Let AI agents work on z/OS, safely.
Envoy is an MCP server that gives AI agents tools for CICS, Db2, IBM MQ, IMS, JES, data sets, z/OS UNIX files, RACF and the system console. Every call runs as the real caller, is authorised by RACF, and is audited.
One MCP server for the whole of z/OS
Agents call tools over the Model Context Protocol, and Envoy reaches the subsystems behind them.
The mainframe's own security, on every call
Identity comes from a z/OSMF token. Each call runs as the user who made it, and RACF decides which tools that user may use.
Write tools exist only when switched on for a subsystem, are fenced to named resources, and need confirm: true on every call.
Every tool call is audited, so anything an agent did on the mainframe can be traced to the user it ran as.
A refused call says what was wrong and what a correct call looks like, so agents learn the boundary instead of guessing at it.
One vocabulary for every subsystem
Each subsystem is a plug-in behind one versioned SPI. Four shared tools (list_subsystems, subsystem_status, list_resources and describe_resource) work the same way everywhere, so a new subsystem adds no new tool names.
list_subsystemssubsystem_statuslist_resourcesdescribe_resourceVerified on z/OS 3.2 (ZD&T) since 4 October 2026. Built with Java 21, embedded Jetty and the MCP Java SDK.
Modernize Your Core Systems With Confidence.
Schedule an executive technical consultation or request an enterprise pilot license for AnikaZEE Terminal.