Mainframe MCP Server

Connect this server

This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.

claude mcp add mainframe-mcp-server -e 'ZOSMF_HOST=<ZOSMF_HOST>' -- npx -y @notharshhaa/mainframe-mcp-server

{
  "mcpServers": {
    "mainframe-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@notharshhaa/mainframe-mcp-server"
      ],
      "env": {
        "ZOSMF_HOST": "<ZOSMF_HOST>"
      }
    }
  }
}

[mcp_servers.mainframe-mcp-server]
command = "npx"
args = ["-y", "@notharshhaa/mainframe-mcp-server"]
env = { ZOSMF_HOST = "<ZOSMF_HOST>" }

{
  "mcpServers": {
    "mainframe-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@notharshhaa/mainframe-mcp-server"
      ],
      "env": {
        "ZOSMF_HOST": "<ZOSMF_HOST>"
      }
    }
  }
}

{
  "servers": {
    "mainframe-mcp-server": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "@notharshhaa/mainframe-mcp-server"
      ],
      "env": {
        "ZOSMF_HOST": "<ZOSMF_HOST>"
      }
    }
  }
}

Put your own value in place of <ZOSMF_HOST> (z/OSMF hostname or IP address). The author’s registry entry marks it as required.

Optional settings from the registry entry, left out of the block above: ZOSMF_PORT (z/OSMF HTTPS port (default 443)), ZOSMF_BASE_PATH (Optional API gateway or mediation layer prefix for z/OSMF), ZOSMF_USER (z/OS user id (required with ZOSMF_PASSWORD unless ZOSMF_TOKEN is set)), ZOSMF_PASSWORD (Password for basic auth (required with ZOSMF_USER unless ZOSMF_TOKEN is set)), ZOSMF_TOKEN (Auth token (alternative to user/password)), ZOSMF_TOKEN_TYPE (Token type when using ZOSMF_TOKEN (e.g. LTPA2)), ZOSMF_REJECT_UNAUTHORIZED (Verify TLS certificates (true in production)), ZOSMF_CERT (PEM client certificate file path for mTLS auth), ZOSMF_CERT_KEY (PEM client key file path for mTLS auth (required with ZOSMF_CERT)), ZOSMF_TOKEN_FILE (Read ZOSMF_TOKEN from this file at startup (vault/agent injection)), ZOSMF_USER_ID (End-user id for PassTicket identity propagation (RACF sees this user, not the service account)), ZOSMF_PASSTICKET_APP (RACF PTKTDATA application name for PassTicket generation (default ZOSMF)), ZOWE_TEAM_CONFIG (Path to a zowe.config.json to import connection settings from (env vars win)), ZOSMF_PROFILE (Profile name inside the Zowe team config (defaults to defaults.zosmf)), LOG_LEVEL (Log level: fatal, error, warn, info, debug, trace, silent), MCP_TRANSPORT (Transport: stdio (IDE) or sse (legacy HTTP+SSE for container/network deployments)), MCP_SSE_PORT (Listen port when MCP_TRANSPORT=sse), MAX_JOB_OUTPUT_LINES (Max lines returned from a single spool DD), MAX_DATASET_READ_LINES (Max lines returned from dataset or USS reads), MAX_JES_SPOOL_FILES (Max spool files fetched during diagnostics), MAX_AUDIT_LINES (Max RACF audit log lines per query), CMCI_CONTEXT (CICSplex name or region APPLID (required for CICS tools)), CMCI_HOST (CMCI hostname (defaults to ZOSMF_HOST)), CMCI_PORT (CMCI HTTPS port (default 1490)), CMCI_BASE_PATH (CMCI REST base path), DB2_LOCATION (Db2 subsystem location name (required for Db2 tools)), DB2_HOST (Db2 REST hostname (defaults to ZOSMF_HOST)), DB2_PORT (Db2 REST port (default 50400)), DB2_BASE_PATH (Db2 REST base path), SMF_SUMMARY_DATASET (Optional SMF summary dataset for offline metrics), RMF_METRICS_ENABLED (Query z/OSMF RMF metrics when available), RACF_AUDIT_USS_PATH (USS path to RACF audit log file), RACF_AUDIT_DATASET (Sequential dataset containing RACF audit records), SECURITY_READ_ONLY (When true (default), blocks write tools such as submit_jcl), SECURITY_ALLOWED_TOOLS (Comma-separated allowlist of MCP tool names), SECURITY_BLOCKED_TOOLS (Comma-separated blocklist of MCP tool names), SECURITY_ALLOWED_DATASET_PATTERNS (Comma-separated dataset patterns (e.g. USERDEV.*,SYS1.*)), SECURITY_ALLOWED_USS_PATHS (Comma-separated USS path prefixes), SECURITY_AUDIT_LOGGING (Log every tool invocation to stderr (SIEM-friendly JSON)), SECURITY_MAX_JCL_BYTES (Maximum inline JCL size for submit_jcl), SECURITY_WRITE_APPROVAL (Human-in-the-loop: submit_jcl returns a one-time token and approve_write executes (default false)), SECURITY_JCL_SCAN (Pre-flight scan JCL before submission: IDCAMS DELETE, IEFBR14 DISP DELETE, blocked utilities (default true)), SECURITY_JCL_SCAN_STRICT (Strict scan mode: WARN findings also block submissions (default false)), SECURITY_BLOCKED_PROGRAMS (Comma-separated EXEC programs that may never run (extends ADRDSSU,ICKDSF,IEHINITT)), SECURITY_BLOCKED_JOB_CLASSES (Comma-separated JES job classes that may never be used), SECURITY_CHANGE_TICKET_PATTERN (Regex a changeTicket argument must match on writes, e.g. CHG[0-9]{6}), SECURITY_WRITE_WINDOW (Allowed write window, 24h HH:MM-HH:MM (overnight ranges allowed), e.g. 08:00-18:00), SECURITY_WRITE_DAYS (Weekdays writes are allowed: 0=Sun..6=Sat, e.g. 1-5), SECURITY_WRITE_WINDOW_TZ (IANA timezone for the write window (default UTC)).