Configuring local authentication using Windows® Credential Manager

To run the Model Context Protocol (MCP) server in local or STDIO mode without exposing RACF passwords in configuration files, store your z/OSMF credentials in Windows® Credential Manager.

Before you begin

Ensure that you have a valid RACF user ID and password with access to z/OSMF REST interfaces on the target mainframe LPAR.

About this task

When running in local single-user mode (server.is-remote=false), the MCP server queries Windows Credential Manager at startup to retrieve your RACF credentials and request an authentication token from z/OSMF. Passwords are never written to disk or configuration files.

Procedure

  1. Use the following format for the credential target name:
    • FA:zosmf:your_racf_userid, for example FA:zosmf:JSMITH
  2. Store the credential using either the Windows command line or the Control Panel GUI:
    • Command line: Open a command prompt and run cmdkey:

      cmdkey /generic:FA:zosmf:your_racf_userid /user:your_racf_userid /pass:your_racf_password
    • Control Panel GUI: Open Credential Manager, select Windows Credentials, click Add a generic credential, and enter the target name, user ID, and password.

  3. Verify that the credential target name matches the zosmf.user property in your server configuration file (application.yml).

Results

The MCP server can now authenticate securely with z/OSMF during local startup without prompting for passwords or storing plain-text credentials.