mainframe-mcp-server v3.0.0

Added

• Official packaging with supply-chain assurance.

  • Signed, SBOM-attached container image: releases publish
    ghcr.io/notharshhaa/mainframe-mcp-server (version/minor/SHA tags), built
    non-root with OCI labels and an SSE healthcheck, signed with Sigstore
    keyless cosign (sign-by-digest, verified in-workflow), with BuildKit
    provenance (mode=max) and SBOM attestations, plus SPDX and CycloneDX
    SBOMs attached to the GitHub release.
  • npm provenance: the package now publishes with --provenance
    (SLSA build provenance via GitHub Actions OIDC) — visible on npmjs.com
    and verifiable with npm audit signatures.
  • Helm chart (helm/mainframe-mcp-server/): SSE deployment hardened by
    default (non-root, read-only root filesystem, dropped capabilities, no
    service-account token), with values for the z/OSMF connection, BYO
    credentials Secret, policy-as-code ConfigMap mount, SIEM audit sinks,
    probes, ingress, and optional persistence for the file audit sink.
  • Release assets: npm tarball, package + image SBOMs (with cosign
    signatures), and a signed sha256sums.txt manifest on every GitHub
    release.
  • The Dockerfile keeps USER node; docker-compose now ships hardened
    defaults (read_only, cap_drop: ALL, no-new-privileges, tmpfs) and
    defaults to the official image; CI builds the image on every push and
    fails if it runs as root.

• Console & JES coverage. MVS operator commands through the z/OSMF Console
  API using a dynamically activated extended MCS console
  (ZOSMF_CONSOLE_NAME): issue_console_command (with follow-up message
  collection), get_console_messages (operations-log tail), hold_job /
  release_job (JES2 $HJ/$OJ), cancel_job (z/OSMF jobs API),
  get_wlm_status (D WLM displays), ims_command (IMS commands via the
  system console), get_hsm_activity (DFSMShsm recall/migration activity
  filtered from the operations log), and analyze_logrec (submits a canned
  EREP IFCEREP report job against LOGREC and summarizes record counts,
  abend codes, and modules). All command-issuing tools are governed writes.

• Batch scheduler integration. scheduler_job_status queries Control-M,
  CA 7, and IBM Workload Automation through their REST APIs
  (SCHEDULER_ADAPTERS JSON with per-scheduler host/token/path templates and
  best-effort status normalization). job_dependencies analyzes a job's JCL
  (inline or from spool) into dataset flows — inputs, outputs, updates per
  step plus PROC references — for predecessor/successor analysis.

• Messaging & data coverage. mq_queue_status and mq_channel_status
  via the IBM MQ REST admin API (MQ_REST_HOST/_PORT/_USER/_PASSWORD),
  with queue high-water warnings and non-running channel flagging.
  get_volume_space reads DASD volume space from the z/OSMF Storage
  Management Interface and flags volumes below STORAGE_FREE_THRESHOLD.

• CICS statistics and gated actions. get_cics_region_stats (CMCI
  CICSRegion attributes), plus governed-write cics_newcopy and
  cics_disable_transaction implemented as CMCI resource actions
  (CICS TS 5.6+ with actions enabled).

• Dump summarization. summarize_dump digests CEEDUMP / SYSMDUMP /
  SYSUDUMP output — system and user completion codes, failing module and
  offset, PSW, Language Environment conditions, section inventory, and
  suggested next steps — from spool or a dataset, without shipping raw hex.

• Capacity and MLC cost attribution. get_job_capacity parses per-step
  and total CPU from JESMSGLG (IEF374I/IEF376I) and estimates MSU consumption
  from CAPACITY_MSU_RATING; estimate_mlc_cost attributes MLC cost from
  CPU/MSU using MLC_MSU_MONTHLY_PRICE, with pricing assumptions surfaced in
  the output.

• Multi-environment support. Define named systems (DEV/TEST/UAT/PROD,
  multiple LPARs/sysplexes) in the policy file or via ZOSMF_ENVIRONMENTS
  (JSON); the base ZOSMF_* connection remains available as default. Every
  tool accepts an optional environment argument; each environment carries
  its own credentials, lazily-cached Zowe session, and policy surface —
  per-environment readOnly (e.g. read-only PROD), allowedRoles, and
  per-user environment restrictions. ZOSMF_ENV / defaults.environment
  select the default. New list_environments tool enumerates targets.

• Policy-as-code and RBAC (SECURITY_POLICY_FILE). A single YAML file
  maps roles to tool allow/deny globs, dataset/USS patterns, per-role
  read-only mode and change-ticket patterns, and read line caps (with role
  inheritance: child allow lists replace, deny lists and readOnly accumulate
  downward). users: maps usernames to roles per environment; unmapped users
  fall back to defaults.role or fail closed. ${env:VAR} interpolation
  keeps credentials out of the file; any structural error aborts startup.
  Env-var controls continue to apply — the policy only narrows. New
  whoami tool shows the acting identity, resolved role, and effective
  policy. On SSE, the X-MCP-User request header supplies the acting
  identity for gateway deployments.

• Audit & SIEM export. One structured JSON audit record per tool call with
  correlation id, user, MCP client (from the initialize handshake),
  transport, environment, redacted arguments, resource references, outcome
  (success/error/blocked), error code, duration, and result size. Sinks:
  NDJSON file (SECURITY_AUDIT_FILE), Splunk HEC
  (SECURITY_AUDIT_SPLUNK_URL/_TOKEN), generic HTTP webhook
  (SECURITY_AUDIT_WEBHOOK_URL/_TOKEN), and OpenTelemetry OTLP/JSON
  (SECURITY_AUDIT_OTLP_URL). HTTP sinks are batched, time-boxed, and
  best-effort — a dead collector never blocks a tool call. Records are
  SHA-256 hash-chained (tamper-evident); npm run verify:audit (or
  node tools/verify-audit-log.mjs) detects any edit, deletion, or
  reordering and reports the first broken sequence number.

• Data protection. Built-in redaction rules (ssn, credit_card with
  Luhn validation, email, secrets such as PASSWORD=/api_key:
  assignments, jwt, private_key blocks) mask job output and dataset/USS
  reads by default (SECURITY_DATA_PROTECTION, style via
  SECURITY_REDACTION_STYLE, rule set via SECURITY_REDACTION_RULES);
  masked output carries an explicit [data protection: …] footer. Policy
  classifications: add per-resource behavior: rule overrides, hard line
  caps (maxLines), head/tail sample of bulk reads, and role-gated access
  to classified resources.

• Policy roles can now require (or relax) change tickets per role:
  changeTicketPattern on a role overrides
  SECURITY_CHANGE_TICKET_PATTERN for that role's submit_jcl calls.

Supply-chain assurance

• npm package published with SLSA provenance — verify on npmjs.com ("Provenance" badge)

• Container image: ghcr.io/notharshhaa/mainframe-mcp-server:3.0.0 — signed with Sigstore keyless; verify with:

  cosign verify ghcr.io/notharshhaa/mainframe-mcp-server:3.0.0 \
    --certificate-identity-regexp 'https://github.com/@notharshhaa/mainframe-mcp-server/\.github/workflows/release\.yml@refs/tags/' \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com
  

• SBOMs (SPDX + CycloneDX) attached below for the npm package and the container image

• sha256sums.txt lists all assets; its signature is in sha256sums.txt.sig