/ 100

1 month ago

npm

IBM/ibmi-mcp-server

Item: IBM/ibmi-mcp-server
Rating: 50
Author: M8ven

A production-grade MCP server for IBM i

→ IBM/ibmi-mcp-server· npm: @ibm/ibmi-mcp-server· listed on npm

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

npm

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

🚨

Secret credentials may flow to a network call

1 flow detected: IBMI_MCP_ACCESS_TOKEN. We can’t prove the destination matches the brand the credential belongs to.

🔐

You'll be asked for 6 credentials: DB2i_PASS, IBMI_MCP_ACCESS_TOKEN, NEXT_PUBLIC_OS_SECURITY_KEY, OPENAI_API_KEY, ANTHROPIC_API_KEY, WATSONX_API_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// known CVEs in dependencies1 medium2 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

mediumajv@8.12.0GHSA-2g4f-4pwh-qvx6

ajv has ReDoS when using `$data` option

lowjs-yaml@4.1.0GHSA-h67p-54hq-rp68

JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases

lowjs-yaml@4.1.0GHSA-mh29-5h37-fv8m

js-yaml has prototype pollution in merge (<<)

Depend on this server? Get alerted when its CVEs change.Watch this server free →

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configDB2i_HOST— your-ibmi-host.com

configDB2i_IGNORE_UNAUTHORIZED

configDB2i_JDBC_OPTIONS

🔐 secretDB2i_PASS— your-password

configDB2i_USER— your-username

🔐 secretIBMI_MCP_ACCESS_TOKEN

configIBMI_SYSTEM

configMCP_LOG_LEVEL

configMCP_SERVER_CONFIG— e =/.env \

configMCP_TRANSPORT_TYPE

🔐 secretNEXT_PUBLIC_OS_SECURITY_KEY

configSHELL

configTOOLS_YAML_PATH

configDB2i_PORT— By default, Mapepire runs on port 8076. You'll need this port number when configuring the variable in your .env file.

configIBMI_AGENT_MODEL

configIBMI_MCP_SERVER_URL

configIBMI_AGENT_LOG_LEVEL

🔐 secretOPENAI_API_KEY

🔐 secretANTHROPIC_API_KEY

configAGENT_CONFIG_PATH

configMCP_URL

configMCP_TRANSPORT

🔐 secretWATSONX_API_KEY

configWATSONX_PROJECT_ID

configWATSONX_SPACE_ID

configWATSONX_URL

configWATSONX_BASE_URL

configWATSONX_MODEL_ID

configWATSONX_VERIFY

configOPENAI_ORGANIZATION

configOPENAI_BASE_URL

configLOG_LEVEL

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 0 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/ibm-ibmi-mcp-server-uxvlry)](https://m8ven.ai/mcp/ibm-ibmi-mcp-server-uxvlry)

commit: 9a774d2878d9ab9f35eb3630545866e757dc76d8

code hash: 07d8a1433da9d1722caf73c81277f84444b6098bb1310194d0a8dfe4a0067c09

verified: 6/16/2026, 1:00:56 PM

view raw JSON →