key file path for mTLS auth (required with ZOSMF_CERT)Optional

Environment variable: ZOSMF_CERT_KEY

Read ZOSMF_TOKEN from this file at startup (vault/agent injection)Optional

Environment variable: ZOSMF_TOKEN_FILE

End-user id for PassTicket identity propagation (RACF sees this user, not the service account)Optional

Environment variable: ZOSMF_USER_ID

RACF PTKTDATA application name for PassTicket generation (default ZOSMF)Optional

Environment variable: ZOSMF_PASSTICKET_APP

Path to a zowe.config.json to import connection settings from (env vars win)Optional

Environment variable: ZOWE_TEAM_CONFIG

Profile name inside the Zowe team config (defaults to defaults.zosmf)Optional

Environment variable: ZOSMF_PROFILE

Log level: fatal, error, warn, info, debug, trace, silentOptional

Environment variable: LOG_LEVEL

Transport: stdio (IDE) or sse (legacy HTTP+SSE for container/network deployments)Optional

Environment variable: MCP_TRANSPORT

Listen port when MCP_TRANSPORT=sseOptional

Environment variable: MCP_SSE_PORT

Max lines returned from a single spool DDOptional

Environment variable: MAX_JOB_OUTPUT_LINES

Max lines returned from dataset or USS readsOptional

Environment variable: MAX_DATASET_READ_LINES

Max spool files fetched during diagnosticsOptional

Environment variable: MAX_JES_SPOOL_FILES

Max RACF audit log lines per queryOptional

Environment variable: MAX_AUDIT_LINES

CICSplex name or region APPLID (required for CICS tools)Optional

Environment variable: CMCI_CONTEXT

CMCI hostname (defaults to ZOSMF_HOST)Optional

Environment variable: CMCI_HOST

CMCI HTTPS port (default 1490)Optional

Environment variable: CMCI_PORT

CMCI REST base pathOptional

Environment variable: CMCI_BASE_PATH

Db2 subsystem location name (required for Db2 tools)Optional

Environment variable: DB2_LOCATION

Db2 REST hostname (defaults to ZOSMF_HOST)Optional

Environment variable: DB2_HOST

Db2 REST port (default 50400)Optional

Environment variable: DB2_PORT

Db2 REST base pathOptional

Environment variable: DB2_BASE_PATH

Optional SMF summary dataset for offline metricsOptional

Environment variable: SMF_SUMMARY_DATASET

Query z/OSMF RMF metrics when availableOptional

Environment variable: RMF_METRICS_ENABLED

USS path to RACF audit log fileOptional

Environment variable: RACF_AUDIT_USS_PATH

Sequential dataset containing RACF audit recordsOptional

Environment variable: RACF_AUDIT_DATASET

When true (default), blocks write tools such as submit_jclOptional

Environment variable: SECURITY_READ_ONLY

Comma-separated allowlist of MCP tool namesOptional

Environment variable: SECURITY_ALLOWED_TOOLS

Comma-separated blocklist of MCP tool namesOptional

Environment variable: SECURITY_BLOCKED_TOOLS

Comma-separated dataset patterns (e.g. USERDEV.*,SYS1.*)Optional

Environment variable: SECURITY_ALLOWED_DATASET_PATTERNS

Comma-separated USS path prefixesOptional

Environment variable: SECURITY_ALLOWED_USS_PATHS

Log every tool invocation to stderr (SIEM-friendly JSON)Optional

Environment variable: SECURITY_AUDIT_LOGGING

Maximum inline JCL size for submit_jclOptional

Environment variable: SECURITY_MAX_JCL_BYTES

Human-in-the-loop: submit_jcl returns a one-time token and approve_write executes (default false)Optional

Environment variable: SECURITY_WRITE_APPROVAL

Pre-flight scan JCL before submission: IDCAMS DELETE, IEFBR14 DISP DELETE, blocked utilities (default true)Optional

Environment variable: SECURITY_JCL_SCAN

Strict scan mode: WARN findings also block submissions (default false)Optional

Environment variable: SECURITY_JCL_SCAN_STRICT

Comma-separated EXEC programs that may never run (extends ADRDSSU,ICKDSF,IEHINITT)Optional

Environment variable: SECURITY_BLOCKED_PROGRAMS

Comma-separated JES job classes that may never be usedOptional

Environment variable: SECURITY_BLOCKED_JOB_CLASSES

Regex a changeTicket argument must match on writes, e.g. CHG[0-9]{6}Optional

Environment variable: SECURITY_CHANGE_TICKET_PATTERN

Allowed write window, 24h HH:MM-HH:MM (overnight ranges allowed), e.g. 08:00-18:00Optional

Environment variable: SECURITY_WRITE_WINDOW

Weekdays writes are allowed: 0=Sun..6=Sat, e.g. 1-5Optional

Environment variable: SECURITY_WRITE_DAYS

IANA timezone for the write window (default UTC)Optional

Environment variable: SECURITY_WRITE_WINDOW_TZ

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-notharshhaa-mainframe-mcp-server": {
      "env": {
        "DB2_HOST": "your-db2-host-here",
        "DB2_PORT": "your-db2-port-here",
        "CMCI_HOST": "your-cmci-host-here",
        "CMCI_PORT": "your-cmci-port-here",
        "LOG_LEVEL": "your-log-level-here",
        "ZOSMF_CERT": "your-zosmf-cert-here",
        "ZOSMF_HOST": "your-zosmf-host-here",
        "ZOSMF_PORT": "your-zosmf-port-here",
        "ZOSMF_USER": "your-zosmf-user-here",
        "ZOSMF_TOKEN": "your-zosmf-token-here",
        "CMCI_CONTEXT": "your-cmci-context-here",
        "DB2_LOCATION": "your-db2-location-here",
        "MCP_SSE_PORT": "your-mcp-sse-port-here",
        "DB2_BASE_PATH": "your-db2-base-path-here",
        "MCP_TRANSPORT": "your-mcp-transport-here",
        "ZOSMF_PROFILE": "your-zosmf-profile-here",
        "ZOSMF_USER_ID": "your-zosmf-user-id-here",
        "CMCI_BASE_PATH": "your-cmci-base-path-here",
        "ZOSMF_CERT_KEY": "your-zosmf-cert-key-here",
        "ZOSMF_PASSWORD": "your-zosmf-password-here",
        "MAX_AUDIT_LINES": "your-max-audit-lines-here",
        "ZOSMF_BASE_PATH": "your-zosmf-base-path-here",
        "ZOSMF_TOKEN_FILE": "your-zosmf-token-file-here",
        "ZOSMF_TOKEN_TYPE": "your-zosmf-token-type-here",
        "ZOWE_TEAM_CONFIG": "your-zowe-team-config-here",
        "SECURITY_JCL_SCAN": "your-security-jcl-scan-here",
        "RACF_AUDIT_DATASET": "your-racf-audit-dataset-here",
        "SECURITY_READ_ONLY": "your-security-read-only-here",
        "MAX_JES_SPOOL_FILES": "your-max-jes-spool-files-here",
        "RACF_AUDIT_USS_PATH": "your-racf-audit-uss-path-here",
        "RMF_METRICS_ENABLED": "your-rmf-metrics-enabled-here",
        "SECURITY_WRITE_DAYS": "your-security-write-days-here",
        "SMF_SUMMARY_DATASET": "your-smf-summary-dataset-here",
        "MAX_JOB_OUTPUT_LINES": "your-max-job-output-lines-here",
        "ZOSMF_PASSTICKET_APP": "your-zosmf-passticket-app-here",
        "SECURITY_WRITE_WINDOW": "your-security-write-window-here",
        "MAX_DATASET_READ_LINES": "your-max-dataset-read-lines-here",
        "SECURITY_ALLOWED_TOOLS": "your-security-allowed-tools-here",
        "SECURITY_AUDIT_LOGGING": "your-security-audit-logging-here",
        "SECURITY_BLOCKED_TOOLS": "your-security-blocked-tools-here",
        "SECURITY_MAX_JCL_BYTES": "your-security-max-jcl-bytes-here",
        "SECURITY_WRITE_APPROVAL": "your-security-write-approval-here",
        "SECURITY_JCL_SCAN_STRICT": "your-security-jcl-scan-strict-here",
        "SECURITY_WRITE_WINDOW_TZ": "your-security-write-window-tz-here",
        "SECURITY_BLOCKED_PROGRAMS": "your-security-blocked-programs-here",
        "ZOSMF_REJECT_UNAUTHORIZED": "your-zosmf-reject-unauthorized-here",
        "SECURITY_ALLOWED_USS_PATHS": "your-security-allowed-uss-paths-here",
        "SECURITY_BLOCKED_JOB_CLASSES": "your-security-blocked-job-classes-here",
        "SECURITY_CHANGE_TICKET_PATTERN": "your-security-change-ticket-pattern-here",
        "SECURITY_ALLOWED_DATASET_PATTERNS": "your-security-allowed-dataset-patterns-here"
      },
      "args": [
        "-y",
        "@notharshhaa/mainframe-mcp-server"
      ],
      "command": "npx"
    }
  }
}

Reviews

No reviews yet

Be the first to review this server!